Added missing tegra files.HEADmaster

104 files changed, 66558 insertions, 0 deletions

diff --git a/drivers/net/wireless/bcmdhd/Kconfig b/drivers/net/wireless/bcmdhd/Kconfig
new file mode 100644
index 00000000000..4c3461a67f4
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/Kconfig
@@ -0,0 +1,79 @@
+config BCMDHD
+        tristate "Broadcom 4329/30 wireless cards support"
+        depends on MMC
+        ---help---
+          This module adds support for wireless adapters based on
+          Broadcom 4329/30 chipset.
+
+          This driver uses the kernel's wireless extensions subsystem.
+
+          If you choose to build a module, it'll be called dhd. Say M if
+          unsure.
+
+config BCMDHD_FW_DIR
+        depends on BCMDHD
+        string "Firmware path"
+        default "/system/vendor/firmware"
+        ---help---
+          Path to the firmware file.
+
+config BCMDHD_NVRAM_DIR
+        depends on BCMDHD
+        string "NVRAM path"
+        default "/system/etc"
+        ---help---
+          Path to the calibration file.
+
+choice
+        prompt "Select API"
+        depends on BCMDHD
+        default BCMDHD_NOAPI
+
+config BCMDHD_WEXT
+        bool "Enable WEXT support"
+        select WIRELESS_EXT
+        select WEXT_PRIV
+        help
+          Enables WEXT support
+
+config BCMDHD_CFG80211
+        bool "Enable CFG80211 support"
+        depends on CFG80211
+        help
+          Enables CFG80211 support
+
+config BCMDHD_NOAPI
+        bool "No wireless API"
+        help
+          No wireless API is needed
+
+endchoice
+
+config BCMDHD_WIFI_CONTROL_FUNC
+        bool "Use bcmdhd_wlan device"
+        depends on BCMDHD
+        default n
+        ---help---
+          Use this option to get various parameters from architecture specific
+          bcmdhd_wlan platform device. Say n if unsure.
+
+config BCMDHD_HW_OOB
+        bool "Use out of band interrupt"
+        depends on BCMDHD
+        default n
+        ---help---
+          Use out of band interrupt for card interrupt and wake on wireless.
+
+config BCMDHD_CSCAN_ENABLE
+        bool "Enable Combo Scan"
+        depends on BCMDHD
+        default n
+        ---help---
+        Enable Combo Scan
+
+config BCMDHD_INSMOD_NO_FW_LOAD
+        bool "Enable delayed firmware load"
+        depends on BCMDHD
+        default n
+        ---help---
+        Enable delayes firmware
diff --git a/drivers/net/wireless/bcmdhd/Makefile b/drivers/net/wireless/bcmdhd/Makefile
new file mode 100644
index 00000000000..918e59fb495
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/Makefile
@@ -0,0 +1,54 @@
+# bcmdhd
+DHDCFLAGS = -Wall -Wstrict-prototypes -Dlinux -DBCMDRIVER                     \
+        -DBCMDONGLEHOST -DUNRELEASEDCHIP -DBCMDMA32 -DWLBTAMP -DBCMFILEIMAGE  \
+        -DDHDTHREAD -DDHD_GPL -DDHD_SCHED -DDHD_DEBUG -DSDTEST -DBDC -DTOE    \
+        -DDHD_BCMEVENTS -DSHOW_EVENTS -DDONGLEOVERLAYS -DBCMDBG               \
+        -DCUSTOMER_HW2    \
+        -DMMC_SDIO_ABORT -DBCMSDIO -DBCMLXSDMMC -DBCMPLATFORM_BUS -DWLP2P     \
+        -DNEW_COMPAT_WIRELESS -DWIFI_ACT_FRAME -DARP_OFFLOAD_SUPPORT          \
+        -DKEEP_ALIVE -DPKT_FILTER_SUPPORT     \
+        -DEMBEDDED_PLATFORM           \
+        -Idrivers/net/wireless/bcmdhd -Idrivers/net/wireless/bcmdhd/include
+
+ifeq ($(CONFIG_BCMDHD_WIFI_CONTROL_FUNC),y)
+DHDCFLAGS += -DCONFIG_WIFI_CONTROL_FUNC
+else
+DHDCFLAGS += -DCUSTOM_OOB_GPIO_NUM=2
+endif
+
+ifeq ($(CONFIG_BCMDHD_HW_OOB),y)
+DHDCFLAGS += -DHW_OOB -DOOB_INTR_ONLY
+else
+DHDCFLAGS += -DSDIO_ISR_THREAD
+endif
+
+ifeq ($(CONFIG_BCMDHD_CSCAN_ENABLE),y)
+DHDCFLAGS += -DCSCAN -DPNO_SUPPORT
+endif
+
+ifeq ($(CONFIG_BCMDHD_INSMOD_NO_FW_LOAD),y)
+DHDCFLAGS += -DENABLE_INSMOD_NO_FW_LOAD
+endif
+
+DHDOFILES = aiutils.o bcmsdh_sdmmc_linux.o dhd_linux.o siutils.o bcmutils.o   \
+        dhd_linux_sched.o bcmwifi.o dhd_sdio.o bcmevent.o dhd_bta.o hndpmu.o  \
+        bcmsdh.o dhd_cdc.o bcmsdh_linux.o dhd_common.o linux_osl.o            \
+        bcmsdh_sdmmc.o dhd_custom_gpio.o sbutils.o wldev_common.o wl_android.o
+
+obj-$(CONFIG_BCMDHD) += bcmdhd.o
+bcmdhd-objs += $(DHDOFILES)
+
+ifeq ($(CONFIG_BCMDHD_WEXT),y)
+bcmdhd-objs += wl_iw.o
+DHDCFLAGS += -DSOFTAP
+endif
+
+ifeq ($(CONFIG_BCMDHD_CFG80211),y)
+bcmdhd-objs += wl_cfg80211.o wl_cfgp2p.o dhd_linux_mon.o
+DHDCFLAGS += -DWL_CFG80211
+endif
+
+EXTRA_CFLAGS = $(DHDCFLAGS)
+ifeq ($(CONFIG_BCMDHD),m)
+EXTRA_LDFLAGS += --strip-debug
+endif
diff --git a/drivers/net/wireless/bcmdhd/aiutils.c b/drivers/net/wireless/bcmdhd/aiutils.c
new file mode 100644
index 00000000000..059df890792
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/aiutils.c
@@ -0,0 +1,675 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: aiutils.c,v 1.26.2.1 2010-03-09 18:41:21 Exp $
+ */
+
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+
+#include "siutils_priv.h"
+
+
+
+
+
+static uint32
+get_erom_ent(si_t *sih, uint32 **eromptr, uint32 mask, uint32 match)
+{
+        uint32 ent;
+        uint inv = 0, nom = 0;
+
+        while (TRUE) {
+                ent = R_REG(si_osh(sih), *eromptr);
+                (*eromptr)++;
+
+                if (mask == 0)
+                        break;
+
+                if ((ent & ER_VALID) == 0) {
+                        inv++;
+                        continue;
+                }
+
+                if (ent == (ER_END | ER_VALID))
+                        break;
+
+                if ((ent & mask) == match)
+                        break;
+
+                nom++;
+        }
+
+        SI_VMSG(("%s: Returning ent 0x%08x\n", __FUNCTION__, ent));
+        if (inv + nom) {
+                SI_VMSG(("  after %d invalid and %d non-matching entries\n", inv, nom));
+        }
+        return ent;
+}
+
+static uint32
+get_asd(si_t *sih, uint32 **eromptr, uint sp, uint ad, uint st, uint32 *addrl, uint32 *addrh,
+        uint32 *sizel, uint32 *sizeh)
+{
+        uint32 asd, sz, szd;
+
+        asd = get_erom_ent(sih, eromptr, ER_VALID, ER_VALID);
+        if (((asd & ER_TAG1) != ER_ADD) ||
+            (((asd & AD_SP_MASK) >> AD_SP_SHIFT) != sp) ||
+            ((asd & AD_ST_MASK) != st)) {
+                
+                (*eromptr)--;
+                return 0;
+        }
+        *addrl = asd & AD_ADDR_MASK;
+        if (asd & AD_AG32)
+                *addrh = get_erom_ent(sih, eromptr, 0, 0);
+        else
+                *addrh = 0;
+        *sizeh = 0;
+        sz = asd & AD_SZ_MASK;
+        if (sz == AD_SZ_SZD) {
+                szd = get_erom_ent(sih, eromptr, 0, 0);
+                *sizel = szd & SD_SZ_MASK;
+                if (szd & SD_SG32)
+                        *sizeh = get_erom_ent(sih, eromptr, 0, 0);
+        } else
+                *sizel = AD_SZ_BASE << (sz >> AD_SZ_SHIFT);
+
+        SI_VMSG(("  SP %d, ad %d: st = %d, 0x%08x_0x%08x @ 0x%08x_0x%08x\n",
+                sp, ad, st, *sizeh, *sizel, *addrh, *addrl));
+
+        return asd;
+}
+
+static void
+ai_hwfixup(si_info_t *sii)
+{
+}
+
+
+void
+ai_scan(si_t *sih, void *regs, uint devid)
+{
+        si_info_t *sii = SI_INFO(sih);
+        chipcregs_t *cc = (chipcregs_t *)regs;
+        uint32 erombase, *eromptr, *eromlim;
+
+        erombase = R_REG(sii->osh, &cc->eromptr);
+
+        switch (BUSTYPE(sih->bustype)) {
+        case SI_BUS:
+                eromptr = (uint32 *)REG_MAP(erombase, SI_CORE_SIZE);
+                break;
+
+        case PCI_BUS:
+                
+                sii->curwrap = (void *)((uintptr)regs + SI_CORE_SIZE);
+
+                
+                OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, erombase);
+                eromptr = regs;
+                break;
+
+        case SPI_BUS:
+        case SDIO_BUS:
+                eromptr = (uint32 *)(uintptr)erombase;
+                break;
+
+        case PCMCIA_BUS:
+        default:
+                SI_ERROR(("Don't know how to do AXI enumertion on bus %d\n", sih->bustype));
+                ASSERT(0);
+                return;
+        }
+        eromlim = eromptr + (ER_REMAPCONTROL / sizeof(uint32));
+
+        SI_VMSG(("ai_scan: regs = 0x%p, erombase = 0x%08x, eromptr = 0x%p, eromlim = 0x%p\n",
+                 regs, erombase, eromptr, eromlim));
+        while (eromptr < eromlim) {
+                uint32 cia, cib, cid, mfg, crev, nmw, nsw, nmp, nsp;
+                uint32 mpd, asd, addrl, addrh, sizel, sizeh;
+                uint32 *base;
+                uint i, j, idx;
+                bool br;
+
+                br = FALSE;
+
+                
+                cia = get_erom_ent(sih, &eromptr, ER_TAG, ER_CI);
+                if (cia == (ER_END | ER_VALID)) {
+                        SI_VMSG(("Found END of erom after %d cores\n", sii->numcores));
+                        ai_hwfixup(sii);
+                        return;
+                }
+                base = eromptr - 1;
+                cib = get_erom_ent(sih, &eromptr, 0, 0);
+
+                if ((cib & ER_TAG) != ER_CI) {
+                        SI_ERROR(("CIA not followed by CIB\n"));
+                        goto error;
+                }
+
+                cid = (cia & CIA_CID_MASK) >> CIA_CID_SHIFT;
+                mfg = (cia & CIA_MFG_MASK) >> CIA_MFG_SHIFT;
+                crev = (cib & CIB_REV_MASK) >> CIB_REV_SHIFT;
+                nmw = (cib & CIB_NMW_MASK) >> CIB_NMW_SHIFT;
+                nsw = (cib & CIB_NSW_MASK) >> CIB_NSW_SHIFT;
+                nmp = (cib & CIB_NMP_MASK) >> CIB_NMP_SHIFT;
+                nsp = (cib & CIB_NSP_MASK) >> CIB_NSP_SHIFT;
+
+                SI_VMSG(("Found component 0x%04x/0x%04x rev %d at erom addr 0x%p, with nmw = %d, "
+                         "nsw = %d, nmp = %d & nsp = %d\n",
+                         mfg, cid, crev, base, nmw, nsw, nmp, nsp));
+
+                if (((mfg == MFGID_ARM) && (cid == DEF_AI_COMP)) || (nsp == 0))
+                        continue;
+                if ((nmw + nsw == 0)) {
+                        
+                        if (cid == OOB_ROUTER_CORE_ID) {
+                                asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE,
+                                        &addrl, &addrh, &sizel, &sizeh);
+                                if (asd != 0) {
+                                        sii->oob_router = addrl;
+                                }
+                        }
+                        continue;
+                }
+
+                idx = sii->numcores;
+
+                sii->cia[idx] = cia;
+                sii->cib[idx] = cib;
+                sii->coreid[idx] = cid;
+
+                for (i = 0; i < nmp; i++) {
+                        mpd = get_erom_ent(sih, &eromptr, ER_VALID, ER_VALID);
+                        if ((mpd & ER_TAG) != ER_MP) {
+                                SI_ERROR(("Not enough MP entries for component 0x%x\n", cid));
+                                goto error;
+                        }
+                        SI_VMSG(("  Master port %d, mp: %d id: %d\n", i,
+                                 (mpd & MPD_MP_MASK) >> MPD_MP_SHIFT,
+                                 (mpd & MPD_MUI_MASK) >> MPD_MUI_SHIFT));
+                }
+
+                
+                asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE, &addrl, &addrh, &sizel, &sizeh);
+                if (asd == 0) {
+                        
+                        asd = get_asd(sih, &eromptr, 0, 0, AD_ST_BRIDGE, &addrl, &addrh,
+                                      &sizel, &sizeh);
+                        if (asd != 0)
+                                br = TRUE;
+                        else
+                                if ((addrh != 0) || (sizeh != 0) || (sizel != SI_CORE_SIZE)) {
+                                        SI_ERROR(("First Slave ASD for core 0x%04x malformed "
+                                                  "(0x%08x)\n", cid, asd));
+                                        goto error;
+                                }
+                }
+                sii->coresba[idx] = addrl;
+                sii->coresba_size[idx] = sizel;
+                
+                j = 1;
+                do {
+                        asd = get_asd(sih, &eromptr, 0, j, AD_ST_SLAVE, &addrl, &addrh,
+                                      &sizel, &sizeh);
+                        if ((asd != 0) && (j == 1) && (sizel == SI_CORE_SIZE)) {
+                                sii->coresba2[idx] = addrl;
+                                sii->coresba2_size[idx] = sizel;
+                        }
+                        j++;
+                } while (asd != 0);
+
+                
+                for (i = 1; i < nsp; i++) {
+                        j = 0;
+                        do {
+                                asd = get_asd(sih, &eromptr, i, j++, AD_ST_SLAVE, &addrl, &addrh,
+                                              &sizel, &sizeh);
+                        } while (asd != 0);
+                        if (j == 0) {
+                                SI_ERROR((" SP %d has no address descriptors\n", i));
+                                goto error;
+                        }
+                }
+
+                
+                for (i = 0; i < nmw; i++) {
+                        asd = get_asd(sih, &eromptr, i, 0, AD_ST_MWRAP, &addrl, &addrh,
+                                      &sizel, &sizeh);
+                        if (asd == 0) {
+                                SI_ERROR(("Missing descriptor for MW %d\n", i));
+                                goto error;
+                        }
+                        if ((sizeh != 0) || (sizel != SI_CORE_SIZE)) {
+                                SI_ERROR(("Master wrapper %d is not 4KB\n", i));
+                                goto error;
+                        }
+                        if (i == 0)
+                                sii->wrapba[idx] = addrl;
+                }
+
+                
+                for (i = 0; i < nsw; i++) {
+                        uint fwp = (nsp == 1) ? 0 : 1;
+                        asd = get_asd(sih, &eromptr, fwp + i, 0, AD_ST_SWRAP, &addrl, &addrh,
+                                      &sizel, &sizeh);
+                        if (asd == 0) {
+                                SI_ERROR(("Missing descriptor for SW %d\n", i));
+                                goto error;
+                        }
+                        if ((sizeh != 0) || (sizel != SI_CORE_SIZE)) {
+                                SI_ERROR(("Slave wrapper %d is not 4KB\n", i));
+                                goto error;
+                        }
+                        if ((nmw == 0) && (i == 0))
+                                sii->wrapba[idx] = addrl;
+                }
+
+                
+                if (br)
+                        continue;
+
+                
+                sii->numcores++;
+        }
+
+        SI_ERROR(("Reached end of erom without finding END"));
+
+error:
+        sii->numcores = 0;
+        return;
+}
+
+
+void *
+ai_setcoreidx(si_t *sih, uint coreidx)
+{
+        si_info_t *sii = SI_INFO(sih);
+        uint32 addr = sii->coresba[coreidx];
+        uint32 wrap = sii->wrapba[coreidx];
+        void *regs;
+
+        if (coreidx >= sii->numcores)
+                return (NULL);
+
+        
+        ASSERT((sii->intrsenabled_fn == NULL) || !(*(sii)->intrsenabled_fn)((sii)->intr_arg));
+
+        switch (BUSTYPE(sih->bustype)) {
+        case SI_BUS:
+                
+                if (!sii->regs[coreidx]) {
+                        sii->regs[coreidx] = REG_MAP(addr, SI_CORE_SIZE);
+                        ASSERT(GOODREGS(sii->regs[coreidx]));
+                }
+                sii->curmap = regs = sii->regs[coreidx];
+                if (!sii->wrappers[coreidx]) {
+                        sii->wrappers[coreidx] = REG_MAP(wrap, SI_CORE_SIZE);
+                        ASSERT(GOODREGS(sii->wrappers[coreidx]));
+                }
+                sii->curwrap = sii->wrappers[coreidx];
+                break;
+
+
+        case SPI_BUS:
+        case SDIO_BUS:
+                sii->curmap = regs = (void *)((uintptr)addr);
+                sii->curwrap = (void *)((uintptr)wrap);
+                break;
+
+        case PCMCIA_BUS:
+        default:
+                ASSERT(0);
+                regs = NULL;
+                break;
+        }
+
+        sii->curmap = regs;
+        sii->curidx = coreidx;
+
+        return regs;
+}
+
+
+int
+ai_numaddrspaces(si_t *sih)
+{
+        return 2;
+}
+
+
+uint32
+ai_addrspace(si_t *sih, uint asidx)
+{
+        si_info_t *sii;
+        uint cidx;
+
+        sii = SI_INFO(sih);
+        cidx = sii->curidx;
+
+        if (asidx == 0)
+                return sii->coresba[cidx];
+        else if (asidx == 1)
+                return sii->coresba2[cidx];
+        else {
+                SI_ERROR(("%s: Need to parse the erom again to find addr space %d\n",
+                          __FUNCTION__, asidx));
+                return 0;
+        }
+}
+
+
+uint32
+ai_addrspacesize(si_t *sih, uint asidx)
+{
+        si_info_t *sii;
+        uint cidx;
+
+        sii = SI_INFO(sih);
+        cidx = sii->curidx;
+
+        if (asidx == 0)
+                return sii->coresba_size[cidx];
+        else if (asidx == 1)
+                return sii->coresba2_size[cidx];
+        else {
+                SI_ERROR(("%s: Need to parse the erom again to find addr space %d\n",
+                          __FUNCTION__, asidx));
+                return 0;
+        }
+}
+
+uint
+ai_flag(si_t *sih)
+{
+        si_info_t *sii;
+        aidmp_t *ai;
+
+        sii = SI_INFO(sih);
+        ai = sii->curwrap;
+
+        return (R_REG(sii->osh, &ai->oobselouta30) & 0x1f);
+}
+
+void
+ai_setint(si_t *sih, int siflag)
+{
+}
+
+uint
+ai_wrap_reg(si_t *sih, uint32 offset, uint32 mask, uint32 val)
+{
+        si_info_t *sii = SI_INFO(sih);
+        uint32 *map = (uint32 *) sii->curwrap;
+
+        if (mask || val) {
+                uint32 w = R_REG(sii->osh, map+(offset/4));
+                w &= ~mask;
+                w |= val;
+                W_REG(sii->osh, map+(offset/4), val);
+        }
+
+        return (R_REG(sii->osh, map+(offset/4)));
+}
+
+uint
+ai_corevendor(si_t *sih)
+{
+        si_info_t *sii;
+        uint32 cia;
+
+        sii = SI_INFO(sih);
+        cia = sii->cia[sii->curidx];
+        return ((cia & CIA_MFG_MASK) >> CIA_MFG_SHIFT);
+}
+
+uint
+ai_corerev(si_t *sih)
+{
+        si_info_t *sii;
+        uint32 cib;
+
+        sii = SI_INFO(sih);
+        cib = sii->cib[sii->curidx];
+        return ((cib & CIB_REV_MASK) >> CIB_REV_SHIFT);
+}
+
+bool
+ai_iscoreup(si_t *sih)
+{
+        si_info_t *sii;
+        aidmp_t *ai;
+
+        sii = SI_INFO(sih);
+        ai = sii->curwrap;
+
+        return (((R_REG(sii->osh, &ai->ioctrl) & (SICF_FGC | SICF_CLOCK_EN)) == SICF_CLOCK_EN) &&
+                ((R_REG(sii->osh, &ai->resetctrl) & AIRC_RESET) == 0));
+}
+
+
+uint
+ai_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+        uint origidx = 0;
+        uint32 *r = NULL;
+        uint w;
+        uint intr_val = 0;
+        bool fast = FALSE;
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        ASSERT(GOODIDX(coreidx));
+        ASSERT(regoff < SI_CORE_SIZE);
+        ASSERT((val & ~mask) == 0);
+
+        if (coreidx >= SI_MAXCORES)
+                return 0;
+
+        if (BUSTYPE(sih->bustype) == SI_BUS) {
+                
+                fast = TRUE;
+                
+                if (!sii->regs[coreidx]) {
+                        sii->regs[coreidx] = REG_MAP(sii->coresba[coreidx],
+                                                    SI_CORE_SIZE);
+                        ASSERT(GOODREGS(sii->regs[coreidx]));
+                }
+                r = (uint32 *)((uchar *)sii->regs[coreidx] + regoff);
+        } else if (BUSTYPE(sih->bustype) == PCI_BUS) {
+                
+
+                if ((sii->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                        
+
+                        fast = TRUE;
+                        r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+                } else if (sii->pub.buscoreidx == coreidx) {
+                        
+                        fast = TRUE;
+                        if (SI_FAST(sii))
+                                r = (uint32 *)((char *)sii->curmap +
+                                               PCI_16KB0_PCIREGS_OFFSET + regoff);
+                        else
+                                r = (uint32 *)((char *)sii->curmap +
+                                               ((regoff >= SBCONFIGOFF) ?
+                                                PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                               regoff);
+                }
+        }
+
+        if (!fast) {
+                INTR_OFF(sii, intr_val);
+
+                
+                origidx = si_coreidx(&sii->pub);
+
+                
+                r = (uint32*) ((uchar*) ai_setcoreidx(&sii->pub, coreidx) + regoff);
+        }
+        ASSERT(r != NULL);
+
+        
+        if (mask || val) {
+                w = (R_REG(sii->osh, r) & ~mask) | val;
+                W_REG(sii->osh, r, w);
+        }
+
+        
+        w = R_REG(sii->osh, r);
+
+        if (!fast) {
+                
+                if (origidx != coreidx)
+                        ai_setcoreidx(&sii->pub, origidx);
+
+                INTR_RESTORE(sii, intr_val);
+        }
+
+        return (w);
+}
+
+void
+ai_core_disable(si_t *sih, uint32 bits)
+{
+        si_info_t *sii;
+        volatile uint32 dummy;
+        aidmp_t *ai;
+
+        sii = SI_INFO(sih);
+
+        ASSERT(GOODREGS(sii->curwrap));
+        ai = sii->curwrap;
+
+        
+        if (R_REG(sii->osh, &ai->resetctrl) & AIRC_RESET)
+                return;
+
+        W_REG(sii->osh, &ai->ioctrl, bits);
+        dummy = R_REG(sii->osh, &ai->ioctrl);
+        OSL_DELAY(10);
+
+        W_REG(sii->osh, &ai->resetctrl, AIRC_RESET);
+        OSL_DELAY(1);
+}
+
+
+void
+ai_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+        si_info_t *sii;
+        aidmp_t *ai;
+        volatile uint32 dummy;
+
+        sii = SI_INFO(sih);
+        ASSERT(GOODREGS(sii->curwrap));
+        ai = sii->curwrap;
+
+        
+        ai_core_disable(sih, (bits | resetbits));
+
+        
+        W_REG(sii->osh, &ai->ioctrl, (bits | SICF_FGC | SICF_CLOCK_EN));
+        dummy = R_REG(sii->osh, &ai->ioctrl);
+        W_REG(sii->osh, &ai->resetctrl, 0);
+        OSL_DELAY(1);
+
+        W_REG(sii->osh, &ai->ioctrl, (bits | SICF_CLOCK_EN));
+        dummy = R_REG(sii->osh, &ai->ioctrl);
+        OSL_DELAY(1);
+}
+
+
+void
+ai_core_cflags_wo(si_t *sih, uint32 mask, uint32 val)
+{
+        si_info_t *sii;
+        aidmp_t *ai;
+        uint32 w;
+
+        sii = SI_INFO(sih);
+        ASSERT(GOODREGS(sii->curwrap));
+        ai = sii->curwrap;
+
+        ASSERT((val & ~mask) == 0);
+
+        if (mask || val) {
+                w = ((R_REG(sii->osh, &ai->ioctrl) & ~mask) | val);
+                W_REG(sii->osh, &ai->ioctrl, w);
+        }
+}
+
+uint32
+ai_core_cflags(si_t *sih, uint32 mask, uint32 val)
+{
+        si_info_t *sii;
+        aidmp_t *ai;
+        uint32 w;
+
+        sii = SI_INFO(sih);
+        ASSERT(GOODREGS(sii->curwrap));
+        ai = sii->curwrap;
+
+        ASSERT((val & ~mask) == 0);
+
+        if (mask || val) {
+                w = ((R_REG(sii->osh, &ai->ioctrl) & ~mask) | val);
+                W_REG(sii->osh, &ai->ioctrl, w);
+        }
+
+        return R_REG(sii->osh, &ai->ioctrl);
+}
+
+uint32
+ai_core_sflags(si_t *sih, uint32 mask, uint32 val)
+{
+        si_info_t *sii;
+        aidmp_t *ai;
+        uint32 w;
+
+        sii = SI_INFO(sih);
+        ASSERT(GOODREGS(sii->curwrap));
+        ai = sii->curwrap;
+
+        ASSERT((val & ~mask) == 0);
+        ASSERT((mask & ~SISF_CORE_BITS) == 0);
+
+        if (mask || val) {
+                w = ((R_REG(sii->osh, &ai->iostatus) & ~mask) | val);
+                W_REG(sii->osh, &ai->iostatus, w);
+        }
+
+        return R_REG(sii->osh, &ai->iostatus);
+}
diff --git a/drivers/net/wireless/bcmdhd/bcmevent.c b/drivers/net/wireless/bcmdhd/bcmevent.c
new file mode 100644
index 00000000000..24581ddd353
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/bcmevent.c
@@ -0,0 +1,125 @@
+/*
+ * bcmevent read-only data shared by kernel or app layers
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ * $Id: bcmevent.c,v 1.8.2.7 2011-02-01 06:23:39 Exp $
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <proto/ethernet.h>
+#include <proto/bcmeth.h>
+#include <proto/bcmevent.h>
+
+#if WLC_E_LAST != 85
+#error "You need to add an entry to bcmevent_names[] for the new event"
+#endif
+
+const bcmevent_name_t bcmevent_names[] = {
+        { WLC_E_SET_SSID, "SET_SSID" },
+        { WLC_E_JOIN, "JOIN" },
+        { WLC_E_START, "START" },
+        { WLC_E_AUTH, "AUTH" },
+        { WLC_E_AUTH_IND, "AUTH_IND" },
+        { WLC_E_DEAUTH, "DEAUTH" },
+        { WLC_E_DEAUTH_IND, "DEAUTH_IND" },
+        { WLC_E_ASSOC, "ASSOC" },
+        { WLC_E_ASSOC_IND, "ASSOC_IND" },
+        { WLC_E_REASSOC, "REASSOC" },
+        { WLC_E_REASSOC_IND, "REASSOC_IND" },
+        { WLC_E_DISASSOC, "DISASSOC" },
+        { WLC_E_DISASSOC_IND, "DISASSOC_IND" },
+        { WLC_E_QUIET_START, "START_QUIET" },
+        { WLC_E_QUIET_END, "END_QUIET" },
+        { WLC_E_BEACON_RX, "BEACON_RX" },
+        { WLC_E_LINK, "LINK" },
+        { WLC_E_MIC_ERROR, "MIC_ERROR" },
+        { WLC_E_NDIS_LINK, "NDIS_LINK" },
+        { WLC_E_ROAM, "ROAM" },
+        { WLC_E_TXFAIL, "TXFAIL" },
+        { WLC_E_PMKID_CACHE, "PMKID_CACHE" },
+        { WLC_E_RETROGRADE_TSF, "RETROGRADE_TSF" },
+        { WLC_E_PRUNE, "PRUNE" },
+        { WLC_E_AUTOAUTH, "AUTOAUTH" },
+        { WLC_E_EAPOL_MSG, "EAPOL_MSG" },
+        { WLC_E_SCAN_COMPLETE, "SCAN_COMPLETE" },
+        { WLC_E_ADDTS_IND, "ADDTS_IND" },
+        { WLC_E_DELTS_IND, "DELTS_IND" },
+        { WLC_E_BCNSENT_IND, "BCNSENT_IND" },
+        { WLC_E_BCNRX_MSG, "BCNRX_MSG" },
+        { WLC_E_BCNLOST_MSG, "BCNLOST_IND" },
+        { WLC_E_ROAM_PREP, "ROAM_PREP" },
+        { WLC_E_PFN_NET_FOUND, "PFNFOUND_IND" },
+        { WLC_E_PFN_NET_LOST, "PFNLOST_IND" },
+#if defined(IBSS_PEER_DISCOVERY_EVENT)
+        { WLC_E_IBSS_ASSOC, "IBSS_ASSOC" },
+#endif /* defined(IBSS_PEER_DISCOVERY_EVENT) */
+        { WLC_E_RADIO, "RADIO" },
+        { WLC_E_PSM_WATCHDOG, "PSM_WATCHDOG" },
+        { WLC_E_PROBREQ_MSG, "PROBE_REQ_MSG" },
+        { WLC_E_SCAN_CONFIRM_IND, "SCAN_CONFIRM_IND" },
+        { WLC_E_PSK_SUP, "PSK_SUP" },
+        { WLC_E_COUNTRY_CODE_CHANGED, "CNTRYCODE_IND" },
+        { WLC_E_EXCEEDED_MEDIUM_TIME, "EXCEEDED_MEDIUM_TIME" },
+        { WLC_E_ICV_ERROR, "ICV_ERROR" },
+        { WLC_E_UNICAST_DECODE_ERROR, "UNICAST_DECODE_ERROR" },
+        { WLC_E_MULTICAST_DECODE_ERROR, "MULTICAST_DECODE_ERROR" },
+        { WLC_E_TRACE, "TRACE" },
+        { WLC_E_BTA_HCI_EVENT, "BTA_HCI_EVENT" },
+        { WLC_E_IF, "IF" },
+#ifdef WLP2P
+        { WLC_E_P2P_DISC_LISTEN_COMPLETE, "WLC_E_P2P_DISC_LISTEN_COMPLETE" },
+#endif
+        { WLC_E_RSSI, "RSSI" },
+        { WLC_E_PFN_SCAN_COMPLETE, "SCAN_COMPLETE" },
+        { WLC_E_EXTLOG_MSG, "EXTERNAL LOG MESSAGE" },
+#ifdef WIFI_ACT_FRAME
+        { WLC_E_ACTION_FRAME, "ACTION_FRAME" },
+        { WLC_E_ACTION_FRAME_RX, "ACTION_FRAME_RX" },
+        { WLC_E_ACTION_FRAME_COMPLETE, "ACTION_FRAME_COMPLETE" },
+#endif
+        { WLC_E_ESCAN_RESULT, "WLC_E_ESCAN_RESULT" },
+        { WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE, "WLC_E_AF_OFF_CHAN_COMPLETE" },
+#ifdef WLP2P
+        { WLC_E_PROBRESP_MSG, "PROBE_RESP_MSG" },
+        { WLC_E_P2P_PROBREQ_MSG, "P2P PROBE_REQ_MSG" },
+#endif
+#ifdef PROP_TXSTATUS
+        { WLC_E_FIFO_CREDIT_MAP, "FIFO_CREDIT_MAP" },
+#endif
+        { WLC_E_WAKE_EVENT, "WAKE_EVENT" },
+        { WLC_E_DCS_REQUEST, "DCS_REQUEST" },
+        { WLC_E_RM_COMPLETE, "RM_COMPLETE" },
+#ifdef WLMEDIA_HTSF
+        { WLC_E_HTSFSYNC, "HTSF_SYNC_EVENT" },
+#endif
+        { WLC_E_OVERLAY_REQ, "OVERLAY_REQ_EVENT" },
+        { WLC_E_CSA_COMPLETE_IND, "WLC_E_CSA_COMPLETE_IND" },
+        { WLC_E_EXCESS_PM_WAKE_EVENT, "EXCESS_PM_WAKE_EVENT" },
+        { WLC_E_PFN_SCAN_NONE, "PFN_SCAN_NONE" },
+        { WLC_E_PFN_SCAN_ALLGONE, "PFN_SCAN_ALLGONE" },
+#ifdef SOFTAP
+        { WLC_E_GTK_PLUMBED, "GTK_PLUMBED" }
+#endif
+};
+
+
+const int bcmevent_names_size = ARRAYSIZE(bcmevent_names);
diff --git a/drivers/net/wireless/bcmdhd/bcmsdh.c b/drivers/net/wireless/bcmdhd/bcmsdh.c
new file mode 100644
index 00000000000..918c8e648f1
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/bcmsdh.c
@@ -0,0 +1,690 @@
+/*
+ *  BCMSDH interface glue
+ *  implement bcmsdh API for SDIOH driver
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdh.c 275784 2011-08-04 22:41:49Z $
+ */
+
+/**
+ * @file bcmsdh.c
+ */
+
+/* ****************** BCMSDH Interface Functions *************************** */
+
+#include <typedefs.h>
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <hndsoc.h>
+#include <siutils.h>
+#include <osl.h>
+
+#include <bcmsdh.h>     /* BRCM API for SDIO clients (such as wl, dhd) */
+#include <bcmsdbus.h>   /* common SDIO/controller interface */
+#include <sbsdio.h>     /* SDIO device core hardware definitions. */
+
+#include <sdio.h>       /* SDIO Device and Protocol Specs */
+
+#define SDIOH_API_ACCESS_RETRY_LIMIT    2
+const uint bcmsdh_msglevel = BCMSDH_ERROR_VAL;
+
+/**
+ * BCMSDH API context
+ */
+struct bcmsdh_info
+{
+        bool    init_success;   /* underlying driver successfully attached */
+        void    *sdioh;         /* handler for sdioh */
+        uint32  vendevid;       /* Target Vendor and Device ID on SD bus */
+        osl_t   *osh;
+        bool    regfail;        /* Save status of last reg_read/reg_write call */
+        uint32  sbwad;          /* Save backplane window address */
+};
+/* local copy of bcm sd handler */
+bcmsdh_info_t * l_bcmsdh = NULL;
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+extern int
+sdioh_enable_hw_oob_intr(void *sdioh, bool enable);
+
+void
+bcmsdh_enable_hw_oob_intr(bcmsdh_info_t *sdh, bool enable)
+{
+        sdioh_enable_hw_oob_intr(sdh->sdioh, enable);
+}
+#endif
+
+/* Attach BCMSDH layer to SDIO Host Controller Driver
+ *
+ * @param osh OSL Handle.
+ * @param cfghdl Configuration Handle.
+ * @param regsva Virtual address of controller registers.
+ * @param irq Interrupt number of SDIO controller.
+ *
+ * @return bcmsdh_info_t Handle to BCMSDH context.
+ */
+bcmsdh_info_t *
+bcmsdh_attach(osl_t *osh, void *cfghdl, void **regsva, uint irq)
+{
+        bcmsdh_info_t *bcmsdh;
+
+        if ((bcmsdh = (bcmsdh_info_t *)MALLOC(osh, sizeof(bcmsdh_info_t))) == NULL) {
+                BCMSDH_ERROR(("bcmsdh_attach: out of memory, malloced %d bytes\n", MALLOCED(osh)));
+                return NULL;
+        }
+        bzero((char *)bcmsdh, sizeof(bcmsdh_info_t));
+
+        /* save the handler locally */
+        l_bcmsdh = bcmsdh;
+
+        if (!(bcmsdh->sdioh = sdioh_attach(osh, cfghdl, irq))) {
+                bcmsdh_detach(osh, bcmsdh);
+                return NULL;
+        }
+
+        bcmsdh->osh = osh;
+        bcmsdh->init_success = TRUE;
+
+        *regsva = (uint32 *)SI_ENUM_BASE;
+
+        /* Report the BAR, to fix if needed */
+        bcmsdh->sbwad = SI_ENUM_BASE;
+        return bcmsdh;
+}
+
+int
+bcmsdh_detach(osl_t *osh, void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+        if (bcmsdh != NULL) {
+                if (bcmsdh->sdioh) {
+                        sdioh_detach(osh, bcmsdh->sdioh);
+                        bcmsdh->sdioh = NULL;
+                }
+                MFREE(osh, bcmsdh, sizeof(bcmsdh_info_t));
+        }
+
+        l_bcmsdh = NULL;
+        return 0;
+}
+
+int
+bcmsdh_iovar_op(void *sdh, const char *name,
+                void *params, int plen, void *arg, int len, bool set)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        return sdioh_iovar_op(bcmsdh->sdioh, name, params, plen, arg, len, set);
+}
+
+bool
+bcmsdh_intr_query(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        bool on;
+
+        ASSERT(bcmsdh);
+        status = sdioh_interrupt_query(bcmsdh->sdioh, &on);
+        if (SDIOH_API_SUCCESS(status))
+                return FALSE;
+        else
+                return on;
+}
+
+int
+bcmsdh_intr_enable(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        ASSERT(bcmsdh);
+
+        status = sdioh_interrupt_set(bcmsdh->sdioh, TRUE);
+        return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_disable(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        ASSERT(bcmsdh);
+
+        status = sdioh_interrupt_set(bcmsdh->sdioh, FALSE);
+        return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        ASSERT(bcmsdh);
+
+        status = sdioh_interrupt_register(bcmsdh->sdioh, fn, argh);
+        return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_dereg(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        ASSERT(bcmsdh);
+
+        status = sdioh_interrupt_deregister(bcmsdh->sdioh);
+        return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+#if defined(DHD_DEBUG)
+bool
+bcmsdh_intr_pending(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+        ASSERT(sdh);
+        return sdioh_interrupt_pending(bcmsdh->sdioh);
+}
+#endif
+
+
+int
+bcmsdh_devremove_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh)
+{
+        ASSERT(sdh);
+
+        /* don't support yet */
+        return BCME_UNSUPPORTED;
+}
+
+/**
+ * Read from SDIO Configuration Space
+ * @param sdh SDIO Host context.
+ * @param func_num Function number to read from.
+ * @param addr Address to read from.
+ * @param err Error return.
+ * @return value read from SDIO configuration space.
+ */
+uint8
+bcmsdh_cfg_read(void *sdh, uint fnc_num, uint32 addr, int *err)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+        int32 retry = 0;
+#endif
+        uint8 data = 0;
+
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        ASSERT(bcmsdh->init_success);
+
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+        do {
+                if (retry)      /* wait for 1 ms till bus get settled down */
+                        OSL_DELAY(1000);
+#endif
+        status = sdioh_cfg_read(bcmsdh->sdioh, fnc_num, addr, (uint8 *)&data);
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+        } while (!SDIOH_API_SUCCESS(status) && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+#endif
+        if (err)
+                *err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+        BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint8data = 0x%x\n", __FUNCTION__,
+                    fnc_num, addr, data));
+
+        return data;
+}
+
+void
+bcmsdh_cfg_write(void *sdh, uint fnc_num, uint32 addr, uint8 data, int *err)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+        int32 retry = 0;
+#endif
+
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        ASSERT(bcmsdh->init_success);
+
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+        do {
+                if (retry)      /* wait for 1 ms till bus get settled down */
+                        OSL_DELAY(1000);
+#endif
+        status = sdioh_cfg_write(bcmsdh->sdioh, fnc_num, addr, (uint8 *)&data);
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+        } while (!SDIOH_API_SUCCESS(status) && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+#endif
+        if (err)
+                *err = SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR;
+
+        BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint8data = 0x%x\n", __FUNCTION__,
+                    fnc_num, addr, data));
+}
+
+uint32
+bcmsdh_cfg_read_word(void *sdh, uint fnc_num, uint32 addr, int *err)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        uint32 data = 0;
+
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        ASSERT(bcmsdh->init_success);
+
+        status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_READ, fnc_num,
+                                    addr, &data, 4);
+
+        if (err)
+                *err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+        BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint32data = 0x%x\n", __FUNCTION__,
+                    fnc_num, addr, data));
+
+        return data;
+}
+
+void
+bcmsdh_cfg_write_word(void *sdh, uint fnc_num, uint32 addr, uint32 data, int *err)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        ASSERT(bcmsdh->init_success);
+
+        status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_WRITE, fnc_num,
+                                    addr, &data, 4);
+
+        if (err)
+                *err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+        BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint32data = 0x%x\n", __FUNCTION__, fnc_num,
+                     addr, data));
+}
+
+
+int
+bcmsdh_cis_read(void *sdh, uint func, uint8 *cis, uint length)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+
+        uint8 *tmp_buf, *tmp_ptr;
+        uint8 *ptr;
+        bool ascii = func & ~0xf;
+        func &= 0x7;
+
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        ASSERT(bcmsdh->init_success);
+        ASSERT(cis);
+        ASSERT(length <= SBSDIO_CIS_SIZE_LIMIT);
+
+        status = sdioh_cis_read(bcmsdh->sdioh, func, cis, length);
+
+        if (ascii) {
+                /* Move binary bits to tmp and format them into the provided buffer. */
+                if ((tmp_buf = (uint8 *)MALLOC(bcmsdh->osh, length)) == NULL) {
+                        BCMSDH_ERROR(("%s: out of memory\n", __FUNCTION__));
+                        return BCME_NOMEM;
+                }
+                bcopy(cis, tmp_buf, length);
+                for (tmp_ptr = tmp_buf, ptr = cis; ptr < (cis + length - 4); tmp_ptr++) {
+                        ptr += sprintf((char*)ptr, "%.2x ", *tmp_ptr & 0xff);
+                        if ((((tmp_ptr - tmp_buf) + 1) & 0xf) == 0)
+                                ptr += sprintf((char *)ptr, "\n");
+                }
+                MFREE(bcmsdh->osh, tmp_buf, length);
+        }
+
+        return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+
+int
+bcmsdhsdio_set_sbaddr_window(void *sdh, uint32 address, bool force_set)
+{
+        int err = 0;
+        uint bar0 = address & ~SBSDIO_SB_OFT_ADDR_MASK;
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+        if (bar0 != bcmsdh->sbwad || force_set) {
+                bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+                        (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+                if (!err)
+                        bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
+                                (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
+                if (!err)
+                        bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
+                                (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
+
+                if (!err)
+                        bcmsdh->sbwad = bar0;
+                else
+                        /* invalidate cached window var */
+                        bcmsdh->sbwad = 0;
+
+        }
+
+        return err;
+}
+
+uint32
+bcmsdh_reg_read(void *sdh, uint32 addr, uint size)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        uint32 word = 0;
+
+        BCMSDH_INFO(("%s:fun = 1, addr = 0x%x, ", __FUNCTION__, addr));
+
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        ASSERT(bcmsdh->init_success);
+
+        if (bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE))
+                return 0xFFFFFFFF;
+
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+        if (size == 4)
+                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+        status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL,
+                SDIOH_READ, SDIO_FUNC_1, addr, &word, size);
+
+        bcmsdh->regfail = !(SDIOH_API_SUCCESS(status));
+
+        BCMSDH_INFO(("uint32data = 0x%x\n", word));
+
+        /* if ok, return appropriately masked word */
+        if (SDIOH_API_SUCCESS(status)) {
+                switch (size) {
+                        case sizeof(uint8):
+                                return (word & 0xff);
+                        case sizeof(uint16):
+                                return (word & 0xffff);
+                        case sizeof(uint32):
+                                return word;
+                        default:
+                                bcmsdh->regfail = TRUE;
+
+                }
+        }
+
+        /* otherwise, bad sdio access or invalid size */
+        BCMSDH_ERROR(("%s: error reading addr 0x%04x size %d\n", __FUNCTION__, addr, size));
+        return 0xFFFFFFFF;
+}
+
+uint32
+bcmsdh_reg_write(void *sdh, uint32 addr, uint size, uint32 data)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        int err = 0;
+
+        BCMSDH_INFO(("%s:fun = 1, addr = 0x%x, uint%ddata = 0x%x\n",
+                     __FUNCTION__, addr, size*8, data));
+
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        ASSERT(bcmsdh->init_success);
+
+        if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+                return err;
+
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+        if (size == 4)
+                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+        status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_WRITE, SDIO_FUNC_1,
+                                    addr, &data, size);
+        bcmsdh->regfail = !(SDIOH_API_SUCCESS(status));
+
+        if (SDIOH_API_SUCCESS(status))
+                return 0;
+
+        BCMSDH_ERROR(("%s: error writing 0x%08x to addr 0x%04x size %d\n",
+                      __FUNCTION__, data, addr, size));
+        return 0xFFFFFFFF;
+}
+
+bool
+bcmsdh_regfail(void *sdh)
+{
+        return ((bcmsdh_info_t *)sdh)->regfail;
+}
+
+int
+bcmsdh_recv_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                uint8 *buf, uint nbytes, void *pkt,
+                bcmsdh_cmplt_fn_t complete_fn, void *handle)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        uint incr_fix;
+        uint width;
+        int err = 0;
+
+        ASSERT(bcmsdh);
+        ASSERT(bcmsdh->init_success);
+
+        BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+                     __FUNCTION__, fn, addr, nbytes));
+
+        /* Async not implemented yet */
+        ASSERT(!(flags & SDIO_REQ_ASYNC));
+        if (flags & SDIO_REQ_ASYNC)
+                return BCME_UNSUPPORTED;
+
+        if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+                return err;
+
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+        incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+        width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+        if (width == 4)
+                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+        status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, incr_fix,
+                                      SDIOH_READ, fn, addr, width, nbytes, buf, pkt);
+
+        return (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+}
+
+int
+bcmsdh_send_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                uint8 *buf, uint nbytes, void *pkt,
+                bcmsdh_cmplt_fn_t complete_fn, void *handle)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+        uint incr_fix;
+        uint width;
+        int err = 0;
+
+        ASSERT(bcmsdh);
+        ASSERT(bcmsdh->init_success);
+
+        BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+                    __FUNCTION__, fn, addr, nbytes));
+
+        /* Async not implemented yet */
+        ASSERT(!(flags & SDIO_REQ_ASYNC));
+        if (flags & SDIO_REQ_ASYNC)
+                return BCME_UNSUPPORTED;
+
+        if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+                return err;
+
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+        incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+        width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+        if (width == 4)
+                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+        status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, incr_fix,
+                                      SDIOH_WRITE, fn, addr, width, nbytes, buf, pkt);
+
+        return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_rwdata(void *sdh, uint rw, uint32 addr, uint8 *buf, uint nbytes)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        SDIOH_API_RC status;
+
+        ASSERT(bcmsdh);
+        ASSERT(bcmsdh->init_success);
+        ASSERT((addr & SBSDIO_SBWINDOW_MASK) == 0);
+
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+        addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+        status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, SDIOH_DATA_INC,
+                                      (rw ? SDIOH_WRITE : SDIOH_READ), SDIO_FUNC_1,
+                                      addr, 4, nbytes, buf, NULL);
+
+        return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_abort(void *sdh, uint fn)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+        return sdioh_abort(bcmsdh->sdioh, fn);
+}
+
+int
+bcmsdh_start(void *sdh, int stage)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+        return sdioh_start(bcmsdh->sdioh, stage);
+}
+
+int
+bcmsdh_stop(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+        return sdioh_stop(bcmsdh->sdioh);
+}
+
+int
+bcmsdh_waitlockfree(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        return sdioh_waitlockfree(bcmsdh->sdioh);
+}
+
+
+int
+bcmsdh_query_device(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+        bcmsdh->vendevid = (VENDOR_BROADCOM << 16) | 0;
+        return (bcmsdh->vendevid);
+}
+
+uint
+bcmsdh_query_iofnum(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        return (sdioh_query_iofnum(bcmsdh->sdioh));
+}
+
+int
+bcmsdh_reset(bcmsdh_info_t *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+        return sdioh_sdio_reset(bcmsdh->sdioh);
+}
+
+void *bcmsdh_get_sdioh(bcmsdh_info_t *sdh)
+{
+        ASSERT(sdh);
+        return sdh->sdioh;
+}
+
+/* Function to pass device-status bits to DHD. */
+uint32
+bcmsdh_get_dstatus(void *sdh)
+{
+        return 0;
+}
+uint32
+bcmsdh_cur_sbwad(void *sdh)
+{
+        bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+        if (!bcmsdh)
+                bcmsdh = l_bcmsdh;
+
+        return (bcmsdh->sbwad);
+}
+
+void
+bcmsdh_chipinfo(void *sdh, uint32 chip, uint32 chiprev)
+{
+        return;
+}
+
+
+int
+bcmsdh_sleep(void *sdh, bool enab)
+{
+#ifdef SDIOH_SLEEP_ENABLED
+        bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+        sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+        return sdioh_sleep(sd, enab);
+#else
+        return BCME_UNSUPPORTED;
+#endif
+}
diff --git a/drivers/net/wireless/bcmdhd/bcmsdh_linux.c b/drivers/net/wireless/bcmdhd/bcmsdh_linux.c
new file mode 100644
index 00000000000..d467e4b5630
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/bcmsdh_linux.c
@@ -0,0 +1,741 @@
+/*
+ * SDIO access interface for drivers - linux specific (pci only)
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdh_linux.c,v 1.72.6.5 2010-12-23 01:13:15 Exp $
+ */
+
+/**
+ * @file bcmsdh_linux.c
+ */
+
+#define __UNDEF_NO_VERSION__
+
+#include <typedefs.h>
+#include <linuxver.h>
+
+#include <linux/pci.h>
+#include <linux/completion.h>
+#include <linux/mmc/sdio_func.h>
+
+#include <osl.h>
+#include <pcicfg.h>
+#include <bcmdefs.h>
+#include <bcmdevs.h>
+
+#if defined(OOB_INTR_ONLY)
+#include <linux/irq.h>
+extern void dhdsdio_isr(void * args);
+#include <bcmutils.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#endif /* defined(OOB_INTR_ONLY) */
+
+/**
+ * SDIO Host Controller info
+ */
+typedef struct bcmsdh_hc bcmsdh_hc_t;
+
+struct bcmsdh_hc {
+        bcmsdh_hc_t *next;
+#ifdef BCMPLATFORM_BUS
+        struct device *dev;                     /* platform device handle */
+#else
+        struct pci_dev *dev;            /* pci device handle */
+#endif /* BCMPLATFORM_BUS */
+        osl_t *osh;
+        void *regs;                     /* SDIO Host Controller address */
+        bcmsdh_info_t *sdh;             /* SDIO Host Controller handle */
+        void *ch;
+        unsigned int oob_irq;
+        unsigned long oob_flags; /* OOB Host specifiction as edge and etc */
+        bool oob_irq_registered;
+        bool oob_irq_enable_flag;
+#if defined(OOB_INTR_ONLY)
+        spinlock_t irq_lock;
+#endif
+};
+static bcmsdh_hc_t *sdhcinfo = NULL;
+
+/* driver info, initialized when bcmsdh_register is called */
+static bcmsdh_driver_t drvinfo = {NULL, NULL};
+
+/* debugging macros */
+#define SDLX_MSG(x)
+
+/**
+ * Checks to see if vendor and device IDs match a supported SDIO Host Controller.
+ */
+bool
+bcmsdh_chipmatch(uint16 vendor, uint16 device)
+{
+        /* Add other vendors and devices as required */
+
+#ifdef BCMSDIOH_STD
+        /* Check for Arasan host controller */
+        if (vendor == VENDOR_SI_IMAGE) {
+                return (TRUE);
+        }
+        /* Check for BRCM 27XX Standard host controller */
+        if (device == BCM27XX_SDIOH_ID && vendor == VENDOR_BROADCOM) {
+                return (TRUE);
+        }
+        /* Check for BRCM Standard host controller */
+        if (device == SDIOH_FPGA_ID && vendor == VENDOR_BROADCOM) {
+                return (TRUE);
+        }
+        /* Check for TI PCIxx21 Standard host controller */
+        if (device == PCIXX21_SDIOH_ID && vendor == VENDOR_TI) {
+                return (TRUE);
+        }
+        if (device == PCIXX21_SDIOH0_ID && vendor == VENDOR_TI) {
+                return (TRUE);
+        }
+        /* Ricoh R5C822 Standard SDIO Host */
+        if (device == R5C822_SDIOH_ID && vendor == VENDOR_RICOH) {
+                return (TRUE);
+        }
+        /* JMicron Standard SDIO Host */
+        if (device == JMICRON_SDIOH_ID && vendor == VENDOR_JMICRON) {
+                return (TRUE);
+        }
+
+#endif /* BCMSDIOH_STD */
+#ifdef BCMSDIOH_SPI
+        /* This is the PciSpiHost. */
+        if (device == SPIH_FPGA_ID && vendor == VENDOR_BROADCOM) {
+                printf("Found PCI SPI Host Controller\n");
+                return (TRUE);
+        }
+
+#endif /* BCMSDIOH_SPI */
+
+        return (FALSE);
+}
+
+#if defined(BCMPLATFORM_BUS)
+#if defined(BCMLXSDMMC)
+/* forward declarations */
+int bcmsdh_probe_bcmdhd(struct device *dev);
+int bcmsdh_remove_bcmdhd(struct device *dev);
+
+EXPORT_SYMBOL(bcmsdh_probe_bcmdhd);
+EXPORT_SYMBOL(bcmsdh_remove_bcmdhd);
+
+#else
+/* forward declarations */
+static int __devinit bcmsdh_probe_bcmdhd(struct device *dev);
+static int __devexit bcmsdh_remove_bcmdhd(struct device *dev);
+#endif /* BCMLXSDMMC */
+
+#ifndef BCMLXSDMMC
+static struct device_driver bcmsdh_driver = {
+        .name           = "pxa2xx-mci",
+        .bus            = &platform_bus_type,
+        .probe          = bcmsdh_probe_bcmdhd,
+        .remove         = bcmsdh_remove_bcmdhd,
+        .suspend        = NULL,
+        .resume         = NULL,
+        };
+#endif /* BCMLXSDMMC */
+
+#ifndef BCMLXSDMMC
+static
+#endif /* BCMLXSDMMC */
+int bcmsdh_probe_bcmdhd(struct device *dev)
+{
+        osl_t *osh = NULL;
+        bcmsdh_hc_t *sdhc = NULL;
+        ulong regs = 0;
+        bcmsdh_info_t *sdh = NULL;
+        struct sdio_func *func = container_of(dev, struct sdio_func, dev);
+#if !defined(BCMLXSDMMC) && defined(BCMPLATFORM_BUS)
+        struct platform_device *pdev;
+        struct resource *r;
+#endif /* BCMLXSDMMC */
+        int irq = 0;
+        uint32 vendevid;
+        unsigned long irq_flags = 0;
+
+#if !defined(BCMLXSDMMC) && defined(BCMPLATFORM_BUS)
+        pdev = to_platform_device(dev);
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        irq = platform_get_irq(pdev, 0);
+        if (!r || irq == NO_IRQ)
+                return -ENXIO;
+#endif /* BCMLXSDMMC */
+
+#if defined(OOB_INTR_ONLY)
+#ifdef HW_OOB
+        irq_flags =
+                IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL | IORESOURCE_IRQ_SHAREABLE;
+#else
+         irq_flags = IRQF_TRIGGER_FALLING;
+#endif /* HW_OOB */
+
+        /* Get customer specific OOB IRQ parametres: IRQ number as IRQ type */
+        irq = dhd_customer_oob_irq_map(&irq_flags);
+        if  (irq < 0) {
+                SDLX_MSG(("%s: Host irq is not defined\n", __FUNCTION__));
+                return 1;
+        }
+#endif /* defined(OOB_INTR_ONLY) */
+        /* allocate SDIO Host Controller state info */
+        if (!(osh = osl_attach(dev, PCI_BUS, FALSE))) {
+                SDLX_MSG(("%s: osl_attach failed\n", __FUNCTION__));
+                goto err;
+        }
+        if (!(sdhc = MALLOC(osh, sizeof(bcmsdh_hc_t)))) {
+                SDLX_MSG(("%s: out of memory, allocated %d bytes\n",
+                        __FUNCTION__,
+                        MALLOCED(osh)));
+                goto err;
+        }
+        bzero(sdhc, sizeof(bcmsdh_hc_t));
+        sdhc->osh = osh;
+
+        sdhc->dev = (void *)dev;
+
+#ifdef BCMLXSDMMC
+        if (!(sdh = bcmsdh_attach(osh, (void *)0,
+                                  (void **)&regs, irq))) {
+                SDLX_MSG(("%s: bcmsdh_attach failed\n", __FUNCTION__));
+                goto err;
+        }
+#else
+        if (!(sdh = bcmsdh_attach(osh, (void *)r->start,
+                                  (void **)&regs, irq))) {
+                SDLX_MSG(("%s: bcmsdh_attach failed\n", __FUNCTION__));
+                goto err;
+        }
+#endif /* BCMLXSDMMC */
+        sdhc->sdh = sdh;
+        sdhc->oob_irq = irq;
+        sdhc->oob_flags = irq_flags;
+        sdhc->oob_irq_registered = FALSE;       /* to make sure.. */
+        sdhc->oob_irq_enable_flag = FALSE;
+#if defined(OOB_INTR_ONLY)
+        spin_lock_init(&sdhc->irq_lock);
+#endif
+
+        /* chain SDIO Host Controller info together */
+        sdhc->next = sdhcinfo;
+        sdhcinfo = sdhc;
+        /* Read the vendor/device ID from the CIS */
+        vendevid = bcmsdh_query_device(sdh);
+
+
+        /* try to attach to the target device */
+        if (!(sdhc->ch = drvinfo.attach((vendevid >> 16),
+                                        func->device, 0, 0, 0, 0,
+                                        (void *)regs, NULL, sdh, dev))) {
+                SDLX_MSG(("%s: device attach failed\n", __FUNCTION__));
+                goto err;
+        }
+
+        return 0;
+
+        /* error handling */
+err:
+        if (sdhc) {
+                if (sdhc->sdh)
+                        bcmsdh_detach(sdhc->osh, sdhc->sdh);
+                MFREE(osh, sdhc, sizeof(bcmsdh_hc_t));
+        }
+        if (osh)
+                osl_detach(osh);
+        return -ENODEV;
+}
+
+#ifndef BCMLXSDMMC
+static
+#endif /* BCMLXSDMMC */
+int bcmsdh_remove_bcmdhd(struct device *dev)
+{
+        bcmsdh_hc_t *sdhc, *prev;
+        osl_t *osh;
+
+        sdhc = sdhcinfo;
+        drvinfo.detach(sdhc->ch);
+        bcmsdh_detach(sdhc->osh, sdhc->sdh);
+        /* find the SDIO Host Controller state for this pdev and take it out from the list */
+        for (sdhc = sdhcinfo, prev = NULL; sdhc; sdhc = sdhc->next) {
+                if (sdhc->dev == (void *)dev) {
+                        if (prev)
+                                prev->next = sdhc->next;
+                        else
+                                sdhcinfo = NULL;
+                        break;
+                }
+                prev = sdhc;
+        }
+        if (!sdhc) {
+                SDLX_MSG(("%s: failed\n", __FUNCTION__));
+                return 0;
+        }
+
+
+        /* release SDIO Host Controller info */
+        osh = sdhc->osh;
+        MFREE(osh, sdhc, sizeof(bcmsdh_hc_t));
+        osl_detach(osh);
+
+#if !defined(BCMLXSDMMC) || defined(OOB_INTR_ONLY)
+        dev_set_drvdata(dev, NULL);
+#endif /* !defined(BCMLXSDMMC) || defined(OOB_INTR_ONLY) */
+
+        return 0;
+}
+
+#else /* BCMPLATFORM_BUS */
+
+#if !defined(BCMLXSDMMC)
+/* forward declarations for PCI probe and remove functions. */
+static int __devinit bcmsdh_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
+static void __devexit bcmsdh_pci_remove(struct pci_dev *pdev);
+
+/**
+ * pci id table
+ */
+static struct pci_device_id bcmsdh_pci_devid[] __devinitdata = {
+        { vendor: PCI_ANY_ID,
+        device: PCI_ANY_ID,
+        subvendor: PCI_ANY_ID,
+        subdevice: PCI_ANY_ID,
+        class: 0,
+        class_mask: 0,
+        driver_data: 0,
+        },
+        { 0, }
+};
+MODULE_DEVICE_TABLE(pci, bcmsdh_pci_devid);
+
+/**
+ * SDIO Host Controller pci driver info
+ */
+static struct pci_driver bcmsdh_pci_driver = {
+        node:           {},
+        name:           "bcmsdh",
+        id_table:       bcmsdh_pci_devid,
+        probe:          bcmsdh_pci_probe,
+        remove:         bcmsdh_pci_remove,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+        save_state:     NULL,
+#endif
+        suspend:        NULL,
+        resume:         NULL,
+        };
+
+
+extern uint sd_pci_slot;        /* Force detection to a particular PCI */
+                                                        /* slot only . Allows for having multiple */
+                                                        /* WL devices at once in a PC */
+                                                        /* Only one instance of dhd will be */
+                                                        /* usable at a time */
+                                                        /* Upper word is bus number, */
+                                                        /* lower word is slot number */
+                                                        /* Default value of 0xffffffff turns this */
+                                                        /* off */
+module_param(sd_pci_slot, uint, 0);
+
+
+/**
+ * Detect supported SDIO Host Controller and attach if found.
+ *
+ * Determine if the device described by pdev is a supported SDIO Host
+ * Controller.  If so, attach to it and attach to the target device.
+ */
+static int __devinit
+bcmsdh_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+{
+        osl_t *osh = NULL;
+        bcmsdh_hc_t *sdhc = NULL;
+        ulong regs;
+        bcmsdh_info_t *sdh = NULL;
+        int rc;
+
+        if (sd_pci_slot != 0xFFFFffff) {
+                if (pdev->bus->number != (sd_pci_slot>>16) ||
+                        PCI_SLOT(pdev->devfn) != (sd_pci_slot&0xffff)) {
+                        SDLX_MSG(("%s: %s: bus %X, slot %X, vend %X, dev %X\n",
+                                __FUNCTION__,
+                                bcmsdh_chipmatch(pdev->vendor, pdev->device)
+                                ?"Found compatible SDIOHC"
+                                :"Probing unknown device",
+                                pdev->bus->number, PCI_SLOT(pdev->devfn), pdev->vendor,
+                                pdev->device));
+                        return -ENODEV;
+                }
+                SDLX_MSG(("%s: %s: bus %X, slot %X, vendor %X, device %X (good PCI location)\n",
+                        __FUNCTION__,
+                        bcmsdh_chipmatch(pdev->vendor, pdev->device)
+                        ?"Using compatible SDIOHC"
+                        :"WARNING, forced use of unkown device",
+                        pdev->bus->number, PCI_SLOT(pdev->devfn), pdev->vendor, pdev->device));
+        }
+
+        if ((pdev->vendor == VENDOR_TI) && ((pdev->device == PCIXX21_FLASHMEDIA_ID) ||
+            (pdev->device == PCIXX21_FLASHMEDIA0_ID))) {
+                uint32 config_reg;
+
+                SDLX_MSG(("%s: Disabling TI FlashMedia Controller.\n", __FUNCTION__));
+                if (!(osh = osl_attach(pdev, PCI_BUS, FALSE))) {
+                        SDLX_MSG(("%s: osl_attach failed\n", __FUNCTION__));
+                        goto err;
+                }
+
+                config_reg = OSL_PCI_READ_CONFIG(osh, 0x4c, 4);
+
+                /*
+                 * Set MMC_SD_DIS bit in FlashMedia Controller.
+                 * Disbling the SD/MMC Controller in the FlashMedia Controller
+                 * allows the Standard SD Host Controller to take over control
+                 * of the SD Slot.
+                 */
+                config_reg |= 0x02;
+                OSL_PCI_WRITE_CONFIG(osh, 0x4c, 4, config_reg);
+                osl_detach(osh);
+        }
+        /* match this pci device with what we support */
+        /* we can't solely rely on this to believe it is our SDIO Host Controller! */
+        if (!bcmsdh_chipmatch(pdev->vendor, pdev->device)) {
+                return -ENODEV;
+        }
+
+        /* this is a pci device we might support */
+        SDLX_MSG(("%s: Found possible SDIO Host Controller: bus %d slot %d func %d irq %d\n",
+                __FUNCTION__,
+                pdev->bus->number, PCI_SLOT(pdev->devfn),
+                PCI_FUNC(pdev->devfn), pdev->irq));
+
+        /* use bcmsdh_query_device() to get the vendor ID of the target device so
+         * it will eventually appear in the Broadcom string on the console
+         */
+
+        /* allocate SDIO Host Controller state info */
+        if (!(osh = osl_attach(pdev, PCI_BUS, FALSE))) {
+                SDLX_MSG(("%s: osl_attach failed\n", __FUNCTION__));
+                goto err;
+        }
+        if (!(sdhc = MALLOC(osh, sizeof(bcmsdh_hc_t)))) {
+                SDLX_MSG(("%s: out of memory, allocated %d bytes\n",
+                        __FUNCTION__,
+                        MALLOCED(osh)));
+                goto err;
+        }
+        bzero(sdhc, sizeof(bcmsdh_hc_t));
+        sdhc->osh = osh;
+
+        sdhc->dev = pdev;
+
+        /* map to address where host can access */
+        pci_set_master(pdev);
+        rc = pci_enable_device(pdev);
+        if (rc) {
+                SDLX_MSG(("%s: Cannot enable PCI device\n", __FUNCTION__));
+                goto err;
+        }
+        if (!(sdh = bcmsdh_attach(osh, (void *)(uintptr)pci_resource_start(pdev, 0),
+                                  (void **)&regs, pdev->irq))) {
+                SDLX_MSG(("%s: bcmsdh_attach failed\n", __FUNCTION__));
+                goto err;
+        }
+
+        sdhc->sdh = sdh;
+
+        /* try to attach to the target device */
+        if (!(sdhc->ch = drvinfo.attach(VENDOR_BROADCOM, /* pdev->vendor, */
+                                        bcmsdh_query_device(sdh) & 0xFFFF, 0, 0, 0, 0,
+                                        (void *)regs, NULL, sdh, pdev->dev))) {
+                SDLX_MSG(("%s: device attach failed\n", __FUNCTION__));
+                goto err;
+        }
+
+        /* chain SDIO Host Controller info together */
+        sdhc->next = sdhcinfo;
+        sdhcinfo = sdhc;
+
+        return 0;
+
+        /* error handling */
+err:
+        if (sdhc) {
+                if (sdhc->sdh)
+                        bcmsdh_detach(sdhc->osh, sdhc->sdh);
+                MFREE(osh, sdhc, sizeof(bcmsdh_hc_t));
+        }
+        if (osh)
+                osl_detach(osh);
+        return -ENODEV;
+}
+
+
+/**
+ * Detach from target devices and SDIO Host Controller
+ */
+static void __devexit
+bcmsdh_pci_remove(struct pci_dev *pdev)
+{
+        bcmsdh_hc_t *sdhc, *prev;
+        osl_t *osh;
+
+        /* find the SDIO Host Controller state for this pdev and take it out from the list */
+        for (sdhc = sdhcinfo, prev = NULL; sdhc; sdhc = sdhc->next) {
+                if (sdhc->dev == pdev) {
+                        if (prev)
+                                prev->next = sdhc->next;
+                        else
+                                sdhcinfo = NULL;
+                        break;
+                }
+                prev = sdhc;
+        }
+        if (!sdhc)
+                return;
+
+        drvinfo.detach(sdhc->ch);
+
+        bcmsdh_detach(sdhc->osh, sdhc->sdh);
+
+        /* release SDIO Host Controller info */
+        osh = sdhc->osh;
+        MFREE(osh, sdhc, sizeof(bcmsdh_hc_t));
+        osl_detach(osh);
+}
+#endif /* BCMLXSDMMC */
+#endif /* BCMPLATFORM_BUS */
+
+extern int sdio_function_init(void);
+
+int
+bcmsdh_register(bcmsdh_driver_t *driver)
+{
+        int error = 0;
+
+        drvinfo = *driver;
+
+#if defined(BCMPLATFORM_BUS)
+#if defined(BCMLXSDMMC)
+        SDLX_MSG(("Linux Kernel SDIO/MMC Driver\n"));
+        error = sdio_function_init();
+#else
+        SDLX_MSG(("Intel PXA270 SDIO Driver\n"));
+        error = driver_register(&bcmsdh_driver);
+#endif /* defined(BCMLXSDMMC) */
+        return error;
+#endif /* defined(BCMPLATFORM_BUS) */
+
+#if !defined(BCMPLATFORM_BUS) && !defined(BCMLXSDMMC)
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+        if (!(error = pci_module_init(&bcmsdh_pci_driver)))
+                return 0;
+#else
+        if (!(error = pci_register_driver(&bcmsdh_pci_driver)))
+                return 0;
+#endif
+
+        SDLX_MSG(("%s: pci_module_init failed 0x%x\n", __FUNCTION__, error));
+#endif /* BCMPLATFORM_BUS */
+
+        return error;
+}
+
+extern void sdio_function_cleanup(void);
+
+void
+bcmsdh_unregister(void)
+{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+        if (bcmsdh_pci_driver.node.next)
+#endif
+
+#if defined(BCMPLATFORM_BUS) && !defined(BCMLXSDMMC)
+                driver_unregister(&bcmsdh_driver);
+#endif
+#if defined(BCMLXSDMMC)
+        sdio_function_cleanup();
+#endif /* BCMLXSDMMC */
+#if !defined(BCMPLATFORM_BUS) && !defined(BCMLXSDMMC)
+                pci_unregister_driver(&bcmsdh_pci_driver);
+#endif /* BCMPLATFORM_BUS */
+}
+
+#if defined(OOB_INTR_ONLY)
+void bcmsdh_oob_intr_set(bool enable)
+{
+        static bool curstate = 1;
+        unsigned long flags;
+
+        spin_lock_irqsave(&sdhcinfo->irq_lock, flags);
+        if (curstate != enable) {
+                if (enable)
+                        enable_irq(sdhcinfo->oob_irq);
+                else
+                        disable_irq_nosync(sdhcinfo->oob_irq);
+                curstate = enable;
+        }
+        spin_unlock_irqrestore(&sdhcinfo->irq_lock, flags);
+}
+
+static irqreturn_t wlan_oob_irq(int irq, void *dev_id)
+{
+        dhd_pub_t *dhdp;
+
+        dhdp = (dhd_pub_t *)dev_get_drvdata(sdhcinfo->dev);
+
+        bcmsdh_oob_intr_set(0);
+
+        if (dhdp == NULL) {
+                SDLX_MSG(("Out of band GPIO interrupt fired way too early\n"));
+                return IRQ_HANDLED;
+        }
+
+        dhdsdio_isr((void *)dhdp->bus);
+
+        return IRQ_HANDLED;
+}
+
+void *bcmsdh_get_drvdata(void)
+{
+        if (!sdhcinfo)
+                return NULL;
+        return dev_get_drvdata(sdhcinfo->dev);
+}
+
+int bcmsdh_register_oob_intr(void * dhdp)
+{
+        int error = 0;
+
+        SDLX_MSG(("%s Enter \n", __FUNCTION__));
+
+        /* IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL | IORESOURCE_IRQ_SHAREABLE; */
+
+        dev_set_drvdata(sdhcinfo->dev, dhdp);
+
+        if (!sdhcinfo->oob_irq_registered) {
+                SDLX_MSG(("%s IRQ=%d Type=%X \n", __FUNCTION__,
+                        (int)sdhcinfo->oob_irq, (int)sdhcinfo->oob_flags));
+                /* Refer to customer Host IRQ docs about proper irqflags definition */
+                error = request_irq(sdhcinfo->oob_irq, wlan_oob_irq, sdhcinfo->oob_flags,
+                        "bcmsdh_sdmmc", NULL);
+                if (error)
+                        return -ENODEV;
+
+                enable_irq_wake(sdhcinfo->oob_irq);
+                sdhcinfo->oob_irq_registered = TRUE;
+                sdhcinfo->oob_irq_enable_flag = TRUE;
+        }
+
+        return 0;
+}
+
+void bcmsdh_set_irq(int flag)
+{
+        if (sdhcinfo->oob_irq_registered && sdhcinfo->oob_irq_enable_flag != flag) {
+                SDLX_MSG(("%s Flag = %d", __FUNCTION__, flag));
+                sdhcinfo->oob_irq_enable_flag = flag;
+                if (flag) {
+                        enable_irq(sdhcinfo->oob_irq);
+                        enable_irq_wake(sdhcinfo->oob_irq);
+                } else {
+                        disable_irq_wake(sdhcinfo->oob_irq);
+                        disable_irq(sdhcinfo->oob_irq);
+                }
+        }
+}
+
+void bcmsdh_unregister_oob_intr(void)
+{
+        SDLX_MSG(("%s: Enter\n", __FUNCTION__));
+
+        if (sdhcinfo->oob_irq_registered == TRUE) {
+                bcmsdh_set_irq(FALSE);
+                free_irq(sdhcinfo->oob_irq, NULL);
+                sdhcinfo->oob_irq_registered = FALSE;
+        }
+}
+#endif /* defined(OOB_INTR_ONLY) */
+/* Module parameters specific to each host-controller driver */
+
+extern uint sd_msglevel;        /* Debug message level */
+module_param(sd_msglevel, uint, 0);
+
+extern uint sd_power;   /* 0 = SD Power OFF, 1 = SD Power ON. */
+module_param(sd_power, uint, 0);
+
+extern uint sd_clock;   /* SD Clock Control, 0 = SD Clock OFF, 1 = SD Clock ON */
+module_param(sd_clock, uint, 0);
+
+extern uint sd_divisor; /* Divisor (-1 means external clock) */
+module_param(sd_divisor, uint, 0);
+
+extern uint sd_sdmode;  /* Default is SD4, 0=SPI, 1=SD1, 2=SD4 */
+module_param(sd_sdmode, uint, 0);
+
+extern uint sd_hiok;    /* Ok to use hi-speed mode */
+module_param(sd_hiok, uint, 0);
+
+extern uint sd_f2_blocksize;
+module_param(sd_f2_blocksize, int, 0);
+
+
+#ifdef BCMSDH_MODULE
+EXPORT_SYMBOL(bcmsdh_attach);
+EXPORT_SYMBOL(bcmsdh_detach);
+EXPORT_SYMBOL(bcmsdh_intr_query);
+EXPORT_SYMBOL(bcmsdh_intr_enable);
+EXPORT_SYMBOL(bcmsdh_intr_disable);
+EXPORT_SYMBOL(bcmsdh_intr_reg);
+EXPORT_SYMBOL(bcmsdh_intr_dereg);
+
+#if defined(DHD_DEBUG)
+EXPORT_SYMBOL(bcmsdh_intr_pending);
+#endif
+
+EXPORT_SYMBOL(bcmsdh_devremove_reg);
+EXPORT_SYMBOL(bcmsdh_cfg_read);
+EXPORT_SYMBOL(bcmsdh_cfg_write);
+EXPORT_SYMBOL(bcmsdh_cis_read);
+EXPORT_SYMBOL(bcmsdh_reg_read);
+EXPORT_SYMBOL(bcmsdh_reg_write);
+EXPORT_SYMBOL(bcmsdh_regfail);
+EXPORT_SYMBOL(bcmsdh_send_buf);
+EXPORT_SYMBOL(bcmsdh_recv_buf);
+
+EXPORT_SYMBOL(bcmsdh_rwdata);
+EXPORT_SYMBOL(bcmsdh_abort);
+EXPORT_SYMBOL(bcmsdh_query_device);
+EXPORT_SYMBOL(bcmsdh_query_iofnum);
+EXPORT_SYMBOL(bcmsdh_iovar_op);
+EXPORT_SYMBOL(bcmsdh_register);
+EXPORT_SYMBOL(bcmsdh_unregister);
+EXPORT_SYMBOL(bcmsdh_chipmatch);
+EXPORT_SYMBOL(bcmsdh_reset);
+EXPORT_SYMBOL(bcmsdh_waitlockfree);
+
+EXPORT_SYMBOL(bcmsdh_get_dstatus);
+EXPORT_SYMBOL(bcmsdh_cfg_read_word);
+EXPORT_SYMBOL(bcmsdh_cfg_write_word);
+EXPORT_SYMBOL(bcmsdh_cur_sbwad);
+EXPORT_SYMBOL(bcmsdh_chipinfo);
+
+#endif /* BCMSDH_MODULE */
diff --git a/drivers/net/wireless/bcmdhd/bcmsdh_sdmmc.c b/drivers/net/wireless/bcmdhd/bcmsdh_sdmmc.c
new file mode 100644
index 00000000000..7499a1ec55f
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/bcmsdh_sdmmc.c
@@ -0,0 +1,1331 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdh_sdmmc.c 282820 2011-09-09 15:40:35Z $
+ */
+#include <typedefs.h>
+
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <osl.h>
+#include <sdio.h>       /* SDIO Device and Protocol Specs */
+#include <sdioh.h>      /* Standard SDIO Host Controller Specification */
+#include <bcmsdbus.h>   /* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>    /* ioctl/iovars */
+
+#include <linux/mmc/core.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+#include <linux/suspend.h>
+extern volatile bool dhd_mmc_suspend;
+#endif
+#include "bcmsdh_sdmmc.h"
+
+#ifndef BCMSDH_MODULE
+extern int sdio_function_init(void);
+extern void sdio_function_cleanup(void);
+#endif /* BCMSDH_MODULE */
+
+#if !defined(OOB_INTR_ONLY)
+static void IRQHandler(struct sdio_func *func);
+static void IRQHandlerF2(struct sdio_func *func);
+#endif /* !defined(OOB_INTR_ONLY) */
+static int sdioh_sdmmc_get_cisaddr(sdioh_info_t *sd, uint32 regaddr);
+extern int sdio_reset_comm(struct mmc_card *card);
+
+extern PBCMSDH_SDMMC_INSTANCE gInstance;
+
+uint sd_sdmode = SDIOH_MODE_SD4;        /* Use SD4 mode by default */
+uint sd_f2_blocksize = 512;             /* Default blocksize */
+
+uint sd_divisor = 2;                    /* Default 48MHz/2 = 24MHz */
+
+uint sd_power = 1;              /* Default to SD Slot powered ON */
+uint sd_clock = 1;              /* Default to SD Clock turned ON */
+uint sd_hiok = FALSE;   /* Don't use hi-speed mode by default */
+uint sd_msglevel = 0x01;
+uint sd_use_dma = TRUE;
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_byte_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_word_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_packet_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_buffer_wait);
+
+#define DMA_ALIGN_MASK  0x03
+
+int sdioh_sdmmc_card_regread(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data);
+
+static int
+sdioh_sdmmc_card_enablefuncs(sdioh_info_t *sd)
+{
+        int err_ret;
+        uint32 fbraddr;
+        uint8 func;
+
+        sd_trace(("%s\n", __FUNCTION__));
+
+        /* Get the Card's common CIS address */
+        sd->com_cis_ptr = sdioh_sdmmc_get_cisaddr(sd, SDIOD_CCCR_CISPTR_0);
+        sd->func_cis_ptr[0] = sd->com_cis_ptr;
+        sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __FUNCTION__, sd->com_cis_ptr));
+
+        /* Get the Card's function CIS (for each function) */
+        for (fbraddr = SDIOD_FBR_STARTADDR, func = 1;
+             func <= sd->num_funcs; func++, fbraddr += SDIOD_FBR_SIZE) {
+                sd->func_cis_ptr[func] = sdioh_sdmmc_get_cisaddr(sd, SDIOD_FBR_CISPTR_0 + fbraddr);
+                sd_info(("%s: Function %d CIS Ptr = 0x%x\n",
+                         __FUNCTION__, func, sd->func_cis_ptr[func]));
+        }
+
+        sd->func_cis_ptr[0] = sd->com_cis_ptr;
+        sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __FUNCTION__, sd->com_cis_ptr));
+
+        /* Enable Function 1 */
+        sdio_claim_host(gInstance->func[1]);
+        err_ret = sdio_enable_func(gInstance->func[1]);
+        sdio_release_host(gInstance->func[1]);
+        if (err_ret) {
+                sd_err(("bcmsdh_sdmmc: Failed to enable F1 Err: 0x%08x", err_ret));
+        }
+
+        return FALSE;
+}
+
+/*
+ *      Public entry points & extern's
+ */
+extern sdioh_info_t *
+sdioh_attach(osl_t *osh, void *bar0, uint irq)
+{
+        sdioh_info_t *sd;
+        int err_ret;
+
+        sd_trace(("%s\n", __FUNCTION__));
+
+        if (gInstance == NULL) {
+                sd_err(("%s: SDIO Device not present\n", __FUNCTION__));
+                return NULL;
+        }
+
+        if ((sd = (sdioh_info_t *)MALLOC(osh, sizeof(sdioh_info_t))) == NULL) {
+                sd_err(("sdioh_attach: out of memory, malloced %d bytes\n", MALLOCED(osh)));
+                return NULL;
+        }
+        bzero((char *)sd, sizeof(sdioh_info_t));
+        sd->osh = osh;
+        if (sdioh_sdmmc_osinit(sd) != 0) {
+                sd_err(("%s:sdioh_sdmmc_osinit() failed\n", __FUNCTION__));
+                MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+                return NULL;
+        }
+
+        sd->num_funcs = 2;
+        sd->sd_blockmode = TRUE;
+        sd->use_client_ints = TRUE;
+        sd->client_block_size[0] = 64;
+
+        gInstance->sd = sd;
+
+        /* Claim host controller */
+        sdio_claim_host(gInstance->func[1]);
+
+        sd->client_block_size[1] = 64;
+        err_ret = sdio_set_block_size(gInstance->func[1], 64);
+        if (err_ret) {
+                sd_err(("bcmsdh_sdmmc: Failed to set F1 blocksize\n"));
+        }
+
+        /* Release host controller F1 */
+        sdio_release_host(gInstance->func[1]);
+
+        if (gInstance->func[2]) {
+                /* Claim host controller F2 */
+                sdio_claim_host(gInstance->func[2]);
+
+                sd->client_block_size[2] = sd_f2_blocksize;
+                err_ret = sdio_set_block_size(gInstance->func[2], sd_f2_blocksize);
+                if (err_ret) {
+                        sd_err(("bcmsdh_sdmmc: Failed to set F2 blocksize to %d\n",
+                                sd_f2_blocksize));
+                }
+
+                /* Release host controller F2 */
+                sdio_release_host(gInstance->func[2]);
+        }
+
+        sdioh_sdmmc_card_enablefuncs(sd);
+
+        sd_trace(("%s: Done\n", __FUNCTION__));
+        return sd;
+}
+
+
+extern SDIOH_API_RC
+sdioh_detach(osl_t *osh, sdioh_info_t *sd)
+{
+        sd_trace(("%s\n", __FUNCTION__));
+
+        if (sd) {
+
+                /* Disable Function 2 */
+                sdio_claim_host(gInstance->func[2]);
+                sdio_disable_func(gInstance->func[2]);
+                sdio_release_host(gInstance->func[2]);
+
+                /* Disable Function 1 */
+                if (gInstance->func[1]) {
+                        sdio_claim_host(gInstance->func[1]);
+                        sdio_disable_func(gInstance->func[1]);
+                        sdio_release_host(gInstance->func[1]);
+                }
+
+                gInstance->func[1] = NULL;
+                gInstance->func[2] = NULL;
+
+                /* deregister irq */
+                sdioh_sdmmc_osfree(sd);
+
+                MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+        }
+        return SDIOH_API_RC_SUCCESS;
+}
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+
+extern SDIOH_API_RC
+sdioh_enable_func_intr(void)
+{
+        uint8 reg;
+        int err;
+
+        if (gInstance->func[0]) {
+                sdio_claim_host(gInstance->func[0]);
+
+                reg = sdio_readb(gInstance->func[0], SDIOD_CCCR_INTEN, &err);
+                if (err) {
+                        sd_err(("%s: error for read SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+                        sdio_release_host(gInstance->func[0]);
+                        return SDIOH_API_RC_FAIL;
+                }
+
+                /* Enable F1 and F2 interrupts, set master enable */
+                reg |= (INTR_CTL_FUNC1_EN | INTR_CTL_FUNC2_EN | INTR_CTL_MASTER_EN);
+
+                sdio_writeb(gInstance->func[0], reg, SDIOD_CCCR_INTEN, &err);
+                sdio_release_host(gInstance->func[0]);
+
+                if (err) {
+                        sd_err(("%s: error for write SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+                        return SDIOH_API_RC_FAIL;
+                }
+        }
+
+        return SDIOH_API_RC_SUCCESS;
+}
+
+#endif /* defined(OOB_INTR_ONLY) && defined(HW_OOB) */
+
+extern SDIOH_API_RC
+sdioh_disable_func_intr(int func)
+{
+        uint8 reg;
+        int err;
+
+        if (gInstance->func[func]) {
+                sdio_claim_host(gInstance->func[func]);
+                reg = sdio_readb(gInstance->func[func], SDIOD_CCCR_INTEN, &err);
+                if (err) {
+                        sd_err(("%s: error for read SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+                        sdio_release_host(gInstance->func[func]);
+                        return SDIOH_API_RC_FAIL;
+                }
+#if defined(HW_OOB)
+                reg &= ~(INTR_CTL_FUNC1_EN | INTR_CTL_FUNC2_EN);
+#else
+                reg &= ~(1 << func);
+#endif
+                /* Disable master interrupt with the last function interrupt */
+                if (!(reg & 0xFE))
+                        reg = 0;
+                sdio_writeb(gInstance->func[func], reg, SDIOD_CCCR_INTEN, &err);
+
+                sdio_release_host(gInstance->func[func]);
+                if (err) {
+                        sd_err(("%s: error for write SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+                        return SDIOH_API_RC_FAIL;
+                }
+        }
+        return SDIOH_API_RC_SUCCESS;
+}
+
+
+/* Configure callback to client when we recieve client interrupt */
+extern SDIOH_API_RC
+sdioh_interrupt_register(sdioh_info_t *sd, sdioh_cb_fn_t fn, void *argh)
+{
+        sd_trace(("%s: Entering\n", __FUNCTION__));
+        if (fn == NULL) {
+                sd_err(("%s: interrupt handler is NULL, not registering\n", __FUNCTION__));
+                return SDIOH_API_RC_FAIL;
+        }
+#if !defined(OOB_INTR_ONLY)
+        sd->intr_handler = fn;
+        sd->intr_handler_arg = argh;
+        sd->intr_handler_valid = TRUE;
+
+        /* register and unmask irq */
+        if (gInstance->func[2]) {
+                sdio_claim_host(gInstance->func[2]);
+                sdio_claim_irq(gInstance->func[2], IRQHandlerF2);
+                sdio_release_host(gInstance->func[2]);
+        }
+
+        if (gInstance->func[1]) {
+                sdio_claim_host(gInstance->func[1]);
+                sdio_claim_irq(gInstance->func[1], IRQHandler);
+                sdio_release_host(gInstance->func[1]);
+        }
+#elif defined(HW_OOB)
+        sdioh_enable_func_intr();
+#endif /* !defined(OOB_INTR_ONLY) */
+
+        return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_deregister(sdioh_info_t *sd)
+{
+        sd_trace(("%s: Entering\n", __FUNCTION__));
+
+#if !defined(OOB_INTR_ONLY)
+        if (gInstance->func[1]) {
+                sdioh_disable_func_intr(1);
+                /*Wait for the pending interrupts to be cleared*/
+                msleep(300);
+                /* register and unmask irq */
+                sdio_claim_host(gInstance->func[1]);
+                sdio_release_irq(gInstance->func[1]);
+                sdio_release_host(gInstance->func[1]);
+        }
+
+        if (gInstance->func[2]) {
+                sdioh_disable_func_intr(2);
+                /*Wait for the pending interrupts to be cleared*/
+                msleep(300);
+                /* Claim host controller F2 */
+                sdio_claim_host(gInstance->func[2]);
+                sdio_release_irq(gInstance->func[2]);
+                /* Release host controller F2 */
+                sdio_release_host(gInstance->func[2]);
+        }
+
+        sd->intr_handler_valid = FALSE;
+        sd->intr_handler = NULL;
+        sd->intr_handler_arg = NULL;
+#elif defined(HW_OOB)
+        sdioh_disable_func_intr(0);
+#endif /* !defined(OOB_INTR_ONLY) */
+        return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_query(sdioh_info_t *sd, bool *onoff)
+{
+        sd_trace(("%s: Entering\n", __FUNCTION__));
+        *onoff = sd->client_intr_enabled;
+        return SDIOH_API_RC_SUCCESS;
+}
+
+#if defined(DHD_DEBUG)
+extern bool
+sdioh_interrupt_pending(sdioh_info_t *sd)
+{
+        return (0);
+}
+#endif
+
+uint
+sdioh_query_iofnum(sdioh_info_t *sd)
+{
+        return sd->num_funcs;
+}
+
+/* IOVar table */
+enum {
+        IOV_MSGLEVEL = 1,
+        IOV_BLOCKMODE,
+        IOV_BLOCKSIZE,
+        IOV_DMA,
+        IOV_USEINTS,
+        IOV_NUMINTS,
+        IOV_NUMLOCALINTS,
+        IOV_HOSTREG,
+        IOV_DEVREG,
+        IOV_DIVISOR,
+        IOV_SDMODE,
+        IOV_HISPEED,
+        IOV_HCIREGS,
+        IOV_POWER,
+        IOV_CLOCK,
+        IOV_RXCHAIN
+};
+
+const bcm_iovar_t sdioh_iovars[] = {
+        {"sd_msglevel", IOV_MSGLEVEL,   0,      IOVT_UINT32,    0 },
+        {"sd_blockmode", IOV_BLOCKMODE, 0,      IOVT_BOOL,      0 },
+        {"sd_blocksize", IOV_BLOCKSIZE, 0,      IOVT_UINT32,    0 }, /* ((fn << 16) | size) */
+        {"sd_dma",      IOV_DMA,        0,      IOVT_BOOL,      0 },
+        {"sd_ints",     IOV_USEINTS,    0,      IOVT_BOOL,      0 },
+        {"sd_numints",  IOV_NUMINTS,    0,      IOVT_UINT32,    0 },
+        {"sd_numlocalints", IOV_NUMLOCALINTS, 0, IOVT_UINT32,   0 },
+        {"sd_hostreg",  IOV_HOSTREG,    0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+        {"sd_devreg",   IOV_DEVREG,     0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+        {"sd_divisor",  IOV_DIVISOR,    0,      IOVT_UINT32,    0 },
+        {"sd_power",    IOV_POWER,      0,      IOVT_UINT32,    0 },
+        {"sd_clock",    IOV_CLOCK,      0,      IOVT_UINT32,    0 },
+        {"sd_mode",     IOV_SDMODE,     0,      IOVT_UINT32,    100},
+        {"sd_highspeed", IOV_HISPEED,   0,      IOVT_UINT32,    0 },
+        {"sd_rxchain",  IOV_RXCHAIN,    0,      IOVT_BOOL,      0 },
+        {NULL, 0, 0, 0, 0 }
+};
+
+int
+sdioh_iovar_op(sdioh_info_t *si, const char *name,
+                           void *params, int plen, void *arg, int len, bool set)
+{
+        const bcm_iovar_t *vi = NULL;
+        int bcmerror = 0;
+        int val_size;
+        int32 int_val = 0;
+        bool bool_val;
+        uint32 actionid;
+
+        ASSERT(name);
+        ASSERT(len >= 0);
+
+        /* Get must have return space; Set does not take qualifiers */
+        ASSERT(set || (arg && len));
+        ASSERT(!set || (!params && !plen));
+
+        sd_trace(("%s: Enter (%s %s)\n", __FUNCTION__, (set ? "set" : "get"), name));
+
+        if ((vi = bcm_iovar_lookup(sdioh_iovars, name)) == NULL) {
+                bcmerror = BCME_UNSUPPORTED;
+                goto exit;
+        }
+
+        if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, set)) != 0)
+                goto exit;
+
+        /* Set up params so get and set can share the convenience variables */
+        if (params == NULL) {
+                params = arg;
+                plen = len;
+        }
+
+        if (vi->type == IOVT_VOID)
+                val_size = 0;
+        else if (vi->type == IOVT_BUFFER)
+                val_size = len;
+        else
+                val_size = sizeof(int);
+
+        if (plen >= (int)sizeof(int_val))
+                bcopy(params, &int_val, sizeof(int_val));
+
+        bool_val = (int_val != 0) ? TRUE : FALSE;
+
+        actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+        switch (actionid) {
+        case IOV_GVAL(IOV_MSGLEVEL):
+                int_val = (int32)sd_msglevel;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_MSGLEVEL):
+                sd_msglevel = int_val;
+                break;
+
+        case IOV_GVAL(IOV_BLOCKMODE):
+                int_val = (int32)si->sd_blockmode;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_BLOCKMODE):
+                si->sd_blockmode = (bool)int_val;
+                /* Haven't figured out how to make non-block mode with DMA */
+                break;
+
+        case IOV_GVAL(IOV_BLOCKSIZE):
+                if ((uint32)int_val > si->num_funcs) {
+                        bcmerror = BCME_BADARG;
+                        break;
+                }
+                int_val = (int32)si->client_block_size[int_val];
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_BLOCKSIZE):
+        {
+                uint func = ((uint32)int_val >> 16);
+                uint blksize = (uint16)int_val;
+                uint maxsize;
+
+                if (func > si->num_funcs) {
+                        bcmerror = BCME_BADARG;
+                        break;
+                }
+
+                switch (func) {
+                case 0: maxsize = 32; break;
+                case 1: maxsize = BLOCK_SIZE_4318; break;
+                case 2: maxsize = BLOCK_SIZE_4328; break;
+                default: maxsize = 0;
+                }
+                if (blksize > maxsize) {
+                        bcmerror = BCME_BADARG;
+                        break;
+                }
+                if (!blksize) {
+                        blksize = maxsize;
+                }
+
+                /* Now set it */
+                si->client_block_size[func] = blksize;
+
+                break;
+        }
+
+        case IOV_GVAL(IOV_RXCHAIN):
+                int_val = FALSE;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_GVAL(IOV_DMA):
+                int_val = (int32)si->sd_use_dma;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_DMA):
+                si->sd_use_dma = (bool)int_val;
+                break;
+
+        case IOV_GVAL(IOV_USEINTS):
+                int_val = (int32)si->use_client_ints;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_USEINTS):
+                si->use_client_ints = (bool)int_val;
+                if (si->use_client_ints)
+                        si->intmask |= CLIENT_INTR;
+                else
+                        si->intmask &= ~CLIENT_INTR;
+
+                break;
+
+        case IOV_GVAL(IOV_DIVISOR):
+                int_val = (uint32)sd_divisor;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_DIVISOR):
+                sd_divisor = int_val;
+                break;
+
+        case IOV_GVAL(IOV_POWER):
+                int_val = (uint32)sd_power;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_POWER):
+                sd_power = int_val;
+                break;
+
+        case IOV_GVAL(IOV_CLOCK):
+                int_val = (uint32)sd_clock;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_CLOCK):
+                sd_clock = int_val;
+                break;
+
+        case IOV_GVAL(IOV_SDMODE):
+                int_val = (uint32)sd_sdmode;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_SDMODE):
+                sd_sdmode = int_val;
+                break;
+
+        case IOV_GVAL(IOV_HISPEED):
+                int_val = (uint32)sd_hiok;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_HISPEED):
+                sd_hiok = int_val;
+                break;
+
+        case IOV_GVAL(IOV_NUMINTS):
+                int_val = (int32)si->intrcount;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_GVAL(IOV_NUMLOCALINTS):
+                int_val = (int32)0;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_GVAL(IOV_HOSTREG):
+        {
+                sdreg_t *sd_ptr = (sdreg_t *)params;
+
+                if (sd_ptr->offset < SD_SysAddr || sd_ptr->offset > SD_MaxCurCap) {
+                        sd_err(("%s: bad offset 0x%x\n", __FUNCTION__, sd_ptr->offset));
+                        bcmerror = BCME_BADARG;
+                        break;
+                }
+
+                sd_trace(("%s: rreg%d at offset %d\n", __FUNCTION__,
+                                  (sd_ptr->offset & 1) ? 8 : ((sd_ptr->offset & 2) ? 16 : 32),
+                                  sd_ptr->offset));
+                if (sd_ptr->offset & 1)
+                        int_val = 8; /* sdioh_sdmmc_rreg8(si, sd_ptr->offset); */
+                else if (sd_ptr->offset & 2)
+                        int_val = 16; /* sdioh_sdmmc_rreg16(si, sd_ptr->offset); */
+                else
+                        int_val = 32; /* sdioh_sdmmc_rreg(si, sd_ptr->offset); */
+
+                bcopy(&int_val, arg, sizeof(int_val));
+                break;
+        }
+
+        case IOV_SVAL(IOV_HOSTREG):
+        {
+                sdreg_t *sd_ptr = (sdreg_t *)params;
+
+                if (sd_ptr->offset < SD_SysAddr || sd_ptr->offset > SD_MaxCurCap) {
+                        sd_err(("%s: bad offset 0x%x\n", __FUNCTION__, sd_ptr->offset));
+                        bcmerror = BCME_BADARG;
+                        break;
+                }
+
+                sd_trace(("%s: wreg%d value 0x%08x at offset %d\n", __FUNCTION__, sd_ptr->value,
+                                  (sd_ptr->offset & 1) ? 8 : ((sd_ptr->offset & 2) ? 16 : 32),
+                                  sd_ptr->offset));
+                break;
+        }
+
+        case IOV_GVAL(IOV_DEVREG):
+        {
+                sdreg_t *sd_ptr = (sdreg_t *)params;
+                uint8 data = 0;
+
+                if (sdioh_cfg_read(si, sd_ptr->func, sd_ptr->offset, &data)) {
+                        bcmerror = BCME_SDIO_ERROR;
+                        break;
+                }
+
+                int_val = (int)data;
+                bcopy(&int_val, arg, sizeof(int_val));
+                break;
+        }
+
+        case IOV_SVAL(IOV_DEVREG):
+        {
+                sdreg_t *sd_ptr = (sdreg_t *)params;
+                uint8 data = (uint8)sd_ptr->value;
+
+                if (sdioh_cfg_write(si, sd_ptr->func, sd_ptr->offset, &data)) {
+                        bcmerror = BCME_SDIO_ERROR;
+                        break;
+                }
+                break;
+        }
+
+        default:
+                bcmerror = BCME_UNSUPPORTED;
+                break;
+        }
+exit:
+
+        return bcmerror;
+}
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+
+SDIOH_API_RC
+sdioh_enable_hw_oob_intr(sdioh_info_t *sd, bool enable)
+{
+        SDIOH_API_RC status;
+        uint8 data;
+
+        if (enable)
+                data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;       /* enable hw oob interrupt */
+        else
+                data = SDIO_SEPINT_ACT_HI;      /* disable hw oob interrupt */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+        /* Needed for Android Linux Kernel 2.6.35 */
+        data |= SDIO_SEPINT_ACT_HI;             /* Active HIGH */
+#endif
+
+        status = sdioh_request_byte(sd, SDIOH_WRITE, 0, SDIOD_CCCR_BRCM_SEPINT, &data);
+        return status;
+}
+#endif /* defined(OOB_INTR_ONLY) && defined(HW_OOB) */
+
+extern SDIOH_API_RC
+sdioh_cfg_read(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+        SDIOH_API_RC status;
+        /* No lock needed since sdioh_request_byte does locking */
+        status = sdioh_request_byte(sd, SDIOH_READ, fnc_num, addr, data);
+        return status;
+}
+
+extern SDIOH_API_RC
+sdioh_cfg_write(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+        /* No lock needed since sdioh_request_byte does locking */
+        SDIOH_API_RC status;
+        status = sdioh_request_byte(sd, SDIOH_WRITE, fnc_num, addr, data);
+        return status;
+}
+
+static int
+sdioh_sdmmc_get_cisaddr(sdioh_info_t *sd, uint32 regaddr)
+{
+        /* read 24 bits and return valid 17 bit addr */
+        int i;
+        uint32 scratch, regdata;
+        uint8 *ptr = (uint8 *)&scratch;
+        for (i = 0; i < 3; i++) {
+                if ((sdioh_sdmmc_card_regread (sd, 0, regaddr, 1, &regdata)) != SUCCESS)
+                        sd_err(("%s: Can't read!\n", __FUNCTION__));
+
+                *ptr++ = (uint8) regdata;
+                regaddr++;
+        }
+
+        /* Only the lower 17-bits are valid */
+        scratch = ltoh32(scratch);
+        scratch &= 0x0001FFFF;
+        return (scratch);
+}
+
+extern SDIOH_API_RC
+sdioh_cis_read(sdioh_info_t *sd, uint func, uint8 *cisd, uint32 length)
+{
+        uint32 count;
+        int offset;
+        uint32 foo;
+        uint8 *cis = cisd;
+
+        sd_trace(("%s: Func = %d\n", __FUNCTION__, func));
+
+        if (!sd->func_cis_ptr[func]) {
+                bzero(cis, length);
+                sd_err(("%s: no func_cis_ptr[%d]\n", __FUNCTION__, func));
+                return SDIOH_API_RC_FAIL;
+        }
+
+        sd_err(("%s: func_cis_ptr[%d]=0x%04x\n", __FUNCTION__, func, sd->func_cis_ptr[func]));
+
+        for (count = 0; count < length; count++) {
+                offset =  sd->func_cis_ptr[func] + count;
+                if (sdioh_sdmmc_card_regread (sd, 0, offset, 1, &foo) < 0) {
+                        sd_err(("%s: regread failed: Can't read CIS\n", __FUNCTION__));
+                        return SDIOH_API_RC_FAIL;
+                }
+
+                *cis = (uint8)(foo & 0xff);
+                cis++;
+        }
+
+        return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_request_byte(sdioh_info_t *sd, uint rw, uint func, uint regaddr, uint8 *byte)
+{
+        int err_ret;
+
+        sd_info(("%s: rw=%d, func=%d, addr=0x%05x\n", __FUNCTION__, rw, func, regaddr));
+
+        DHD_PM_RESUME_WAIT(sdioh_request_byte_wait);
+        DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+        if(rw) { /* CMD52 Write */
+                if (func == 0) {
+                        /* Can only directly write to some F0 registers.  Handle F2 enable
+                         * as a special case.
+                         */
+                        if (regaddr == SDIOD_CCCR_IOEN) {
+                                if (gInstance->func[2]) {
+                                        sdio_claim_host(gInstance->func[2]);
+                                        if (*byte & SDIO_FUNC_ENABLE_2) {
+                                                /* Enable Function 2 */
+                                                err_ret = sdio_enable_func(gInstance->func[2]);
+                                                if (err_ret) {
+                                                        sd_err(("bcmsdh_sdmmc: enable F2 failed:%d",
+                                                                err_ret));
+                                                }
+                                        } else {
+                                                /* Disable Function 2 */
+                                                err_ret = sdio_disable_func(gInstance->func[2]);
+                                                if (err_ret) {
+                                                        sd_err(("bcmsdh_sdmmc: Disab F2 failed:%d",
+                                                                err_ret));
+                                                }
+                                        }
+                                        sdio_release_host(gInstance->func[2]);
+                                }
+                        }
+#if defined(MMC_SDIO_ABORT)
+                        /* to allow abort command through F1 */
+                        else if (regaddr == SDIOD_CCCR_IOABORT) {
+                                sdio_claim_host(gInstance->func[func]);
+                                /*
+                                * this sdio_f0_writeb() can be replaced with another api
+                                * depending upon MMC driver change.
+                                * As of this time, this is temporaray one
+                                */
+                                sdio_writeb(gInstance->func[func], *byte, regaddr, &err_ret);
+                                sdio_release_host(gInstance->func[func]);
+                        }
+#endif /* MMC_SDIO_ABORT */
+                        else if (regaddr < 0xF0) {
+                                sd_err(("bcmsdh_sdmmc: F0 Wr:0x%02x: write disallowed\n", regaddr));
+                        } else {
+                                /* Claim host controller, perform F0 write, and release */
+                                sdio_claim_host(gInstance->func[func]);
+                                sdio_f0_writeb(gInstance->func[func], *byte, regaddr, &err_ret);
+                                sdio_release_host(gInstance->func[func]);
+                        }
+                } else {
+                        /* Claim host controller, perform Fn write, and release */
+                        sdio_claim_host(gInstance->func[func]);
+                        sdio_writeb(gInstance->func[func], *byte, regaddr, &err_ret);
+                        sdio_release_host(gInstance->func[func]);
+                }
+        } else { /* CMD52 Read */
+                /* Claim host controller, perform Fn read, and release */
+                sdio_claim_host(gInstance->func[func]);
+
+                if (func == 0) {
+                        *byte = sdio_f0_readb(gInstance->func[func], regaddr, &err_ret);
+                } else {
+                        *byte = sdio_readb(gInstance->func[func], regaddr, &err_ret);
+                }
+
+                sdio_release_host(gInstance->func[func]);
+        }
+
+        if (err_ret) {
+                sd_err(("bcmsdh_sdmmc: Failed to %s byte F%d:@0x%05x=%02x, Err: %d\n",
+                                        rw ? "Write" : "Read", func, regaddr, *byte, err_ret));
+        }
+
+        return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+extern SDIOH_API_RC
+sdioh_request_word(sdioh_info_t *sd, uint cmd_type, uint rw, uint func, uint addr,
+                                   uint32 *word, uint nbytes)
+{
+        int err_ret = SDIOH_API_RC_FAIL;
+
+        if (func == 0) {
+                sd_err(("%s: Only CMD52 allowed to F0.\n", __FUNCTION__));
+                return SDIOH_API_RC_FAIL;
+        }
+
+        sd_info(("%s: cmd_type=%d, rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+                 __FUNCTION__, cmd_type, rw, func, addr, nbytes));
+
+        DHD_PM_RESUME_WAIT(sdioh_request_word_wait);
+        DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+        /* Claim host controller */
+        sdio_claim_host(gInstance->func[func]);
+
+        if(rw) { /* CMD52 Write */
+                if (nbytes == 4) {
+                        sdio_writel(gInstance->func[func], *word, addr, &err_ret);
+                } else if (nbytes == 2) {
+                        sdio_writew(gInstance->func[func], (*word & 0xFFFF), addr, &err_ret);
+                } else {
+                        sd_err(("%s: Invalid nbytes: %d\n", __FUNCTION__, nbytes));
+                }
+        } else { /* CMD52 Read */
+                if (nbytes == 4) {
+                        *word = sdio_readl(gInstance->func[func], addr, &err_ret);
+                } else if (nbytes == 2) {
+                        *word = sdio_readw(gInstance->func[func], addr, &err_ret) & 0xFFFF;
+                } else {
+                        sd_err(("%s: Invalid nbytes: %d\n", __FUNCTION__, nbytes));
+                }
+        }
+
+        /* Release host controller */
+        sdio_release_host(gInstance->func[func]);
+
+        if (err_ret) {
+                sd_err(("bcmsdh_sdmmc: Failed to %s word, Err: 0x%08x",
+                                        rw ? "Write" : "Read", err_ret));
+        }
+
+        return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+static SDIOH_API_RC
+sdioh_request_packet(sdioh_info_t *sd, uint fix_inc, uint write, uint func,
+                     uint addr, void *pkt)
+{
+        bool fifo = (fix_inc == SDIOH_DATA_FIX);
+        uint32  SGCount = 0;
+        int err_ret = 0;
+
+        void *pnext;
+
+        sd_trace(("%s: Enter\n", __FUNCTION__));
+
+        ASSERT(pkt);
+        DHD_PM_RESUME_WAIT(sdioh_request_packet_wait);
+        DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+
+        /* Claim host controller */
+        sdio_claim_host(gInstance->func[func]);
+        for (pnext = pkt; pnext; pnext = PKTNEXT(sd->osh, pnext)) {
+                uint pkt_len = PKTLEN(sd->osh, pnext);
+                pkt_len += 3;
+                pkt_len &= 0xFFFFFFFC;
+
+#ifdef CONFIG_MMC_MSM7X00A
+                if ((pkt_len % 64) == 32) {
+                        sd_trace(("%s: Rounding up TX packet +=32\n", __FUNCTION__));
+                        pkt_len += 32;
+                }
+#endif /* CONFIG_MMC_MSM7X00A */
+                /* Make sure the packet is aligned properly. If it isn't, then this
+                 * is the fault of sdioh_request_buffer() which is supposed to give
+                 * us something we can work with.
+                 */
+                ASSERT(((uint32)(PKTDATA(sd->osh, pkt)) & DMA_ALIGN_MASK) == 0);
+
+                if ((write) && (!fifo)) {
+                        err_ret = sdio_memcpy_toio(gInstance->func[func], addr,
+                                ((uint8*)PKTDATA(sd->osh, pnext)),
+                                pkt_len);
+                } else if (write) {
+                        err_ret = sdio_memcpy_toio(gInstance->func[func], addr,
+                                ((uint8*)PKTDATA(sd->osh, pnext)),
+                                pkt_len);
+                } else if (fifo) {
+                        err_ret = sdio_readsb(gInstance->func[func],
+                                ((uint8*)PKTDATA(sd->osh, pnext)),
+                                addr,
+                                pkt_len);
+                } else {
+                        err_ret = sdio_memcpy_fromio(gInstance->func[func],
+                                ((uint8*)PKTDATA(sd->osh, pnext)),
+                                addr,
+                                pkt_len);
+                }
+
+                if (err_ret) {
+                        sd_err(("%s: %s FAILED %p[%d], addr=0x%05x, pkt_len=%d, ERR=0x%08x\n",
+                                __FUNCTION__,
+                                (write) ? "TX" : "RX",
+                                pnext, SGCount, addr, pkt_len, err_ret));
+                } else {
+                        sd_trace(("%s: %s xfr'd %p[%d], addr=0x%05x, len=%d\n",
+                                __FUNCTION__,
+                                (write) ? "TX" : "RX",
+                                pnext, SGCount, addr, pkt_len));
+                }
+
+                if (!fifo) {
+                        addr += pkt_len;
+                }
+                SGCount ++;
+
+        }
+
+        /* Release host controller */
+        sdio_release_host(gInstance->func[func]);
+
+        sd_trace(("%s: Exit\n", __FUNCTION__));
+        return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+
+/*
+ * This function takes a buffer or packet, and fixes everything up so that in the
+ * end, a DMA-able packet is created.
+ *
+ * A buffer does not have an associated packet pointer, and may or may not be aligned.
+ * A packet may consist of a single packet, or a packet chain.  If it is a packet chain,
+ * then all the packets in the chain must be properly aligned.  If the packet data is not
+ * aligned, then there may only be one packet, and in this case, it is copied to a new
+ * aligned packet.
+ *
+ */
+extern SDIOH_API_RC
+sdioh_request_buffer(sdioh_info_t *sd, uint pio_dma, uint fix_inc, uint write, uint func,
+                     uint addr, uint reg_width, uint buflen_u, uint8 *buffer, void *pkt)
+{
+        SDIOH_API_RC Status;
+        void *mypkt = NULL;
+
+        sd_trace(("%s: Enter\n", __FUNCTION__));
+
+        DHD_PM_RESUME_WAIT(sdioh_request_buffer_wait);
+        DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+        /* Case 1: we don't have a packet. */
+        if (pkt == NULL) {
+                sd_data(("%s: Creating new %s Packet, len=%d\n",
+                         __FUNCTION__, write ? "TX" : "RX", buflen_u));
+#ifdef DHD_USE_STATIC_BUF
+                if (!(mypkt = PKTGET_STATIC(sd->osh, buflen_u, write ? TRUE : FALSE))) {
+#else
+                if (!(mypkt = PKTGET(sd->osh, buflen_u, write ? TRUE : FALSE))) {
+#endif /* DHD_USE_STATIC_BUF */
+                        sd_err(("%s: PKTGET failed: len %d\n",
+                                   __FUNCTION__, buflen_u));
+                        return SDIOH_API_RC_FAIL;
+                }
+
+                /* For a write, copy the buffer data into the packet. */
+                if (write) {
+                        bcopy(buffer, PKTDATA(sd->osh, mypkt), buflen_u);
+                }
+
+                Status = sdioh_request_packet(sd, fix_inc, write, func, addr, mypkt);
+
+                /* For a read, copy the packet data back to the buffer. */
+                if (!write) {
+                        bcopy(PKTDATA(sd->osh, mypkt), buffer, buflen_u);
+                }
+#ifdef DHD_USE_STATIC_BUF
+                PKTFREE_STATIC(sd->osh, mypkt, write ? TRUE : FALSE);
+#else
+                PKTFREE(sd->osh, mypkt, write ? TRUE : FALSE);
+#endif /* DHD_USE_STATIC_BUF */
+        } else if (((uint32)(PKTDATA(sd->osh, pkt)) & DMA_ALIGN_MASK) != 0) {
+                /* Case 2: We have a packet, but it is unaligned. */
+
+                /* In this case, we cannot have a chain. */
+                ASSERT(PKTNEXT(sd->osh, pkt) == NULL);
+
+                sd_data(("%s: Creating aligned %s Packet, len=%d\n",
+                         __FUNCTION__, write ? "TX" : "RX", PKTLEN(sd->osh, pkt)));
+#ifdef DHD_USE_STATIC_BUF
+                if (!(mypkt = PKTGET_STATIC(sd->osh, PKTLEN(sd->osh, pkt), write ? TRUE : FALSE))) {
+#else
+                if (!(mypkt = PKTGET(sd->osh, PKTLEN(sd->osh, pkt), write ? TRUE : FALSE))) {
+#endif /* DHD_USE_STATIC_BUF */
+                        sd_err(("%s: PKTGET failed: len %d\n",
+                                   __FUNCTION__, PKTLEN(sd->osh, pkt)));
+                        return SDIOH_API_RC_FAIL;
+                }
+
+                /* For a write, copy the buffer data into the packet. */
+                if (write) {
+                        bcopy(PKTDATA(sd->osh, pkt),
+                              PKTDATA(sd->osh, mypkt),
+                              PKTLEN(sd->osh, pkt));
+                }
+
+                Status = sdioh_request_packet(sd, fix_inc, write, func, addr, mypkt);
+
+                /* For a read, copy the packet data back to the buffer. */
+                if (!write) {
+                        bcopy(PKTDATA(sd->osh, mypkt),
+                              PKTDATA(sd->osh, pkt),
+                              PKTLEN(sd->osh, mypkt));
+                }
+#ifdef DHD_USE_STATIC_BUF
+                PKTFREE_STATIC(sd->osh, mypkt, write ? TRUE : FALSE);
+#else
+                PKTFREE(sd->osh, mypkt, write ? TRUE : FALSE);
+#endif /* DHD_USE_STATIC_BUF */
+        } else { /* case 3: We have a packet and it is aligned. */
+                sd_data(("%s: Aligned %s Packet, direct DMA\n",
+                         __FUNCTION__, write ? "Tx" : "Rx"));
+                Status = sdioh_request_packet(sd, fix_inc, write, func, addr, pkt);
+        }
+
+        return (Status);
+}
+
+/* this function performs "abort" for both of host & device */
+extern int
+sdioh_abort(sdioh_info_t *sd, uint func)
+{
+#if defined(MMC_SDIO_ABORT)
+        char t_func = (char) func;
+#endif /* defined(MMC_SDIO_ABORT) */
+        sd_trace(("%s: Enter\n", __FUNCTION__));
+
+#if defined(MMC_SDIO_ABORT)
+        /* issue abort cmd52 command through F1 */
+        sdioh_request_byte(sd, SD_IO_OP_WRITE, SDIO_FUNC_0, SDIOD_CCCR_IOABORT, &t_func);
+#endif /* defined(MMC_SDIO_ABORT) */
+
+        sd_trace(("%s: Exit\n", __FUNCTION__));
+        return SDIOH_API_RC_SUCCESS;
+}
+
+/* Reset and re-initialize the device */
+int sdioh_sdio_reset(sdioh_info_t *si)
+{
+        sd_trace(("%s: Enter\n", __FUNCTION__));
+        sd_trace(("%s: Exit\n", __FUNCTION__));
+        return SDIOH_API_RC_SUCCESS;
+}
+
+/* Disable device interrupt */
+void
+sdioh_sdmmc_devintr_off(sdioh_info_t *sd)
+{
+        sd_trace(("%s: %d\n", __FUNCTION__, sd->use_client_ints));
+        sd->intmask &= ~CLIENT_INTR;
+}
+
+/* Enable device interrupt */
+void
+sdioh_sdmmc_devintr_on(sdioh_info_t *sd)
+{
+        sd_trace(("%s: %d\n", __FUNCTION__, sd->use_client_ints));
+        sd->intmask |= CLIENT_INTR;
+}
+
+/* Read client card reg */
+int
+sdioh_sdmmc_card_regread(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data)
+{
+
+        if ((func == 0) || (regsize == 1)) {
+                uint8 temp = 0;
+
+                sdioh_request_byte(sd, SDIOH_READ, func, regaddr, &temp);
+                *data = temp;
+                *data &= 0xff;
+                sd_data(("%s: byte read data=0x%02x\n",
+                         __FUNCTION__, *data));
+        } else {
+                sdioh_request_word(sd, 0, SDIOH_READ, func, regaddr, data, regsize);
+                if (regsize == 2)
+                        *data &= 0xffff;
+
+                sd_data(("%s: word read data=0x%08x\n",
+                         __FUNCTION__, *data));
+        }
+
+        return SUCCESS;
+}
+
+#if !defined(OOB_INTR_ONLY)
+/* bcmsdh_sdmmc interrupt handler */
+static void IRQHandler(struct sdio_func *func)
+{
+        sdioh_info_t *sd;
+
+        sd_trace(("bcmsdh_sdmmc: ***IRQHandler\n"));
+        sd = gInstance->sd;
+
+        ASSERT(sd != NULL);
+        sdio_release_host(gInstance->func[0]);
+
+        if (sd->use_client_ints) {
+                sd->intrcount++;
+                ASSERT(sd->intr_handler);
+                ASSERT(sd->intr_handler_arg);
+                (sd->intr_handler)(sd->intr_handler_arg);
+        } else {
+                sd_err(("bcmsdh_sdmmc: ***IRQHandler\n"));
+
+                sd_err(("%s: Not ready for intr: enabled %d, handler %p\n",
+                        __FUNCTION__, sd->client_intr_enabled, sd->intr_handler));
+        }
+
+        sdio_claim_host(gInstance->func[0]);
+}
+
+/* bcmsdh_sdmmc interrupt handler for F2 (dummy handler) */
+static void IRQHandlerF2(struct sdio_func *func)
+{
+        sdioh_info_t *sd;
+
+        sd_trace(("bcmsdh_sdmmc: ***IRQHandlerF2\n"));
+
+        sd = gInstance->sd;
+
+        ASSERT(sd != NULL);
+}
+#endif /* !defined(OOB_INTR_ONLY) */
+
+#ifdef NOTUSED
+/* Write client card reg */
+static int
+sdioh_sdmmc_card_regwrite(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 data)
+{
+
+        if ((func == 0) || (regsize == 1)) {
+                uint8 temp;
+
+                temp = data & 0xff;
+                sdioh_request_byte(sd, SDIOH_READ, func, regaddr, &temp);
+                sd_data(("%s: byte write data=0x%02x\n",
+                         __FUNCTION__, data));
+        } else {
+                if (regsize == 2)
+                        data &= 0xffff;
+
+                sdioh_request_word(sd, 0, SDIOH_READ, func, regaddr, &data, regsize);
+
+                sd_data(("%s: word write data=0x%08x\n",
+                         __FUNCTION__, data));
+        }
+
+        return SUCCESS;
+}
+#endif /* NOTUSED */
+
+int
+sdioh_start(sdioh_info_t *si, int stage)
+{
+        int ret;
+        sdioh_info_t *sd = gInstance->sd;
+
+        /* Need to do this stages as we can't enable the interrupt till
+                downloading of the firmware is complete, other wise polling
+                sdio access will come in way
+        */
+        if (gInstance->func[0]) {
+                        if (stage == 0) {
+                /* Since the power to the chip is killed, we will have
+                        re enumerate the device again. Set the block size
+                        and enable the fucntion 1 for in preparation for
+                        downloading the code
+                */
+                /* sdio_reset_comm() - has been fixed in latest kernel/msm.git for Linux
+                   2.6.27. The implementation prior to that is buggy, and needs broadcom's
+                   patch for it
+                */
+                if ((ret = sdio_reset_comm(gInstance->func[0]->card)))
+                        sd_err(("%s Failed, error = %d\n", __FUNCTION__, ret));
+                else {
+                        sd->num_funcs = 2;
+                        sd->sd_blockmode = TRUE;
+                        sd->use_client_ints = TRUE;
+                        sd->client_block_size[0] = 64;
+
+                        /* Claim host controller */
+                        sdio_claim_host(gInstance->func[1]);
+
+                        sd->client_block_size[1] = 64;
+                        if (sdio_set_block_size(gInstance->func[1], 64)) {
+                                sd_err(("bcmsdh_sdmmc: Failed to set F1 blocksize\n"));
+                        }
+
+                        /* Release host controller F1 */
+                        sdio_release_host(gInstance->func[1]);
+
+                        if (gInstance->func[2]) {
+                                /* Claim host controller F2 */
+                                sdio_claim_host(gInstance->func[2]);
+
+                                sd->client_block_size[2] = sd_f2_blocksize;
+                                if (sdio_set_block_size(gInstance->func[2],
+                                        sd_f2_blocksize)) {
+                                        sd_err(("bcmsdh_sdmmc: Failed to set F2 "
+                                                "blocksize to %d\n", sd_f2_blocksize));
+                                }
+
+                                /* Release host controller F2 */
+                                sdio_release_host(gInstance->func[2]);
+                        }
+
+                        sdioh_sdmmc_card_enablefuncs(sd);
+                        }
+                } else {
+#if !defined(OOB_INTR_ONLY)
+                        sdio_claim_host(gInstance->func[0]);
+                        sdio_claim_irq(gInstance->func[2], IRQHandlerF2);
+                        sdio_claim_irq(gInstance->func[1], IRQHandler);
+                        sdio_release_host(gInstance->func[0]);
+#else /* defined(OOB_INTR_ONLY) */
+#if defined(HW_OOB)
+                        sdioh_enable_func_intr();
+#endif
+                        bcmsdh_oob_intr_set(TRUE);
+#endif /* !defined(OOB_INTR_ONLY) */
+                }
+        }
+        else
+                sd_err(("%s Failed\n", __FUNCTION__));
+
+        return (0);
+}
+
+int
+sdioh_stop(sdioh_info_t *si)
+{
+        /* MSM7201A Android sdio stack has bug with interrupt
+                So internaly within SDIO stack they are polling
+                which cause issue when device is turned off. So
+                unregister interrupt with SDIO stack to stop the
+                polling
+        */
+        if (gInstance->func[0]) {
+#if !defined(OOB_INTR_ONLY)
+                sdio_claim_host(gInstance->func[0]);
+                sdio_release_irq(gInstance->func[1]);
+                sdio_release_irq(gInstance->func[2]);
+                sdio_release_host(gInstance->func[0]);
+#else /* defined(OOB_INTR_ONLY) */
+#if defined(HW_OOB)
+                sdioh_disable_func_intr(0);
+#endif
+                bcmsdh_oob_intr_set(FALSE);
+#endif /* !defined(OOB_INTR_ONLY) */
+        }
+        else
+                sd_err(("%s Failed\n", __FUNCTION__));
+        return (0);
+}
+
+int
+sdioh_waitlockfree(sdioh_info_t *sd)
+{
+        return (1);
+}
diff --git a/drivers/net/wireless/bcmdhd/bcmsdh_sdmmc_linux.c b/drivers/net/wireless/bcmdhd/bcmsdh_sdmmc_linux.c
new file mode 100644
index 00000000000..1a370862b33
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/bcmsdh_sdmmc_linux.c
@@ -0,0 +1,350 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdh_sdmmc_linux.c,v 1.8.6.2 2011-02-01 18:38:36 Exp $
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <sdio.h>       /* SDIO Device and Protocol Specs */
+#include <bcmsdbus.h>   /* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>    /* to get msglevel bit values */
+
+#include <linux/sched.h>        /* request_irq() */
+
+#include <linux/mmc/core.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+
+#if !defined(SDIO_VENDOR_ID_BROADCOM)
+#define SDIO_VENDOR_ID_BROADCOM         0x02d0
+#endif /* !defined(SDIO_VENDOR_ID_BROADCOM) */
+
+#define SDIO_DEVICE_ID_BROADCOM_DEFAULT 0x0000
+
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4325_SDGWB)
+#define SDIO_DEVICE_ID_BROADCOM_4325_SDGWB      0x0492  /* BCM94325SDGWB */
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4325_SDGWB) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4325)
+#define SDIO_DEVICE_ID_BROADCOM_4325    0x0493
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4325) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4319)
+#define SDIO_DEVICE_ID_BROADCOM_4319    0x4319
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4319) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4330)
+#define SDIO_DEVICE_ID_BROADCOM_4330    0x4330
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4330) */
+
+#include <bcmsdh_sdmmc.h>
+
+#include <dhd_dbg.h>
+
+#ifdef WL_CFG80211
+extern void wl_cfg80211_set_sdio_func(void *func);
+#endif
+
+extern void sdioh_sdmmc_devintr_off(sdioh_info_t *sd);
+extern void sdioh_sdmmc_devintr_on(sdioh_info_t *sd);
+extern int dhd_os_check_wakelock(void *dhdp);
+extern int dhd_os_check_if_up(void *dhdp);
+extern void *bcmsdh_get_drvdata(void);
+
+int sdio_function_init(void);
+void sdio_function_cleanup(void);
+
+#define DESCRIPTION "bcmsdh_sdmmc Driver"
+#define AUTHOR "Broadcom Corporation"
+
+/* module param defaults */
+static int clockoverride = 0;
+
+module_param(clockoverride, int, 0644);
+MODULE_PARM_DESC(clockoverride, "SDIO card clock override");
+
+PBCMSDH_SDMMC_INSTANCE gInstance;
+
+/* Maximum number of bcmsdh_sdmmc devices supported by driver */
+#define BCMSDH_SDMMC_MAX_DEVICES 1
+
+extern int bcmsdh_probe_bcmdhd(struct device *dev);
+extern int bcmsdh_remove_bcmdhd(struct device *dev);
+
+extern volatile bool dhd_mmc_suspend;
+
+static int bcmsdh_sdmmc_probe(struct sdio_func *func,
+                              const struct sdio_device_id *id)
+{
+        int ret = 0;
+        static struct sdio_func sdio_func_0;
+        sd_trace(("bcmsdh_sdmmc: %s Enter\n", __FUNCTION__));
+        sd_trace(("sdio_bcmsdh: func->class=%x\n", func->class));
+        sd_trace(("sdio_vendor: 0x%04x\n", func->vendor));
+        sd_trace(("sdio_device: 0x%04x\n", func->device));
+        sd_trace(("Function#: 0x%04x\n", func->num));
+
+        if (func->num == 1) {
+                sdio_func_0.num = 0;
+                sdio_func_0.card = func->card;
+                gInstance->func[0] = &sdio_func_0;
+                if(func->device == 0x4) { /* 4318 */
+                        gInstance->func[2] = NULL;
+                        sd_trace(("NIC found, calling bcmsdh_probe_bcmdhd...\n"));
+                        ret = bcmsdh_probe_bcmdhd(&func->dev);
+                }
+        }
+
+        gInstance->func[func->num] = func;
+
+        if (func->num == 2) {
+#ifdef WL_CFG80211
+                wl_cfg80211_set_sdio_func(func);
+#endif
+                sd_trace(("F2 found, calling bcmsdh_probe_bcmdhd...\n"));
+                ret = bcmsdh_probe_bcmdhd(&func->dev);
+        }
+
+        return ret;
+}
+
+static void bcmsdh_sdmmc_remove(struct sdio_func *func)
+{
+        sd_trace(("bcmsdh_sdmmc: %s Enter\n", __FUNCTION__));
+        sd_info(("sdio_bcmsdh: func->class=%x\n", func->class));
+        sd_info(("sdio_vendor: 0x%04x\n", func->vendor));
+        sd_info(("sdio_device: 0x%04x\n", func->device));
+        sd_info(("Function#: 0x%04x\n", func->num));
+
+        if (func->num == 2) {
+                sd_trace(("F2 found, calling bcmsdh_remove_bcmdhd...\n"));
+                bcmsdh_remove_bcmdhd(&func->dev);
+        } else if (func->num == 1) {
+                sdio_claim_host(func);
+                sdio_disable_func(func);
+                sdio_release_host(func);
+                gInstance->func[1] = NULL;
+        }
+}
+
+/* devices we support, null terminated */
+static const struct sdio_device_id bcmsdh_sdmmc_ids[] = {
+        { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_DEFAULT) },
+        { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4325_SDGWB) },
+        { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4325) },
+        { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4319) },
+        { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330) },
+        { /* end: all zeroes */                         },
+};
+
+MODULE_DEVICE_TABLE(sdio, bcmsdh_sdmmc_ids);
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM)
+static int bcmsdh_sdmmc_suspend(struct device *pdev)
+{
+        struct sdio_func *func = dev_to_sdio_func(pdev);
+        mmc_pm_flag_t sdio_flags;
+        int ret = 0;
+
+        if (func->num != 2)
+                return 0;
+        if (dhd_os_check_wakelock(bcmsdh_get_drvdata()))
+                return -EBUSY;
+#if defined(OOB_INTR_ONLY)
+        bcmsdh_oob_intr_set(0);
+#endif
+        smp_mb();
+
+        sdio_flags = sdio_get_host_pm_caps(func);
+
+        if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
+                sd_err(("can't keep power while host "
+                                "is suspended\n", __FUNCTION__));
+                ret = -EINVAL;
+                goto out;
+        }
+
+        /* keep power while host suspended */
+        ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
+        if (ret) {
+                sd_err(("error while trying to keep power\n", __FUNCTION__));
+                goto out;
+        }
+
+        dhd_mmc_suspend = TRUE;
+
+out:
+        return ret;
+}
+
+static int bcmsdh_sdmmc_resume(struct device *pdev)
+{
+        struct sdio_func *func = dev_to_sdio_func(pdev);
+
+        if (func->num != 2)
+                return 0;
+        dhd_mmc_suspend = FALSE;
+#if defined(OOB_INTR_ONLY)
+        if (dhd_os_check_if_up(bcmsdh_get_drvdata()))
+                bcmsdh_oob_intr_set(1);
+#endif
+        smp_mb();
+        return 0;
+}
+
+static const struct dev_pm_ops bcmsdh_sdmmc_pm_ops = {
+        .suspend        = bcmsdh_sdmmc_suspend,
+        .resume         = bcmsdh_sdmmc_resume,
+};
+#endif
+
+static struct sdio_driver bcmsdh_sdmmc_driver = {
+        .probe          = bcmsdh_sdmmc_probe,
+        .remove         = bcmsdh_sdmmc_remove,
+        .name           = "bcmsdh_sdmmc",
+        .id_table       = bcmsdh_sdmmc_ids,
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM)
+        .drv = {
+                .pm     = &bcmsdh_sdmmc_pm_ops,
+        },
+#endif
+};
+
+struct sdos_info {
+        sdioh_info_t *sd;
+        spinlock_t lock;
+};
+
+
+int
+sdioh_sdmmc_osinit(sdioh_info_t *sd)
+{
+        struct sdos_info *sdos;
+
+        sdos = (struct sdos_info*)MALLOC(sd->osh, sizeof(struct sdos_info));
+        sd->sdos_info = (void*)sdos;
+        if (sdos == NULL)
+                return BCME_NOMEM;
+
+        sdos->sd = sd;
+        spin_lock_init(&sdos->lock);
+        return BCME_OK;
+}
+
+void
+sdioh_sdmmc_osfree(sdioh_info_t *sd)
+{
+        struct sdos_info *sdos;
+        ASSERT(sd && sd->sdos_info);
+
+        sdos = (struct sdos_info *)sd->sdos_info;
+        MFREE(sd->osh, sdos, sizeof(struct sdos_info));
+}
+
+/* Interrupt enable/disable */
+SDIOH_API_RC
+sdioh_interrupt_set(sdioh_info_t *sd, bool enable)
+{
+        ulong flags;
+        struct sdos_info *sdos;
+
+        sd_trace(("%s: %s\n", __FUNCTION__, enable ? "Enabling" : "Disabling"));
+
+        sdos = (struct sdos_info *)sd->sdos_info;
+        ASSERT(sdos);
+
+#if !defined(OOB_INTR_ONLY)
+        if (enable && !(sd->intr_handler && sd->intr_handler_arg)) {
+                sd_err(("%s: no handler registered, will not enable\n", __FUNCTION__));
+                return SDIOH_API_RC_FAIL;
+        }
+#endif /* !defined(OOB_INTR_ONLY) */
+
+        /* Ensure atomicity for enable/disable calls */
+        spin_lock_irqsave(&sdos->lock, flags);
+
+        sd->client_intr_enabled = enable;
+        if (enable) {
+                sdioh_sdmmc_devintr_on(sd);
+        } else {
+                sdioh_sdmmc_devintr_off(sd);
+        }
+
+        spin_unlock_irqrestore(&sdos->lock, flags);
+
+        return SDIOH_API_RC_SUCCESS;
+}
+
+
+#ifdef BCMSDH_MODULE
+static int __init
+bcmsdh_module_init(void)
+{
+        int error = 0;
+        sdio_function_init();
+        return error;
+}
+
+static void __exit
+bcmsdh_module_cleanup(void)
+{
+        sdio_function_cleanup();
+}
+
+module_init(bcmsdh_module_init);
+module_exit(bcmsdh_module_cleanup);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION(DESCRIPTION);
+MODULE_AUTHOR(AUTHOR);
+
+#endif /* BCMSDH_MODULE */
+/*
+ * module init
+*/
+int sdio_function_init(void)
+{
+        int error = 0;
+        sd_trace(("bcmsdh_sdmmc: %s Enter\n", __FUNCTION__));
+
+        gInstance = kzalloc(sizeof(BCMSDH_SDMMC_INSTANCE), GFP_KERNEL);
+        if (!gInstance)
+                return -ENOMEM;
+
+        error = sdio_register_driver(&bcmsdh_sdmmc_driver);
+
+        return error;
+}
+
+/*
+ * module cleanup
+*/
+void sdio_function_cleanup(void)
+{
+        sd_trace(("%s Enter\n", __FUNCTION__));
+
+
+        sdio_unregister_driver(&bcmsdh_sdmmc_driver);
+
+        if (gInstance)
+                kfree(gInstance);
+}
diff --git a/drivers/net/wireless/bcmdhd/bcmutils.c b/drivers/net/wireless/bcmdhd/bcmutils.c
new file mode 100644
index 00000000000..fbdd7cd2d19
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/bcmutils.c
@@ -0,0 +1,1967 @@
+/*
+ * Driver O/S-independent utility routines
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ * $Id: bcmutils.c,v 1.277.2.18 2011-01-26 02:32:08 Exp $
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <stdarg.h>
+
+#ifdef BCMDRIVER
+
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+
+#else /* !BCMDRIVER */
+
+#include <stdio.h>
+#include <string.h>
+#include <bcmutils.h>
+
+#if defined(BCMEXTSUP)
+#include <bcm_osl.h>
+#endif
+
+
+#endif /* !BCMDRIVER */
+
+#include <bcmendian.h>
+#include <bcmdevs.h>
+#include <proto/ethernet.h>
+#include <proto/vlan.h>
+#include <proto/bcmip.h>
+#include <proto/802.1d.h>
+#include <proto/802.11.h>
+
+void *_bcmutils_dummy_fn = NULL;
+
+#ifdef BCMDRIVER
+
+
+
+/* copy a pkt buffer chain into a buffer */
+uint
+pktcopy(osl_t *osh, void *p, uint offset, int len, uchar *buf)
+{
+        uint n, ret = 0;
+
+        if (len < 0)
+                len = 4096; /* "infinite" */
+
+        /* skip 'offset' bytes */
+        for (; p && offset; p = PKTNEXT(osh, p)) {
+                if (offset < (uint)PKTLEN(osh, p))
+                        break;
+                offset -= PKTLEN(osh, p);
+        }
+
+        if (!p)
+                return 0;
+
+        /* copy the data */
+        for (; p && len; p = PKTNEXT(osh, p)) {
+                n = MIN((uint)PKTLEN(osh, p) - offset, (uint)len);
+                bcopy(PKTDATA(osh, p) + offset, buf, n);
+                buf += n;
+                len -= n;
+                ret += n;
+                offset = 0;
+        }
+
+        return ret;
+}
+
+/* copy a buffer into a pkt buffer chain */
+uint
+pktfrombuf(osl_t *osh, void *p, uint offset, int len, uchar *buf)
+{
+        uint n, ret = 0;
+
+        /* skip 'offset' bytes */
+        for (; p && offset; p = PKTNEXT(osh, p)) {
+                if (offset < (uint)PKTLEN(osh, p))
+                        break;
+                offset -= PKTLEN(osh, p);
+        }
+
+        if (!p)
+                return 0;
+
+        /* copy the data */
+        for (; p && len; p = PKTNEXT(osh, p)) {
+                n = MIN((uint)PKTLEN(osh, p) - offset, (uint)len);
+                bcopy(buf, PKTDATA(osh, p) + offset, n);
+                buf += n;
+                len -= n;
+                ret += n;
+                offset = 0;
+        }
+
+        return ret;
+}
+
+
+
+/* return total length of buffer chain */
+uint BCMFASTPATH
+pkttotlen(osl_t *osh, void *p)
+{
+        uint total;
+
+        total = 0;
+        for (; p; p = PKTNEXT(osh, p))
+                total += PKTLEN(osh, p);
+        return (total);
+}
+
+/* return the last buffer of chained pkt */
+void *
+pktlast(osl_t *osh, void *p)
+{
+        for (; PKTNEXT(osh, p); p = PKTNEXT(osh, p))
+                ;
+
+        return (p);
+}
+
+/* count segments of a chained packet */
+uint BCMFASTPATH
+pktsegcnt(osl_t *osh, void *p)
+{
+        uint cnt;
+
+        for (cnt = 0; p; p = PKTNEXT(osh, p))
+                cnt++;
+
+        return cnt;
+}
+
+
+/*
+ * osl multiple-precedence packet queue
+ * hi_prec is always >= the number of the highest non-empty precedence
+ */
+void * BCMFASTPATH
+pktq_penq(struct pktq *pq, int prec, void *p)
+{
+        struct pktq_prec *q;
+
+        ASSERT(prec >= 0 && prec < pq->num_prec);
+        ASSERT(PKTLINK(p) == NULL);         /* queueing chains not allowed */
+
+        ASSERT(!pktq_full(pq));
+        ASSERT(!pktq_pfull(pq, prec));
+
+        q = &pq->q[prec];
+
+        if (q->head)
+                PKTSETLINK(q->tail, p);
+        else
+                q->head = p;
+
+        q->tail = p;
+        q->len++;
+
+        pq->len++;
+
+        if (pq->hi_prec < prec)
+                pq->hi_prec = (uint8)prec;
+
+        return p;
+}
+
+void * BCMFASTPATH
+pktq_penq_head(struct pktq *pq, int prec, void *p)
+{
+        struct pktq_prec *q;
+
+        ASSERT(prec >= 0 && prec < pq->num_prec);
+        ASSERT(PKTLINK(p) == NULL);         /* queueing chains not allowed */
+
+        ASSERT(!pktq_full(pq));
+        ASSERT(!pktq_pfull(pq, prec));
+
+        q = &pq->q[prec];
+
+        if (q->head == NULL)
+                q->tail = p;
+
+        PKTSETLINK(p, q->head);
+        q->head = p;
+        q->len++;
+
+        pq->len++;
+
+        if (pq->hi_prec < prec)
+                pq->hi_prec = (uint8)prec;
+
+        return p;
+}
+
+void * BCMFASTPATH
+pktq_pdeq(struct pktq *pq, int prec)
+{
+        struct pktq_prec *q;
+        void *p;
+
+        ASSERT(prec >= 0 && prec < pq->num_prec);
+
+        q = &pq->q[prec];
+
+        if ((p = q->head) == NULL)
+                return NULL;
+
+        if ((q->head = PKTLINK(p)) == NULL)
+                q->tail = NULL;
+
+        q->len--;
+
+        pq->len--;
+
+        PKTSETLINK(p, NULL);
+
+        return p;
+}
+
+void * BCMFASTPATH
+pktq_pdeq_tail(struct pktq *pq, int prec)
+{
+        struct pktq_prec *q;
+        void *p, *prev;
+
+        ASSERT(prec >= 0 && prec < pq->num_prec);
+
+        q = &pq->q[prec];
+
+        if ((p = q->head) == NULL)
+                return NULL;
+
+        for (prev = NULL; p != q->tail; p = PKTLINK(p))
+                prev = p;
+
+        if (prev)
+                PKTSETLINK(prev, NULL);
+        else
+                q->head = NULL;
+
+        q->tail = prev;
+        q->len--;
+
+        pq->len--;
+
+        return p;
+}
+
+void
+pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir, ifpkt_cb_t fn, int arg)
+{
+        struct pktq_prec *q;
+        void *p, *prev = NULL;
+
+        q = &pq->q[prec];
+        p = q->head;
+        while (p) {
+                if (fn == NULL || (*fn)(p, arg)) {
+                        bool head = (p == q->head);
+                        if (head)
+                                q->head = PKTLINK(p);
+                        else
+                                PKTSETLINK(prev, PKTLINK(p));
+                        PKTSETLINK(p, NULL);
+                        PKTFREE(osh, p, dir);
+                        q->len--;
+                        pq->len--;
+                        p = (head ? q->head : PKTLINK(prev));
+                } else {
+                        prev = p;
+                        p = PKTLINK(p);
+                }
+        }
+
+        if (q->head == NULL) {
+                ASSERT(q->len == 0);
+                q->tail = NULL;
+        }
+}
+
+bool BCMFASTPATH
+pktq_pdel(struct pktq *pq, void *pktbuf, int prec)
+{
+        struct pktq_prec *q;
+        void *p;
+
+        ASSERT(prec >= 0 && prec < pq->num_prec);
+
+        if (!pktbuf)
+                return FALSE;
+
+        q = &pq->q[prec];
+
+        if (q->head == pktbuf) {
+                if ((q->head = PKTLINK(pktbuf)) == NULL)
+                        q->tail = NULL;
+        } else {
+                for (p = q->head; p && PKTLINK(p) != pktbuf; p = PKTLINK(p))
+                        ;
+                if (p == NULL)
+                        return FALSE;
+
+                PKTSETLINK(p, PKTLINK(pktbuf));
+                if (q->tail == pktbuf)
+                        q->tail = p;
+        }
+
+        q->len--;
+        pq->len--;
+        PKTSETLINK(pktbuf, NULL);
+        return TRUE;
+}
+
+void
+pktq_init(struct pktq *pq, int num_prec, int max_len)
+{
+        int prec;
+
+        ASSERT(num_prec > 0 && num_prec <= PKTQ_MAX_PREC);
+
+        /* pq is variable size; only zero out what's requested */
+        bzero(pq, OFFSETOF(struct pktq, q) + (sizeof(struct pktq_prec) * num_prec));
+
+        pq->num_prec = (uint16)num_prec;
+
+        pq->max = (uint16)max_len;
+
+        for (prec = 0; prec < num_prec; prec++)
+                pq->q[prec].max = pq->max;
+}
+
+void * BCMFASTPATH
+pktq_deq(struct pktq *pq, int *prec_out)
+{
+        struct pktq_prec *q;
+        void *p;
+        int prec;
+
+        if (pq->len == 0)
+                return NULL;
+
+        while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+                pq->hi_prec--;
+
+        q = &pq->q[prec];
+
+        if ((p = q->head) == NULL)
+                return NULL;
+
+        if ((q->head = PKTLINK(p)) == NULL)
+                q->tail = NULL;
+
+        q->len--;
+
+        pq->len--;
+
+        if (prec_out)
+                *prec_out = prec;
+
+        PKTSETLINK(p, NULL);
+
+        return p;
+}
+
+void * BCMFASTPATH
+pktq_deq_tail(struct pktq *pq, int *prec_out)
+{
+        struct pktq_prec *q;
+        void *p, *prev;
+        int prec;
+
+        if (pq->len == 0)
+                return NULL;
+
+        for (prec = 0; prec < pq->hi_prec; prec++)
+                if (pq->q[prec].head)
+                        break;
+
+        q = &pq->q[prec];
+
+        if ((p = q->head) == NULL)
+                return NULL;
+
+        for (prev = NULL; p != q->tail; p = PKTLINK(p))
+                prev = p;
+
+        if (prev)
+                PKTSETLINK(prev, NULL);
+        else
+                q->head = NULL;
+
+        q->tail = prev;
+        q->len--;
+
+        pq->len--;
+
+        if (prec_out)
+                *prec_out = prec;
+
+        PKTSETLINK(p, NULL);
+
+        return p;
+}
+
+void *
+pktq_peek(struct pktq *pq, int *prec_out)
+{
+        int prec;
+
+        if (pq->len == 0)
+                return NULL;
+
+        while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+                pq->hi_prec--;
+
+        if (prec_out)
+                *prec_out = prec;
+
+        return (pq->q[prec].head);
+}
+
+void *
+pktq_peek_tail(struct pktq *pq, int *prec_out)
+{
+        int prec;
+
+        if (pq->len == 0)
+                return NULL;
+
+        for (prec = 0; prec < pq->hi_prec; prec++)
+                if (pq->q[prec].head)
+                        break;
+
+        if (prec_out)
+                *prec_out = prec;
+
+        return (pq->q[prec].tail);
+}
+
+void
+pktq_flush(osl_t *osh, struct pktq *pq, bool dir, ifpkt_cb_t fn, int arg)
+{
+        int prec;
+        for (prec = 0; prec < pq->num_prec; prec++)
+                pktq_pflush(osh, pq, prec, dir, fn, arg);
+        if (fn == NULL)
+                ASSERT(pq->len == 0);
+}
+
+/* Return sum of lengths of a specific set of precedences */
+int
+pktq_mlen(struct pktq *pq, uint prec_bmp)
+{
+        int prec, len;
+
+        len = 0;
+
+        for (prec = 0; prec <= pq->hi_prec; prec++)
+                if (prec_bmp & (1 << prec))
+                        len += pq->q[prec].len;
+
+        return len;
+}
+
+/* Priority dequeue from a specific set of precedences */
+void * BCMFASTPATH
+pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out)
+{
+        struct pktq_prec *q;
+        void *p;
+        int prec;
+
+        if (pq->len == 0)
+                return NULL;
+
+        while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+                pq->hi_prec--;
+
+        while ((prec_bmp & (1 << prec)) == 0 || pq->q[prec].head == NULL)
+                if (prec-- == 0)
+                        return NULL;
+
+        q = &pq->q[prec];
+
+        if ((p = q->head) == NULL)
+                return NULL;
+
+        if ((q->head = PKTLINK(p)) == NULL)
+                q->tail = NULL;
+
+        q->len--;
+
+        if (prec_out)
+                *prec_out = prec;
+
+        pq->len--;
+
+        PKTSETLINK(p, NULL);
+
+        return p;
+}
+
+#endif /* BCMDRIVER */
+
+const unsigned char bcm_ctype[] = {
+
+        _BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,            /* 0-7 */
+        _BCM_C, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C,
+        _BCM_C, /* 8-15 */
+        _BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,            /* 16-23 */
+        _BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,            /* 24-31 */
+        _BCM_S|_BCM_SP,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,        /* 32-39 */
+        _BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,            /* 40-47 */
+        _BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,            /* 48-55 */
+        _BCM_D,_BCM_D,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,            /* 56-63 */
+        _BCM_P, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X,
+        _BCM_U|_BCM_X, _BCM_U, /* 64-71 */
+        _BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,            /* 72-79 */
+        _BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,            /* 80-87 */
+        _BCM_U,_BCM_U,_BCM_U,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,            /* 88-95 */
+        _BCM_P, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X,
+        _BCM_L|_BCM_X, _BCM_L, /* 96-103 */
+        _BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 104-111 */
+        _BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 112-119 */
+        _BCM_L,_BCM_L,_BCM_L,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_C, /* 120-127 */
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,     /* 128-143 */
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,     /* 144-159 */
+        _BCM_S|_BCM_SP, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
+        _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, /* 160-175 */
+        _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
+        _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, /* 176-191 */
+        _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U,
+        _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, /* 192-207 */
+        _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_P, _BCM_U, _BCM_U, _BCM_U,
+        _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_L, /* 208-223 */
+        _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L,
+        _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, /* 224-239 */
+        _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_P, _BCM_L, _BCM_L, _BCM_L,
+        _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L /* 240-255 */
+};
+
+ulong
+bcm_strtoul(char *cp, char **endp, uint base)
+{
+        ulong result, last_result = 0, value;
+        bool minus;
+
+        minus = FALSE;
+
+        while (bcm_isspace(*cp))
+                cp++;
+
+        if (cp[0] == '+')
+                cp++;
+        else if (cp[0] == '-') {
+                minus = TRUE;
+                cp++;
+        }
+
+        if (base == 0) {
+                if (cp[0] == '0') {
+                        if ((cp[1] == 'x') || (cp[1] == 'X')) {
+                                base = 16;
+                                cp = &cp[2];
+                        } else {
+                                base = 8;
+                                cp = &cp[1];
+                        }
+                } else
+                        base = 10;
+        } else if (base == 16 && (cp[0] == '0') && ((cp[1] == 'x') || (cp[1] == 'X'))) {
+                cp = &cp[2];
+        }
+
+        result = 0;
+
+        while (bcm_isxdigit(*cp) &&
+                (value = bcm_isdigit(*cp) ? *cp-'0' : bcm_toupper(*cp)-'A'+10) < base)
+        {
+                result = result*base + value;
+                /* Detected overflow */
+                if (result < last_result && !minus)
+                        return (ulong)-1;
+                last_result = result;
+                cp++;
+        }
+
+        if (minus)
+                result = (ulong)(-(long)result);
+
+        if (endp)
+                *endp = (char *)cp;
+
+        return (result);
+}
+
+int
+bcm_atoi(char *s)
+{
+        return (int)bcm_strtoul(s, NULL, 10);
+}
+
+/* return pointer to location of substring 'needle' in 'haystack' */
+char*
+bcmstrstr(char *haystack, char *needle)
+{
+        int len, nlen;
+        int i;
+
+        if ((haystack == NULL) || (needle == NULL))
+                return (haystack);
+
+        nlen = strlen(needle);
+        len = strlen(haystack) - nlen + 1;
+
+        for (i = 0; i < len; i++)
+                if (memcmp(needle, &haystack[i], nlen) == 0)
+                        return (&haystack[i]);
+        return (NULL);
+}
+
+char*
+bcmstrcat(char *dest, const char *src)
+{
+        char *p;
+
+        p = dest + strlen(dest);
+
+        while ((*p++ = *src++) != '\0')
+                ;
+
+        return (dest);
+}
+
+char*
+bcmstrncat(char *dest, const char *src, uint size)
+{
+        char *endp;
+        char *p;
+
+        p = dest + strlen(dest);
+        endp = p + size;
+
+        while (p != endp && (*p++ = *src++) != '\0')
+                ;
+
+        return (dest);
+}
+
+
+/****************************************************************************
+* Function:   bcmstrtok
+*
+* Purpose:
+*  Tokenizes a string. This function is conceptually similiar to ANSI C strtok(),
+*  but allows strToken() to be used by different strings or callers at the same
+*  time. Each call modifies '*string' by substituting a NULL character for the
+*  first delimiter that is encountered, and updates 'string' to point to the char
+*  after the delimiter. Leading delimiters are skipped.
+*
+* Parameters:
+*  string      (mod) Ptr to string ptr, updated by token.
+*  delimiters  (in)  Set of delimiter characters.
+*  tokdelim    (out) Character that delimits the returned token. (May
+*                    be set to NULL if token delimiter is not required).
+*
+* Returns:  Pointer to the next token found. NULL when no more tokens are found.
+*****************************************************************************
+*/
+char *
+bcmstrtok(char **string, const char *delimiters, char *tokdelim)
+{
+        unsigned char *str;
+        unsigned long map[8];
+        int count;
+        char *nextoken;
+
+        if (tokdelim != NULL) {
+                /* Prime the token delimiter */
+                *tokdelim = '\0';
+        }
+
+        /* Clear control map */
+        for (count = 0; count < 8; count++) {
+                map[count] = 0;
+        }
+
+        /* Set bits in delimiter table */
+        do {
+                map[*delimiters >> 5] |= (1 << (*delimiters & 31));
+        }
+        while (*delimiters++);
+
+        str = (unsigned char*)*string;
+
+        /* Find beginning of token (skip over leading delimiters). Note that
+         * there is no token iff this loop sets str to point to the terminal
+         * null (*str == '\0')
+         */
+        while (((map[*str >> 5] & (1 << (*str & 31))) && *str) || (*str == ' ')) {
+                str++;
+        }
+
+        nextoken = (char*)str;
+
+        /* Find the end of the token. If it is not the end of the string,
+         * put a null there.
+         */
+        for (; *str; str++) {
+                if (map[*str >> 5] & (1 << (*str & 31))) {
+                        if (tokdelim != NULL) {
+                                *tokdelim = *str;
+                        }
+
+                        *str++ = '\0';
+                        break;
+                }
+        }
+
+        *string = (char*)str;
+
+        /* Determine if a token has been found. */
+        if (nextoken == (char *) str) {
+                return NULL;
+        }
+        else {
+                return nextoken;
+        }
+}
+
+
+#define xToLower(C) \
+        ((C >= 'A' && C <= 'Z') ? (char)((int)C - (int)'A' + (int)'a') : C)
+
+
+/****************************************************************************
+* Function:   bcmstricmp
+*
+* Purpose:    Compare to strings case insensitively.
+*
+* Parameters: s1 (in) First string to compare.
+*             s2 (in) Second string to compare.
+*
+* Returns:    Return 0 if the two strings are equal, -1 if t1 < t2 and 1 if
+*             t1 > t2, when ignoring case sensitivity.
+*****************************************************************************
+*/
+int
+bcmstricmp(const char *s1, const char *s2)
+{
+        char dc, sc;
+
+        while (*s2 && *s1) {
+                dc = xToLower(*s1);
+                sc = xToLower(*s2);
+                if (dc < sc) return -1;
+                if (dc > sc) return 1;
+                s1++;
+                s2++;
+        }
+
+        if (*s1 && !*s2) return 1;
+        if (!*s1 && *s2) return -1;
+        return 0;
+}
+
+
+/****************************************************************************
+* Function:   bcmstrnicmp
+*
+* Purpose:    Compare to strings case insensitively, upto a max of 'cnt'
+*             characters.
+*
+* Parameters: s1  (in) First string to compare.
+*             s2  (in) Second string to compare.
+*             cnt (in) Max characters to compare.
+*
+* Returns:    Return 0 if the two strings are equal, -1 if t1 < t2 and 1 if
+*             t1 > t2, when ignoring case sensitivity.
+*****************************************************************************
+*/
+int
+bcmstrnicmp(const char* s1, const char* s2, int cnt)
+{
+        char dc, sc;
+
+        while (*s2 && *s1 && cnt) {
+                dc = xToLower(*s1);
+                sc = xToLower(*s2);
+                if (dc < sc) return -1;
+                if (dc > sc) return 1;
+                s1++;
+                s2++;
+                cnt--;
+        }
+
+        if (!cnt) return 0;
+        if (*s1 && !*s2) return 1;
+        if (!*s1 && *s2) return -1;
+        return 0;
+}
+
+/* parse a xx:xx:xx:xx:xx:xx format ethernet address */
+int
+bcm_ether_atoe(char *p, struct ether_addr *ea)
+{
+        int i = 0;
+
+        for (;;) {
+                ea->octet[i++] = (char) bcm_strtoul(p, &p, 16);
+                if (!*p++ || i == 6)
+                        break;
+        }
+
+        return (i == 6);
+}
+
+
+#if defined(CONFIG_USBRNDIS_RETAIL) || defined(NDIS_MINIPORT_DRIVER)
+/* registry routine buffer preparation utility functions:
+ * parameter order is like strncpy, but returns count
+ * of bytes copied. Minimum bytes copied is null char(1)/wchar(2)
+ */
+ulong
+wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen)
+{
+        ulong copyct = 1;
+        ushort i;
+
+        if (abuflen == 0)
+                return 0;
+
+        /* wbuflen is in bytes */
+        wbuflen /= sizeof(ushort);
+
+        for (i = 0; i < wbuflen; ++i) {
+                if (--abuflen == 0)
+                        break;
+                *abuf++ = (char) *wbuf++;
+                ++copyct;
+        }
+        *abuf = '\0';
+
+        return copyct;
+}
+#endif /* CONFIG_USBRNDIS_RETAIL || NDIS_MINIPORT_DRIVER */
+
+char *
+bcm_ether_ntoa(const struct ether_addr *ea, char *buf)
+{
+        static const char template[] = "%02x:%02x:%02x:%02x:%02x:%02x";
+        snprintf(buf, 18, template,
+                ea->octet[0]&0xff, ea->octet[1]&0xff, ea->octet[2]&0xff,
+                ea->octet[3]&0xff, ea->octet[4]&0xff, ea->octet[5]&0xff);
+        return (buf);
+}
+
+char *
+bcm_ip_ntoa(struct ipv4_addr *ia, char *buf)
+{
+        snprintf(buf, 16, "%d.%d.%d.%d",
+                ia->addr[0], ia->addr[1], ia->addr[2], ia->addr[3]);
+        return (buf);
+}
+
+#ifdef BCMDRIVER
+
+void
+bcm_mdelay(uint ms)
+{
+        uint i;
+
+        for (i = 0; i < ms; i++) {
+                OSL_DELAY(1000);
+        }
+}
+
+
+
+
+
+#if defined(DHD_DEBUG)
+/* pretty hex print a pkt buffer chain */
+void
+prpkt(const char *msg, osl_t *osh, void *p0)
+{
+        void *p;
+
+        if (msg && (msg[0] != '\0'))
+                printf("%s:\n", msg);
+
+        for (p = p0; p; p = PKTNEXT(osh, p))
+                prhex(NULL, PKTDATA(osh, p), PKTLEN(osh, p));
+}
+#endif  
+
+/* Takes an Ethernet frame and sets out-of-bound PKTPRIO.
+ * Also updates the inplace vlan tag if requested.
+ * For debugging, it returns an indication of what it did.
+ */
+uint BCMFASTPATH
+pktsetprio(void *pkt, bool update_vtag)
+{
+        struct ether_header *eh;
+        struct ethervlan_header *evh;
+        uint8 *pktdata;
+        int priority = 0;
+        int rc = 0;
+
+        pktdata = (uint8 *) PKTDATA(NULL, pkt);
+        ASSERT(ISALIGNED((uintptr)pktdata, sizeof(uint16)));
+
+        eh = (struct ether_header *) pktdata;
+
+        if (ntoh16(eh->ether_type) == ETHER_TYPE_8021Q) {
+                uint16 vlan_tag;
+                int vlan_prio, dscp_prio = 0;
+
+                evh = (struct ethervlan_header *)eh;
+
+                vlan_tag = ntoh16(evh->vlan_tag);
+                vlan_prio = (int) (vlan_tag >> VLAN_PRI_SHIFT) & VLAN_PRI_MASK;
+
+                if (ntoh16(evh->ether_type) == ETHER_TYPE_IP) {
+                        uint8 *ip_body = pktdata + sizeof(struct ethervlan_header);
+                        uint8 tos_tc = IP_TOS46(ip_body);
+                        dscp_prio = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
+                }
+
+                /* DSCP priority gets precedence over 802.1P (vlan tag) */
+                if (dscp_prio != 0) {
+                        priority = dscp_prio;
+                        rc |= PKTPRIO_VDSCP;
+                } else {
+                        priority = vlan_prio;
+                        rc |= PKTPRIO_VLAN;
+                }
+                /*
+                 * If the DSCP priority is not the same as the VLAN priority,
+                 * then overwrite the priority field in the vlan tag, with the
+                 * DSCP priority value. This is required for Linux APs because
+                 * the VLAN driver on Linux, overwrites the skb->priority field
+                 * with the priority value in the vlan tag
+                 */
+                if (update_vtag && (priority != vlan_prio)) {
+                        vlan_tag &= ~(VLAN_PRI_MASK << VLAN_PRI_SHIFT);
+                        vlan_tag |= (uint16)priority << VLAN_PRI_SHIFT;
+                        evh->vlan_tag = hton16(vlan_tag);
+                        rc |= PKTPRIO_UPD;
+                }
+        } else if (ntoh16(eh->ether_type) == ETHER_TYPE_IP) {
+                uint8 *ip_body = pktdata + sizeof(struct ether_header);
+                uint8 tos_tc = IP_TOS46(ip_body);
+                priority = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
+                rc |= PKTPRIO_DSCP;
+        }
+
+        ASSERT(priority >= 0 && priority <= MAXPRIO);
+        PKTSETPRIO(pkt, priority);
+        return (rc | priority);
+}
+
+#ifndef BCM_BOOTLOADER
+
+static char bcm_undeferrstr[32];
+static const char *bcmerrorstrtable[] = BCMERRSTRINGTABLE;
+
+/* Convert the error codes into related error strings  */
+const char *
+bcmerrorstr(int bcmerror)
+{
+        /* check if someone added a bcmerror code but forgot to add errorstring */
+        ASSERT(ABS(BCME_LAST) == (ARRAYSIZE(bcmerrorstrtable) - 1));
+
+        if (bcmerror > 0 || bcmerror < BCME_LAST) {
+                snprintf(bcm_undeferrstr, sizeof(bcm_undeferrstr), "Undefined error %d", bcmerror);
+                return bcm_undeferrstr;
+        }
+
+        ASSERT(strlen(bcmerrorstrtable[-bcmerror]) < BCME_STRLEN);
+
+        return bcmerrorstrtable[-bcmerror];
+}
+
+#endif /* !BCM_BOOTLOADER */
+
+
+
+/* iovar table lookup */
+const bcm_iovar_t*
+bcm_iovar_lookup(const bcm_iovar_t *table, const char *name)
+{
+        const bcm_iovar_t *vi;
+        const char *lookup_name;
+
+        /* skip any ':' delimited option prefixes */
+        lookup_name = strrchr(name, ':');
+        if (lookup_name != NULL)
+                lookup_name++;
+        else
+                lookup_name = name;
+
+        ASSERT(table != NULL);
+
+        for (vi = table; vi->name; vi++) {
+                if (!strcmp(vi->name, lookup_name))
+                        return vi;
+        }
+        /* ran to end of table */
+
+        return NULL; /* var name not found */
+}
+
+int
+bcm_iovar_lencheck(const bcm_iovar_t *vi, void *arg, int len, bool set)
+{
+        int bcmerror = 0;
+
+        /* length check on io buf */
+        switch (vi->type) {
+        case IOVT_BOOL:
+        case IOVT_INT8:
+        case IOVT_INT16:
+        case IOVT_INT32:
+        case IOVT_UINT8:
+        case IOVT_UINT16:
+        case IOVT_UINT32:
+                /* all integers are int32 sized args at the ioctl interface */
+                if (len < (int)sizeof(int)) {
+                        bcmerror = BCME_BUFTOOSHORT;
+                }
+                break;
+
+        case IOVT_BUFFER:
+                /* buffer must meet minimum length requirement */
+                if (len < vi->minlen) {
+                        bcmerror = BCME_BUFTOOSHORT;
+                }
+                break;
+
+        case IOVT_VOID:
+                if (!set) {
+                        /* Cannot return nil... */
+                        bcmerror = BCME_UNSUPPORTED;
+                } else if (len) {
+                        /* Set is an action w/o parameters */
+                        bcmerror = BCME_BUFTOOLONG;
+                }
+                break;
+
+        default:
+                /* unknown type for length check in iovar info */
+                ASSERT(0);
+                bcmerror = BCME_UNSUPPORTED;
+        }
+
+        return bcmerror;
+}
+
+#endif  /* BCMDRIVER */
+
+
+/*******************************************************************************
+ * crc8
+ *
+ * Computes a crc8 over the input data using the polynomial:
+ *
+ *       x^8 + x^7 +x^6 + x^4 + x^2 + 1
+ *
+ * The caller provides the initial value (either CRC8_INIT_VALUE
+ * or the previous returned value) to allow for processing of
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC8_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms",
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ * ****************************************************************************
+ */
+
+static const uint8 crc8_table[256] = {
+        0x00, 0xF7, 0xB9, 0x4E, 0x25, 0xD2, 0x9C, 0x6B,
+        0x4A, 0xBD, 0xF3, 0x04, 0x6F, 0x98, 0xD6, 0x21,
+        0x94, 0x63, 0x2D, 0xDA, 0xB1, 0x46, 0x08, 0xFF,
+        0xDE, 0x29, 0x67, 0x90, 0xFB, 0x0C, 0x42, 0xB5,
+        0x7F, 0x88, 0xC6, 0x31, 0x5A, 0xAD, 0xE3, 0x14,
+        0x35, 0xC2, 0x8C, 0x7B, 0x10, 0xE7, 0xA9, 0x5E,
+        0xEB, 0x1C, 0x52, 0xA5, 0xCE, 0x39, 0x77, 0x80,
+        0xA1, 0x56, 0x18, 0xEF, 0x84, 0x73, 0x3D, 0xCA,
+        0xFE, 0x09, 0x47, 0xB0, 0xDB, 0x2C, 0x62, 0x95,
+        0xB4, 0x43, 0x0D, 0xFA, 0x91, 0x66, 0x28, 0xDF,
+        0x6A, 0x9D, 0xD3, 0x24, 0x4F, 0xB8, 0xF6, 0x01,
+        0x20, 0xD7, 0x99, 0x6E, 0x05, 0xF2, 0xBC, 0x4B,
+        0x81, 0x76, 0x38, 0xCF, 0xA4, 0x53, 0x1D, 0xEA,
+        0xCB, 0x3C, 0x72, 0x85, 0xEE, 0x19, 0x57, 0xA0,
+        0x15, 0xE2, 0xAC, 0x5B, 0x30, 0xC7, 0x89, 0x7E,
+        0x5F, 0xA8, 0xE6, 0x11, 0x7A, 0x8D, 0xC3, 0x34,
+        0xAB, 0x5C, 0x12, 0xE5, 0x8E, 0x79, 0x37, 0xC0,
+        0xE1, 0x16, 0x58, 0xAF, 0xC4, 0x33, 0x7D, 0x8A,
+        0x3F, 0xC8, 0x86, 0x71, 0x1A, 0xED, 0xA3, 0x54,
+        0x75, 0x82, 0xCC, 0x3B, 0x50, 0xA7, 0xE9, 0x1E,
+        0xD4, 0x23, 0x6D, 0x9A, 0xF1, 0x06, 0x48, 0xBF,
+        0x9E, 0x69, 0x27, 0xD0, 0xBB, 0x4C, 0x02, 0xF5,
+        0x40, 0xB7, 0xF9, 0x0E, 0x65, 0x92, 0xDC, 0x2B,
+        0x0A, 0xFD, 0xB3, 0x44, 0x2F, 0xD8, 0x96, 0x61,
+        0x55, 0xA2, 0xEC, 0x1B, 0x70, 0x87, 0xC9, 0x3E,
+        0x1F, 0xE8, 0xA6, 0x51, 0x3A, 0xCD, 0x83, 0x74,
+        0xC1, 0x36, 0x78, 0x8F, 0xE4, 0x13, 0x5D, 0xAA,
+        0x8B, 0x7C, 0x32, 0xC5, 0xAE, 0x59, 0x17, 0xE0,
+        0x2A, 0xDD, 0x93, 0x64, 0x0F, 0xF8, 0xB6, 0x41,
+        0x60, 0x97, 0xD9, 0x2E, 0x45, 0xB2, 0xFC, 0x0B,
+        0xBE, 0x49, 0x07, 0xF0, 0x9B, 0x6C, 0x22, 0xD5,
+        0xF4, 0x03, 0x4D, 0xBA, 0xD1, 0x26, 0x68, 0x9F
+};
+
+#define CRC_INNER_LOOP(n, c, x) \
+        (c) = ((c) >> 8) ^ crc##n##_table[((c) ^ (x)) & 0xff]
+
+uint8
+hndcrc8(
+        uint8 *pdata,   /* pointer to array of data to process */
+        uint  nbytes,   /* number of input data bytes to process */
+        uint8 crc   /* either CRC8_INIT_VALUE or previous return value */
+)
+{
+        /* hard code the crc loop instead of using CRC_INNER_LOOP macro
+         * to avoid the undefined and unnecessary (uint8 >> 8) operation.
+         */
+        while (nbytes-- > 0)
+                crc = crc8_table[(crc ^ *pdata++) & 0xff];
+
+        return crc;
+}
+
+/*******************************************************************************
+ * crc16
+ *
+ * Computes a crc16 over the input data using the polynomial:
+ *
+ *       x^16 + x^12 +x^5 + 1
+ *
+ * The caller provides the initial value (either CRC16_INIT_VALUE
+ * or the previous returned value) to allow for processing of
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC16_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms",
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ * ****************************************************************************
+ */
+
+static const uint16 crc16_table[256] = {
+        0x0000, 0x1189, 0x2312, 0x329B, 0x4624, 0x57AD, 0x6536, 0x74BF,
+        0x8C48, 0x9DC1, 0xAF5A, 0xBED3, 0xCA6C, 0xDBE5, 0xE97E, 0xF8F7,
+        0x1081, 0x0108, 0x3393, 0x221A, 0x56A5, 0x472C, 0x75B7, 0x643E,
+        0x9CC9, 0x8D40, 0xBFDB, 0xAE52, 0xDAED, 0xCB64, 0xF9FF, 0xE876,
+        0x2102, 0x308B, 0x0210, 0x1399, 0x6726, 0x76AF, 0x4434, 0x55BD,
+        0xAD4A, 0xBCC3, 0x8E58, 0x9FD1, 0xEB6E, 0xFAE7, 0xC87C, 0xD9F5,
+        0x3183, 0x200A, 0x1291, 0x0318, 0x77A7, 0x662E, 0x54B5, 0x453C,
+        0xBDCB, 0xAC42, 0x9ED9, 0x8F50, 0xFBEF, 0xEA66, 0xD8FD, 0xC974,
+        0x4204, 0x538D, 0x6116, 0x709F, 0x0420, 0x15A9, 0x2732, 0x36BB,
+        0xCE4C, 0xDFC5, 0xED5E, 0xFCD7, 0x8868, 0x99E1, 0xAB7A, 0xBAF3,
+        0x5285, 0x430C, 0x7197, 0x601E, 0x14A1, 0x0528, 0x37B3, 0x263A,
+        0xDECD, 0xCF44, 0xFDDF, 0xEC56, 0x98E9, 0x8960, 0xBBFB, 0xAA72,
+        0x6306, 0x728F, 0x4014, 0x519D, 0x2522, 0x34AB, 0x0630, 0x17B9,
+        0xEF4E, 0xFEC7, 0xCC5C, 0xDDD5, 0xA96A, 0xB8E3, 0x8A78, 0x9BF1,
+        0x7387, 0x620E, 0x5095, 0x411C, 0x35A3, 0x242A, 0x16B1, 0x0738,
+        0xFFCF, 0xEE46, 0xDCDD, 0xCD54, 0xB9EB, 0xA862, 0x9AF9, 0x8B70,
+        0x8408, 0x9581, 0xA71A, 0xB693, 0xC22C, 0xD3A5, 0xE13E, 0xF0B7,
+        0x0840, 0x19C9, 0x2B52, 0x3ADB, 0x4E64, 0x5FED, 0x6D76, 0x7CFF,
+        0x9489, 0x8500, 0xB79B, 0xA612, 0xD2AD, 0xC324, 0xF1BF, 0xE036,
+        0x18C1, 0x0948, 0x3BD3, 0x2A5A, 0x5EE5, 0x4F6C, 0x7DF7, 0x6C7E,
+        0xA50A, 0xB483, 0x8618, 0x9791, 0xE32E, 0xF2A7, 0xC03C, 0xD1B5,
+        0x2942, 0x38CB, 0x0A50, 0x1BD9, 0x6F66, 0x7EEF, 0x4C74, 0x5DFD,
+        0xB58B, 0xA402, 0x9699, 0x8710, 0xF3AF, 0xE226, 0xD0BD, 0xC134,
+        0x39C3, 0x284A, 0x1AD1, 0x0B58, 0x7FE7, 0x6E6E, 0x5CF5, 0x4D7C,
+        0xC60C, 0xD785, 0xE51E, 0xF497, 0x8028, 0x91A1, 0xA33A, 0xB2B3,
+        0x4A44, 0x5BCD, 0x6956, 0x78DF, 0x0C60, 0x1DE9, 0x2F72, 0x3EFB,
+        0xD68D, 0xC704, 0xF59F, 0xE416, 0x90A9, 0x8120, 0xB3BB, 0xA232,
+        0x5AC5, 0x4B4C, 0x79D7, 0x685E, 0x1CE1, 0x0D68, 0x3FF3, 0x2E7A,
+        0xE70E, 0xF687, 0xC41C, 0xD595, 0xA12A, 0xB0A3, 0x8238, 0x93B1,
+        0x6B46, 0x7ACF, 0x4854, 0x59DD, 0x2D62, 0x3CEB, 0x0E70, 0x1FF9,
+        0xF78F, 0xE606, 0xD49D, 0xC514, 0xB1AB, 0xA022, 0x92B9, 0x8330,
+        0x7BC7, 0x6A4E, 0x58D5, 0x495C, 0x3DE3, 0x2C6A, 0x1EF1, 0x0F78
+};
+
+uint16
+hndcrc16(
+        uint8 *pdata,  /* pointer to array of data to process */
+        uint nbytes, /* number of input data bytes to process */
+        uint16 crc     /* either CRC16_INIT_VALUE or previous return value */
+)
+{
+        while (nbytes-- > 0)
+                CRC_INNER_LOOP(16, crc, *pdata++);
+        return crc;
+}
+
+static const uint32 crc32_table[256] = {
+        0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
+        0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
+        0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
+        0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
+        0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
+        0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
+        0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
+        0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
+        0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
+        0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
+        0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
+        0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
+        0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116,
+        0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
+        0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
+        0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
+        0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A,
+        0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
+        0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818,
+        0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
+        0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
+        0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
+        0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C,
+        0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
+        0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
+        0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
+        0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
+        0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
+        0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086,
+        0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
+        0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4,
+        0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
+        0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
+        0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
+        0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
+        0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
+        0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE,
+        0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
+        0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
+        0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
+        0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252,
+        0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
+        0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60,
+        0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
+        0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
+        0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
+        0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04,
+        0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
+        0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A,
+        0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
+        0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
+        0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
+        0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E,
+        0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
+        0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
+        0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
+        0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
+        0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
+        0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0,
+        0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
+        0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6,
+        0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
+        0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
+        0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
+};
+
+/*
+ * crc input is CRC32_INIT_VALUE for a fresh start, or previous return value if
+ * accumulating over multiple pieces.
+ */
+uint32
+hndcrc32(uint8 *pdata, uint nbytes, uint32 crc)
+{
+        uint8 *pend;
+#ifdef __mips__
+        uint8 tmp[4];
+        ulong *tptr = (ulong *)tmp;
+
+        /* in case the beginning of the buffer isn't aligned */
+        pend = (uint8 *)((uint)(pdata + 3) & 0xfffffffc);
+        nbytes -= (pend - pdata);
+        while (pdata < pend)
+                CRC_INNER_LOOP(32, crc, *pdata++);
+
+        /* handle bulk of data as 32-bit words */
+        pend = pdata + (nbytes & 0xfffffffc);
+        while (pdata < pend) {
+                *tptr = *(ulong *)pdata;
+                pdata += sizeof(ulong *);
+                CRC_INNER_LOOP(32, crc, tmp[0]);
+                CRC_INNER_LOOP(32, crc, tmp[1]);
+                CRC_INNER_LOOP(32, crc, tmp[2]);
+                CRC_INNER_LOOP(32, crc, tmp[3]);
+        }
+
+        /* 1-3 bytes at end of buffer */
+        pend = pdata + (nbytes & 0x03);
+        while (pdata < pend)
+                CRC_INNER_LOOP(32, crc, *pdata++);
+#else
+        pend = pdata + nbytes;
+        while (pdata < pend)
+                CRC_INNER_LOOP(32, crc, *pdata++);
+#endif /* __mips__ */
+
+        return crc;
+}
+
+#ifdef notdef
+#define CLEN    1499    /*  CRC Length */
+#define CBUFSIZ     (CLEN+4)
+#define CNBUFS      5 /* # of bufs */
+
+void
+testcrc32(void)
+{
+        uint j, k, l;
+        uint8 *buf;
+        uint len[CNBUFS];
+        uint32 crcr;
+        uint32 crc32tv[CNBUFS] =
+                {0xd2cb1faa, 0xd385c8fa, 0xf5b4f3f3, 0x55789e20, 0x00343110};
+
+        ASSERT((buf = MALLOC(CBUFSIZ*CNBUFS)) != NULL);
+
+        /* step through all possible alignments */
+        for (l = 0; l <= 4; l++) {
+                for (j = 0; j < CNBUFS; j++) {
+                        len[j] = CLEN;
+                        for (k = 0; k < len[j]; k++)
+                                *(buf + j*CBUFSIZ + (k+l)) = (j+k) & 0xff;
+                }
+
+                for (j = 0; j < CNBUFS; j++) {
+                        crcr = crc32(buf + j*CBUFSIZ + l, len[j], CRC32_INIT_VALUE);
+                        ASSERT(crcr == crc32tv[j]);
+                }
+        }
+
+        MFREE(buf, CBUFSIZ*CNBUFS);
+        return;
+}
+#endif /* notdef */
+
+/*
+ * Advance from the current 1-byte tag/1-byte length/variable-length value
+ * triple, to the next, returning a pointer to the next.
+ * If the current or next TLV is invalid (does not fit in given buffer length),
+ * NULL is returned.
+ * *buflen is not modified if the TLV elt parameter is invalid, or is decremented
+ * by the TLV parameter's length if it is valid.
+ */
+bcm_tlv_t *
+bcm_next_tlv(bcm_tlv_t *elt, int *buflen)
+{
+        int len;
+
+        /* validate current elt */
+        if (!bcm_valid_tlv(elt, *buflen))
+                return NULL;
+
+        /* advance to next elt */
+        len = elt->len;
+        elt = (bcm_tlv_t*)(elt->data + len);
+        *buflen -= (2 + len);
+
+        /* validate next elt */
+        if (!bcm_valid_tlv(elt, *buflen))
+                return NULL;
+
+        return elt;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag
+ */
+bcm_tlv_t *
+bcm_parse_tlvs(void *buf, int buflen, uint key)
+{
+        bcm_tlv_t *elt;
+        int totlen;
+
+        elt = (bcm_tlv_t*)buf;
+        totlen = buflen;
+
+        /* find tagged parameter */
+        while (totlen >= 2) {
+                int len = elt->len;
+
+                /* validate remaining totlen */
+                if ((elt->id == key) && (totlen >= (len + 2)))
+                        return (elt);
+
+                elt = (bcm_tlv_t*)((uint8*)elt + (len + 2));
+                totlen -= (len + 2);
+        }
+
+        return NULL;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag.  Stop parsing when we see an element whose ID is greater
+ * than the target key.
+ */
+bcm_tlv_t *
+bcm_parse_ordered_tlvs(void *buf, int buflen, uint key)
+{
+        bcm_tlv_t *elt;
+        int totlen;
+
+        elt = (bcm_tlv_t*)buf;
+        totlen = buflen;
+
+        /* find tagged parameter */
+        while (totlen >= 2) {
+                uint id = elt->id;
+                int len = elt->len;
+
+                /* Punt if we start seeing IDs > than target key */
+                if (id > key)
+                        return (NULL);
+
+                /* validate remaining totlen */
+                if ((id == key) && (totlen >= (len + 2)))
+                        return (elt);
+
+                elt = (bcm_tlv_t*)((uint8*)elt + (len + 2));
+                totlen -= (len + 2);
+        }
+        return NULL;
+}
+
+#if defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || defined(WLMSG_ASSOC) || \
+        defined(DHD_DEBUG)
+int
+bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len)
+{
+        int i;
+        char* p = buf;
+        char hexstr[16];
+        int slen = 0, nlen = 0;
+        uint32 bit;
+        const char* name;
+
+        if (len < 2 || !buf)
+                return 0;
+
+        buf[0] = '\0';
+
+        for (i = 0; flags != 0; i++) {
+                bit = bd[i].bit;
+                name = bd[i].name;
+                if (bit == 0 && flags != 0) {
+                        /* print any unnamed bits */
+                        snprintf(hexstr, 16, "0x%X", flags);
+                        name = hexstr;
+                        flags = 0;  /* exit loop */
+                } else if ((flags & bit) == 0)
+                        continue;
+                flags &= ~bit;
+                nlen = strlen(name);
+                slen += nlen;
+                /* count btwn flag space */
+                if (flags != 0)
+                        slen += 1;
+                /* need NULL char as well */
+                if (len <= slen)
+                        break;
+                /* copy NULL char but don't count it */
+                strncpy(p, name, nlen + 1);
+                p += nlen;
+                /* copy btwn flag space and NULL char */
+                if (flags != 0)
+                        p += snprintf(p, 2, " ");
+                len -= slen;
+        }
+
+        /* indicate the str was too short */
+        if (flags != 0) {
+                if (len < 2)
+                        p -= 2 - len;   /* overwrite last char */
+                p += snprintf(p, 2, ">");
+        }
+
+        return (int)(p - buf);
+}
+#endif 
+
+#if defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || defined(WLMSG_ASSOC) || \
+        defined(DHD_DEBUG) || defined(WLMEDIA_PEAKRATE)
+/* print bytes formatted as hex to a string. return the resulting string length */
+int
+bcm_format_hex(char *str, const void *bytes, int len)
+{
+        int i;
+        char *p = str;
+        const uint8 *src = (const uint8*)bytes;
+
+        for (i = 0; i < len; i++) {
+                p += snprintf(p, 3, "%02X", *src);
+                src++;
+        }
+        return (int)(p - str);
+}
+#endif 
+
+/* pretty hex print a contiguous buffer */
+void
+prhex(const char *msg, uchar *buf, uint nbytes)
+{
+        char line[128], *p;
+        int len = sizeof(line);
+        int nchar;
+        uint i;
+
+        if (msg && (msg[0] != '\0'))
+                printf("%s:\n", msg);
+
+        p = line;
+        for (i = 0; i < nbytes; i++) {
+                if (i % 16 == 0) {
+                        nchar = snprintf(p, len, "  %04d: ", i);    /* line prefix */
+                        p += nchar;
+                        len -= nchar;
+                }
+                if (len > 0) {
+                        nchar = snprintf(p, len, "%02x ", buf[i]);
+                        p += nchar;
+                        len -= nchar;
+                }
+
+                if (i % 16 == 15) {
+                        printf("%s\n", line);       /* flush line */
+                        p = line;
+                        len = sizeof(line);
+                }
+        }
+
+        /* flush last partial line */
+        if (p != line)
+                printf("%s\n", line);
+}
+
+static const char *crypto_algo_names[] = {
+        "NONE",
+        "WEP1",
+        "TKIP",
+        "WEP128",
+        "AES_CCM",
+        "AES_OCB_MSDU",
+        "AES_OCB_MPDU",
+        "NALG"
+        "UNDEF",
+        "UNDEF",
+        "UNDEF",
+        "UNDEF"
+};
+
+const char *
+bcm_crypto_algo_name(uint algo)
+{
+        return (algo < ARRAYSIZE(crypto_algo_names)) ? crypto_algo_names[algo] : "ERR";
+}
+
+
+char *
+bcm_chipname(uint chipid, char *buf, uint len)
+{
+        const char *fmt;
+
+        fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
+        snprintf(buf, len, fmt, chipid);
+        return buf;
+}
+
+/* Produce a human-readable string for boardrev */
+char *
+bcm_brev_str(uint32 brev, char *buf)
+{
+        if (brev < 0x100)
+                snprintf(buf, 8, "%d.%d", (brev & 0xf0) >> 4, brev & 0xf);
+        else
+                snprintf(buf, 8, "%c%03x", ((brev & 0xf000) == 0x1000) ? 'P' : 'A', brev & 0xfff);
+
+        return (buf);
+}
+
+#define BUFSIZE_TODUMP_ATONCE 512 /* Buffer size */
+
+/* dump large strings to console */
+void
+printbig(char *buf)
+{
+        uint len, max_len;
+        char c;
+
+        len = strlen(buf);
+
+        max_len = BUFSIZE_TODUMP_ATONCE;
+
+        while (len > max_len) {
+                c = buf[max_len];
+                buf[max_len] = '\0';
+                printf("%s", buf);
+                buf[max_len] = c;
+
+                buf += max_len;
+                len -= max_len;
+        }
+        /* print the remaining string */
+        printf("%s\n", buf);
+        return;
+}
+
+/* routine to dump fields in a fileddesc structure */
+uint
+bcmdumpfields(bcmutl_rdreg_rtn read_rtn, void *arg0, uint arg1, struct fielddesc *fielddesc_array,
+        char *buf, uint32 bufsize)
+{
+        uint  filled_len;
+        int len;
+        struct fielddesc *cur_ptr;
+
+        filled_len = 0;
+        cur_ptr = fielddesc_array;
+
+        while (bufsize > 1) {
+                if (cur_ptr->nameandfmt == NULL)
+                        break;
+                len = snprintf(buf, bufsize, cur_ptr->nameandfmt,
+                        read_rtn(arg0, arg1, cur_ptr->offset));
+                /* check for snprintf overflow or error */
+                if (len < 0 || (uint32)len >= bufsize)
+                        len = bufsize - 1;
+                buf += len;
+                bufsize -= len;
+                filled_len += len;
+                cur_ptr++;
+        }
+        return filled_len;
+}
+
+uint
+bcm_mkiovar(char *name, char *data, uint datalen, char *buf, uint buflen)
+{
+        uint len;
+
+        len = strlen(name) + 1;
+
+        if ((len + datalen) > buflen)
+                return 0;
+
+        strncpy(buf, name, buflen);
+
+        /* append data onto the end of the name string */
+        memcpy(&buf[len], data, datalen);
+        len += datalen;
+
+        return len;
+}
+
+/* Quarter dBm units to mW
+ * Table starts at QDBM_OFFSET, so the first entry is mW for qdBm=153
+ * Table is offset so the last entry is largest mW value that fits in
+ * a uint16.
+ */
+
+#define QDBM_OFFSET 153     /* Offset for first entry */
+#define QDBM_TABLE_LEN 40   /* Table size */
+
+/* Smallest mW value that will round up to the first table entry, QDBM_OFFSET.
+ * Value is ( mW(QDBM_OFFSET - 1) + mW(QDBM_OFFSET) ) / 2
+ */
+#define QDBM_TABLE_LOW_BOUND 6493 /* Low bound */
+
+/* Largest mW value that will round down to the last table entry,
+ * QDBM_OFFSET + QDBM_TABLE_LEN-1.
+ * Value is ( mW(QDBM_OFFSET + QDBM_TABLE_LEN - 1) + mW(QDBM_OFFSET + QDBM_TABLE_LEN) ) / 2.
+ */
+#define QDBM_TABLE_HIGH_BOUND 64938 /* High bound */
+
+static const uint16 nqdBm_to_mW_map[QDBM_TABLE_LEN] = {
+/* qdBm:    +0  +1  +2  +3  +4  +5  +6  +7 */
+/* 153: */      6683,   7079,   7499,   7943,   8414,   8913,   9441,   10000,
+/* 161: */      10593,  11220,  11885,  12589,  13335,  14125,  14962,  15849,
+/* 169: */      16788,  17783,  18836,  19953,  21135,  22387,  23714,  25119,
+/* 177: */      26607,  28184,  29854,  31623,  33497,  35481,  37584,  39811,
+/* 185: */      42170,  44668,  47315,  50119,  53088,  56234,  59566,  63096
+};
+
+uint16
+bcm_qdbm_to_mw(uint8 qdbm)
+{
+        uint factor = 1;
+        int idx = qdbm - QDBM_OFFSET;
+
+        if (idx >= QDBM_TABLE_LEN) {
+                /* clamp to max uint16 mW value */
+                return 0xFFFF;
+        }
+
+        /* scale the qdBm index up to the range of the table 0-40
+         * where an offset of 40 qdBm equals a factor of 10 mW.
+         */
+        while (idx < 0) {
+                idx += 40;
+                factor *= 10;
+        }
+
+        /* return the mW value scaled down to the correct factor of 10,
+         * adding in factor/2 to get proper rounding.
+         */
+        return ((nqdBm_to_mW_map[idx] + factor/2) / factor);
+}
+
+uint8
+bcm_mw_to_qdbm(uint16 mw)
+{
+        uint8 qdbm;
+        int offset;
+        uint mw_uint = mw;
+        uint boundary;
+
+        /* handle boundary case */
+        if (mw_uint <= 1)
+                return 0;
+
+        offset = QDBM_OFFSET;
+
+        /* move mw into the range of the table */
+        while (mw_uint < QDBM_TABLE_LOW_BOUND) {
+                mw_uint *= 10;
+                offset -= 40;
+        }
+
+        for (qdbm = 0; qdbm < QDBM_TABLE_LEN-1; qdbm++) {
+                boundary = nqdBm_to_mW_map[qdbm] + (nqdBm_to_mW_map[qdbm+1] -
+                        nqdBm_to_mW_map[qdbm])/2;
+                if (mw_uint < boundary)
+                        break;
+        }
+
+        qdbm += (uint8)offset;
+
+        return (qdbm);
+}
+
+
+uint
+bcm_bitcount(uint8 *bitmap, uint length)
+{
+        uint bitcount = 0, i;
+        uint8 tmp;
+        for (i = 0; i < length; i++) {
+                tmp = bitmap[i];
+                while (tmp) {
+                        bitcount++;
+                        tmp &= (tmp - 1);
+                }
+        }
+        return bitcount;
+}
+
+#ifdef BCMDRIVER
+
+/* Initialization of bcmstrbuf structure */
+void
+bcm_binit(struct bcmstrbuf *b, char *buf, uint size)
+{
+        b->origsize = b->size = size;
+        b->origbuf = b->buf = buf;
+}
+
+/* Buffer sprintf wrapper to guard against buffer overflow */
+int
+bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...)
+{
+        va_list ap;
+        int r;
+
+        va_start(ap, fmt);
+        r = vsnprintf(b->buf, b->size, fmt, ap);
+
+        /* Non Ansi C99 compliant returns -1,
+         * Ansi compliant return r >= b->size,
+         * bcmstdlib returns 0, handle all
+         */
+        if ((r == -1) || (r >= (int)b->size) || (r == 0)) {
+                b->size = 0;
+        } else {
+                b->size -= r;
+                b->buf += r;
+        }
+
+        va_end(ap);
+
+        return r;
+}
+
+void
+bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount)
+{
+        int i;
+
+        for (i = 0; i < num_bytes; i++) {
+                num[i] += amount;
+                if (num[i] >= amount)
+                        break;
+                amount = 1;
+        }
+}
+
+int
+bcm_cmp_bytes(uchar *arg1, uchar *arg2, uint8 nbytes)
+{
+        int i;
+
+        for (i = nbytes - 1; i >= 0; i--) {
+                if (arg1[i] != arg2[i])
+                        return (arg1[i] - arg2[i]);
+        }
+        return 0;
+}
+
+void
+bcm_print_bytes(char *name, const uchar *data, int len)
+{
+        int i;
+        int per_line = 0;
+
+        printf("%s: %d \n", name ? name : "", len);
+        for (i = 0; i < len; i++) {
+                printf("%02x ", *data++);
+                per_line++;
+                if (per_line == 16) {
+                        per_line = 0;
+                        printf("\n");
+                }
+        }
+        printf("\n");
+}
+#if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
+        defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
+#define SSID_FMT_BUF_LEN    ((4 * DOT11_MAX_SSID_LEN) + 1)
+
+int
+bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len)
+{
+        uint i, c;
+        char *p = buf;
+        char *endp = buf + SSID_FMT_BUF_LEN;
+
+        if (ssid_len > DOT11_MAX_SSID_LEN) ssid_len = DOT11_MAX_SSID_LEN;
+
+        for (i = 0; i < ssid_len; i++) {
+                c = (uint)ssid[i];
+                if (c == '\\') {
+                        *p++ = '\\';
+                        *p++ = '\\';
+                } else if (bcm_isprint((uchar)c)) {
+                        *p++ = (char)c;
+                } else {
+                        p += snprintf(p, (endp - p), "\\x%02X", c);
+                }
+        }
+        *p = '\0';
+        ASSERT(p < endp);
+
+        return (int)(p - buf);
+}
+#endif 
+
+#endif /* BCMDRIVER */
+
+/*
+ * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file and ending in a NUL.
+ * also accepts nvram files which are already in the format of <var1>=<value>\0\<var2>=<value2>\0
+ * Removes carriage returns, empty lines, comment lines, and converts newlines to NULs.
+ * Shortens buffer as needed and pads with NULs.  End of buffer is marked by two NULs.
+*/
+
+unsigned int
+process_nvram_vars(char *varbuf, unsigned int len)
+{
+        char *dp;
+        bool findNewline;
+        int column;
+        unsigned int buf_len, n;
+        unsigned int pad = 0;
+
+        dp = varbuf;
+
+        findNewline = FALSE;
+        column = 0;
+
+        for (n = 0; n < len; n++) {
+                if (varbuf[n] == '\r')
+                        continue;
+                if (findNewline && varbuf[n] != '\n')
+                        continue;
+                findNewline = FALSE;
+                if (varbuf[n] == '#') {
+                        findNewline = TRUE;
+                        continue;
+                }
+                if (varbuf[n] == '\n') {
+                        if (column == 0)
+                                continue;
+                        *dp++ = 0;
+                        column = 0;
+                        continue;
+                }
+                *dp++ = varbuf[n];
+                column++;
+        }
+        buf_len = (unsigned int)(dp - varbuf);
+        if (buf_len % 4) {
+                pad = 4 - buf_len % 4;
+                if (pad && (buf_len + pad <= len)) {
+                        buf_len += pad;
+                }
+        }
+
+        while (dp < varbuf + n)
+                *dp++ = 0;
+
+        return buf_len;
+}
diff --git a/drivers/net/wireless/bcmdhd/bcmwifi.c b/drivers/net/wireless/bcmdhd/bcmwifi.c
new file mode 100644
index 00000000000..70722170bdf
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/bcmwifi.c
@@ -0,0 +1,274 @@
+/*
+ * Misc utility routines used by kernel or app-level.
+ * Contents are wifi-specific, used by any kernel or app-level
+ * software that might want wifi things as it grows.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ * $Id: bcmwifi.c,v 1.31.8.1 2010-08-03 17:47:05 Exp $
+ */
+
+
+#include <typedefs.h>
+
+#ifdef BCMDRIVER
+#include <osl.h>
+#include <bcmutils.h>
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#define tolower(c) (bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#else
+#include <stdio.h>
+#include <stdlib.h>
+#include <ctype.h>
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+#endif 
+#include <bcmwifi.h>
+
+#if defined(WIN32) && (defined(BCMDLL) || defined(WLMDLL))
+#include <bcmstdlib.h>  
+#endif
+
+
+
+
+
+char *
+wf_chspec_ntoa(chanspec_t chspec, char *buf)
+{
+        const char *band, *bw, *sb;
+        uint channel;
+
+        band = "";
+        bw = "";
+        sb = "";
+        channel = CHSPEC_CHANNEL(chspec);
+        
+        if ((CHSPEC_IS2G(chspec) && channel > CH_MAX_2G_CHANNEL) ||
+            (CHSPEC_IS5G(chspec) && channel <= CH_MAX_2G_CHANNEL))
+                band = (CHSPEC_IS2G(chspec)) ? "b" : "a";
+        if (CHSPEC_IS40(chspec)) {
+                if (CHSPEC_SB_UPPER(chspec)) {
+                        sb = "u";
+                        channel += CH_10MHZ_APART;
+                } else {
+                        sb = "l";
+                        channel -= CH_10MHZ_APART;
+                }
+        } else if (CHSPEC_IS10(chspec)) {
+                bw = "n";
+        }
+
+        
+        snprintf(buf, 6, "%d%s%s%s", channel, band, bw, sb);
+        return (buf);
+}
+
+
+chanspec_t
+wf_chspec_aton(char *a)
+{
+        char *endp = NULL;
+        uint channel, band, bw, ctl_sb;
+        char c;
+
+        channel = strtoul(a, &endp, 10);
+
+        
+        if (endp == a)
+                return 0;
+
+        if (channel > MAXCHANNEL)
+                return 0;
+
+        band = ((channel <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G);
+        bw = WL_CHANSPEC_BW_20;
+        ctl_sb = WL_CHANSPEC_CTL_SB_NONE;
+
+        a = endp;
+
+        c = tolower(a[0]);
+        if (c == '\0')
+                goto done;
+
+        
+        if (c == 'a' || c == 'b') {
+                band = (c == 'a') ? WL_CHANSPEC_BAND_5G : WL_CHANSPEC_BAND_2G;
+                a++;
+                c = tolower(a[0]);
+                if (c == '\0')
+                        goto done;
+        }
+
+        
+        if (c == 'n') {
+                bw = WL_CHANSPEC_BW_10;
+        } else if (c == 'l') {
+                bw = WL_CHANSPEC_BW_40;
+                ctl_sb = WL_CHANSPEC_CTL_SB_LOWER;
+                
+                if (channel <= (MAXCHANNEL - CH_20MHZ_APART))
+                        channel += CH_10MHZ_APART;
+                else
+                        return 0;
+        } else if (c == 'u') {
+                bw = WL_CHANSPEC_BW_40;
+                ctl_sb = WL_CHANSPEC_CTL_SB_UPPER;
+                
+                if (channel > CH_20MHZ_APART)
+                        channel -= CH_10MHZ_APART;
+                else
+                        return 0;
+        } else {
+                return 0;
+        }
+
+done:
+        return (channel | band | bw | ctl_sb);
+}
+
+
+bool
+wf_chspec_malformed(chanspec_t chanspec)
+{
+        
+        if (!CHSPEC_IS5G(chanspec) && !CHSPEC_IS2G(chanspec))
+                return TRUE;
+        
+        if (!CHSPEC_IS40(chanspec) && !CHSPEC_IS20(chanspec))
+                return TRUE;
+
+        
+        if (CHSPEC_IS20_UNCOND(chanspec)) {
+                if (!CHSPEC_SB_NONE(chanspec))
+                        return TRUE;
+        } else {
+                if (!CHSPEC_SB_UPPER(chanspec) && !CHSPEC_SB_LOWER(chanspec))
+                return TRUE;
+        }
+
+        return FALSE;
+}
+
+
+uint8
+wf_chspec_ctlchan(chanspec_t chspec)
+{
+        uint8 ctl_chan;
+
+        
+        if (CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_NONE) {
+                return CHSPEC_CHANNEL(chspec);
+        } else {
+                
+                ASSERT(CHSPEC_BW(chspec) == WL_CHANSPEC_BW_40);
+                
+                if (CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_UPPER) {
+                        
+                        ctl_chan = UPPER_20_SB(CHSPEC_CHANNEL(chspec));
+                } else {
+                        ASSERT(CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_LOWER);
+                        
+                        ctl_chan = LOWER_20_SB(CHSPEC_CHANNEL(chspec));
+                }
+        }
+
+        return ctl_chan;
+}
+
+chanspec_t
+wf_chspec_ctlchspec(chanspec_t chspec)
+{
+        chanspec_t ctl_chspec = 0;
+        uint8 channel;
+
+        ASSERT(!wf_chspec_malformed(chspec));
+
+        
+        if (CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_NONE) {
+                return chspec;
+        } else {
+                if (CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_UPPER) {
+                        channel = UPPER_20_SB(CHSPEC_CHANNEL(chspec));
+                } else {
+                        channel = LOWER_20_SB(CHSPEC_CHANNEL(chspec));
+                }
+                ctl_chspec = channel | WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE;
+                ctl_chspec |= CHSPEC_BAND(chspec);
+        }
+        return ctl_chspec;
+}
+
+
+int
+wf_mhz2channel(uint freq, uint start_factor)
+{
+        int ch = -1;
+        uint base;
+        int offset;
+
+        
+        if (start_factor == 0) {
+                if (freq >= 2400 && freq <= 2500)
+                        start_factor = WF_CHAN_FACTOR_2_4_G;
+                else if (freq >= 5000 && freq <= 6000)
+                        start_factor = WF_CHAN_FACTOR_5_G;
+        }
+
+        if (freq == 2484 && start_factor == WF_CHAN_FACTOR_2_4_G)
+                return 14;
+
+        base = start_factor / 2;
+
+        
+        if ((freq < base) || (freq > base + 1000))
+                return -1;
+
+        offset = freq - base;
+        ch = offset / 5;
+
+        
+        if (offset != (ch * 5))
+                return -1;
+
+        
+        if (start_factor == WF_CHAN_FACTOR_2_4_G && (ch < 1 || ch > 13))
+                return -1;
+
+        return ch;
+}
+
+
+int
+wf_channel2mhz(uint ch, uint start_factor)
+{
+        int freq;
+
+        if ((start_factor == WF_CHAN_FACTOR_2_4_G && (ch < 1 || ch > 14)) ||
+            (ch > 200))
+                freq = -1;
+        else if ((start_factor == WF_CHAN_FACTOR_2_4_G) && (ch == 14))
+                freq = 2484;
+        else
+                freq = ch * 5 + start_factor / 2;
+
+        return freq;
+}
diff --git a/drivers/net/wireless/bcmdhd/dhd.h b/drivers/net/wireless/bcmdhd/dhd.h
new file mode 100644
index 00000000000..1b7242d4828
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd.h
@@ -0,0 +1,733 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd.h 290844 2011-10-20 08:54:39Z $
+ */
+
+/****************
+ * Common types *
+ */
+
+#ifndef _dhd_h_
+#define _dhd_h_
+
+#if defined(CHROMIUMOS_COMPAT_WIRELESS)
+#include <linux/sched.h>
+#endif
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_HAS_WAKELOCK)
+#include <linux/wakelock.h>
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined (CONFIG_HAS_WAKELOCK) */
+/* The kernel threading is sdio-specific */
+struct task_struct;
+struct sched_param;
+int setScheduler(struct task_struct *p, int policy, struct sched_param *param);
+
+#define ALL_INTERFACES  0xff
+
+#include <wlioctl.h>
+
+
+/* Forward decls */
+struct dhd_bus;
+struct dhd_prot;
+struct dhd_info;
+struct dhd_cmn;
+
+/* The level of bus communication with the dongle */
+enum dhd_bus_state {
+        DHD_BUS_DOWN,           /* Not ready for frame transfers */
+        DHD_BUS_LOAD,           /* Download access only (CPU reset) */
+        DHD_BUS_DATA            /* Ready for frame transfers */
+};
+
+/* Firmware requested operation mode */
+#define STA_MASK                        0x0001
+#define HOSTAPD_MASK                    0x0002
+#define WFD_MASK                        0x0004
+#define SOFTAP_FW_MASK                  0x0008
+
+/* max sequential rxcntl timeouts to set HANG event */
+#define MAX_CNTL_TIMEOUT  2
+
+enum dhd_bus_wake_state {
+        WAKE_LOCK_OFF,
+        WAKE_LOCK_PRIV,
+        WAKE_LOCK_DPC,
+        WAKE_LOCK_IOCTL,
+        WAKE_LOCK_DOWNLOAD,
+        WAKE_LOCK_TMOUT,
+        WAKE_LOCK_WATCHDOG,
+        WAKE_LOCK_LINK_DOWN_TMOUT,
+        WAKE_LOCK_PNO_FIND_TMOUT,
+        WAKE_LOCK_SOFTAP_SET,
+        WAKE_LOCK_SOFTAP_STOP,
+        WAKE_LOCK_SOFTAP_START,
+        WAKE_LOCK_SOFTAP_THREAD,
+        WAKE_LOCK_MAX
+};
+
+enum dhd_prealloc_index {
+        DHD_PREALLOC_PROT = 0,
+        DHD_PREALLOC_RXBUF,
+        DHD_PREALLOC_DATABUF,
+        DHD_PREALLOC_OSL_BUF
+};
+
+typedef enum  {
+        DHD_IF_NONE = 0,
+        DHD_IF_ADD,
+        DHD_IF_DEL,
+        DHD_IF_CHANGE,
+        DHD_IF_DELETING
+} dhd_if_state_t;
+
+
+#if defined(DHD_USE_STATIC_BUF)
+
+uint8* dhd_os_prealloc(void *osh, int section, uint size);
+void dhd_os_prefree(void *osh, void *addr, uint size);
+#define DHD_OS_PREALLOC(osh, section, size) dhd_os_prealloc(osh, section, size)
+#define DHD_OS_PREFREE(osh, addr, size) dhd_os_prefree(osh, addr, size)
+
+#else
+
+#define DHD_OS_PREALLOC(osh, section, size) MALLOC(osh, size)
+#define DHD_OS_PREFREE(osh, addr, size) MFREE(osh, addr, size)
+
+#endif /* defined(DHD_USE_STATIC_BUF) */
+
+/* Packet alignment for most efficient SDIO (can change based on platform) */
+#ifndef DHD_SDALIGN
+#define DHD_SDALIGN     32
+#endif
+
+/* Common structure for module and instance linkage */
+typedef struct dhd_pub {
+        /* Linkage ponters */
+        osl_t *osh;             /* OSL handle */
+        struct dhd_bus *bus;    /* Bus module handle */
+        struct dhd_prot *prot;  /* Protocol module handle */
+        struct dhd_info  *info; /* Info module handle */
+        struct dhd_cmn  *cmn;   /* dhd_common module handle */
+
+        /* Internal dhd items */
+        bool up;                /* Driver up/down (to OS) */
+        bool txoff;             /* Transmit flow-controlled */
+        bool dongle_reset;  /* TRUE = DEVRESET put dongle into reset */
+        enum dhd_bus_state busstate;
+        uint hdrlen;            /* Total DHD header length (proto + bus) */
+        uint maxctl;            /* Max size rxctl request from proto to bus */
+        uint rxsz;              /* Rx buffer size bus module should use */
+        uint8 wme_dp;   /* wme discard priority */
+
+        /* Dongle media info */
+        bool iswl;              /* Dongle-resident driver is wl */
+        ulong drv_version;      /* Version of dongle-resident driver */
+        struct ether_addr mac;  /* MAC address obtained from dongle */
+        dngl_stats_t dstats;    /* Stats for dongle-based data */
+
+        /* Additional stats for the bus level */
+        ulong tx_packets;       /* Data packets sent to dongle */
+        ulong tx_multicast;     /* Multicast data packets sent to dongle */
+        ulong tx_errors;        /* Errors in sending data to dongle */
+        ulong tx_ctlpkts;       /* Control packets sent to dongle */
+        ulong tx_ctlerrs;       /* Errors sending control frames to dongle */
+        ulong rx_packets;       /* Packets sent up the network interface */
+        ulong rx_multicast;     /* Multicast packets sent up the network interface */
+        ulong rx_errors;        /* Errors processing rx data packets */
+        ulong rx_ctlpkts;       /* Control frames processed from dongle */
+        ulong rx_ctlerrs;       /* Errors in processing rx control frames */
+        ulong rx_dropped;       /* Packets dropped locally (no memory) */
+        ulong rx_flushed;  /* Packets flushed due to unscheduled sendup thread */
+        ulong wd_dpc_sched;   /* Number of times dhd dpc scheduled by watchdog timer */
+
+        ulong rx_readahead_cnt; /* Number of packets where header read-ahead was used. */
+        ulong tx_realloc;       /* Number of tx packets we had to realloc for headroom */
+        ulong fc_packets;       /* Number of flow control pkts recvd */
+
+        /* Last error return */
+        int bcmerror;
+        uint tickcnt;
+
+        /* Last error from dongle */
+        int dongle_error;
+
+        /* Suspend disable flag and "in suspend" flag */
+        int suspend_disable_flag; /* "1" to disable all extra powersaving during suspend */
+        int in_suspend;                 /* flag set to 1 when early suspend called */
+#ifdef PNO_SUPPORT
+        int pno_enable;                 /* pno status : "1" is pno enable */
+#endif /* PNO_SUPPORT */
+        int dtim_skip;         /* dtim skip , default 0 means wake each dtim */
+
+        /* Pkt filter defination */
+        char * pktfilter[100];
+        int pktfilter_count;
+
+        wl_country_t dhd_cspec;         /* Current Locale info */
+        char eventmask[WL_EVENTING_MASK_LEN];
+        int     op_mode;                                /* STA, HostAPD, WFD, SoftAP */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_HAS_WAKELOCK)
+        struct wake_lock        wakelock[WAKE_LOCK_MAX];
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined (CONFIG_HAS_WAKELOCK) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+        struct mutex    wl_start_stop_lock; /* lock/unlock for Android start/stop */
+        struct mutex    wl_softap_lock;          /* lock/unlock for any SoftAP/STA settings */
+#endif 
+
+        uint16  maxdatablks;
+#ifdef PROP_TXSTATUS
+        int   wlfc_enabled;
+        void* wlfc_state;
+#endif
+        bool    dongle_isolation;
+        int   hang_was_sent;
+        int   rxcnt_timeout;            /* counter rxcnt timeout to send HANG */
+        int   txcnt_timeout;            /* counter txcnt timeout to send HANG */
+#ifdef WLMEDIA_HTSF
+        uint8 htsfdlystat_sz; /* Size of delay stats, max 255B */
+#endif
+} dhd_pub_t;
+
+typedef struct dhd_cmn {
+        osl_t *osh;             /* OSL handle */
+        dhd_pub_t *dhd;
+} dhd_cmn_t;
+
+
+        #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+
+        #define DHD_PM_RESUME_WAIT_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+        #define _DHD_PM_RESUME_WAIT(a, b) do {\
+                        int retry = 0; \
+                        SMP_RD_BARRIER_DEPENDS(); \
+                        while (dhd_mmc_suspend && retry++ != b) { \
+                                SMP_RD_BARRIER_DEPENDS(); \
+                                wait_event_interruptible_timeout(a, !dhd_mmc_suspend, HZ/100); \
+                        } \
+                } while (0)
+        #define DHD_PM_RESUME_WAIT(a)           _DHD_PM_RESUME_WAIT(a, 200)
+        #define DHD_PM_RESUME_WAIT_FOREVER(a)   _DHD_PM_RESUME_WAIT(a, ~0)
+        #define DHD_PM_RESUME_RETURN_ERROR(a)   do { if (dhd_mmc_suspend) return a; } while (0)
+        #define DHD_PM_RESUME_RETURN            do { if (dhd_mmc_suspend) return; } while (0)
+
+        #define DHD_SPINWAIT_SLEEP_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+        #define SPINWAIT_SLEEP(a, exp, us) do { \
+                uint countdown = (us) + 9999; \
+                while ((exp) && (countdown >= 10000)) { \
+                        wait_event_interruptible_timeout(a, FALSE, HZ/100); \
+                        countdown -= 10000; \
+                } \
+        } while (0)
+
+        #else
+
+        #define DHD_PM_RESUME_WAIT_INIT(a)
+        #define DHD_PM_RESUME_WAIT(a)
+        #define DHD_PM_RESUME_WAIT_FOREVER(a)
+        #define DHD_PM_RESUME_RETURN_ERROR(a)
+        #define DHD_PM_RESUME_RETURN
+
+        #define DHD_SPINWAIT_SLEEP_INIT(a)
+        #define SPINWAIT_SLEEP(a, exp, us)  do { \
+                uint countdown = (us) + 9; \
+                while ((exp) && (countdown >= 10)) { \
+                        OSL_DELAY(10);  \
+                        countdown -= 10;  \
+                } \
+        } while (0)
+
+        #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP) */
+#ifndef DHDTHREAD
+#undef  SPINWAIT_SLEEP
+#define SPINWAIT_SLEEP(a, exp, us) SPINWAIT(exp, us)
+#endif /* DHDTHREAD */
+#define DHD_IF_VIF      0x01    /* Virtual IF (Hidden from user) */
+
+unsigned long dhd_os_spin_lock(dhd_pub_t *pub);
+void dhd_os_spin_unlock(dhd_pub_t *pub, unsigned long flags);
+
+/*  Wakelock Functions */
+extern int dhd_os_wake_lock(dhd_pub_t *pub);
+extern int dhd_os_wake_unlock(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_timeout(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_timeout_enable(dhd_pub_t *pub, int val);
+
+inline static void MUTEX_LOCK_SOFTAP_SET_INIT(dhd_pub_t * dhdp)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+        mutex_init(&dhdp->wl_softap_lock);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+}
+
+inline static void MUTEX_LOCK_SOFTAP_SET(dhd_pub_t * dhdp)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+        mutex_lock(&dhdp->wl_softap_lock);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+}
+
+inline static void MUTEX_UNLOCK_SOFTAP_SET(dhd_pub_t * dhdp)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+        mutex_unlock(&dhdp->wl_softap_lock);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+}
+
+#define DHD_OS_WAKE_LOCK(pub)                   dhd_os_wake_lock(pub)
+#define DHD_OS_WAKE_UNLOCK(pub)                 dhd_os_wake_unlock(pub)
+#define DHD_OS_WAKE_LOCK_TIMEOUT(pub)           dhd_os_wake_lock_timeout(pub)
+#define DHD_OS_WAKE_LOCK_TIMEOUT_ENABLE(pub, val)       dhd_os_wake_lock_timeout_enable(pub, val)
+
+#define DHD_PACKET_TIMEOUT      1
+#define DHD_EVENT_TIMEOUT       2
+
+/* interface operations (register, remove) should be atomic, use this lock to prevent race
+ * condition among wifi on/off and interface operation functions
+ */
+void dhd_net_if_lock(struct net_device *dev);
+void dhd_net_if_unlock(struct net_device *dev);
+
+typedef struct dhd_if_event {
+        uint8 ifidx;
+        uint8 action;
+        uint8 flags;
+        uint8 bssidx;
+        uint8 is_AP;
+} dhd_if_event_t;
+
+typedef enum dhd_attach_states
+{
+        DHD_ATTACH_STATE_INIT = 0x0,
+        DHD_ATTACH_STATE_NET_ALLOC = 0x1,
+        DHD_ATTACH_STATE_DHD_ALLOC = 0x2,
+        DHD_ATTACH_STATE_ADD_IF = 0x4,
+        DHD_ATTACH_STATE_PROT_ATTACH = 0x8,
+        DHD_ATTACH_STATE_WL_ATTACH = 0x10,
+        DHD_ATTACH_STATE_THREADS_CREATED = 0x20,
+        DHD_ATTACH_STATE_WAKELOCKS_INIT = 0x40,
+        DHD_ATTACH_STATE_CFG80211 = 0x80,
+        DHD_ATTACH_STATE_EARLYSUSPEND_DONE = 0x100,
+        DHD_ATTACH_STATE_DONE = 0x200
+} dhd_attach_states_t;
+
+/* Value -1 means we are unsuccessful in creating the kthread. */
+#define DHD_PID_KT_INVALID      -1
+/* Value -2 means we are unsuccessful in both creating the kthread and tasklet */
+#define DHD_PID_KT_TL_INVALID   -2
+
+/*
+ * Exported from dhd OS modules (dhd_linux/dhd_ndis)
+ */
+
+/* To allow osl_attach/detach calls from os-independent modules */
+osl_t *dhd_osl_attach(void *pdev, uint bustype);
+void dhd_osl_detach(osl_t *osh);
+
+/* Indication from bus module regarding presence/insertion of dongle.
+ * Return dhd_pub_t pointer, used as handle to OS module in later calls.
+ * Returned structure should have bus and prot pointers filled in.
+ * bus_hdrlen specifies required headroom for bus module header.
+ */
+extern dhd_pub_t *dhd_attach(osl_t *osh, struct dhd_bus *bus, uint bus_hdrlen, void *dev);
+extern int dhd_net_attach(dhd_pub_t *dhdp, int idx);
+
+/* Indication from bus module regarding removal/absence of dongle */
+extern void dhd_detach(dhd_pub_t *dhdp);
+extern void dhd_free(dhd_pub_t *dhdp);
+
+/* Indication from bus module to change flow-control state */
+extern void dhd_txflowcontrol(dhd_pub_t *dhdp, int ifidx, bool on);
+
+extern bool dhd_prec_enq(dhd_pub_t *dhdp, struct pktq *q, void *pkt, int prec);
+
+/* Receive frame for delivery to OS.  Callee disposes of rxp. */
+extern void dhd_rx_frame(dhd_pub_t *dhdp, int ifidx, void *rxp, int numpkt, uint8 chan);
+
+/* Return pointer to interface name */
+extern char *dhd_ifname(dhd_pub_t *dhdp, int idx);
+
+/* Request scheduling of the bus dpc */
+extern void dhd_sched_dpc(dhd_pub_t *dhdp);
+
+/* Notify tx completion */
+extern void dhd_txcomplete(dhd_pub_t *dhdp, void *txp, bool success);
+
+/* OS independent layer functions */
+extern int dhd_os_proto_block(dhd_pub_t * pub);
+extern int dhd_os_proto_unblock(dhd_pub_t * pub);
+extern int dhd_os_ioctl_resp_wait(dhd_pub_t * pub, uint * condition, bool * pending);
+extern int dhd_os_ioctl_resp_wake(dhd_pub_t * pub);
+extern unsigned int dhd_os_get_ioctl_resp_timeout(void);
+extern void dhd_os_set_ioctl_resp_timeout(unsigned int timeout_msec);
+extern void * dhd_os_open_image(char * filename);
+extern int dhd_os_get_image_block(char * buf, int len, void * image);
+extern void dhd_os_close_image(void * image);
+extern void dhd_os_wd_timer(void *bus, uint wdtick);
+extern void dhd_os_sdlock(dhd_pub_t * pub);
+extern void dhd_os_sdunlock(dhd_pub_t * pub);
+extern void dhd_os_sdlock_txq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_txq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_sndup_rxq(dhd_pub_t * pub);
+extern void dhd_customer_gpio_wlan_ctrl(int onoff);
+extern int dhd_custom_get_mac_address(unsigned char *buf);
+extern void dhd_os_sdunlock_sndup_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_eventq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_eventq(dhd_pub_t * pub);
+extern int dhd_pno_enable(dhd_pub_t *dhd, int pfn_enabled);
+extern int dhd_pno_clean(dhd_pub_t *dhd);
+extern int dhd_pno_set(dhd_pub_t *dhd, wlc_ssid_t* ssids_local, int nssid,
+                       ushort  scan_fr, int pno_repeat, int pno_freq_expo_max);
+extern int dhd_pno_get_status(dhd_pub_t *dhd);
+extern int dhd_dev_pno_reset(struct net_device *dev);
+extern int dhd_dev_pno_set(struct net_device *dev, wlc_ssid_t* ssids_local,
+                           int nssid, ushort  scan_fr, int pno_repeat, int pno_freq_expo_max);
+extern int dhd_dev_pno_enable(struct net_device *dev,  int pfn_enabled);
+extern int dhd_dev_get_pno_status(struct net_device *dev);
+extern int dhd_get_dtim_skip(dhd_pub_t *dhd);
+extern bool dhd_check_ap_wfd_mode_set(dhd_pub_t *dhd);
+extern bool dhd_os_check_hang(dhd_pub_t *dhdp, int ifidx, int ret);
+
+#define DHD_UNICAST_FILTER_NUM          0
+#define DHD_BROADCAST_FILTER_NUM        1
+#define DHD_MULTICAST4_FILTER_NUM       2
+#define DHD_MULTICAST6_FILTER_NUM       3
+extern int net_os_set_packet_filter(struct net_device *dev, int val);
+extern int net_os_rxfilter_add_remove(struct net_device *dev, int val, int num);
+
+#ifdef DHD_DEBUG
+extern int write_to_file(dhd_pub_t *dhd, uint8 *buf, int size);
+#endif /* DHD_DEBUG */
+#if defined(OOB_INTR_ONLY)
+extern int dhd_customer_oob_irq_map(unsigned long *irq_flags_ptr);
+#endif /* defined(OOB_INTR_ONLY) */
+extern void dhd_os_sdtxlock(dhd_pub_t * pub);
+extern void dhd_os_sdtxunlock(dhd_pub_t * pub);
+
+typedef struct {
+        uint32 limit;           /* Expiration time (usec) */
+        uint32 increment;       /* Current expiration increment (usec) */
+        uint32 elapsed;         /* Current elapsed time (usec) */
+        uint32 tick;            /* O/S tick time (usec) */
+} dhd_timeout_t;
+
+extern void dhd_timeout_start(dhd_timeout_t *tmo, uint usec);
+extern int dhd_timeout_expired(dhd_timeout_t *tmo);
+
+extern int dhd_ifname2idx(struct dhd_info *dhd, char *name);
+extern int dhd_net2idx(struct dhd_info *dhd, struct net_device *net);
+extern struct net_device * dhd_idx2net(struct dhd_pub *dhd_pub, int ifidx);
+extern int wl_host_event(dhd_pub_t *dhd_pub, int *idx, void *pktdata,
+                         wl_event_msg_t *, void **data_ptr);
+extern void wl_event_to_host_order(wl_event_msg_t * evt);
+
+extern int dhd_wl_ioctl(dhd_pub_t *dhd_pub, int ifindex, wl_ioctl_t *ioc, void *buf, int len);
+extern int dhd_wl_ioctl_cmd(dhd_pub_t *dhd_pub, int cmd, void *arg, int len, uint8 set,
+                            int ifindex);
+
+extern struct dhd_cmn *dhd_common_init(uint16 devid, osl_t *osh);
+extern void dhd_common_deinit(dhd_pub_t *dhd_pub, dhd_cmn_t *sa_cmn);
+
+extern int dhd_add_if(struct dhd_info *dhd, int ifidx, void *handle,
+        char *name, uint8 *mac_addr, uint32 flags, uint8 bssidx);
+extern void dhd_del_if(struct dhd_info *dhd, int ifidx);
+
+extern void dhd_vif_add(struct dhd_info *dhd, int ifidx, char * name);
+extern void dhd_vif_del(struct dhd_info *dhd, int ifidx);
+
+extern void dhd_event(struct dhd_info *dhd, char *evpkt, int evlen, int ifidx);
+extern void dhd_vif_sendup(struct dhd_info *dhd, int ifidx, uchar *cp, int len);
+
+
+/* Send packet to dongle via data channel */
+extern int dhd_sendpkt(dhd_pub_t *dhdp, int ifidx, void *pkt);
+
+/* send up locally generated event */
+extern void dhd_sendup_event_common(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data);
+/* Send event to host */
+extern void dhd_sendup_event(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data);
+extern int dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag);
+extern uint dhd_bus_status(dhd_pub_t *dhdp);
+extern int  dhd_bus_start(dhd_pub_t *dhdp);
+extern int dhd_bus_membytes(dhd_pub_t *dhdp, bool set, uint32 address, uint8 *data, uint size);
+extern void dhd_print_buf(void *pbuf, int len, int bytes_per_line);
+extern bool dhd_is_associated(dhd_pub_t *dhd, void *bss_buf);
+
+#if defined(KEEP_ALIVE)
+extern int dhd_keep_alive_onoff(dhd_pub_t *dhd);
+#endif /* KEEP_ALIVE */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+extern void dhd_arp_offload_set(dhd_pub_t * dhd, int arp_mode);
+extern void dhd_arp_offload_enable(dhd_pub_t * dhd, int arp_enable);
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+
+typedef enum cust_gpio_modes {
+        WLAN_RESET_ON,
+        WLAN_RESET_OFF,
+        WLAN_POWER_ON,
+        WLAN_POWER_OFF
+} cust_gpio_modes_t;
+
+extern int wl_iw_iscan_set_scan_broadcast_prep(struct net_device *dev, uint flag);
+extern int wl_iw_send_priv_event(struct net_device *dev, char *flag);
+/*
+ * Insmod parameters for debug/test
+ */
+
+/* Watchdog timer interval */
+extern uint dhd_watchdog_ms;
+
+#if defined(DHD_DEBUG)
+/* Console output poll interval */
+extern uint dhd_console_ms;
+extern uint wl_msg_level;
+#endif /* defined(DHD_DEBUG) */
+
+/* Use interrupts */
+extern uint dhd_intr;
+
+/* Use polling */
+extern uint dhd_poll;
+
+/* ARP offload agent mode */
+extern uint dhd_arp_mode;
+
+/* ARP offload enable */
+extern uint dhd_arp_enable;
+
+/* Pkt filte enable control */
+extern uint dhd_pkt_filter_enable;
+
+/*  Pkt filter init setup */
+extern uint dhd_pkt_filter_init;
+
+/* Pkt filter mode control */
+extern uint dhd_master_mode;
+
+/* Roaming mode control */
+extern uint dhd_roam_disable;
+
+/* Roaming mode control */
+extern uint dhd_radio_up;
+
+/* Initial idletime ticks (may be -1 for immediate idle, 0 for no idle) */
+extern int dhd_idletime;
+#define DHD_IDLETIME_TICKS 1
+
+/* SDIO Drive Strength */
+extern uint dhd_sdiod_drive_strength;
+
+/* Override to force tx queueing all the time */
+extern uint dhd_force_tx_queueing;
+/* Default KEEP_ALIVE Period is 55 sec to prevent AP from sending Keep Alive probe frame */
+#define KEEP_ALIVE_PERIOD 55000
+#define NULL_PKT_STR    "null_pkt"
+
+#ifdef SDTEST
+/* Echo packet generator (SDIO), pkts/s */
+extern uint dhd_pktgen;
+
+/* Echo packet len (0 => sawtooth, max 1800) */
+extern uint dhd_pktgen_len;
+#define MAX_PKTGEN_LEN 1800
+#endif
+
+
+/* optionally set by a module_param_string() */
+#define MOD_PARAM_PATHLEN       2048
+extern char fw_path[MOD_PARAM_PATHLEN];
+extern char nv_path[MOD_PARAM_PATHLEN];
+
+#ifdef SOFTAP
+extern char fw_path2[MOD_PARAM_PATHLEN];
+#endif
+
+/* Flag to indicate if we should download firmware on driver load */
+extern uint dhd_download_fw_on_driverload;
+
+/* For supporting multiple interfaces */
+#define DHD_MAX_IFS     16
+#define DHD_DEL_IF      -0xe
+#define DHD_BAD_IF      -0xf
+
+#ifdef PROP_TXSTATUS
+/* Please be mindful that total pkttag space is 32 octets only */
+typedef struct dhd_pkttag {
+        /*
+        b[11 ] - 1 = this packet was sent in response to one time packet request,
+        do not increment credit on status for this one. [WLFC_CTL_TYPE_MAC_REQUEST_PACKET].
+        b[10 ] - 1 = signal-only-packet to firmware [i.e. nothing to piggyback on]
+        b[9  ] - 1 = packet is host->firmware (transmit direction)
+               - 0 = packet received from firmware (firmware->host)
+        b[8  ] - 1 = packet was sent due to credit_request (pspoll),
+                     packet does not count against FIFO credit.
+               - 0 = normal transaction, packet counts against FIFO credit
+        b[7  ] - 1 = AP, 0 = STA
+        b[6:4] - AC FIFO number
+        b[3:0] - interface index
+        */
+        uint16  if_flags;
+        /* destination MAC address for this packet so that not every
+        module needs to open the packet to find this
+        */
+        uint8   dstn_ether[ETHER_ADDR_LEN];
+        /*
+        This 32-bit goes from host to device for every packet.
+        */
+        uint32  htod_tag;
+        /* bus specific stuff */
+        union {
+                struct {
+                        void* stuff;
+                        uint32 thing1;
+                        uint32 thing2;
+                } sd;
+                struct {
+                        void* bus;
+                        void* urb;
+                } usb;
+        } bus_specific;
+} dhd_pkttag_t;
+
+#define DHD_PKTTAG_SET_H2DTAG(tag, h2dvalue)    ((dhd_pkttag_t*)(tag))->htod_tag = (h2dvalue)
+#define DHD_PKTTAG_H2DTAG(tag)                                  (((dhd_pkttag_t*)(tag))->htod_tag)
+
+#define DHD_PKTTAG_IFMASK               0xf
+#define DHD_PKTTAG_IFTYPE_MASK  0x1
+#define DHD_PKTTAG_IFTYPE_SHIFT 7
+#define DHD_PKTTAG_FIFO_MASK    0x7
+#define DHD_PKTTAG_FIFO_SHIFT   4
+
+#define DHD_PKTTAG_SIGNALONLY_MASK                      0x1
+#define DHD_PKTTAG_SIGNALONLY_SHIFT                     10
+
+#define DHD_PKTTAG_ONETIMEPKTRQST_MASK          0x1
+#define DHD_PKTTAG_ONETIMEPKTRQST_SHIFT         11
+
+#define DHD_PKTTAG_PKTDIR_MASK                  0x1
+#define DHD_PKTTAG_PKTDIR_SHIFT                 9
+
+#define DHD_PKTTAG_CREDITCHECK_MASK             0x1
+#define DHD_PKTTAG_CREDITCHECK_SHIFT    8
+
+#define DHD_PKTTAG_INVALID_FIFOID 0x7
+
+#define DHD_PKTTAG_SETFIFO(tag, fifo)   ((dhd_pkttag_t*)(tag))->if_flags = \
+        (((dhd_pkttag_t*)(tag))->if_flags & ~(DHD_PKTTAG_FIFO_MASK << DHD_PKTTAG_FIFO_SHIFT)) | \
+        (((fifo) & DHD_PKTTAG_FIFO_MASK) << DHD_PKTTAG_FIFO_SHIFT)
+#define DHD_PKTTAG_FIFO(tag)                    ((((dhd_pkttag_t*)(tag))->if_flags >> \
+        DHD_PKTTAG_FIFO_SHIFT) & DHD_PKTTAG_FIFO_MASK)
+
+#define DHD_PKTTAG_SETIF(tag, if)       ((dhd_pkttag_t*)(tag))->if_flags = \
+        (((dhd_pkttag_t*)(tag))->if_flags & ~DHD_PKTTAG_IFMASK) | ((if) & DHD_PKTTAG_IFMASK)
+#define DHD_PKTTAG_IF(tag)      (((dhd_pkttag_t*)(tag))->if_flags & DHD_PKTTAG_IFMASK)
+
+#define DHD_PKTTAG_SETIFTYPE(tag, isAP) ((dhd_pkttag_t*)(tag))->if_flags = \
+        (((dhd_pkttag_t*)(tag))->if_flags & \
+        ~(DHD_PKTTAG_IFTYPE_MASK << DHD_PKTTAG_IFTYPE_SHIFT)) | \
+        (((isAP) & DHD_PKTTAG_IFTYPE_MASK) << DHD_PKTTAG_IFTYPE_SHIFT)
+#define DHD_PKTTAG_IFTYPE(tag)  ((((dhd_pkttag_t*)(tag))->if_flags >> \
+        DHD_PKTTAG_IFTYPE_SHIFT) & DHD_PKTTAG_IFTYPE_MASK)
+
+#define DHD_PKTTAG_SETCREDITCHECK(tag, check)   ((dhd_pkttag_t*)(tag))->if_flags = \
+        (((dhd_pkttag_t*)(tag))->if_flags & \
+        ~(DHD_PKTTAG_CREDITCHECK_MASK << DHD_PKTTAG_CREDITCHECK_SHIFT)) | \
+        (((check) & DHD_PKTTAG_CREDITCHECK_MASK) << DHD_PKTTAG_CREDITCHECK_SHIFT)
+#define DHD_PKTTAG_CREDITCHECK(tag)     ((((dhd_pkttag_t*)(tag))->if_flags >> \
+        DHD_PKTTAG_CREDITCHECK_SHIFT) & DHD_PKTTAG_CREDITCHECK_MASK)
+
+#define DHD_PKTTAG_SETPKTDIR(tag, dir)  ((dhd_pkttag_t*)(tag))->if_flags = \
+        (((dhd_pkttag_t*)(tag))->if_flags & \
+        ~(DHD_PKTTAG_PKTDIR_MASK << DHD_PKTTAG_PKTDIR_SHIFT)) | \
+        (((dir) & DHD_PKTTAG_PKTDIR_MASK) << DHD_PKTTAG_PKTDIR_SHIFT)
+#define DHD_PKTTAG_PKTDIR(tag)  ((((dhd_pkttag_t*)(tag))->if_flags >> \
+        DHD_PKTTAG_PKTDIR_SHIFT) & DHD_PKTTAG_PKTDIR_MASK)
+
+#define DHD_PKTTAG_SETSIGNALONLY(tag, signalonly)       ((dhd_pkttag_t*)(tag))->if_flags = \
+        (((dhd_pkttag_t*)(tag))->if_flags & \
+        ~(DHD_PKTTAG_SIGNALONLY_MASK << DHD_PKTTAG_SIGNALONLY_SHIFT)) | \
+        (((signalonly) & DHD_PKTTAG_SIGNALONLY_MASK) << DHD_PKTTAG_SIGNALONLY_SHIFT)
+#define DHD_PKTTAG_SIGNALONLY(tag)      ((((dhd_pkttag_t*)(tag))->if_flags >> \
+        DHD_PKTTAG_SIGNALONLY_SHIFT) & DHD_PKTTAG_SIGNALONLY_MASK)
+
+#define DHD_PKTTAG_SETONETIMEPKTRQST(tag)       ((dhd_pkttag_t*)(tag))->if_flags = \
+        (((dhd_pkttag_t*)(tag))->if_flags & \
+        ~(DHD_PKTTAG_ONETIMEPKTRQST_MASK << DHD_PKTTAG_ONETIMEPKTRQST_SHIFT)) | \
+        (1 << DHD_PKTTAG_ONETIMEPKTRQST_SHIFT)
+#define DHD_PKTTAG_ONETIMEPKTRQST(tag)  ((((dhd_pkttag_t*)(tag))->if_flags >> \
+        DHD_PKTTAG_ONETIMEPKTRQST_SHIFT) & DHD_PKTTAG_ONETIMEPKTRQST_MASK)
+
+#define DHD_PKTTAG_SETDSTN(tag, dstn_MAC_ea)    memcpy(((dhd_pkttag_t*)((tag)))->dstn_ether, \
+        (dstn_MAC_ea), ETHER_ADDR_LEN)
+#define DHD_PKTTAG_DSTN(tag)    ((dhd_pkttag_t*)(tag))->dstn_ether
+
+typedef int (*f_commitpkt_t)(void* ctx, void* p);
+int dhd_wlfc_enable(dhd_pub_t *dhd);
+int dhd_wlfc_interface_event(struct dhd_info *, uint8 action, uint8 ifid, uint8 iftype, uint8* ea);
+int dhd_wlfc_FIFOcreditmap_event(struct dhd_info *dhd, uint8* event_data);
+int dhd_wlfc_event(struct dhd_info *dhd);
+int dhd_os_wlfc_block(dhd_pub_t *pub);
+int dhd_os_wlfc_unblock(dhd_pub_t *pub);
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define DHD_WLFC_CTRINC_MAC_CLOSE(entry)        do { (entry)->closed_ct++; } while (0)
+#define DHD_WLFC_CTRINC_MAC_OPEN(entry)         do { (entry)->opened_ct++; } while (0)
+#else
+#define DHD_WLFC_CTRINC_MAC_CLOSE(entry)        do {} while (0)
+#define DHD_WLFC_CTRINC_MAC_OPEN(entry)         do {} while (0)
+#endif
+
+#endif /* PROP_TXSTATUS */
+
+extern void dhd_wait_for_event(dhd_pub_t *dhd, bool *lockvar);
+extern void dhd_wait_event_wakeup(dhd_pub_t*dhd);
+
+#ifdef ARP_OFFLOAD_SUPPORT
+#define MAX_IPV4_ENTRIES        8
+/* dhd_commn arp offload wrapers */
+void dhd_aoe_hostip_clr(dhd_pub_t *dhd);
+void dhd_aoe_arp_clr(dhd_pub_t *dhd);
+int dhd_arp_get_arp_hostip_table(dhd_pub_t *dhd, void *buf, int buflen);
+void dhd_arp_offload_add_ip(dhd_pub_t *dhd, uint32 ipaddr);
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#endif /* _dhd_h_ */
diff --git a/drivers/net/wireless/bcmdhd/dhd_bta.c b/drivers/net/wireless/bcmdhd/dhd_bta.c
new file mode 100644
index 00000000000..6b782ea4a4d
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_bta.c
@@ -0,0 +1,335 @@
+/*
+ * BT-AMP support routines
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_bta.c,v 1.10.4.2 2010-12-22 23:47:23 Exp $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmcdc.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <proto/802.11.h>
+#include <proto/802.11_bta.h>
+#include <proto/bt_amp_hci.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhdioctl.h>
+#include <dhd_dbg.h>
+
+#include <dhd_bta.h>
+
+
+#ifdef SEND_HCI_CMD_VIA_IOCTL
+#define BTA_HCI_CMD_MAX_LEN HCI_CMD_PREAMBLE_SIZE + HCI_CMD_DATA_SIZE
+
+/* Send HCI cmd via wl iovar HCI_cmd to the dongle. */
+int
+dhd_bta_docmd(dhd_pub_t *pub, void *cmd_buf, uint cmd_len)
+{
+        amp_hci_cmd_t *cmd = (amp_hci_cmd_t *)cmd_buf;
+        uint8 buf[BTA_HCI_CMD_MAX_LEN + 16];
+        uint len = sizeof(buf);
+        wl_ioctl_t ioc;
+
+        if (cmd_len < HCI_CMD_PREAMBLE_SIZE)
+                return BCME_BADLEN;
+
+        if ((uint)cmd->plen + HCI_CMD_PREAMBLE_SIZE > cmd_len)
+                return BCME_BADLEN;
+
+        len = bcm_mkiovar("HCI_cmd",
+                (char *)cmd, (uint)cmd->plen + HCI_CMD_PREAMBLE_SIZE, (char *)buf, len);
+
+
+        memset(&ioc, 0, sizeof(ioc));
+
+        ioc.cmd = WLC_SET_VAR;
+        ioc.buf = buf;
+        ioc.len = len;
+        ioc.set = TRUE;
+
+        return dhd_wl_ioctl(pub, &ioc, ioc.buf, ioc.len);
+}
+#else /* !SEND_HCI_CMD_VIA_IOCTL */
+
+static void
+dhd_bta_flush_hcidata(dhd_pub_t *pub, uint16 llh)
+{
+        int prec;
+        struct pktq *q;
+        uint count = 0;
+
+        q = dhd_bus_txq(pub->bus);
+        if (q == NULL)
+                return;
+
+        DHD_BTA(("dhd: flushing HCI ACL data for logical link %u...\n", llh));
+
+        dhd_os_sdlock_txq(pub);
+
+        /* Walk through the txq and toss all HCI ACL data packets */
+        PKTQ_PREC_ITER(q, prec) {
+                void *head_pkt = NULL;
+
+                while (pktq_ppeek(q, prec) != head_pkt) {
+                        void *pkt = pktq_pdeq(q, prec);
+                        int ifidx;
+
+                        PKTPULL(pub->osh, pkt, dhd_bus_hdrlen(pub->bus));
+                        dhd_prot_hdrpull(pub, &ifidx, pkt);
+
+                        if (PKTLEN(pub->osh, pkt) >= RFC1042_HDR_LEN) {
+                                struct ether_header *eh =
+                                        (struct ether_header *)PKTDATA(pub->osh, pkt);
+
+                                if (ntoh16(eh->ether_type) < ETHER_TYPE_MIN) {
+                                        struct dot11_llc_snap_header *lsh =
+                                                (struct dot11_llc_snap_header *)&eh[1];
+
+                                        if (bcmp(lsh, BT_SIG_SNAP_MPROT,
+                                                 DOT11_LLC_SNAP_HDR_LEN - 2) == 0 &&
+                                            ntoh16(lsh->type) == BTA_PROT_L2CAP) {
+                                                amp_hci_ACL_data_t *ACL_data =
+                                                        (amp_hci_ACL_data_t *)&lsh[1];
+                                                uint16 handle = ltoh16(ACL_data->handle);
+
+                                                if (HCI_ACL_DATA_HANDLE(handle) == llh) {
+                                                        PKTFREE(pub->osh, pkt, TRUE);
+                                                        count ++;
+                                                        continue;
+                                                }
+                                        }
+                                }
+                        }
+
+                        dhd_prot_hdrpush(pub, ifidx, pkt);
+                        PKTPUSH(pub->osh, pkt, dhd_bus_hdrlen(pub->bus));
+
+                        if (head_pkt == NULL)
+                                head_pkt = pkt;
+                        pktq_penq(q, prec, pkt);
+                }
+        }
+
+        dhd_os_sdunlock_txq(pub);
+
+        DHD_BTA(("dhd: flushed %u packet(s) for logical link %u...\n", count, llh));
+}
+
+/* Handle HCI cmd locally.
+ * Return 0: continue to send the cmd across SDIO
+ *        < 0: stop, fail
+ *        > 0: stop, succuess
+ */
+static int
+_dhd_bta_docmd(dhd_pub_t *pub, amp_hci_cmd_t *cmd)
+{
+        int status = 0;
+
+        switch (ltoh16_ua((uint8 *)&cmd->opcode)) {
+        case HCI_Enhanced_Flush: {
+                eflush_cmd_parms_t *cmdparms = (eflush_cmd_parms_t *)cmd->parms;
+                dhd_bta_flush_hcidata(pub, ltoh16_ua(cmdparms->llh));
+                break;
+        }
+        default:
+                break;
+        }
+
+        return status;
+}
+
+/* Send HCI cmd encapsulated in BT-SIG frame via data channel to the dongle. */
+int
+dhd_bta_docmd(dhd_pub_t *pub, void *cmd_buf, uint cmd_len)
+{
+        amp_hci_cmd_t *cmd = (amp_hci_cmd_t *)cmd_buf;
+        struct ether_header *eh;
+        struct dot11_llc_snap_header *lsh;
+        osl_t *osh = pub->osh;
+        uint len;
+        void *p;
+        int status;
+
+        if (cmd_len < HCI_CMD_PREAMBLE_SIZE) {
+                DHD_ERROR(("dhd_bta_docmd: short command, cmd_len %u\n", cmd_len));
+                return BCME_BADLEN;
+        }
+
+        if ((len = (uint)cmd->plen + HCI_CMD_PREAMBLE_SIZE) > cmd_len) {
+                DHD_ERROR(("dhd_bta_docmd: malformed command, len %u cmd_len %u\n",
+                           len, cmd_len));
+                /* return BCME_BADLEN; */
+        }
+
+        p = PKTGET(osh, pub->hdrlen + RFC1042_HDR_LEN + len, TRUE);
+        if (p == NULL) {
+                DHD_ERROR(("dhd_bta_docmd: out of memory\n"));
+                return BCME_NOMEM;
+        }
+
+
+        /* intercept and handle the HCI cmd locally */
+        if ((status = _dhd_bta_docmd(pub, cmd)) > 0)
+                return 0;
+        else if (status < 0)
+                return status;
+
+        /* copy in HCI cmd */
+        PKTPULL(osh, p, pub->hdrlen + RFC1042_HDR_LEN);
+        bcopy(cmd, PKTDATA(osh, p), len);
+
+        /* copy in partial Ethernet header with BT-SIG LLC/SNAP header */
+        PKTPUSH(osh, p, RFC1042_HDR_LEN);
+        eh = (struct ether_header *)PKTDATA(osh, p);
+        bzero(eh->ether_dhost, ETHER_ADDR_LEN);
+        ETHER_SET_LOCALADDR(eh->ether_dhost);
+        bcopy(&pub->mac, eh->ether_shost, ETHER_ADDR_LEN);
+        eh->ether_type = hton16(len + DOT11_LLC_SNAP_HDR_LEN);
+        lsh = (struct dot11_llc_snap_header *)&eh[1];
+        bcopy(BT_SIG_SNAP_MPROT, lsh, DOT11_LLC_SNAP_HDR_LEN - 2);
+        lsh->type = 0;
+
+        return dhd_sendpkt(pub, 0, p);
+}
+#endif /* !SEND_HCI_CMD_VIA_IOCTL */
+
+/* Send HCI ACL data to dongle via data channel */
+int
+dhd_bta_tx_hcidata(dhd_pub_t *pub, void *data_buf, uint data_len)
+{
+        amp_hci_ACL_data_t *data = (amp_hci_ACL_data_t *)data_buf;
+        struct ether_header *eh;
+        struct dot11_llc_snap_header *lsh;
+        osl_t *osh = pub->osh;
+        uint len;
+        void *p;
+
+        if (data_len < HCI_ACL_DATA_PREAMBLE_SIZE) {
+                DHD_ERROR(("dhd_bta_tx_hcidata: short data_buf, data_len %u\n", data_len));
+                return BCME_BADLEN;
+        }
+
+        if ((len = (uint)ltoh16(data->dlen) + HCI_ACL_DATA_PREAMBLE_SIZE) > data_len) {
+                DHD_ERROR(("dhd_bta_tx_hcidata: malformed hci data, len %u data_len %u\n",
+                           len, data_len));
+                /* return BCME_BADLEN; */
+        }
+
+        p = PKTGET(osh, pub->hdrlen + RFC1042_HDR_LEN + len, TRUE);
+        if (p == NULL) {
+                DHD_ERROR(("dhd_bta_tx_hcidata: out of memory\n"));
+                return BCME_NOMEM;
+        }
+
+
+        /* copy in HCI ACL data header and HCI ACL data */
+        PKTPULL(osh, p, pub->hdrlen + RFC1042_HDR_LEN);
+        bcopy(data, PKTDATA(osh, p), len);
+
+        /* copy in partial Ethernet header with BT-SIG LLC/SNAP header */
+        PKTPUSH(osh, p, RFC1042_HDR_LEN);
+        eh = (struct ether_header *)PKTDATA(osh, p);
+        bzero(eh->ether_dhost, ETHER_ADDR_LEN);
+        bcopy(&pub->mac, eh->ether_shost, ETHER_ADDR_LEN);
+        eh->ether_type = hton16(len + DOT11_LLC_SNAP_HDR_LEN);
+        lsh = (struct dot11_llc_snap_header *)&eh[1];
+        bcopy(BT_SIG_SNAP_MPROT, lsh, DOT11_LLC_SNAP_HDR_LEN - 2);
+        lsh->type = HTON16(BTA_PROT_L2CAP);
+
+        return dhd_sendpkt(pub, 0, p);
+}
+
+/* txcomplete callback */
+void
+dhd_bta_tx_hcidata_complete(dhd_pub_t *dhdp, void *txp, bool success)
+{
+        uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, txp);
+        amp_hci_ACL_data_t *ACL_data = (amp_hci_ACL_data_t *)(pktdata + RFC1042_HDR_LEN);
+        uint16 handle = ltoh16(ACL_data->handle);
+        uint16 llh = HCI_ACL_DATA_HANDLE(handle);
+
+        wl_event_msg_t event;
+        uint8 data[HCI_EVT_PREAMBLE_SIZE + sizeof(num_completed_data_blocks_evt_parms_t)];
+        amp_hci_event_t *evt;
+        num_completed_data_blocks_evt_parms_t *parms;
+
+        uint16 len = HCI_EVT_PREAMBLE_SIZE + sizeof(num_completed_data_blocks_evt_parms_t);
+
+        /* update the event struct */
+        memset(&event, 0, sizeof(event));
+        event.version = hton16(BCM_EVENT_MSG_VERSION);
+        event.event_type = hton32(WLC_E_BTA_HCI_EVENT);
+        event.status = 0;
+        event.reason = 0;
+        event.auth_type = 0;
+        event.datalen = hton32(len);
+        event.flags = 0;
+
+        /* generate Number of Completed Blocks event */
+        evt = (amp_hci_event_t *)data;
+        evt->ecode = HCI_Number_of_Completed_Data_Blocks;
+        evt->plen = sizeof(num_completed_data_blocks_evt_parms_t);
+
+        parms = (num_completed_data_blocks_evt_parms_t *)evt->parms;
+        htol16_ua_store(dhdp->maxdatablks, (uint8 *)&parms->num_blocks);
+        parms->num_handles = 1;
+        htol16_ua_store(llh, (uint8 *)&parms->completed[0].handle);
+        parms->completed[0].pkts = 1;
+        parms->completed[0].blocks = 1;
+
+        dhd_sendup_event_common(dhdp, &event, data);
+}
+
+/* event callback */
+void
+dhd_bta_doevt(dhd_pub_t *dhdp, void *data_buf, uint data_len)
+{
+        amp_hci_event_t *evt = (amp_hci_event_t *)data_buf;
+
+        switch (evt->ecode) {
+        case HCI_Command_Complete: {
+                cmd_complete_parms_t *parms = (cmd_complete_parms_t *)evt->parms;
+                switch (ltoh16_ua((uint8 *)&parms->opcode)) {
+                case HCI_Read_Data_Block_Size: {
+                        read_data_block_size_evt_parms_t *parms2 =
+                                (read_data_block_size_evt_parms_t *)parms->parms;
+                        dhdp->maxdatablks = ltoh16_ua((uint8 *)&parms2->data_block_num);
+                        break;
+                }
+                }
+                break;
+        }
+
+        case HCI_Flush_Occurred: {
+                flush_occurred_evt_parms_t *evt_parms = (flush_occurred_evt_parms_t *)evt->parms;
+                dhd_bta_flush_hcidata(dhdp, ltoh16_ua((uint8 *)&evt_parms->handle));
+                break;
+        }
+        default:
+                break;
+        }
+}
diff --git a/drivers/net/wireless/bcmdhd/dhd_bta.h b/drivers/net/wireless/bcmdhd/dhd_bta.h
new file mode 100644
index 00000000000..07d9cebb883
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_bta.h
@@ -0,0 +1,39 @@
+/*
+ * BT-AMP support routines
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_bta.h,v 1.2 2009-02-26 22:35:56 Exp $
+ */
+#ifndef __dhd_bta_h__
+#define __dhd_bta_h__
+
+struct dhd_pub;
+
+extern int dhd_bta_docmd(struct dhd_pub *pub, void *cmd_buf, uint cmd_len);
+
+extern void dhd_bta_doevt(struct dhd_pub *pub, void *data_buf, uint data_len);
+
+extern int dhd_bta_tx_hcidata(struct dhd_pub *pub, void *data_buf, uint data_len);
+extern void dhd_bta_tx_hcidata_complete(struct dhd_pub *dhdp, void *txp, bool success);
+
+
+#endif /* __dhd_bta_h__ */
diff --git a/drivers/net/wireless/bcmdhd/dhd_bus.h b/drivers/net/wireless/bcmdhd/dhd_bus.h
new file mode 100644
index 00000000000..bccb8b6603f
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_bus.h
@@ -0,0 +1,99 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_bus.h,v 1.14.28.1 2010-12-23 01:13:17 Exp $
+ */
+
+#ifndef _dhd_bus_h_
+#define _dhd_bus_h_
+
+/*
+ * Exported from dhd bus module (dhd_usb, dhd_sdio)
+ */
+
+/* Indicate (dis)interest in finding dongles. */
+extern int dhd_bus_register(void);
+extern void dhd_bus_unregister(void);
+
+/* Download firmware image and nvram image */
+extern bool dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+        char *fw_path, char *nv_path);
+
+/* Stop bus module: clear pending frames, disable data flow */
+extern void dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex);
+
+/* Initialize bus module: prepare for communication w/dongle */
+extern int dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex);
+
+/* Get the Bus Idle Time */
+extern void dhd_bus_getidletime(dhd_pub_t *dhdp, int *idletime);
+
+/* Set the Bus Idle Time*/
+extern void dhd_bus_setidletime(dhd_pub_t *dhdp, int idle_time);
+/* Send a data frame to the dongle.  Callee disposes of txp. */
+extern int dhd_bus_txdata(struct dhd_bus *bus, void *txp);
+
+/* Send/receive a control message to/from the dongle.
+ * Expects caller to enforce a single outstanding transaction.
+ */
+extern int dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen);
+extern int dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen);
+
+/* Watchdog timer function */
+extern bool dhd_bus_watchdog(dhd_pub_t *dhd);
+extern void dhd_disable_intr(dhd_pub_t *dhd);
+
+#if defined(DHD_DEBUG)
+/* Device console input function */
+extern int dhd_bus_console_in(dhd_pub_t *dhd, uchar *msg, uint msglen);
+#endif /* defined(DHD_DEBUG) */
+
+/* Deferred processing for the bus, return TRUE requests reschedule */
+extern bool dhd_bus_dpc(struct dhd_bus *bus);
+extern void dhd_bus_isr(bool * InterruptRecognized, bool * QueueMiniportHandleInterrupt, void *arg);
+
+
+/* Check for and handle local prot-specific iovar commands */
+extern int dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                            void *params, int plen, void *arg, int len, bool set);
+
+/* Add bus dump output to a buffer */
+extern void dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+
+/* Clear any bus counters */
+extern void dhd_bus_clearcounts(dhd_pub_t *dhdp);
+
+/* return the dongle chipid */
+extern uint dhd_bus_chip(struct dhd_bus *bus);
+
+/* Set user-specified nvram parameters. */
+extern void dhd_bus_set_nvram_params(struct dhd_bus * bus, const char *nvram_params);
+
+extern void *dhd_bus_pub(struct dhd_bus *bus);
+extern void *dhd_bus_txq(struct dhd_bus *bus);
+extern uint dhd_bus_hdrlen(struct dhd_bus *bus);
+
+#endif /* _dhd_bus_h_ */
diff --git a/drivers/net/wireless/bcmdhd/dhd_cdc.c b/drivers/net/wireless/bcmdhd/dhd_cdc.c
new file mode 100644
index 00000000000..3a4de96c002
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_cdc.c
@@ -0,0 +1,2530 @@
+/*
+ * DHD Protocol Module for CDC and BDC.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_cdc.c,v 1.51.6.31 2011-02-09 14:31:43 Exp $
+ *
+ * BDC is like CDC, except it includes a header for data packets to convey
+ * packet priority over the bus, and flags (e.g. to indicate checksum status
+ * for dongle offload.)
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmcdc.h>
+#include <bcmendian.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_proto.h>
+#include <dhd_bus.h>
+#include <dhd_dbg.h>
+
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+
+#define RETRIES 2               /* # of retries to retrieve matching ioctl response */
+#define BUS_HEADER_LEN  (16+DHD_SDALIGN)        /* Must be at least SDPCM_RESERVE
+                                 * defined in dhd_sdio.c (amount of header tha might be added)
+                                 * plus any space that might be needed for alignment padding.
+                                 */
+#define ROUND_UP_MARGIN 2048    /* Biggest SDIO block size possible for
+                                 * round off at the end of buffer
+                                 */
+
+#define BUS_RETRIES 1   /* # of retries before aborting a bus tx operation */
+
+#ifdef PROP_TXSTATUS
+typedef struct dhd_wlfc_commit_info {
+        uint8                                   needs_hdr;
+        uint8                                   ac_fifo_credit_spent;
+        ewlfc_packet_state_t    pkt_type;
+        wlfc_mac_descriptor_t*  mac_entry;
+        void*                                   p;
+} dhd_wlfc_commit_info_t;
+#endif /* PROP_TXSTATUS */
+
+typedef struct dhd_prot {
+        uint16 reqid;
+        uint8 pending;
+        uint32 lastcmd;
+        uint8 bus_header[BUS_HEADER_LEN];
+        cdc_ioctl_t msg;
+        unsigned char buf[WLC_IOCTL_MAXLEN + ROUND_UP_MARGIN];
+} dhd_prot_t;
+
+static int
+dhdcdc_msg(dhd_pub_t *dhd)
+{
+        int err = 0;
+        dhd_prot_t *prot = dhd->prot;
+        int len = ltoh32(prot->msg.len) + sizeof(cdc_ioctl_t);
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        DHD_OS_WAKE_LOCK(dhd);
+
+        /* NOTE : cdc->msg.len holds the desired length of the buffer to be
+         *        returned. Only up to CDC_MAX_MSG_SIZE of this buffer area
+         *        is actually sent to the dongle
+         */
+        if (len > CDC_MAX_MSG_SIZE)
+                len = CDC_MAX_MSG_SIZE;
+
+        /* Send request */
+        err = dhd_bus_txctl(dhd->bus, (uchar*)&prot->msg, len);
+
+        DHD_OS_WAKE_UNLOCK(dhd);
+        return err;
+}
+
+static int
+dhdcdc_cmplt(dhd_pub_t *dhd, uint32 id, uint32 len)
+{
+        int ret;
+        int cdc_len = len+sizeof(cdc_ioctl_t);
+        dhd_prot_t *prot = dhd->prot;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        do {
+                ret = dhd_bus_rxctl(dhd->bus, (uchar*)&prot->msg, cdc_len);
+                if (ret < 0)
+                        break;
+        } while (CDC_IOC_ID(ltoh32(prot->msg.flags)) != id);
+
+        return ret;
+}
+
+static int
+dhdcdc_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+        dhd_prot_t *prot = dhd->prot;
+        cdc_ioctl_t *msg = &prot->msg;
+        void *info;
+        int ret = 0, retries = 0;
+        uint32 id, flags = 0;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+        DHD_CTL(("%s: cmd %d len %d\n", __FUNCTION__, cmd, len));
+
+
+        /* Respond "bcmerror" and "bcmerrorstr" with local cache */
+        if (cmd == WLC_GET_VAR && buf)
+        {
+                if (!strcmp((char *)buf, "bcmerrorstr"))
+                {
+                        strncpy((char *)buf, bcmerrorstr(dhd->dongle_error), BCME_STRLEN);
+                        goto done;
+                }
+                else if (!strcmp((char *)buf, "bcmerror"))
+                {
+                        *(int *)buf = dhd->dongle_error;
+                        goto done;
+                }
+        }
+
+        memset(msg, 0, sizeof(cdc_ioctl_t));
+
+        msg->cmd = htol32(cmd);
+        msg->len = htol32(len);
+        msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT);
+        CDC_SET_IF_IDX(msg, ifidx);
+        /* add additional action bits */
+        action &= WL_IOCTL_ACTION_MASK;
+        msg->flags |= (action << CDCF_IOC_ACTION_SHIFT);
+        msg->flags = htol32(msg->flags);
+
+        if (buf)
+                memcpy(prot->buf, buf, len);
+
+        if ((ret = dhdcdc_msg(dhd)) < 0) {
+                if (!dhd->hang_was_sent)
+                        DHD_ERROR(("dhdcdc_query_ioctl: dhdcdc_msg failed w/status %d\n", ret));
+                goto done;
+        }
+
+retry:
+        /* wait for interrupt and get first fragment */
+        if ((ret = dhdcdc_cmplt(dhd, prot->reqid, len)) < 0)
+                goto done;
+
+        flags = ltoh32(msg->flags);
+        id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+        if ((id < prot->reqid) && (++retries < RETRIES))
+                goto retry;
+        if (id != prot->reqid) {
+                DHD_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+                           dhd_ifname(dhd, ifidx), __FUNCTION__, id, prot->reqid));
+                ret = -EINVAL;
+                goto done;
+        }
+
+        /* Check info buffer */
+        info = (void*)&msg[1];
+
+        /* Copy info buffer */
+        if (buf)
+        {
+                if (ret < (int)len)
+                        len = ret;
+                memcpy(buf, info, len);
+        }
+
+        /* Check the ERROR flag */
+        if (flags & CDCF_IOC_ERROR)
+        {
+                ret = ltoh32(msg->status);
+                /* Cache error from dongle */
+                dhd->dongle_error = ret;
+        }
+
+done:
+        return ret;
+}
+
+static int
+dhdcdc_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+        dhd_prot_t *prot = dhd->prot;
+        cdc_ioctl_t *msg = &prot->msg;
+        int ret = 0;
+        uint32 flags, id;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+        DHD_CTL(("%s: cmd %d len %d\n", __FUNCTION__, cmd, len));
+
+        if (dhd->busstate == DHD_BUS_DOWN) {
+                DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+                return -EIO;
+        }
+
+        /* don't talk to the dongle if fw is about to be reloaded */
+        if (dhd->hang_was_sent) {
+                DHD_ERROR(("%s: HANG was sent up earlier. Not talking to the chip\n",
+                        __FUNCTION__));
+                return -EIO;
+        }
+
+        memset(msg, 0, sizeof(cdc_ioctl_t));
+
+        msg->cmd = htol32(cmd);
+        msg->len = htol32(len);
+        msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT);
+        CDC_SET_IF_IDX(msg, ifidx);
+        /* add additional action bits */
+        action &= WL_IOCTL_ACTION_MASK;
+        msg->flags |= (action << CDCF_IOC_ACTION_SHIFT) | CDCF_IOC_SET;
+        msg->flags = htol32(msg->flags);
+
+        if (buf)
+                memcpy(prot->buf, buf, len);
+
+        if ((ret = dhdcdc_msg(dhd)) < 0) {
+                DHD_ERROR(("%s: dhdcdc_msg failed w/status %d\n", __FUNCTION__, ret));
+                goto done;
+        }
+
+        if ((ret = dhdcdc_cmplt(dhd, prot->reqid, len)) < 0)
+                goto done;
+
+        flags = ltoh32(msg->flags);
+        id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+        if (id != prot->reqid) {
+                DHD_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+                           dhd_ifname(dhd, ifidx), __FUNCTION__, id, prot->reqid));
+                ret = -EINVAL;
+                goto done;
+        }
+
+        /* Check the ERROR flag */
+        if (flags & CDCF_IOC_ERROR)
+        {
+                ret = ltoh32(msg->status);
+                /* Cache error from dongle */
+                dhd->dongle_error = ret;
+        }
+
+done:
+        return ret;
+}
+
+
+int
+dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len)
+{
+        dhd_prot_t *prot = dhd->prot;
+        int ret = -1;
+        uint8 action;
+
+        if ((dhd->busstate == DHD_BUS_DOWN) || dhd->hang_was_sent) {
+                DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+                goto done;
+        }
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        ASSERT(len <= WLC_IOCTL_MAXLEN);
+
+        if (len > WLC_IOCTL_MAXLEN)
+                goto done;
+
+        if (prot->pending == TRUE) {
+                DHD_ERROR(("CDC packet is pending!!!! cmd=0x%x (%lu) lastcmd=0x%x (%lu)\n",
+                        ioc->cmd, (unsigned long)ioc->cmd, prot->lastcmd,
+                        (unsigned long)prot->lastcmd));
+                if ((ioc->cmd == WLC_SET_VAR) || (ioc->cmd == WLC_GET_VAR)) {
+                        DHD_TRACE(("iovar cmd=%s\n", (char*)buf));
+                }
+                goto done;
+        }
+
+        prot->pending = TRUE;
+        prot->lastcmd = ioc->cmd;
+        action = ioc->set;
+        if (action & WL_IOCTL_ACTION_SET)
+                ret = dhdcdc_set_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+        else {
+                ret = dhdcdc_query_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+                if (ret > 0)
+                        ioc->used = ret - sizeof(cdc_ioctl_t);
+        }
+
+        /* Too many programs assume ioctl() returns 0 on success */
+        if (ret >= 0)
+                ret = 0;
+        else {
+                cdc_ioctl_t *msg = &prot->msg;
+                ioc->needed = ltoh32(msg->len); /* len == needed when set/query fails from dongle */
+        }
+
+        /* Intercept the wme_dp ioctl here */
+        if ((!ret) && (ioc->cmd == WLC_SET_VAR) && (!strcmp(buf, "wme_dp"))) {
+                int slen, val = 0;
+
+                slen = strlen("wme_dp") + 1;
+                if (len >= (int)(slen + sizeof(int)))
+                        bcopy(((char *)buf + slen), &val, sizeof(int));
+                dhd->wme_dp = (uint8) ltoh32(val);
+        }
+
+        prot->pending = FALSE;
+
+done:
+        return ret;
+}
+
+int
+dhd_prot_iovar_op(dhd_pub_t *dhdp, const char *name,
+                  void *params, int plen, void *arg, int len, bool set)
+{
+        return BCME_UNSUPPORTED;
+}
+
+#ifdef PROP_TXSTATUS
+void
+dhd_wlfc_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+        int i;
+        uint8* ea;
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhdp->wlfc_state;
+        wlfc_hanger_t* h;
+        wlfc_mac_descriptor_t* mac_table;
+        wlfc_mac_descriptor_t* interfaces;
+        char* iftypes[] = {"STA", "AP", "WDS", "p2pGO", "p2pCL"};
+
+        if (wlfc == NULL) {
+                bcm_bprintf(strbuf, "wlfc not initialized yet\n");
+                return;
+        }
+        h = (wlfc_hanger_t*)wlfc->hanger;
+        if (h == NULL) {
+                bcm_bprintf(strbuf, "wlfc-hanger not initialized yet\n");
+        }
+
+        mac_table = wlfc->destination_entries.nodes;
+        interfaces = wlfc->destination_entries.interfaces;
+        bcm_bprintf(strbuf, "---- wlfc stats ----\n");
+        if (h) {
+                bcm_bprintf(strbuf, "wlfc hanger (pushed,popped,f_push,"
+                        "f_pop,f_slot, pending) = (%d,%d,%d,%d,%d,%d)\n",
+                        h->pushed,
+                        h->popped,
+                        h->failed_to_push,
+                        h->failed_to_pop,
+                        h->failed_slotfind,
+                        (h->pushed - h->popped));
+        }
+
+        bcm_bprintf(strbuf, "wlfc fail(tlv,credit_rqst,mac_update,psmode_update), "
+                "(dq_full,sendq_full, rollback_fail) = (%d,%d,%d,%d), (%d,%d,%d)\n",
+                wlfc->stats.tlv_parse_failed,
+                wlfc->stats.credit_request_failed,
+                wlfc->stats.mac_update_failed,
+                wlfc->stats.psmode_update_failed,
+                wlfc->stats.delayq_full_error,
+                wlfc->stats.sendq_full_error,
+                wlfc->stats.rollback_failed);
+
+        bcm_bprintf(strbuf, "SENDQ (len,credit,sent) "
+                "(AC0[%d,%d,%d],AC1[%d,%d,%d],AC2[%d,%d,%d],AC3[%d,%d,%d],BC_MC[%d,%d,%d])\n",
+                wlfc->SENDQ.q[0].len, wlfc->FIFO_credit[0], wlfc->stats.sendq_pkts[0],
+                wlfc->SENDQ.q[1].len, wlfc->FIFO_credit[1], wlfc->stats.sendq_pkts[1],
+                wlfc->SENDQ.q[2].len, wlfc->FIFO_credit[2], wlfc->stats.sendq_pkts[2],
+                wlfc->SENDQ.q[3].len, wlfc->FIFO_credit[3], wlfc->stats.sendq_pkts[3],
+                wlfc->SENDQ.q[4].len, wlfc->FIFO_credit[4], wlfc->stats.sendq_pkts[4]);
+
+#ifdef PROP_TXSTATUS_DEBUG
+        bcm_bprintf(strbuf, "SENDQ dropped: AC[0-3]:(%d,%d,%d,%d), (bcmc,atim):(%d,%d)\n",
+                wlfc->stats.dropped_qfull[0], wlfc->stats.dropped_qfull[1],
+                wlfc->stats.dropped_qfull[2], wlfc->stats.dropped_qfull[3],
+                wlfc->stats.dropped_qfull[4], wlfc->stats.dropped_qfull[5]);
+#endif
+
+        bcm_bprintf(strbuf, "\n");
+        for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+                if (interfaces[i].occupied) {
+                        char* iftype_desc;
+
+                        if (interfaces[i].iftype > WLC_E_IF_ROLE_P2P_CLIENT)
+                                iftype_desc = "<Unknown";
+                        else
+                                iftype_desc = iftypes[interfaces[i].iftype];
+
+                        ea = interfaces[i].ea;
+                        bcm_bprintf(strbuf, "INTERFACE[%d].ea = "
+                                "[%02x:%02x:%02x:%02x:%02x:%02x], if:%d, type: %s\n", i,
+                                ea[0], ea[1], ea[2], ea[3], ea[4], ea[5],
+                                interfaces[i].interface_id,
+                                iftype_desc);
+
+                        bcm_bprintf(strbuf, "INTERFACE[%d].DELAYQ(len,state,credit)"
+                                "= (%d,%s,%d)\n",
+                                i,
+                                interfaces[i].psq.len,
+                                ((interfaces[i].state ==
+                                WLFC_STATE_OPEN) ? " OPEN":"CLOSE"),
+                                interfaces[i].requested_credit);
+
+                        bcm_bprintf(strbuf, "INTERFACE[%d].DELAYQ"
+                                "(sup,ac0),(sup,ac1),(sup,ac2),(sup,ac3) = "
+                                "(%d,%d),(%d,%d),(%d,%d),(%d,%d)\n",
+                                i,
+                                interfaces[i].psq.q[0].len,
+                                interfaces[i].psq.q[1].len,
+                                interfaces[i].psq.q[2].len,
+                                interfaces[i].psq.q[3].len,
+                                interfaces[i].psq.q[4].len,
+                                interfaces[i].psq.q[5].len,
+                                interfaces[i].psq.q[6].len,
+                                interfaces[i].psq.q[7].len);
+                }
+        }
+
+        bcm_bprintf(strbuf, "\n");
+        for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+                if (mac_table[i].occupied) {
+                        ea = mac_table[i].ea;
+                        bcm_bprintf(strbuf, "MAC_table[%d].ea = "
+                                "[%02x:%02x:%02x:%02x:%02x:%02x], if:%d\n", i,
+                                ea[0], ea[1], ea[2], ea[3], ea[4], ea[5],
+                                mac_table[i].interface_id);
+
+                        bcm_bprintf(strbuf, "MAC_table[%d].DELAYQ(len,state,credit)"
+                                "= (%d,%s,%d)\n",
+                                i,
+                                mac_table[i].psq.len,
+                                ((mac_table[i].state ==
+                                WLFC_STATE_OPEN) ? " OPEN":"CLOSE"),
+                                mac_table[i].requested_credit);
+#ifdef PROP_TXSTATUS_DEBUG
+                        bcm_bprintf(strbuf, "MAC_table[%d]: (opened, closed) = (%d, %d)\n",
+                                i, mac_table[i].opened_ct, mac_table[i].closed_ct);
+#endif
+                        bcm_bprintf(strbuf, "MAC_table[%d].DELAYQ"
+                                "(sup,ac0),(sup,ac1),(sup,ac2),(sup,ac3) = "
+                                "(%d,%d),(%d,%d),(%d,%d),(%d,%d)\n",
+                                i,
+                                mac_table[i].psq.q[0].len,
+                                mac_table[i].psq.q[1].len,
+                                mac_table[i].psq.q[2].len,
+                                mac_table[i].psq.q[3].len,
+                                mac_table[i].psq.q[4].len,
+                                mac_table[i].psq.q[5].len,
+                                mac_table[i].psq.q[6].len,
+                                mac_table[i].psq.q[7].len);
+                }
+        }
+
+#ifdef PROP_TXSTATUS_DEBUG
+        {
+                int avg;
+                int moving_avg = 0;
+                int moving_samples;
+
+                if (wlfc->stats.latency_sample_count) {
+                        moving_samples = sizeof(wlfc->stats.deltas)/sizeof(uint32);
+
+                        for (i = 0; i < moving_samples; i++)
+                                moving_avg += wlfc->stats.deltas[i];
+                        moving_avg /= moving_samples;
+
+                        avg = (100 * wlfc->stats.total_status_latency) /
+                                wlfc->stats.latency_sample_count;
+                        bcm_bprintf(strbuf, "txstatus latency (average, last, moving[%d]) = "
+                                "(%d.%d, %03d, %03d)\n",
+                                moving_samples, avg/100, (avg - (avg/100)*100),
+                                wlfc->stats.latency_most_recent,
+                                moving_avg);
+                }
+        }
+
+        bcm_bprintf(strbuf, "wlfc- fifo[0-5] credit stats: sent = (%d,%d,%d,%d,%d,%d), "
+                "back = (%d,%d,%d,%d,%d,%d)\n",
+                wlfc->stats.fifo_credits_sent[0],
+                wlfc->stats.fifo_credits_sent[1],
+                wlfc->stats.fifo_credits_sent[2],
+                wlfc->stats.fifo_credits_sent[3],
+                wlfc->stats.fifo_credits_sent[4],
+                wlfc->stats.fifo_credits_sent[5],
+
+                wlfc->stats.fifo_credits_back[0],
+                wlfc->stats.fifo_credits_back[1],
+                wlfc->stats.fifo_credits_back[2],
+                wlfc->stats.fifo_credits_back[3],
+                wlfc->stats.fifo_credits_back[4],
+                wlfc->stats.fifo_credits_back[5]);
+        {
+                uint32 fifo_cr_sent = 0;
+                uint32 fifo_cr_acked = 0;
+                uint32 request_cr_sent = 0;
+                uint32 request_cr_ack = 0;
+                uint32 bc_mc_cr_ack = 0;
+
+                for (i = 0; i < sizeof(wlfc->stats.fifo_credits_sent)/sizeof(uint32); i++) {
+                        fifo_cr_sent += wlfc->stats.fifo_credits_sent[i];
+                }
+
+                for (i = 0; i < sizeof(wlfc->stats.fifo_credits_back)/sizeof(uint32); i++) {
+                        fifo_cr_acked += wlfc->stats.fifo_credits_back[i];
+                }
+
+                for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+                        if (wlfc->destination_entries.nodes[i].occupied) {
+                                request_cr_sent +=
+                                        wlfc->destination_entries.nodes[i].dstncredit_sent_packets;
+                        }
+                }
+                for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+                        if (wlfc->destination_entries.interfaces[i].occupied) {
+                                request_cr_sent +=
+                                wlfc->destination_entries.interfaces[i].dstncredit_sent_packets;
+                        }
+                }
+                for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+                        if (wlfc->destination_entries.nodes[i].occupied) {
+                                request_cr_ack +=
+                                        wlfc->destination_entries.nodes[i].dstncredit_acks;
+                        }
+                }
+                for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+                        if (wlfc->destination_entries.interfaces[i].occupied) {
+                                request_cr_ack +=
+                                        wlfc->destination_entries.interfaces[i].dstncredit_acks;
+                        }
+                }
+                bcm_bprintf(strbuf, "wlfc- (sent, status) => pq(%d,%d), vq(%d,%d),"
+                        "other:%d, bc_mc:%d, signal-only, (sent,freed): (%d,%d)",
+                        fifo_cr_sent, fifo_cr_acked,
+                        request_cr_sent, request_cr_ack,
+                        wlfc->destination_entries.other.dstncredit_acks,
+                        bc_mc_cr_ack,
+                        wlfc->stats.signal_only_pkts_sent, wlfc->stats.signal_only_pkts_freed);
+        }
+#endif /* PROP_TXSTATUS_DEBUG */
+        bcm_bprintf(strbuf, "\n");
+        bcm_bprintf(strbuf, "wlfc- pkt((in,2bus,txstats,hdrpull),(dropped,hdr_only,wlc_tossed)"
+                "(freed,free_err,rollback)) = "
+                "((%d,%d,%d,%d),(%d,%d,%d),(%d,%d,%d))\n",
+                wlfc->stats.pktin,
+                wlfc->stats.pkt2bus,
+                wlfc->stats.txstatus_in,
+                wlfc->stats.dhd_hdrpulls,
+
+                wlfc->stats.pktdropped,
+                wlfc->stats.wlfc_header_only_pkt,
+                wlfc->stats.wlc_tossed_pkts,
+
+                wlfc->stats.pkt_freed,
+                wlfc->stats.pkt_free_err, wlfc->stats.rollback);
+
+        bcm_bprintf(strbuf, "wlfc- suppress((d11,wlc,err),enq(d11,wl,hq,mac?),retx(d11,wlc,hq)) = "
+                "((%d,%d,%d),(%d,%d,%d,%d),(%d,%d,%d))\n",
+
+                wlfc->stats.d11_suppress,
+                wlfc->stats.wl_suppress,
+                wlfc->stats.bad_suppress,
+
+                wlfc->stats.psq_d11sup_enq,
+                wlfc->stats.psq_wlsup_enq,
+                wlfc->stats.psq_hostq_enq,
+                wlfc->stats.mac_handle_notfound,
+
+                wlfc->stats.psq_d11sup_retx,
+                wlfc->stats.psq_wlsup_retx,
+                wlfc->stats.psq_hostq_retx);
+        return;
+}
+
+/* Create a place to store all packet pointers submitted to the firmware until
+        a status comes back, suppress or otherwise.
+
+        hang-er: noun, a contrivance on which things are hung, as a hook.
+*/
+static void*
+dhd_wlfc_hanger_create(osl_t *osh, int max_items)
+{
+        int i;
+        wlfc_hanger_t* hanger;
+
+        /* allow only up to a specific size for now */
+        ASSERT(max_items == WLFC_HANGER_MAXITEMS);
+
+        if ((hanger = (wlfc_hanger_t*)MALLOC(osh, WLFC_HANGER_SIZE(max_items))) == NULL)
+                return NULL;
+
+        memset(hanger, 0, WLFC_HANGER_SIZE(max_items));
+        hanger->max_items = max_items;
+
+        for (i = 0; i < hanger->max_items; i++) {
+                hanger->items[i].state = WLFC_HANGER_ITEM_STATE_FREE;
+        }
+        return hanger;
+}
+
+static int
+dhd_wlfc_hanger_delete(osl_t *osh, void* hanger)
+{
+        wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+        if (h) {
+                MFREE(osh, h, WLFC_HANGER_SIZE(h->max_items));
+                return BCME_OK;
+        }
+        return BCME_BADARG;
+}
+
+static uint16
+dhd_wlfc_hanger_get_free_slot(void* hanger)
+{
+        int i;
+        wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+        if (h) {
+                for (i = 0; i < h->max_items; i++) {
+                        if (h->items[i].state == WLFC_HANGER_ITEM_STATE_FREE)
+                                return (uint16)i;
+                }
+                h->failed_slotfind++;
+        }
+        return WLFC_HANGER_MAXITEMS;
+}
+
+static int
+dhd_wlfc_hanger_pushpkt(void* hanger, void* pkt, uint32 slot_id)
+{
+        int rc = BCME_OK;
+        wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+        if (h && (slot_id < WLFC_HANGER_MAXITEMS)) {
+                if (h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_FREE) {
+                        h->items[slot_id].state = WLFC_HANGER_ITEM_STATE_INUSE;
+                        h->items[slot_id].pkt = pkt;
+                        h->items[slot_id].identifier = slot_id;
+                        h->pushed++;
+                }
+                else {
+                        h->failed_to_push++;
+                        rc = BCME_NOTFOUND;
+                }
+        }
+        else
+                rc = BCME_BADARG;
+        return rc;
+}
+
+static int
+dhd_wlfc_hanger_poppkt(void* hanger, uint32 slot_id, void** pktout, int remove_from_hanger)
+{
+        int rc = BCME_OK;
+        wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+        /* this packet was not pushed at the time it went to the firmware */
+        if (slot_id == WLFC_HANGER_MAXITEMS)
+                return BCME_NOTFOUND;
+
+        if (h) {
+                if (h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_INUSE) {
+                        *pktout = h->items[slot_id].pkt;
+                        if (remove_from_hanger) {
+                                h->items[slot_id].state =
+                                        WLFC_HANGER_ITEM_STATE_FREE;
+                                h->items[slot_id].pkt = NULL;
+                                h->items[slot_id].identifier = 0;
+                                h->popped++;
+                        }
+                }
+                else {
+                        h->failed_to_pop++;
+                        rc = BCME_NOTFOUND;
+                }
+        }
+        else
+                rc = BCME_BADARG;
+        return rc;
+}
+
+static int
+_dhd_wlfc_pushheader(athost_wl_status_info_t* ctx, void* p, bool tim_signal,
+        uint8 tim_bmp, uint8 mac_handle, uint32 htodtag)
+{
+        uint32 wl_pktinfo = 0;
+        uint8* wlh;
+        uint8 dataOffset;
+        uint8 fillers;
+        uint8 tim_signal_len = 0;
+
+        struct bdc_header *h;
+
+        if (tim_signal) {
+                tim_signal_len = 1 + 1 + WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP;
+        }
+
+        /* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
+        dataOffset = WLFC_CTL_VALUE_LEN_PKTTAG + 2 + tim_signal_len;
+        fillers = ROUNDUP(dataOffset, 4) - dataOffset;
+        dataOffset += fillers;
+
+        PKTPUSH(ctx->osh, p, dataOffset);
+        wlh = (uint8*) PKTDATA(ctx->osh, p);
+
+        wl_pktinfo = htol32(htodtag);
+
+        wlh[0] = WLFC_CTL_TYPE_PKTTAG;
+        wlh[1] = WLFC_CTL_VALUE_LEN_PKTTAG;
+        memcpy(&wlh[2], &wl_pktinfo, sizeof(uint32));
+
+        if (tim_signal_len) {
+                wlh[dataOffset - fillers - tim_signal_len ] =
+                        WLFC_CTL_TYPE_PENDING_TRAFFIC_BMP;
+                wlh[dataOffset - fillers - tim_signal_len + 1] =
+                        WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP;
+                wlh[dataOffset - fillers - tim_signal_len + 2] = mac_handle;
+                wlh[dataOffset - fillers - tim_signal_len + 3] = tim_bmp;
+        }
+        if (fillers)
+                memset(&wlh[dataOffset - fillers], WLFC_CTL_TYPE_FILLER, fillers);
+
+        PKTPUSH(ctx->osh, p, BDC_HEADER_LEN);
+        h = (struct bdc_header *)PKTDATA(ctx->osh, p);
+        h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
+        if (PKTSUMNEEDED(p))
+                h->flags |= BDC_FLAG_SUM_NEEDED;
+
+
+        h->priority = (PKTPRIO(p) & BDC_PRIORITY_MASK);
+        h->flags2 = 0;
+        h->dataOffset = dataOffset >> 2;
+        BDC_SET_IF_IDX(h, DHD_PKTTAG_IF(PKTTAG(p)));
+        return BCME_OK;
+}
+
+static int
+_dhd_wlfc_pullheader(athost_wl_status_info_t* ctx, void* pktbuf)
+{
+        struct bdc_header *h;
+
+        if (PKTLEN(ctx->osh, pktbuf) < BDC_HEADER_LEN) {
+                WLFC_DBGMESG(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+                           PKTLEN(ctx->osh, pktbuf), BDC_HEADER_LEN));
+                return BCME_ERROR;
+        }
+        h = (struct bdc_header *)PKTDATA(ctx->osh, pktbuf);
+
+        /* pull BDC header */
+        PKTPULL(ctx->osh, pktbuf, BDC_HEADER_LEN);
+        /* pull wl-header */
+        PKTPULL(ctx->osh, pktbuf, (h->dataOffset << 2));
+        return BCME_OK;
+}
+
+static wlfc_mac_descriptor_t*
+_dhd_wlfc_find_table_entry(athost_wl_status_info_t* ctx, void* p)
+{
+        int i;
+        wlfc_mac_descriptor_t* table = ctx->destination_entries.nodes;
+        uint8 ifid = DHD_PKTTAG_IF(PKTTAG(p));
+        uint8* dstn = DHD_PKTTAG_DSTN(PKTTAG(p));
+
+        /* no lookup necessary, only if this packet belongs to STA interface */
+        if (((ctx->destination_entries.interfaces[ifid].iftype == WLC_E_IF_ROLE_STA) ||
+                ETHER_ISMULTI(dstn) ||
+                (ctx->destination_entries.interfaces[ifid].iftype == WLC_E_IF_ROLE_P2P_CLIENT)) &&
+                (ctx->destination_entries.interfaces[ifid].occupied)) {
+                        return &ctx->destination_entries.interfaces[ifid];
+        }
+
+        for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+                if (table[i].occupied) {
+                        if (table[i].interface_id == ifid) {
+                                if (!memcmp(table[i].ea, dstn, ETHER_ADDR_LEN))
+                                        return &table[i];
+                        }
+                }
+        }
+        return &ctx->destination_entries.other;
+}
+
+static int
+_dhd_wlfc_rollback_packet_toq(athost_wl_status_info_t* ctx,
+        void* p, ewlfc_packet_state_t pkt_type, uint32 hslot)
+{
+        /*
+        put the packet back to the head of queue
+
+        - a packet from send-q will need to go back to send-q and not delay-q
+        since that will change the order of packets.
+        - suppressed packet goes back to suppress sub-queue
+        - pull out the header, if new or delayed packet
+
+        Note: hslot is used only when header removal is done.
+        */
+        wlfc_mac_descriptor_t* entry;
+        void* pktout;
+        int rc = BCME_OK;
+        int prec;
+
+        entry = _dhd_wlfc_find_table_entry(ctx, p);
+        prec = DHD_PKTTAG_FIFO(PKTTAG(p));
+        if (entry != NULL) {
+                if (pkt_type == eWLFC_PKTTYPE_SUPPRESSED) {
+                        /* wl-header is saved for suppressed packets */
+                        if (WLFC_PKTQ_PENQ_HEAD(&entry->psq, ((prec << 1) + 1), p) == NULL) {
+                                WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                                rc = BCME_ERROR;
+                        }
+                }
+                else {
+                        /* remove header first */
+                        _dhd_wlfc_pullheader(ctx, p);
+
+                        if (pkt_type == eWLFC_PKTTYPE_DELAYED) {
+                                /* delay-q packets are going to delay-q */
+                                if (WLFC_PKTQ_PENQ_HEAD(&entry->psq, (prec << 1), p) == NULL) {
+                                        WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                                        rc = BCME_ERROR;
+                                }
+                        }
+                        else {
+                                /* these are going to SENDQ */
+                                if (WLFC_PKTQ_PENQ_HEAD(&ctx->SENDQ, prec, p) == NULL) {
+                                        WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                                        rc = BCME_ERROR;
+                                }
+                        }
+                        /* free the hanger slot */
+                        dhd_wlfc_hanger_poppkt(ctx->hanger, hslot, &pktout, 1);
+
+                        /* decrement sequence count */
+                        WLFC_DECR_SEQCOUNT(entry, prec);
+                }
+                /*
+                if this packet did not count against FIFO credit, it must have
+                taken a requested_credit from the firmware (for pspoll etc.)
+                */
+                if (!DHD_PKTTAG_CREDITCHECK(PKTTAG(p))) {
+                        entry->requested_credit++;
+                }
+        }
+        else {
+                WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                rc = BCME_ERROR;
+        }
+        if (rc != BCME_OK)
+                ctx->stats.rollback_failed++;
+        else
+                ctx->stats.rollback++;
+
+        return rc;
+}
+
+static void
+_dhd_wlfc_flow_control_check(athost_wl_status_info_t* ctx, struct pktq* pq, uint8 if_id)
+{
+        if ((pq->len <= WLFC_FLOWCONTROL_LOWATER) && (ctx->hostif_flow_state[if_id] == ON)) {
+                /* start traffic */
+                ctx->hostif_flow_state[if_id] = OFF;
+                /*
+                WLFC_DBGMESG(("qlen:%02d, if:%02d, ->OFF, start traffic %s()\n",
+                pq->len, if_id, __FUNCTION__));
+                */
+                WLFC_DBGMESG(("F"));
+                /* dhd_txflowcontrol(ctx->dhdp, if_id, OFF); */
+                ctx->toggle_host_if = 0;
+        }
+        if ((pq->len >= WLFC_FLOWCONTROL_HIWATER) && (ctx->hostif_flow_state[if_id] == OFF)) {
+                /* stop traffic */
+                ctx->hostif_flow_state[if_id] = ON;
+                /*
+                WLFC_DBGMESG(("qlen:%02d, if:%02d, ->ON, stop traffic   %s()\n",
+                pq->len, if_id, __FUNCTION__));
+                */
+                WLFC_DBGMESG(("N"));
+                /* dhd_txflowcontrol(ctx->dhdp, if_id, ON); */
+                ctx->host_ifidx = if_id;
+                ctx->toggle_host_if = 1;
+        }
+        return;
+}
+
+static int
+_dhd_wlfc_send_signalonly_packet(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+        uint8 ta_bmp)
+{
+        int rc = BCME_OK;
+        void* p = NULL;
+        int dummylen = ((dhd_pub_t *)ctx->dhdp)->hdrlen+ 12;
+
+        /* allocate a dummy packet */
+        p = PKTGET(ctx->osh, dummylen, TRUE);
+        if (p) {
+                PKTPULL(ctx->osh, p, dummylen);
+                DHD_PKTTAG_SET_H2DTAG(PKTTAG(p), 0);
+                _dhd_wlfc_pushheader(ctx, p, TRUE, ta_bmp, entry->mac_handle, 0);
+                DHD_PKTTAG_SETSIGNALONLY(PKTTAG(p), 1);
+#ifdef PROP_TXSTATUS_DEBUG
+                ctx->stats.signal_only_pkts_sent++;
+#endif
+                rc = dhd_bus_txdata(((dhd_pub_t *)ctx->dhdp)->bus, p);
+                if (rc != BCME_OK) {
+                        PKTFREE(ctx->osh, p, TRUE);
+                }
+        }
+        else {
+                DHD_ERROR(("%s: couldn't allocate new %d-byte packet\n",
+                           __FUNCTION__, dummylen));
+                rc = BCME_NOMEM;
+        }
+        return rc;
+}
+
+/* Return TRUE if traffic availability changed */
+static bool
+_dhd_wlfc_traffic_pending_check(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+        int prec)
+{
+        bool rc = FALSE;
+
+        if (entry->state == WLFC_STATE_CLOSE) {
+                if ((pktq_plen(&entry->psq, (prec << 1)) == 0) &&
+                        (pktq_plen(&entry->psq, ((prec << 1) + 1)) == 0)) {
+
+                        if (entry->traffic_pending_bmp & NBITVAL(prec)) {
+                                rc = TRUE;
+                                entry->traffic_pending_bmp =
+                                        entry->traffic_pending_bmp & ~ NBITVAL(prec);
+                        }
+                }
+                else {
+                        if (!(entry->traffic_pending_bmp & NBITVAL(prec))) {
+                                rc = TRUE;
+                                entry->traffic_pending_bmp =
+                                        entry->traffic_pending_bmp | NBITVAL(prec);
+                        }
+                }
+        }
+        if (rc) {
+                /* request a TIM update to firmware at the next piggyback opportunity */
+                if (entry->traffic_lastreported_bmp != entry->traffic_pending_bmp) {
+                        entry->send_tim_signal = 1;
+                        _dhd_wlfc_send_signalonly_packet(ctx, entry, entry->traffic_pending_bmp);
+                        entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
+                        entry->send_tim_signal = 0;
+                }
+                else {
+                        rc = FALSE;
+                }
+        }
+        return rc;
+}
+
+static int
+_dhd_wlfc_enque_suppressed(athost_wl_status_info_t* ctx, int prec, void* p)
+{
+        wlfc_mac_descriptor_t* entry;
+
+        entry = _dhd_wlfc_find_table_entry(ctx, p);
+        if (entry == NULL) {
+                WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                return BCME_NOTFOUND;
+        }
+        /*
+        - suppressed packets go to sub_queue[2*prec + 1] AND
+        - delayed packets go to sub_queue[2*prec + 0] to ensure
+        order of delivery.
+        */
+        if (WLFC_PKTQ_PENQ(&entry->psq, ((prec << 1) + 1), p) == NULL) {
+                ctx->stats.delayq_full_error++;
+                /* WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__)); */
+                WLFC_DBGMESG(("s"));
+                return BCME_ERROR;
+        }
+        /* A packet has been pushed, update traffic availability bitmap, if applicable */
+        _dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+        _dhd_wlfc_flow_control_check(ctx, &entry->psq, DHD_PKTTAG_IF(PKTTAG(p)));
+        return BCME_OK;
+}
+
+static int
+_dhd_wlfc_pretx_pktprocess(athost_wl_status_info_t* ctx,
+        wlfc_mac_descriptor_t* entry, void* p, int header_needed, uint32* slot)
+{
+        int rc = BCME_OK;
+        int hslot = WLFC_HANGER_MAXITEMS;
+        bool send_tim_update = FALSE;
+        uint32 htod = 0;
+        uint8 free_ctr;
+
+        *slot = hslot;
+
+        if (entry == NULL) {
+                entry = _dhd_wlfc_find_table_entry(ctx, p);
+        }
+
+        if (entry == NULL) {
+                WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                return BCME_ERROR;
+        }
+        if (entry->send_tim_signal) {
+                send_tim_update = TRUE;
+                entry->send_tim_signal = 0;
+                entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
+        }
+        if (header_needed) {
+                hslot = dhd_wlfc_hanger_get_free_slot(ctx->hanger);
+                free_ctr = WLFC_SEQCOUNT(entry, DHD_PKTTAG_FIFO(PKTTAG(p)));
+                DHD_PKTTAG_SET_H2DTAG(PKTTAG(p), htod);
+        }
+        else {
+                hslot = WLFC_PKTID_HSLOT_GET(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+                free_ctr = WLFC_PKTID_FREERUNCTR_GET(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+        }
+        WLFC_PKTID_HSLOT_SET(htod, hslot);
+        WLFC_PKTID_FREERUNCTR_SET(htod, free_ctr);
+        DHD_PKTTAG_SETPKTDIR(PKTTAG(p), 1);
+        WL_TXSTATUS_SET_FLAGS(htod, WLFC_PKTFLAG_PKTFROMHOST);
+        WL_TXSTATUS_SET_FIFO(htod, DHD_PKTTAG_FIFO(PKTTAG(p)));
+        WLFC_PKTFLAG_SET_GENERATION(htod, entry->generation);
+
+        if (!DHD_PKTTAG_CREDITCHECK(PKTTAG(p))) {
+                /*
+                Indicate that this packet is being sent in response to an
+                explicit request from the firmware side.
+                */
+                WLFC_PKTFLAG_SET_PKTREQUESTED(htod);
+        }
+        else {
+                WLFC_PKTFLAG_CLR_PKTREQUESTED(htod);
+        }
+        if (header_needed) {
+                rc = _dhd_wlfc_pushheader(ctx, p, send_tim_update,
+                        entry->traffic_lastreported_bmp, entry->mac_handle, htod);
+                if (rc == BCME_OK) {
+                        DHD_PKTTAG_SET_H2DTAG(PKTTAG(p), htod);
+                        /*
+                        a new header was created for this packet.
+                        push to hanger slot and scrub q. Since bus
+                        send succeeded, increment seq number as well.
+                        */
+                        rc = dhd_wlfc_hanger_pushpkt(ctx->hanger, p, hslot);
+                        if (rc == BCME_OK) {
+                                /* increment free running sequence count */
+                                WLFC_INCR_SEQCOUNT(entry, DHD_PKTTAG_FIFO(PKTTAG(p)));
+#ifdef PROP_TXSTATUS_DEBUG
+                                ((wlfc_hanger_t*)(ctx->hanger))->items[hslot].push_time =
+                                        OSL_SYSUPTIME();
+#endif
+                        }
+                        else {
+                                WLFC_DBGMESG(("%s() hanger_pushpkt() failed, rc: %d\n",
+                                        __FUNCTION__, rc));
+                        }
+                }
+        }
+        else {
+                /* remove old header */
+                _dhd_wlfc_pullheader(ctx, p);
+
+                hslot = WLFC_PKTID_HSLOT_GET(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+                free_ctr = WLFC_PKTID_FREERUNCTR_GET(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+                /* push new header */
+                _dhd_wlfc_pushheader(ctx, p, send_tim_update,
+                        entry->traffic_lastreported_bmp, entry->mac_handle, htod);
+        }
+        *slot = hslot;
+        return rc;
+}
+
+static int
+_dhd_wlfc_is_destination_closed(athost_wl_status_info_t* ctx,
+        wlfc_mac_descriptor_t* entry, int prec)
+{
+        if (ctx->destination_entries.interfaces[entry->interface_id].iftype ==
+                WLC_E_IF_ROLE_P2P_GO) {
+                /* - destination interface is of type p2p GO.
+                For a p2pGO interface, if the destination is OPEN but the interface is
+                CLOSEd, do not send traffic. But if the dstn is CLOSEd while there is
+                destination-specific-credit left send packets. This is because the
+                firmware storing the destination-specific-requested packet in queue.
+                */
+                if ((entry->state == WLFC_STATE_CLOSE) && (entry->requested_credit == 0) &&
+                        (entry->requested_packet == 0))
+                        return 1;
+        }
+        /* AP, p2p_go -> unicast desc entry, STA/p2p_cl -> interface desc. entry */
+        if (((entry->state == WLFC_STATE_CLOSE) && (entry->requested_credit == 0) &&
+                (entry->requested_packet == 0)) ||
+                (!(entry->ac_bitmap & (1 << prec))))
+                return 1;
+
+        return 0;
+}
+
+static void*
+_dhd_wlfc_deque_delayedq(athost_wl_status_info_t* ctx,
+        int prec, uint8* ac_credit_spent, uint8* needs_hdr, wlfc_mac_descriptor_t** entry_out)
+{
+        wlfc_mac_descriptor_t* entry;
+        wlfc_mac_descriptor_t* table;
+        uint8 token_pos;
+        int total_entries;
+        void* p = NULL;
+        int pout;
+        int i;
+
+        *entry_out = NULL;
+        token_pos = ctx->token_pos[prec];
+        /* most cases a packet will count against FIFO credit */
+        *ac_credit_spent = 1;
+        *needs_hdr = 1;
+
+        /* search all entries, include nodes as well as interfaces */
+        table = (wlfc_mac_descriptor_t*)&ctx->destination_entries;
+        total_entries = sizeof(ctx->destination_entries)/sizeof(wlfc_mac_descriptor_t);
+
+        for (i = 0; i < total_entries; i++) {
+                entry = &table[(token_pos + i) % total_entries];
+                if (entry->occupied) {
+                        if (!_dhd_wlfc_is_destination_closed(ctx, entry, prec)) {
+                                p = pktq_mdeq(&entry->psq,
+                                        /* higher precedence will be picked up first,
+                                        i.e. suppressed packets before delayed ones
+                                        */
+                                        (NBITVAL((prec << 1) + 1) | NBITVAL((prec << 1))),
+                                        &pout);
+                                if (p != NULL) {
+                                        /* did the packet come from suppress sub-queue? */
+                                        if (pout == ((prec << 1) + 1)) {
+                                                /*
+                                                this packet was suppressed and was sent on the bus
+                                                previously; this already has a header
+                                                */
+                                                *needs_hdr = 0;
+                                        }
+                                        if (entry->requested_credit > 0) {
+                                                entry->requested_credit--;
+#ifdef PROP_TXSTATUS_DEBUG
+                                                entry->dstncredit_sent_packets++;
+#endif
+                                                /*
+                                                if the packet was pulled out while destination is in
+                                                closed state but had a non-zero packets requested,
+                                                then this should not count against the FIFO credit.
+                                                That is due to the fact that the firmware will
+                                                most likely hold onto this packet until a suitable
+                                                time later to push it to the appropriate  AC FIFO.
+                                                */
+                                                if (entry->state == WLFC_STATE_CLOSE)
+                                                        *ac_credit_spent = 0;
+                                        }
+                                        else if (entry->requested_packet > 0) {
+                                                entry->requested_packet--;
+                                                DHD_PKTTAG_SETONETIMEPKTRQST(PKTTAG(p));
+                                                if (entry->state == WLFC_STATE_CLOSE)
+                                                        *ac_credit_spent = 0;
+                                        }
+                                        /* move token to ensure fair round-robin */
+                                        ctx->token_pos[prec] =
+                                                (token_pos + i + 1) % total_entries;
+                                        *entry_out = entry;
+                                        _dhd_wlfc_flow_control_check(ctx, &entry->psq,
+                                                DHD_PKTTAG_IF(PKTTAG(p)));
+                                        /*
+                                        A packet has been picked up, update traffic
+                                        availability bitmap, if applicable
+                                        */
+                                        _dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+                                        return p;
+                                }
+                        }
+                }
+        }
+        return NULL;
+}
+
+static void*
+_dhd_wlfc_deque_sendq(athost_wl_status_info_t* ctx, int prec, uint8* ac_credit_spent)
+{
+        wlfc_mac_descriptor_t* entry;
+        void* p;
+
+        /* most cases a packet will count against FIFO credit */
+        *ac_credit_spent = 1;
+
+        p = pktq_pdeq(&ctx->SENDQ, prec);
+        if (p != NULL) {
+                if (ETHER_ISMULTI(DHD_PKTTAG_DSTN(PKTTAG(p))))
+                        /* bc/mc packets do not have a delay queue */
+                        return p;
+
+                entry = _dhd_wlfc_find_table_entry(ctx, p);
+
+                if (entry == NULL) {
+                        WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                        return p;
+                }
+
+                while ((p != NULL) && _dhd_wlfc_is_destination_closed(ctx, entry, prec)) {
+                        /*
+                        - suppressed packets go to sub_queue[2*prec + 1] AND
+                        - delayed packets go to sub_queue[2*prec + 0] to ensure
+                        order of delivery.
+                        */
+                        if (WLFC_PKTQ_PENQ(&entry->psq, (prec << 1), p) == NULL) {
+                                WLFC_DBGMESG(("D"));
+                                /* dhd_txcomplete(ctx->dhdp, p, FALSE); */
+                                PKTFREE(ctx->osh, p, TRUE);
+                                ctx->stats.delayq_full_error++;
+                        }
+                        /*
+                        A packet has been pushed, update traffic availability bitmap,
+                        if applicable
+                        */
+                        _dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+                        _dhd_wlfc_flow_control_check(ctx, &entry->psq, DHD_PKTTAG_IF(PKTTAG(p)));
+                        p = pktq_pdeq(&ctx->SENDQ, prec);
+                        if (p == NULL)
+                                break;
+
+                        entry = _dhd_wlfc_find_table_entry(ctx, p);
+
+                        if ((entry == NULL) || (ETHER_ISMULTI(DHD_PKTTAG_DSTN(PKTTAG(p))))) {
+                                return p;
+                        }
+                }
+                if (p) {
+                        if (entry->requested_packet == 0) {
+                                if (entry->requested_credit > 0)
+                                        entry->requested_credit--;
+                        }
+                        else {
+                                entry->requested_packet--;
+                                DHD_PKTTAG_SETONETIMEPKTRQST(PKTTAG(p));
+                        }
+                        if (entry->state == WLFC_STATE_CLOSE)
+                                *ac_credit_spent = 0;
+#ifdef PROP_TXSTATUS_DEBUG
+                        entry->dstncredit_sent_packets++;
+#endif
+                }
+                if (p)
+                        _dhd_wlfc_flow_control_check(ctx, &ctx->SENDQ, DHD_PKTTAG_IF(PKTTAG(p)));
+        }
+        return p;
+}
+
+static int
+_dhd_wlfc_mac_entry_update(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+        ewlfc_mac_entry_action_t action, uint8 ifid, uint8 iftype, uint8* ea)
+{
+        int rc = BCME_OK;
+
+        if (action == eWLFC_MAC_ENTRY_ACTION_ADD) {
+                entry->occupied = 1;
+                entry->state = WLFC_STATE_OPEN;
+                entry->requested_credit = 0;
+                entry->interface_id = ifid;
+                entry->iftype = iftype;
+                entry->ac_bitmap = 0xff; /* update this when handling APSD */
+                /* for an interface entry we may not care about the MAC address */
+                if (ea != NULL)
+                        memcpy(&entry->ea[0], ea, ETHER_ADDR_LEN);
+                pktq_init(&entry->psq, WLFC_PSQ_PREC_COUNT, WLFC_PSQ_LEN);
+        }
+        else if (action == eWLFC_MAC_ENTRY_ACTION_DEL) {
+                entry->occupied = 0;
+                entry->state = WLFC_STATE_CLOSE;
+                entry->requested_credit = 0;
+                /* enable after packets are queued-deqeued properly.
+                pktq_flush(dhd->osh, &entry->psq, FALSE, NULL, 0);
+                */
+        }
+        return rc;
+}
+
+int
+_dhd_wlfc_borrow_credit(athost_wl_status_info_t* ctx, uint8 available_credit_map, int borrower_ac)
+{
+        int lender_ac;
+        int rc = BCME_ERROR;
+
+        if (ctx == NULL || available_credit_map == 0) {
+                WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                return BCME_BADARG;
+        }
+
+        /* Borrow from lowest priority available AC (including BC/MC credits) */
+        for (lender_ac = 0; lender_ac <= AC_COUNT; lender_ac++) {
+                if ((available_credit_map && (1 << lender_ac)) &&
+                   (ctx->FIFO_credit[lender_ac] > 0)) {
+                        ctx->credits_borrowed[borrower_ac][lender_ac]++;
+                        ctx->FIFO_credit[lender_ac]--;
+                        rc = BCME_OK;
+                        break;
+                }
+        }
+
+        return rc;
+}
+
+int
+dhd_wlfc_interface_entry_update(void* state,
+        ewlfc_mac_entry_action_t action, uint8 ifid, uint8 iftype, uint8* ea)
+{
+        athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+        wlfc_mac_descriptor_t* entry;
+
+        if (ifid >= WLFC_MAX_IFNUM)
+                return BCME_BADARG;
+
+        entry = &ctx->destination_entries.interfaces[ifid];
+        return _dhd_wlfc_mac_entry_update(ctx, entry, action, ifid, iftype, ea);
+}
+
+int
+dhd_wlfc_FIFOcreditmap_update(void* state, uint8* credits)
+{
+        athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+
+        /* update the AC FIFO credit map */
+        ctx->FIFO_credit[0] = credits[0];
+        ctx->FIFO_credit[1] = credits[1];
+        ctx->FIFO_credit[2] = credits[2];
+        ctx->FIFO_credit[3] = credits[3];
+        /* credit for bc/mc packets */
+        ctx->FIFO_credit[4] = credits[4];
+        /* credit for ATIM FIFO is not used yet. */
+        ctx->FIFO_credit[5] = 0;
+        return BCME_OK;
+}
+
+int
+dhd_wlfc_enque_sendq(void* state, int prec, void* p)
+{
+        athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+
+        if ((state == NULL) ||
+                /* prec = AC_COUNT is used for bc/mc queue */
+                (prec > AC_COUNT) ||
+                (p == NULL)) {
+                WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                return BCME_BADARG;
+        }
+        if (FALSE == dhd_prec_enq(ctx->dhdp, &ctx->SENDQ, p, prec)) {
+                ctx->stats.sendq_full_error++;
+                /*
+                WLFC_DBGMESG(("Error: %s():%d, qlen:%d\n",
+                __FUNCTION__, __LINE__, ctx->SENDQ.len));
+                */
+                WLFC_HOST_FIFO_DROPPEDCTR_INC(ctx, prec);
+                WLFC_DBGMESG(("Q"));
+                PKTFREE(ctx->osh, p, TRUE);
+                return BCME_ERROR;
+        }
+        ctx->stats.pktin++;
+        /* _dhd_wlfc_flow_control_check(ctx, &ctx->SENDQ, DHD_PKTTAG_IF(PKTTAG(p))); */
+        return BCME_OK;
+}
+
+int
+_dhd_wlfc_handle_packet_commit(athost_wl_status_info_t* ctx, int ac,
+    dhd_wlfc_commit_info_t *commit_info, f_commitpkt_t fcommit, void* commit_ctx)
+{
+        uint32 hslot;
+        int     rc;
+
+        /*
+                if ac_fifo_credit_spent = 0
+
+                This packet will not count against the FIFO credit.
+                To ensure the txstatus corresponding to this packet
+                does not provide an implied credit (default behavior)
+                mark the packet accordingly.
+
+                if ac_fifo_credit_spent = 1
+
+                This is a normal packet and it counts against the FIFO
+                credit count.
+        */
+        DHD_PKTTAG_SETCREDITCHECK(PKTTAG(commit_info->p), commit_info->ac_fifo_credit_spent);
+        rc = _dhd_wlfc_pretx_pktprocess(ctx, commit_info->mac_entry, commit_info->p,
+             commit_info->needs_hdr, &hslot);
+
+        if (rc == BCME_OK)
+                rc = fcommit(commit_ctx, commit_info->p);
+        else
+                ctx->stats.generic_error++;
+
+        if (rc == BCME_OK) {
+                ctx->stats.pkt2bus++;
+                if (commit_info->ac_fifo_credit_spent) {
+                        ctx->stats.sendq_pkts[ac]++;
+                        WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac);
+                }
+        }
+        else {
+                /*
+                   bus commit has failed, rollback.
+                   - remove wl-header for a delayed packet
+                   - save wl-header header for suppressed packets
+                */
+                rc = _dhd_wlfc_rollback_packet_toq(ctx, commit_info->p,
+                     (commit_info->pkt_type), hslot);
+                if (rc != BCME_OK)
+                        ctx->stats.rollback_failed++;
+
+                rc = BCME_ERROR;
+        }
+
+        return rc;
+}
+
+int
+dhd_wlfc_commit_packets(void* state, f_commitpkt_t fcommit, void* commit_ctx)
+{
+        int ac;
+        int credit;
+        int rc;
+        dhd_wlfc_commit_info_t  commit_info;
+        athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+        int credit_count = 0;
+        int bus_retry_count = 0;
+        uint8 ac_available = 0;  /* Bitmask for 4 ACs + BC/MC */
+
+        if ((state == NULL) ||
+                (fcommit == NULL)) {
+                WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                return BCME_BADARG;
+        }
+
+        memset(&commit_info, 0, sizeof(commit_info));
+
+        /*
+        Commit packets for regular AC traffic. Higher priority first.
+        First, use up FIFO credits available to each AC. Based on distribution
+        and credits left, borrow from other ACs as applicable
+
+        -NOTE:
+        If the bus between the host and firmware is overwhelmed by the
+        traffic from host, it is possible that higher priority traffic
+        starves the lower priority queue. If that occurs often, we may
+        have to employ weighted round-robin or ucode scheme to avoid
+        low priority packet starvation.
+        */
+
+        for (ac = AC_COUNT; ac >= 0; ac--) {
+
+                int initial_credit_count = ctx->FIFO_credit[ac];
+
+                for (credit = 0; credit < ctx->FIFO_credit[ac];) {
+                        commit_info.p = _dhd_wlfc_deque_delayedq(ctx, ac,
+                                        &(commit_info.ac_fifo_credit_spent),
+                                        &(commit_info.needs_hdr),
+                                        &(commit_info.mac_entry));
+
+                        if (commit_info.p == NULL)
+                                break;
+
+                        commit_info.pkt_type = (commit_info.needs_hdr) ? eWLFC_PKTTYPE_DELAYED :
+                                eWLFC_PKTTYPE_SUPPRESSED;
+
+                        rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info,
+                             fcommit, commit_ctx);
+
+                        /* Bus commits may fail (e.g. flow control); abort after retries */
+                        if (rc == BCME_OK) {
+                                if (commit_info.ac_fifo_credit_spent) {
+                                        credit++;
+                                }
+                        }
+                        else {
+                                bus_retry_count++;
+                                if (bus_retry_count >= BUS_RETRIES) {
+                                        DHD_ERROR(("dhd_wlfc_commit_packets(): bus error\n"));
+                                        ctx->FIFO_credit[ac] -= credit;
+                                        return rc;
+                                }
+                        }
+                }
+
+                ctx->FIFO_credit[ac] -= credit;
+
+                /* packets from SENDQ are fresh and they'd need header and have no MAC entry */
+                commit_info.needs_hdr = 1;
+                commit_info.mac_entry = NULL;
+                commit_info.pkt_type = eWLFC_PKTTYPE_NEW;
+
+                for (credit = 0; credit < ctx->FIFO_credit[ac];) {
+                        commit_info.p = _dhd_wlfc_deque_sendq(ctx, ac,
+                                        &(commit_info.ac_fifo_credit_spent));
+                        if (commit_info.p == NULL)
+                                break;
+
+                        rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info,
+                             fcommit, commit_ctx);
+
+                        /* Bus commits may fail (e.g. flow control); abort after retries */
+                        if (rc == BCME_OK) {
+                                if (commit_info.ac_fifo_credit_spent) {
+                                        credit++;
+                                }
+                        }
+                        else {
+                                bus_retry_count++;
+                                if (bus_retry_count >= BUS_RETRIES) {
+                                        DHD_ERROR(("dhd_wlfc_commit_packets(): bus error\n"));
+                                        ctx->FIFO_credit[ac] -= credit;
+                                        return rc;
+                                }
+                        }
+                }
+
+                ctx->FIFO_credit[ac] -= credit;
+
+                /* If no credits were used, the queue is idle and can be re-used
+                   Note that resv credits cannot be borrowed
+                   */
+                if (initial_credit_count == ctx->FIFO_credit[ac]) {
+                        ac_available |= (1 << ac);
+                        credit_count += ctx->FIFO_credit[ac];
+                }
+        }
+
+        /* We borrow only for AC_BE and only if no other traffic seen for DEFER_PERIOD
+
+           Note that (ac_available & WLFC_AC_BE_TRAFFIC_ONLY) is done to:
+           a) ignore BC/MC for deferring borrow
+           b) ignore AC_BE being available along with other ACs
+                  (this should happen only for pure BC/MC traffic)
+
+           i.e. AC_VI, AC_VO, AC_BK all MUST be available (i.e. no traffic) and
+           we do not care if AC_BE and BC/MC are available or not
+           */
+        if ((ac_available & WLFC_AC_BE_TRAFFIC_ONLY) == WLFC_AC_BE_TRAFFIC_ONLY) {
+
+                if (ctx->allow_credit_borrow) {
+                        ac = 1;  /* Set ac to AC_BE and borrow credits */
+                }
+                else {
+                        int delta;
+                        int curr_t = OSL_SYSUPTIME();
+
+                        if (curr_t > ctx->borrow_defer_timestamp)
+                                delta = curr_t - ctx->borrow_defer_timestamp;
+                        else
+                                delta = 0xffffffff + curr_t - ctx->borrow_defer_timestamp;
+
+                        if (delta >= WLFC_BORROW_DEFER_PERIOD_MS) {
+                                /* Reset borrow but defer to next iteration (defensive borrowing) */
+                                ctx->allow_credit_borrow = TRUE;
+                                ctx->borrow_defer_timestamp = 0;
+                        }
+                        return BCME_OK;
+                }
+        }
+        else {
+                /* If we have multiple AC traffic, turn off borrowing, mark time and bail out */
+                ctx->allow_credit_borrow = FALSE;
+                ctx->borrow_defer_timestamp = OSL_SYSUPTIME();
+                return BCME_OK;
+        }
+
+        /* At this point, borrow all credits only for "ac" (which should be set above to AC_BE)
+           Generically use "ac" only in case we extend to all ACs in future
+           */
+        for (; (credit_count > 0);) {
+
+                commit_info.p = _dhd_wlfc_deque_delayedq(ctx, ac,
+                                &(commit_info.ac_fifo_credit_spent),
+                                &(commit_info.needs_hdr),
+                                &(commit_info.mac_entry));
+                if (commit_info.p == NULL)
+                        break;
+
+                commit_info.pkt_type = (commit_info.needs_hdr) ? eWLFC_PKTTYPE_DELAYED :
+                        eWLFC_PKTTYPE_SUPPRESSED;
+
+                rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info,
+                     fcommit, commit_ctx);
+
+                /* Bus commits may fail (e.g. flow control); abort after retries */
+                if (rc == BCME_OK) {
+                        if (commit_info.ac_fifo_credit_spent) {
+                                (void) _dhd_wlfc_borrow_credit(ctx, ac_available, ac);
+                                credit_count--;
+                        }
+                }
+                else {
+                        bus_retry_count++;
+                        if (bus_retry_count >= BUS_RETRIES) {
+                                DHD_ERROR(("dhd_wlfc_commit_packets(): bus error\n"));
+                                return rc;
+                        }
+                }
+        }
+
+        /* packets from SENDQ are fresh and they'd need header and have no MAC entry */
+        commit_info.needs_hdr = 1;
+        commit_info.mac_entry = NULL;
+        commit_info.pkt_type = eWLFC_PKTTYPE_NEW;
+
+        for (; (credit_count > 0);) {
+
+                commit_info.p = _dhd_wlfc_deque_sendq(ctx, ac,
+                                &(commit_info.ac_fifo_credit_spent));
+                if (commit_info.p == NULL)
+                        break;
+
+                rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info,
+                     fcommit, commit_ctx);
+
+                /* Bus commits may fail (e.g. flow control); abort after retries */
+                if (rc == BCME_OK) {
+                        if (commit_info.ac_fifo_credit_spent) {
+                                (void) _dhd_wlfc_borrow_credit(ctx, ac_available, ac);
+                                credit_count--;
+                        }
+                }
+                else {
+                        bus_retry_count++;
+                        if (bus_retry_count >= BUS_RETRIES) {
+                                DHD_ERROR(("dhd_wlfc_commit_packets(): bus error\n"));
+                                return rc;
+                        }
+                }
+        }
+
+        return BCME_OK;
+}
+
+static uint8
+dhd_wlfc_find_mac_desc_id_from_mac(dhd_pub_t *dhdp, uint8* ea)
+{
+        wlfc_mac_descriptor_t* table =
+                ((athost_wl_status_info_t*)dhdp->wlfc_state)->destination_entries.nodes;
+        uint8 table_index;
+
+        if (ea != NULL) {
+                for (table_index = 0; table_index < WLFC_MAC_DESC_TABLE_SIZE; table_index++) {
+                        if ((memcmp(ea, &table[table_index].ea[0], ETHER_ADDR_LEN) == 0) &&
+                                table[table_index].occupied)
+                                return table_index;
+                }
+        }
+        return WLFC_MAC_DESC_ID_INVALID;
+}
+
+void
+dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success)
+{
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+        void* p;
+        int fifo_id;
+
+        if (DHD_PKTTAG_SIGNALONLY(PKTTAG(txp))) {
+#ifdef PROP_TXSTATUS_DEBUG
+                wlfc->stats.signal_only_pkts_freed++;
+#endif
+                /* is this a signal-only packet? */
+                PKTFREE(wlfc->osh, txp, TRUE);
+                return;
+        }
+        if (!success) {
+                WLFC_DBGMESG(("At: %s():%d, bus_complete() failure for %p, htod_tag:0x%08x\n",
+                        __FUNCTION__, __LINE__, txp, DHD_PKTTAG_H2DTAG(PKTTAG(txp))));
+                dhd_wlfc_hanger_poppkt(wlfc->hanger, WLFC_PKTID_HSLOT_GET(DHD_PKTTAG_H2DTAG
+                        (PKTTAG(txp))), &p, 1);
+
+                /* indicate failure and free the packet */
+                dhd_txcomplete(dhd, txp, FALSE);
+
+                /* return the credit, if necessary */
+                if (DHD_PKTTAG_CREDITCHECK(PKTTAG(txp))) {
+                        int lender, credit_returned = 0; /* Note that borrower is fifo_id */
+
+                        fifo_id = DHD_PKTTAG_FIFO(PKTTAG(txp));
+
+                        /* Return credits to highest priority lender first */
+                        for (lender = AC_COUNT; lender >= 0; lender--) {
+                                if (wlfc->credits_borrowed[fifo_id][lender] > 0) {
+                                        wlfc->FIFO_credit[lender]++;
+                                        wlfc->credits_borrowed[fifo_id][lender]--;
+                                        credit_returned = 1;
+                                        break;
+                                }
+                        }
+
+                        if (!credit_returned) {
+                                wlfc->FIFO_credit[fifo_id]++;
+                        }
+                }
+
+                PKTFREE(wlfc->osh, txp, TRUE);
+        }
+        return;
+}
+
+/* Handle discard or suppress indication */
+static int
+dhd_wlfc_txstatus_update(dhd_pub_t *dhd, uint8* pkt_info)
+{
+        uint8   status_flag;
+        uint32  status;
+        int             ret;
+        int             remove_from_hanger = 1;
+        void*   pktbuf;
+        uint8   fifo_id;
+        wlfc_mac_descriptor_t* entry = NULL;
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+
+        memcpy(&status, pkt_info, sizeof(uint32));
+        status_flag = WL_TXSTATUS_GET_FLAGS(status);
+        wlfc->stats.txstatus_in++;
+
+        if (status_flag == WLFC_CTL_PKTFLAG_DISCARD) {
+                wlfc->stats.pkt_freed++;
+        }
+
+        else if (status_flag == WLFC_CTL_PKTFLAG_D11SUPPRESS) {
+                wlfc->stats.d11_suppress++;
+                remove_from_hanger = 0;
+        }
+
+        else if (status_flag == WLFC_CTL_PKTFLAG_WLSUPPRESS) {
+                wlfc->stats.wl_suppress++;
+                remove_from_hanger = 0;
+        }
+
+        else if (status_flag == WLFC_CTL_PKTFLAG_TOSSED_BYWLC) {
+                wlfc->stats.wlc_tossed_pkts++;
+        }
+
+        ret = dhd_wlfc_hanger_poppkt(wlfc->hanger,
+                WLFC_PKTID_HSLOT_GET(status), &pktbuf, remove_from_hanger);
+        if (ret != BCME_OK) {
+                /* do something */
+                return ret;
+        }
+
+        if (!remove_from_hanger) {
+                /* this packet was suppressed */
+
+                entry = _dhd_wlfc_find_table_entry(wlfc, pktbuf);
+                entry->generation = WLFC_PKTID_GEN(status);
+        }
+
+#ifdef PROP_TXSTATUS_DEBUG
+        {
+                uint32 new_t = OSL_SYSUPTIME();
+                uint32 old_t;
+                uint32 delta;
+                old_t = ((wlfc_hanger_t*)(wlfc->hanger))->items[
+                        WLFC_PKTID_HSLOT_GET(status)].push_time;
+
+
+                wlfc->stats.latency_sample_count++;
+                if (new_t > old_t)
+                        delta = new_t - old_t;
+                else
+                        delta = 0xffffffff + new_t - old_t;
+                wlfc->stats.total_status_latency += delta;
+                wlfc->stats.latency_most_recent = delta;
+
+                wlfc->stats.deltas[wlfc->stats.idx_delta++] = delta;
+                if (wlfc->stats.idx_delta == sizeof(wlfc->stats.deltas)/sizeof(uint32))
+                        wlfc->stats.idx_delta = 0;
+        }
+#endif /* PROP_TXSTATUS_DEBUG */
+
+        fifo_id = DHD_PKTTAG_FIFO(PKTTAG(pktbuf));
+
+        /* pick up the implicit credit from this packet */
+        if (DHD_PKTTAG_CREDITCHECK(PKTTAG(pktbuf))) {
+                if (wlfc->proptxstatus_mode == WLFC_FCMODE_IMPLIED_CREDIT) {
+
+                        int lender, credit_returned = 0; /* Note that borrower is fifo_id */
+
+                        /* Return credits to highest priority lender first */
+                        for (lender = AC_COUNT; lender >= 0; lender--)  {
+                                if (wlfc->credits_borrowed[fifo_id][lender] > 0) {
+                                        wlfc->FIFO_credit[lender]++;
+                                        wlfc->credits_borrowed[fifo_id][lender]--;
+                                        credit_returned = 1;
+                                        break;
+                                }
+                        }
+
+                        if (!credit_returned) {
+                                wlfc->FIFO_credit[fifo_id]++;
+                        }
+                }
+        }
+        else {
+                /*
+                if this packet did not count against FIFO credit, it must have
+                taken a requested_credit from the destination entry (for pspoll etc.)
+                */
+                if (!entry) {
+
+                        entry = _dhd_wlfc_find_table_entry(wlfc, pktbuf);
+                }
+                if (!DHD_PKTTAG_ONETIMEPKTRQST(PKTTAG(pktbuf)))
+                        entry->requested_credit++;
+#ifdef PROP_TXSTATUS_DEBUG
+                entry->dstncredit_acks++;
+#endif
+        }
+        if ((status_flag == WLFC_CTL_PKTFLAG_D11SUPPRESS) ||
+                (status_flag == WLFC_CTL_PKTFLAG_WLSUPPRESS)) {
+                ret = _dhd_wlfc_enque_suppressed(wlfc, fifo_id, pktbuf);
+                if (ret != BCME_OK) {
+                        /* delay q is full, drop this packet */
+                        dhd_wlfc_hanger_poppkt(wlfc->hanger, WLFC_PKTID_HSLOT_GET(status),
+                        &pktbuf, 1);
+
+                        /* indicate failure and free the packet */
+                        dhd_txcomplete(dhd, pktbuf, FALSE);
+                        PKTFREE(wlfc->osh, pktbuf, TRUE);
+                }
+        }
+        else {
+                dhd_txcomplete(dhd, pktbuf, TRUE);
+                /* free the packet */
+                PKTFREE(wlfc->osh, pktbuf, TRUE);
+        }
+        return BCME_OK;
+}
+
+static int
+dhd_wlfc_fifocreditback_indicate(dhd_pub_t *dhd, uint8* credits)
+{
+        int i;
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+        for (i = 0; i < WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK; i++) {
+#ifdef PROP_TXSTATUS_DEBUG
+                wlfc->stats.fifo_credits_back[i] += credits[i];
+#endif
+                /* update FIFO credits */
+                if (wlfc->proptxstatus_mode == WLFC_FCMODE_EXPLICIT_CREDIT)
+                {
+                        int lender; /* Note that borrower is i */
+
+                        /* Return credits to highest priority lender first */
+                        for (lender = AC_COUNT; (lender >= 0) && (credits[i] > 0); lender--) {
+                                if (wlfc->credits_borrowed[i][lender] > 0) {
+                                        if (credits[i] >= wlfc->credits_borrowed[i][lender]) {
+                                                credits[i] -= wlfc->credits_borrowed[i][lender];
+                                                wlfc->FIFO_credit[lender] +=
+                                                    wlfc->credits_borrowed[i][lender];
+                                                wlfc->credits_borrowed[i][lender] = 0;
+                                        }
+                                        else {
+                                                wlfc->credits_borrowed[i][lender] -= credits[i];
+                                                wlfc->FIFO_credit[lender] += credits[i];
+                                                credits[i] = 0;
+                                        }
+                                }
+                        }
+
+                        /* If we have more credits left over, these must belong to the AC */
+                        if (credits[i] > 0) {
+                                wlfc->FIFO_credit[i] += credits[i];
+                        }
+                }
+        }
+
+        return BCME_OK;
+}
+
+static int
+dhd_wlfc_rssi_indicate(dhd_pub_t *dhd, uint8* rssi)
+{
+        (void)dhd;
+        (void)rssi;
+        return BCME_OK;
+}
+
+static int
+dhd_wlfc_mac_table_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+        int rc;
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+        wlfc_mac_descriptor_t* table;
+        uint8 existing_index;
+        uint8 table_index;
+        uint8 ifid;
+        uint8* ea;
+
+        WLFC_DBGMESG(("%s(), mac [%02x:%02x:%02x:%02x:%02x:%02x],%s,idx:%d,id:0x%02x\n",
+                __FUNCTION__, value[2], value[3], value[4], value[5], value[6], value[7],
+                ((type == WLFC_CTL_TYPE_MACDESC_ADD) ? "ADD":"DEL"),
+                WLFC_MAC_DESC_GET_LOOKUP_INDEX(value[0]), value[0]));
+
+        table = wlfc->destination_entries.nodes;
+        table_index = WLFC_MAC_DESC_GET_LOOKUP_INDEX(value[0]);
+        ifid = value[1];
+        ea = &value[2];
+
+        if (type == WLFC_CTL_TYPE_MACDESC_ADD) {
+                existing_index = dhd_wlfc_find_mac_desc_id_from_mac(dhd, &value[2]);
+                if (existing_index == WLFC_MAC_DESC_ID_INVALID) {
+                        /* this MAC entry does not exist, create one */
+                        if (!table[table_index].occupied) {
+                                table[table_index].mac_handle = value[0];
+                                rc = _dhd_wlfc_mac_entry_update(wlfc, &table[table_index],
+                                eWLFC_MAC_ENTRY_ACTION_ADD, ifid,
+                                wlfc->destination_entries.interfaces[ifid].iftype,
+                                ea);
+                        }
+                        else {
+                                /* the space should have been empty, but it's not */
+                                wlfc->stats.mac_update_failed++;
+                        }
+                }
+                else {
+                        /*
+                        there is an existing entry, move it to new index
+                        if necessary.
+                        */
+                        if (existing_index != table_index) {
+                                /* if we already have an entry, free the old one */
+                                table[existing_index].occupied = 0;
+                                table[existing_index].state = WLFC_STATE_CLOSE;
+                                table[existing_index].requested_credit = 0;
+                                table[existing_index].interface_id = 0;
+                        }
+                }
+        }
+        if (type == WLFC_CTL_TYPE_MACDESC_DEL) {
+                if (table[table_index].occupied) {
+                                rc = _dhd_wlfc_mac_entry_update(wlfc, &table[table_index],
+                                        eWLFC_MAC_ENTRY_ACTION_DEL, ifid,
+                                        wlfc->destination_entries.interfaces[ifid].iftype,
+                                        ea);
+                }
+                else {
+                        /* the space should have been occupied, but it's not */
+                        wlfc->stats.mac_update_failed++;
+                }
+        }
+        return BCME_OK;
+}
+
+static int
+dhd_wlfc_psmode_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+        /* Handle PS on/off indication */
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+        wlfc_mac_descriptor_t* table;
+        wlfc_mac_descriptor_t* desc;
+        uint8 mac_handle = value[0];
+        int i;
+
+        table = wlfc->destination_entries.nodes;
+        desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+        if (desc->occupied) {
+                /* a fresh PS mode should wipe old ps credits? */
+                desc->requested_credit = 0;
+                if (type == WLFC_CTL_TYPE_MAC_OPEN) {
+                        desc->state = WLFC_STATE_OPEN;
+                        DHD_WLFC_CTRINC_MAC_OPEN(desc);
+                }
+                else {
+                        desc->state = WLFC_STATE_CLOSE;
+                        DHD_WLFC_CTRINC_MAC_CLOSE(desc);
+                        /*
+                        Indicate to firmware if there is any traffic pending.
+                        */
+                        for (i = AC_BE; i < AC_COUNT; i++) {
+                                _dhd_wlfc_traffic_pending_check(wlfc, desc, i);
+                        }
+                }
+        }
+        else {
+                wlfc->stats.psmode_update_failed++;
+        }
+        return BCME_OK;
+}
+
+static int
+dhd_wlfc_interface_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+        /* Handle PS on/off indication */
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+        wlfc_mac_descriptor_t* table;
+        uint8 if_id = value[0];
+
+        if (if_id < WLFC_MAX_IFNUM) {
+                table = wlfc->destination_entries.interfaces;
+                if (table[if_id].occupied) {
+                        if (type == WLFC_CTL_TYPE_INTERFACE_OPEN) {
+                                table[if_id].state = WLFC_STATE_OPEN;
+                                /* WLFC_DBGMESG(("INTERFACE[%d] OPEN\n", if_id)); */
+                        }
+                        else {
+                                table[if_id].state = WLFC_STATE_CLOSE;
+                                /* WLFC_DBGMESG(("INTERFACE[%d] CLOSE\n", if_id)); */
+                        }
+                        return BCME_OK;
+                }
+        }
+        wlfc->stats.interface_update_failed++;
+
+        return BCME_OK;
+}
+
+static int
+dhd_wlfc_credit_request(dhd_pub_t *dhd, uint8* value)
+{
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+        wlfc_mac_descriptor_t* table;
+        wlfc_mac_descriptor_t* desc;
+        uint8 mac_handle;
+        uint8 credit;
+
+        table = wlfc->destination_entries.nodes;
+        mac_handle = value[1];
+        credit = value[0];
+
+        desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+        if (desc->occupied) {
+                desc->requested_credit = credit;
+
+                desc->ac_bitmap = value[2];
+        }
+        else {
+                wlfc->stats.credit_request_failed++;
+        }
+        return BCME_OK;
+}
+
+static int
+dhd_wlfc_packet_request(dhd_pub_t *dhd, uint8* value)
+{
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+        wlfc_mac_descriptor_t* table;
+        wlfc_mac_descriptor_t* desc;
+        uint8 mac_handle;
+        uint8 packet_count;
+
+        table = wlfc->destination_entries.nodes;
+        mac_handle = value[1];
+        packet_count = value[0];
+
+        desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+        if (desc->occupied) {
+                desc->requested_packet = packet_count;
+
+                desc->ac_bitmap = value[2];
+        }
+        else {
+                wlfc->stats.packet_request_failed++;
+        }
+        return BCME_OK;
+}
+
+static int
+dhd_wlfc_parse_header_info(dhd_pub_t *dhd, void* pktbuf, int tlv_hdr_len)
+{
+        uint8 type, len;
+        uint8* value;
+        uint8* tmpbuf;
+        uint16 remainder = tlv_hdr_len;
+        uint16 processed = 0;
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+        tmpbuf = (uint8*)PKTDATA(dhd->osh, pktbuf);
+        if (remainder) {
+                while ((processed < (WLFC_MAX_PENDING_DATALEN * 2)) && (remainder > 0)) {
+                        type = tmpbuf[processed];
+                        if (type == WLFC_CTL_TYPE_FILLER) {
+                                remainder -= 1;
+                                processed += 1;
+                                continue;
+                        }
+
+                        len  = tmpbuf[processed + 1];
+                        value = &tmpbuf[processed + 2];
+
+                        if (remainder < (2 + len))
+                                break;
+
+                        remainder -= 2 + len;
+                        processed += 2 + len;
+                        if (type == WLFC_CTL_TYPE_TXSTATUS)
+                                dhd_wlfc_txstatus_update(dhd, value);
+
+                        else if (type == WLFC_CTL_TYPE_FIFO_CREDITBACK)
+                                dhd_wlfc_fifocreditback_indicate(dhd, value);
+
+                        else if (type == WLFC_CTL_TYPE_RSSI)
+                                dhd_wlfc_rssi_indicate(dhd, value);
+
+                        else if (type == WLFC_CTL_TYPE_MAC_REQUEST_CREDIT)
+                                dhd_wlfc_credit_request(dhd, value);
+
+                        else if (type == WLFC_CTL_TYPE_MAC_REQUEST_PACKET)
+                                dhd_wlfc_packet_request(dhd, value);
+
+                        else if ((type == WLFC_CTL_TYPE_MAC_OPEN) ||
+                                (type == WLFC_CTL_TYPE_MAC_CLOSE))
+                                dhd_wlfc_psmode_update(dhd, value, type);
+
+                        else if ((type == WLFC_CTL_TYPE_MACDESC_ADD) ||
+                                (type == WLFC_CTL_TYPE_MACDESC_DEL))
+                                dhd_wlfc_mac_table_update(dhd, value, type);
+
+                        else if ((type == WLFC_CTL_TYPE_INTERFACE_OPEN) ||
+                                (type == WLFC_CTL_TYPE_INTERFACE_CLOSE)) {
+                                dhd_wlfc_interface_update(dhd, value, type);
+                        }
+                }
+                if (remainder != 0) {
+                        /* trouble..., something is not right */
+                        wlfc->stats.tlv_parse_failed++;
+                }
+        }
+        return BCME_OK;
+}
+
+int
+dhd_wlfc_init(dhd_pub_t *dhd)
+{
+        char iovbuf[12]; /* Room for "tlv" + '\0' + parameter */
+        /* enable all signals & indicate host proptxstatus logic is active */
+        uint32 tlv = dhd->wlfc_enabled?
+                WLFC_FLAGS_RSSI_SIGNALS |
+                WLFC_FLAGS_XONXOFF_SIGNALS |
+                WLFC_FLAGS_CREDIT_STATUS_SIGNALS |
+                WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE : 0;
+
+
+        /*
+        try to enable/disable signaling by sending "tlv" iovar. if that fails,
+        fallback to no flow control? Print a message for now.
+        */
+
+        /* enable proptxtstatus signaling by default */
+        bcm_mkiovar("tlv", (char *)&tlv, 4, iovbuf, sizeof(iovbuf));
+        if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0) < 0) {
+                DHD_ERROR(("dhd_wlfc_init(): failed to enable/disable bdcv2 tlv signaling\n"));
+        }
+        else {
+                /*
+                Leaving the message for now, it should be removed after a while; once
+                the tlv situation is stable.
+                */
+                DHD_ERROR(("dhd_wlfc_init(): successfully %s bdcv2 tlv signaling, %d\n",
+                        dhd->wlfc_enabled?"enabled":"disabled", tlv));
+        }
+        return BCME_OK;
+}
+
+int
+dhd_wlfc_enable(dhd_pub_t *dhd)
+{
+        int i;
+        athost_wl_status_info_t* wlfc;
+
+        if (!dhd->wlfc_enabled || dhd->wlfc_state)
+                return BCME_OK;
+
+        /* allocate space to track txstatus propagated from firmware */
+        dhd->wlfc_state = MALLOC(dhd->osh, sizeof(athost_wl_status_info_t));
+        if (dhd->wlfc_state == NULL)
+                return BCME_NOMEM;
+
+        /* initialize state space */
+        wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+        memset(wlfc, 0, sizeof(athost_wl_status_info_t));
+
+        /* remember osh & dhdp */
+        wlfc->osh = dhd->osh;
+        wlfc->dhdp = dhd;
+
+        wlfc->hanger =
+                dhd_wlfc_hanger_create(dhd->osh, WLFC_HANGER_MAXITEMS);
+        if (wlfc->hanger == NULL) {
+                MFREE(dhd->osh, dhd->wlfc_state, sizeof(athost_wl_status_info_t));
+                dhd->wlfc_state = NULL;
+                return BCME_NOMEM;
+        }
+
+        /* initialize all interfaces to accept traffic */
+        for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+                wlfc->hostif_flow_state[i] = OFF;
+        }
+
+        /*
+        create the SENDQ containing
+        sub-queues for all AC precedences + 1 for bc/mc traffic
+        */
+        pktq_init(&wlfc->SENDQ, (AC_COUNT + 1), WLFC_SENDQ_LEN);
+
+        wlfc->destination_entries.other.state = WLFC_STATE_OPEN;
+        /* bc/mc FIFO is always open [credit aside], i.e. b[5] */
+        wlfc->destination_entries.other.ac_bitmap = 0x1f;
+        wlfc->destination_entries.other.interface_id = 0;
+
+        wlfc->proptxstatus_mode = WLFC_FCMODE_EXPLICIT_CREDIT;
+
+        wlfc->allow_credit_borrow = TRUE;
+        wlfc->borrow_defer_timestamp = 0;
+
+        return BCME_OK;
+}
+
+/* release all packet resources */
+void
+dhd_wlfc_cleanup(dhd_pub_t *dhd)
+{
+        int i;
+        int total_entries;
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+        wlfc_mac_descriptor_t* table;
+        wlfc_hanger_t* h;
+
+        if (dhd->wlfc_state == NULL)
+                return;
+
+        total_entries = sizeof(wlfc->destination_entries)/sizeof(wlfc_mac_descriptor_t);
+        /* search all entries, include nodes as well as interfaces */
+        table = (wlfc_mac_descriptor_t*)&wlfc->destination_entries;
+
+        for (i = 0; i < total_entries; i++) {
+                if (table[i].occupied) {
+                        if (table[i].psq.len) {
+                                WLFC_DBGMESG(("%s(): DELAYQ[%d].len = %d\n",
+                                        __FUNCTION__, i, table[i].psq.len));
+                                /* release packets held in DELAYQ */
+                                pktq_flush(wlfc->osh, &table[i].psq, TRUE, NULL, 0);
+                        }
+                        table[i].occupied = 0;
+                }
+        }
+        /* release packets held in SENDQ */
+        if (wlfc->SENDQ.len)
+                pktq_flush(wlfc->osh, &wlfc->SENDQ, TRUE, NULL, 0);
+        /* any in the hanger? */
+        h = (wlfc_hanger_t*)wlfc->hanger;
+        for (i = 0; i < h->max_items; i++) {
+                if (h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE) {
+                        PKTFREE(wlfc->osh, h->items[i].pkt, TRUE);
+                }
+        }
+        return;
+}
+
+void
+dhd_wlfc_deinit(dhd_pub_t *dhd)
+{
+        /* cleanup all psq related resources */
+        athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)
+                dhd->wlfc_state;
+
+        if (dhd->wlfc_state == NULL)
+                return;
+
+#ifdef PROP_TXSTATUS_DEBUG
+        {
+                int i;
+                wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+                for (i = 0; i < h->max_items; i++) {
+                        if (h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE) {
+                                WLFC_DBGMESG(("%s() pkt[%d] = 0x%p, FIFO_credit_used:%d\n",
+                                        __FUNCTION__, i, h->items[i].pkt,
+                                        DHD_PKTTAG_CREDITCHECK(PKTTAG(h->items[i].pkt))));
+                        }
+                }
+        }
+#endif
+        /* delete hanger */
+        dhd_wlfc_hanger_delete(dhd->osh, wlfc->hanger);
+
+        /* free top structure */
+        MFREE(dhd->osh, dhd->wlfc_state, sizeof(athost_wl_status_info_t));
+        dhd->wlfc_state = NULL;
+        return;
+}
+#endif /* PROP_TXSTATUS */
+
+void
+dhd_prot_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+        bcm_bprintf(strbuf, "Protocol CDC: reqid %d\n", dhdp->prot->reqid);
+#ifdef PROP_TXSTATUS
+        if (dhdp->wlfc_state)
+                dhd_wlfc_dump(dhdp, strbuf);
+#endif
+}
+
+void
+dhd_prot_hdrpush(dhd_pub_t *dhd, int ifidx, void *pktbuf)
+{
+#ifdef BDC
+        struct bdc_header *h;
+#endif /* BDC */
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BDC
+        /* Push BDC header used to convey priority for buses that don't */
+
+        PKTPUSH(dhd->osh, pktbuf, BDC_HEADER_LEN);
+
+        h = (struct bdc_header *)PKTDATA(dhd->osh, pktbuf);
+
+        h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
+        if (PKTSUMNEEDED(pktbuf))
+                h->flags |= BDC_FLAG_SUM_NEEDED;
+
+
+        h->priority = (PKTPRIO(pktbuf) & BDC_PRIORITY_MASK);
+        h->flags2 = 0;
+        h->dataOffset = 0;
+#endif /* BDC */
+        BDC_SET_IF_IDX(h, ifidx);
+}
+
+int
+dhd_prot_hdrpull(dhd_pub_t *dhd, int *ifidx, void *pktbuf)
+{
+#ifdef BDC
+        struct bdc_header *h;
+#endif
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BDC
+        /* Pop BDC header used to convey priority for buses that don't */
+
+        if (PKTLEN(dhd->osh, pktbuf) < BDC_HEADER_LEN) {
+                DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+                           PKTLEN(dhd->osh, pktbuf), BDC_HEADER_LEN));
+                return BCME_ERROR;
+        }
+
+        h = (struct bdc_header *)PKTDATA(dhd->osh, pktbuf);
+
+        if ((*ifidx = BDC_GET_IF_IDX(h)) >= DHD_MAX_IFS) {
+                DHD_ERROR(("%s: rx data ifnum out of range (%d)\n",
+                           __FUNCTION__, *ifidx));
+                return BCME_ERROR;
+        }
+
+        if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) != BDC_PROTO_VER) {
+                DHD_ERROR(("%s: non-BDC packet received, flags = 0x%x\n",
+                           dhd_ifname(dhd, *ifidx), h->flags));
+                if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) == BDC_PROTO_VER_1)
+                        h->dataOffset = 0;
+                else
+                        return BCME_ERROR;
+        }
+
+        if (h->flags & BDC_FLAG_SUM_GOOD) {
+                DHD_INFO(("%s: BDC packet received with good rx-csum, flags 0x%x\n",
+                          dhd_ifname(dhd, *ifidx), h->flags));
+                PKTSETSUMGOOD(pktbuf, TRUE);
+        }
+
+        PKTSETPRIO(pktbuf, (h->priority & BDC_PRIORITY_MASK));
+        PKTPULL(dhd->osh, pktbuf, BDC_HEADER_LEN);
+#endif /* BDC */
+
+        if (PKTLEN(dhd->osh, pktbuf) < (uint32) (h->dataOffset << 2)) {
+                DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+                           PKTLEN(dhd->osh, pktbuf), (h->dataOffset * 4)));
+                return BCME_ERROR;
+        }
+
+#ifdef PROP_TXSTATUS
+        if (dhd->wlfc_state &&
+                ((athost_wl_status_info_t*)dhd->wlfc_state)->proptxstatus_mode
+                != WLFC_FCMODE_NONE &&
+                (!DHD_PKTTAG_PKTDIR(PKTTAG(pktbuf)))) {
+                /*
+                - parse txstatus only for packets that came from the firmware
+                */
+                dhd_os_wlfc_block(dhd);
+                dhd_wlfc_parse_header_info(dhd, pktbuf, (h->dataOffset << 2));
+                ((athost_wl_status_info_t*)dhd->wlfc_state)->stats.dhd_hdrpulls++;
+                dhd_wlfc_commit_packets(dhd->wlfc_state, (f_commitpkt_t)dhd_bus_txdata,
+                        (void *)dhd->bus);
+                dhd_os_wlfc_unblock(dhd);
+        }
+#endif /* PROP_TXSTATUS */
+        PKTPULL(dhd->osh, pktbuf, (h->dataOffset << 2));
+        return 0;
+}
+
+int
+dhd_prot_attach(dhd_pub_t *dhd)
+{
+        dhd_prot_t *cdc;
+
+        if (!(cdc = (dhd_prot_t *)DHD_OS_PREALLOC(dhd->osh, DHD_PREALLOC_PROT,
+                sizeof(dhd_prot_t)))) {
+                DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+                goto fail;
+        }
+        memset(cdc, 0, sizeof(dhd_prot_t));
+
+        /* ensure that the msg buf directly follows the cdc msg struct */
+        if ((uintptr)(&cdc->msg + 1) != (uintptr)cdc->buf) {
+                DHD_ERROR(("dhd_prot_t is not correctly defined\n"));
+                goto fail;
+        }
+
+        dhd->prot = cdc;
+#ifdef BDC
+        dhd->hdrlen += BDC_HEADER_LEN;
+#endif
+        dhd->maxctl = WLC_IOCTL_MAXLEN + sizeof(cdc_ioctl_t) + ROUND_UP_MARGIN;
+        return 0;
+
+fail:
+#ifndef DHD_USE_STATIC_BUF
+        if (cdc != NULL)
+                MFREE(dhd->osh, cdc, sizeof(dhd_prot_t));
+#endif
+        return BCME_NOMEM;
+}
+
+/* ~NOTE~ What if another thread is waiting on the semaphore?  Holding it? */
+void
+dhd_prot_detach(dhd_pub_t *dhd)
+{
+#ifdef PROP_TXSTATUS
+        dhd_wlfc_deinit(dhd);
+#endif
+#ifndef DHD_USE_STATIC_BUF
+        MFREE(dhd->osh, dhd->prot, sizeof(dhd_prot_t));
+#endif
+        dhd->prot = NULL;
+}
+
+void
+dhd_prot_dstats(dhd_pub_t *dhd)
+{
+        /* No stats from dongle added yet, copy bus stats */
+        dhd->dstats.tx_packets = dhd->tx_packets;
+        dhd->dstats.tx_errors = dhd->tx_errors;
+        dhd->dstats.rx_packets = dhd->rx_packets;
+        dhd->dstats.rx_errors = dhd->rx_errors;
+        dhd->dstats.rx_dropped = dhd->rx_dropped;
+        dhd->dstats.multicast = dhd->rx_multicast;
+        return;
+}
+
+int
+dhd_prot_init(dhd_pub_t *dhd)
+{
+        int ret = 0;
+        wlc_rev_info_t revinfo;
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+
+        /* Get the device rev info */
+        memset(&revinfo, 0, sizeof(revinfo));
+        ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_REVINFO, &revinfo, sizeof(revinfo), FALSE, 0);
+        if (ret < 0)
+                goto done;
+
+
+#ifdef PROP_TXSTATUS
+        ret = dhd_wlfc_init(dhd);
+#endif
+
+#if !defined(WL_CFG80211)
+        ret = dhd_preinit_ioctls(dhd);
+#endif /* WL_CFG80211 */
+
+        /* Always assumes wl for now */
+        dhd->iswl = TRUE;
+
+done:
+        return ret;
+}
+
+void
+dhd_prot_stop(dhd_pub_t *dhd)
+{
+        /* Nothing to do for CDC */
+}
diff --git a/drivers/net/wireless/bcmdhd/dhd_common.c b/drivers/net/wireless/bcmdhd/dhd_common.c
new file mode 100644
index 00000000000..372ec80c866
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_common.c
@@ -0,0 +1,2306 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), common DHD core.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_common.c 290546 2011-10-19 01:55:21Z $
+ */
+#include <typedefs.h>
+#include <osl.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+
+#include <bcmendian.h>
+#include <dngl_stats.h>
+#include <wlioctl.h>
+#include <dhd.h>
+
+#include <proto/bcmevent.h>
+
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <msgtrace.h>
+
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#include <proto/bt_amp_hci.h>
+#include <dhd_bta.h>
+#ifdef SET_RANDOM_MAC_SOFTAP
+#include <linux/random.h>
+#include <linux/jiffies.h>
+#endif
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+
+#ifdef WLMEDIA_HTSF
+extern void htsf_update(struct dhd_info *dhd, void *data);
+#endif
+int dhd_msg_level = DHD_ERROR_VAL;
+
+
+#include <wl_iw.h>
+
+char fw_path[MOD_PARAM_PATHLEN];
+char nv_path[MOD_PARAM_PATHLEN];
+
+#ifdef SOFTAP
+char fw_path2[MOD_PARAM_PATHLEN];
+extern bool softap_enabled;
+#endif
+
+/* Last connection success/failure status */
+uint32 dhd_conn_event;
+uint32 dhd_conn_status;
+uint32 dhd_conn_reason;
+
+#define htod32(i) i
+#define htod16(i) i
+#define dtoh32(i) i
+#define dtoh16(i) i
+extern int dhd_iscan_request(void * dhdp, uint16 action);
+extern void dhd_ind_scan_confirm(void *h, bool status);
+extern int dhd_iscan_in_progress(void *h);
+void dhd_iscan_lock(void);
+void dhd_iscan_unlock(void);
+extern int dhd_change_mtu(dhd_pub_t *dhd, int new_mtu, int ifidx);
+bool ap_cfg_running = FALSE;
+bool ap_fw_loaded = FALSE;
+
+
+#ifdef DHD_DEBUG
+const char dhd_version[] = "Dongle Host Driver, version " EPI_VERSION_STR "\nCompiled on "
+        __DATE__ " at " __TIME__;
+#else
+const char dhd_version[] = "Dongle Host Driver, version " EPI_VERSION_STR;
+#endif
+
+void dhd_set_timer(void *bus, uint wdtick);
+
+/* IOVar table */
+enum {
+        IOV_VERSION = 1,
+        IOV_MSGLEVEL,
+        IOV_BCMERRORSTR,
+        IOV_BCMERROR,
+        IOV_WDTICK,
+        IOV_DUMP,
+        IOV_CLEARCOUNTS,
+        IOV_LOGDUMP,
+        IOV_LOGCAL,
+        IOV_LOGSTAMP,
+        IOV_GPIOOB,
+        IOV_IOCTLTIMEOUT,
+        IOV_HCI_CMD,            /* HCI command */
+        IOV_HCI_ACL_DATA,       /* HCI data packet */
+#if defined(DHD_DEBUG)
+        IOV_CONS,
+        IOV_DCONSOLE_POLL,
+#endif /* defined(DHD_DEBUG) */
+#ifdef PROP_TXSTATUS
+        IOV_PROPTXSTATUS_ENABLE,
+        IOV_PROPTXSTATUS_MODE,
+#endif
+        IOV_BUS_TYPE,
+#ifdef WLMEDIA_HTSF
+        IOV_WLPKTDLYSTAT_SZ,
+#endif
+        IOV_CHANGEMTU,
+        IOV_LAST
+};
+
+const bcm_iovar_t dhd_iovars[] = {
+        {"version",     IOV_VERSION,    0,      IOVT_BUFFER,    sizeof(dhd_version) },
+#ifdef DHD_DEBUG
+        {"msglevel",    IOV_MSGLEVEL,   0,      IOVT_UINT32,    0 },
+#endif /* DHD_DEBUG */
+        {"bcmerrorstr", IOV_BCMERRORSTR, 0, IOVT_BUFFER,        BCME_STRLEN },
+        {"bcmerror",    IOV_BCMERROR,   0,      IOVT_INT8,      0 },
+        {"wdtick",      IOV_WDTICK, 0,  IOVT_UINT32,    0 },
+        {"dump",        IOV_DUMP,       0,      IOVT_BUFFER,    DHD_IOCTL_MAXLEN },
+#ifdef DHD_DEBUG
+        {"cons",        IOV_CONS,       0,      IOVT_BUFFER,    0 },
+        {"dconpoll",    IOV_DCONSOLE_POLL, 0,   IOVT_UINT32,    0 },
+#endif
+        {"clearcounts", IOV_CLEARCOUNTS, 0, IOVT_VOID,  0 },
+        {"gpioob",      IOV_GPIOOB,     0,      IOVT_UINT32,    0 },
+        {"ioctl_timeout",       IOV_IOCTLTIMEOUT,       0,      IOVT_UINT32,    0 },
+        {"HCI_cmd",     IOV_HCI_CMD,    0,      IOVT_BUFFER,    0},
+        {"HCI_ACL_data", IOV_HCI_ACL_DATA, 0,   IOVT_BUFFER,    0},
+#ifdef PROP_TXSTATUS
+        {"proptx",      IOV_PROPTXSTATUS_ENABLE,        0,      IOVT_UINT32,    0 },
+        /*
+        set the proptxtstatus operation mode:
+        0 - Do not do any proptxtstatus flow control
+        1 - Use implied credit from a packet status
+        2 - Use explicit credit
+        */
+        {"ptxmode",     IOV_PROPTXSTATUS_MODE,  0,      IOVT_UINT32,    0 },
+#endif
+        {"bustype", IOV_BUS_TYPE, 0, IOVT_UINT32, 0},
+#ifdef WLMEDIA_HTSF
+        {"pktdlystatsz", IOV_WLPKTDLYSTAT_SZ, 0, IOVT_UINT8, 0 },
+#endif
+        {"changemtu", IOV_CHANGEMTU, 0, IOVT_UINT32, 0 },
+        {NULL, 0, 0, 0, 0 }
+};
+
+struct dhd_cmn *
+dhd_common_init(uint16 devid, osl_t *osh)
+{
+        dhd_cmn_t *cmn;
+
+        /* Init global variables at run-time, not as part of the declaration.
+         * This is required to support init/de-init of the driver. Initialization
+         * of globals as part of the declaration results in non-deterministic
+         * behavior since the value of the globals may be different on the
+         * first time that the driver is initialized vs subsequent initializations.
+         */
+        /* Allocate private bus interface state */
+        if (!(cmn = MALLOC(osh, sizeof(dhd_cmn_t)))) {
+                DHD_ERROR(("%s: MALLOC failed\n", __FUNCTION__));
+                return NULL;
+        }
+        memset(cmn, 0, sizeof(dhd_cmn_t));
+        cmn->osh = osh;
+
+#ifdef CONFIG_BCMDHD_FW_PATH
+        bcm_strncpy_s(fw_path, sizeof(fw_path), CONFIG_BCMDHD_FW_PATH, MOD_PARAM_PATHLEN-1);
+#elif defined(CONFIG_BCMDHD_FW_DIR)  /* CONFIG_BCMDHD_FW_PATH */
+        sprintf(fw_path, "%s/bcm%x/fw_bcmdhd.bin", CONFIG_BCMDHD_FW_DIR, devid);
+#else
+        fw_path[0] = '\0';
+#endif /* CONFIG_BCMDHD_FW_DIR */
+#ifdef CONFIG_BCMDHD_NVRAM_PATH
+        bcm_strncpy_s(nv_path, sizeof(nv_path), CONFIG_BCMDHD_NVRAM_PATH, MOD_PARAM_PATHLEN-1);
+#elif defined(CONFIG_BCMDHD_NVRAM_DIR) /* CONFIG_BCMDHD_NVRAM_PATH */
+        sprintf(nv_path, "%s/nvram_%x.txt", CONFIG_BCMDHD_NVRAM_DIR, devid);
+#else
+        nv_path[0] = '\0';
+#endif /* CONFIG_BCMDHD_NVRAM_PATH */
+#ifdef SOFTAP
+        fw_path2[0] = '\0';
+#endif
+        DHD_ERROR(("bcmdhd: fw_path: %s nvram_path: %s\n", fw_path, nv_path));
+        return cmn;
+}
+
+void
+dhd_common_deinit(dhd_pub_t *dhd_pub, dhd_cmn_t *sa_cmn)
+{
+        osl_t *osh;
+        dhd_cmn_t *cmn;
+
+        if (dhd_pub != NULL)
+                cmn = dhd_pub->cmn;
+        else
+                cmn = sa_cmn;
+
+        if (!cmn)
+                return;
+
+        osh = cmn->osh;
+
+        if (dhd_pub != NULL)
+        dhd_pub->cmn = NULL;
+        MFREE(osh, cmn, sizeof(dhd_cmn_t));
+}
+
+static int
+dhd_dump(dhd_pub_t *dhdp, char *buf, int buflen)
+{
+        char eabuf[ETHER_ADDR_STR_LEN];
+
+        struct bcmstrbuf b;
+        struct bcmstrbuf *strbuf = &b;
+
+        bcm_binit(strbuf, buf, buflen);
+
+        /* Base DHD info */
+        bcm_bprintf(strbuf, "%s\n", dhd_version);
+        bcm_bprintf(strbuf, "\n");
+        bcm_bprintf(strbuf, "pub.up %d pub.txoff %d pub.busstate %d\n",
+                    dhdp->up, dhdp->txoff, dhdp->busstate);
+        bcm_bprintf(strbuf, "pub.hdrlen %d pub.maxctl %d pub.rxsz %d\n",
+                    dhdp->hdrlen, dhdp->maxctl, dhdp->rxsz);
+        bcm_bprintf(strbuf, "pub.iswl %d pub.drv_version %ld pub.mac %s\n",
+                    dhdp->iswl, dhdp->drv_version, bcm_ether_ntoa(&dhdp->mac, eabuf));
+        bcm_bprintf(strbuf, "pub.bcmerror %d tickcnt %d\n", dhdp->bcmerror, dhdp->tickcnt);
+
+        bcm_bprintf(strbuf, "dongle stats:\n");
+        bcm_bprintf(strbuf, "tx_packets %ld tx_bytes %ld tx_errors %ld tx_dropped %ld\n",
+                    dhdp->dstats.tx_packets, dhdp->dstats.tx_bytes,
+                    dhdp->dstats.tx_errors, dhdp->dstats.tx_dropped);
+        bcm_bprintf(strbuf, "rx_packets %ld rx_bytes %ld rx_errors %ld rx_dropped %ld\n",
+                    dhdp->dstats.rx_packets, dhdp->dstats.rx_bytes,
+                    dhdp->dstats.rx_errors, dhdp->dstats.rx_dropped);
+        bcm_bprintf(strbuf, "multicast %ld\n", dhdp->dstats.multicast);
+
+        bcm_bprintf(strbuf, "bus stats:\n");
+        bcm_bprintf(strbuf, "tx_packets %ld tx_multicast %ld tx_errors %ld\n",
+                    dhdp->tx_packets, dhdp->tx_multicast, dhdp->tx_errors);
+        bcm_bprintf(strbuf, "tx_ctlpkts %ld tx_ctlerrs %ld\n",
+                    dhdp->tx_ctlpkts, dhdp->tx_ctlerrs);
+        bcm_bprintf(strbuf, "rx_packets %ld rx_multicast %ld rx_errors %ld \n",
+                    dhdp->rx_packets, dhdp->rx_multicast, dhdp->rx_errors);
+        bcm_bprintf(strbuf, "rx_ctlpkts %ld rx_ctlerrs %ld rx_dropped %ld\n",
+                    dhdp->rx_ctlpkts, dhdp->rx_ctlerrs, dhdp->rx_dropped);
+        bcm_bprintf(strbuf, "rx_readahead_cnt %ld tx_realloc %ld\n",
+                    dhdp->rx_readahead_cnt, dhdp->tx_realloc);
+        bcm_bprintf(strbuf, "\n");
+
+        /* Add any prot info */
+        dhd_prot_dump(dhdp, strbuf);
+        bcm_bprintf(strbuf, "\n");
+
+        /* Add any bus info */
+        dhd_bus_dump(dhdp, strbuf);
+
+        return (!strbuf->size ? BCME_BUFTOOSHORT : 0);
+}
+
+int
+dhd_wl_ioctl_cmd(dhd_pub_t *dhd_pub, int cmd, void *arg, int len, uint8 set, int ifindex)
+{
+        wl_ioctl_t ioc;
+
+        ioc.cmd = cmd;
+        ioc.buf = arg;
+        ioc.len = len;
+        ioc.set = set;
+
+        return dhd_wl_ioctl(dhd_pub, ifindex, &ioc, arg, len);
+}
+
+
+int
+dhd_wl_ioctl(dhd_pub_t *dhd_pub, int ifindex, wl_ioctl_t *ioc, void *buf, int len)
+{
+        int ret;
+
+        dhd_os_proto_block(dhd_pub);
+
+        ret = dhd_prot_ioctl(dhd_pub, ifindex, ioc, buf, len);
+        if (!ret)
+                dhd_os_check_hang(dhd_pub, ifindex, ret);
+
+        dhd_os_proto_unblock(dhd_pub);
+        return ret;
+}
+
+static int
+dhd_doiovar(dhd_pub_t *dhd_pub, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+            void *params, int plen, void *arg, int len, int val_size)
+{
+        int bcmerror = 0;
+        int32 int_val = 0;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+        DHD_TRACE(("%s: actionid = %d; name %s\n", __FUNCTION__, actionid, name));
+
+        if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+                goto exit;
+
+        if (plen >= (int)sizeof(int_val))
+                bcopy(params, &int_val, sizeof(int_val));
+
+        switch (actionid) {
+        case IOV_GVAL(IOV_VERSION):
+                /* Need to have checked buffer length */
+                bcm_strncpy_s((char*)arg, len, dhd_version, len);
+                break;
+
+        case IOV_GVAL(IOV_MSGLEVEL):
+                int_val = (int32)dhd_msg_level;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_MSGLEVEL):
+                dhd_msg_level = int_val;
+                break;
+        case IOV_GVAL(IOV_BCMERRORSTR):
+                bcm_strncpy_s((char *)arg, len, bcmerrorstr(dhd_pub->bcmerror), BCME_STRLEN);
+                ((char *)arg)[BCME_STRLEN - 1] = 0x00;
+                break;
+
+        case IOV_GVAL(IOV_BCMERROR):
+                int_val = (int32)dhd_pub->bcmerror;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_GVAL(IOV_WDTICK):
+                int_val = (int32)dhd_watchdog_ms;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_WDTICK):
+                if (!dhd_pub->up) {
+                        bcmerror = BCME_NOTUP;
+                        break;
+                }
+                dhd_os_wd_timer(dhd_pub, (uint)int_val);
+                break;
+
+        case IOV_GVAL(IOV_DUMP):
+                bcmerror = dhd_dump(dhd_pub, arg, len);
+                break;
+
+#ifdef DHD_DEBUG
+        case IOV_GVAL(IOV_DCONSOLE_POLL):
+                int_val = (int32)dhd_console_ms;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_DCONSOLE_POLL):
+                dhd_console_ms = (uint)int_val;
+                break;
+
+        case IOV_SVAL(IOV_CONS):
+                if (len > 0)
+                        bcmerror = dhd_bus_console_in(dhd_pub, arg, len - 1);
+                break;
+#endif /* DHD_DEBUG */
+
+        case IOV_SVAL(IOV_CLEARCOUNTS):
+                dhd_pub->tx_packets = dhd_pub->rx_packets = 0;
+                dhd_pub->tx_errors = dhd_pub->rx_errors = 0;
+                dhd_pub->tx_ctlpkts = dhd_pub->rx_ctlpkts = 0;
+                dhd_pub->tx_ctlerrs = dhd_pub->rx_ctlerrs = 0;
+                dhd_pub->rx_dropped = 0;
+                dhd_pub->rx_readahead_cnt = 0;
+                dhd_pub->tx_realloc = 0;
+                dhd_pub->wd_dpc_sched = 0;
+                memset(&dhd_pub->dstats, 0, sizeof(dhd_pub->dstats));
+                dhd_bus_clearcounts(dhd_pub);
+#ifdef PROP_TXSTATUS
+                /* clear proptxstatus related counters */
+                if (dhd_pub->wlfc_state) {
+                        athost_wl_status_info_t *wlfc =
+                                (athost_wl_status_info_t*)dhd_pub->wlfc_state;
+                        wlfc_hanger_t* hanger;
+
+                        memset(&wlfc->stats, 0, sizeof(athost_wl_stat_counters_t));
+
+                        hanger = (wlfc_hanger_t*)wlfc->hanger;
+                        hanger->pushed = 0;
+                        hanger->popped = 0;
+                        hanger->failed_slotfind = 0;
+                        hanger->failed_to_pop = 0;
+                        hanger->failed_to_push = 0;
+                }
+#endif /* PROP_TXSTATUS */
+                break;
+
+
+        case IOV_GVAL(IOV_IOCTLTIMEOUT): {
+                int_val = (int32)dhd_os_get_ioctl_resp_timeout();
+                bcopy(&int_val, arg, sizeof(int_val));
+                break;
+        }
+
+        case IOV_SVAL(IOV_IOCTLTIMEOUT): {
+                if (int_val <= 0)
+                        bcmerror = BCME_BADARG;
+                else
+                        dhd_os_set_ioctl_resp_timeout((unsigned int)int_val);
+                break;
+        }
+
+        case IOV_SVAL(IOV_HCI_CMD): {
+                amp_hci_cmd_t *cmd = (amp_hci_cmd_t *)arg;
+
+                /* sanity check: command preamble present */
+                if (len < HCI_CMD_PREAMBLE_SIZE)
+                        return BCME_BUFTOOSHORT;
+
+                /* sanity check: command parameters are present */
+                if (len < (int)(HCI_CMD_PREAMBLE_SIZE + cmd->plen))
+                        return BCME_BUFTOOSHORT;
+
+                dhd_bta_docmd(dhd_pub, cmd, len);
+                break;
+        }
+
+        case IOV_SVAL(IOV_HCI_ACL_DATA): {
+                amp_hci_ACL_data_t *ACL_data = (amp_hci_ACL_data_t *)arg;
+
+                /* sanity check: HCI header present */
+                if (len < HCI_ACL_DATA_PREAMBLE_SIZE)
+                        return BCME_BUFTOOSHORT;
+
+                /* sanity check: ACL data is present */
+                if (len < (int)(HCI_ACL_DATA_PREAMBLE_SIZE + ACL_data->dlen))
+                        return BCME_BUFTOOSHORT;
+
+                dhd_bta_tx_hcidata(dhd_pub, ACL_data, len);
+                break;
+        }
+
+#ifdef PROP_TXSTATUS
+        case IOV_GVAL(IOV_PROPTXSTATUS_ENABLE):
+                int_val = dhd_pub->wlfc_enabled? 1 : 0;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_PROPTXSTATUS_ENABLE):
+                dhd_pub->wlfc_enabled = int_val? 1 : 0;
+                break;
+
+        case IOV_GVAL(IOV_PROPTXSTATUS_MODE): {
+                athost_wl_status_info_t *wlfc =
+                        (athost_wl_status_info_t*)dhd_pub->wlfc_state;
+                int_val = dhd_pub->wlfc_state ? (int32)wlfc->proptxstatus_mode : 0;
+                bcopy(&int_val, arg, val_size);
+                break;
+        }
+
+        case IOV_SVAL(IOV_PROPTXSTATUS_MODE):
+                if (dhd_pub->wlfc_state) {
+                        athost_wl_status_info_t *wlfc =
+                                (athost_wl_status_info_t*)dhd_pub->wlfc_state;
+                        wlfc->proptxstatus_mode = int_val & 0xff;
+                }
+                break;
+#endif /* PROP_TXSTATUS */
+
+        case IOV_GVAL(IOV_BUS_TYPE):
+                /* The dhd application queries the driver to check if its usb or sdio.  */
+#ifdef BCMDHDUSB
+                int_val = BUS_TYPE_USB;
+#endif
+                int_val = BUS_TYPE_SDIO;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+
+#ifdef WLMEDIA_HTSF
+        case IOV_GVAL(IOV_WLPKTDLYSTAT_SZ):
+                int_val = dhd_pub->htsfdlystat_sz;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_WLPKTDLYSTAT_SZ):
+                dhd_pub->htsfdlystat_sz = int_val & 0xff;
+                printf("Setting tsfdlystat_sz:%d\n", dhd_pub->htsfdlystat_sz);
+                break;
+#endif
+        case IOV_SVAL(IOV_CHANGEMTU):
+                int_val &= 0xffff;
+                bcmerror = dhd_change_mtu(dhd_pub, int_val, 0);
+                break;
+
+        default:
+                bcmerror = BCME_UNSUPPORTED;
+                break;
+        }
+
+exit:
+        DHD_TRACE(("%s: actionid %d, bcmerror %d\n", __FUNCTION__, actionid, bcmerror));
+        return bcmerror;
+}
+
+/* Store the status of a connection attempt for later retrieval by an iovar */
+void
+dhd_store_conn_status(uint32 event, uint32 status, uint32 reason)
+{
+        /* Do not overwrite a WLC_E_PRUNE with a WLC_E_SET_SSID
+         * because an encryption/rsn mismatch results in both events, and
+         * the important information is in the WLC_E_PRUNE.
+         */
+        if (!(event == WLC_E_SET_SSID && status == WLC_E_STATUS_FAIL &&
+              dhd_conn_event == WLC_E_PRUNE)) {
+                dhd_conn_event = event;
+                dhd_conn_status = status;
+                dhd_conn_reason = reason;
+        }
+}
+
+bool
+dhd_prec_enq(dhd_pub_t *dhdp, struct pktq *q, void *pkt, int prec)
+{
+        void *p;
+        int eprec = -1;         /* precedence to evict from */
+        bool discard_oldest;
+
+        /* Fast case, precedence queue is not full and we are also not
+         * exceeding total queue length
+         */
+        if (!pktq_pfull(q, prec) && !pktq_full(q)) {
+                pktq_penq(q, prec, pkt);
+                return TRUE;
+        }
+
+        /* Determine precedence from which to evict packet, if any */
+        if (pktq_pfull(q, prec))
+                eprec = prec;
+        else if (pktq_full(q)) {
+                p = pktq_peek_tail(q, &eprec);
+                ASSERT(p);
+                if (eprec > prec || eprec < 0)
+                        return FALSE;
+        }
+
+        /* Evict if needed */
+        if (eprec >= 0) {
+                /* Detect queueing to unconfigured precedence */
+                ASSERT(!pktq_pempty(q, eprec));
+                discard_oldest = AC_BITMAP_TST(dhdp->wme_dp, eprec);
+                if (eprec == prec && !discard_oldest)
+                        return FALSE;           /* refuse newer (incoming) packet */
+                /* Evict packet according to discard policy */
+                p = discard_oldest ? pktq_pdeq(q, eprec) : pktq_pdeq_tail(q, eprec);
+                ASSERT(p);
+
+                PKTFREE(dhdp->osh, p, TRUE);
+        }
+
+        /* Enqueue */
+        p = pktq_penq(q, prec, pkt);
+        ASSERT(p);
+
+        return TRUE;
+}
+
+static int
+dhd_iovar_op(dhd_pub_t *dhd_pub, const char *name,
+        void *params, int plen, void *arg, int len, bool set)
+{
+        int bcmerror = 0;
+        int val_size;
+        const bcm_iovar_t *vi = NULL;
+        uint32 actionid;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        ASSERT(name);
+        ASSERT(len >= 0);
+
+        /* Get MUST have return space */
+        ASSERT(set || (arg && len));
+
+        /* Set does NOT take qualifiers */
+        ASSERT(!set || (!params && !plen));
+
+        if ((vi = bcm_iovar_lookup(dhd_iovars, name)) == NULL) {
+                bcmerror = BCME_UNSUPPORTED;
+                goto exit;
+        }
+
+        DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+                name, (set ? "set" : "get"), len, plen));
+
+        /* set up 'params' pointer in case this is a set command so that
+         * the convenience int and bool code can be common to set and get
+         */
+        if (params == NULL) {
+                params = arg;
+                plen = len;
+        }
+
+        if (vi->type == IOVT_VOID)
+                val_size = 0;
+        else if (vi->type == IOVT_BUFFER)
+                val_size = len;
+        else
+                /* all other types are integer sized */
+                val_size = sizeof(int);
+
+        actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+
+        bcmerror = dhd_doiovar(dhd_pub, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+        return bcmerror;
+}
+
+int
+dhd_ioctl(dhd_pub_t * dhd_pub, dhd_ioctl_t *ioc, void * buf, uint buflen)
+{
+        int bcmerror = 0;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (!buf) {
+                return BCME_BADARG;
+        }
+
+        switch (ioc->cmd) {
+        case DHD_GET_MAGIC:
+                if (buflen < sizeof(int))
+                        bcmerror = BCME_BUFTOOSHORT;
+                else
+                        *(int*)buf = DHD_IOCTL_MAGIC;
+                break;
+
+        case DHD_GET_VERSION:
+                if (buflen < sizeof(int))
+                        bcmerror = -BCME_BUFTOOSHORT;
+                else
+                        *(int*)buf = DHD_IOCTL_VERSION;
+                break;
+
+        case DHD_GET_VAR:
+        case DHD_SET_VAR: {
+                char *arg;
+                uint arglen;
+
+                /* scan past the name to any arguments */
+                for (arg = buf, arglen = buflen; *arg && arglen; arg++, arglen--)
+                        ;
+
+                if (*arg) {
+                        bcmerror = BCME_BUFTOOSHORT;
+                        break;
+                }
+
+                /* account for the NUL terminator */
+                arg++, arglen--;
+
+                /* call with the appropriate arguments */
+                if (ioc->cmd == DHD_GET_VAR)
+                        bcmerror = dhd_iovar_op(dhd_pub, buf, arg, arglen,
+                        buf, buflen, IOV_GET);
+                else
+                        bcmerror = dhd_iovar_op(dhd_pub, buf, NULL, 0, arg, arglen, IOV_SET);
+                if (bcmerror != BCME_UNSUPPORTED)
+                        break;
+
+                /* not in generic table, try protocol module */
+                if (ioc->cmd == DHD_GET_VAR)
+                        bcmerror = dhd_prot_iovar_op(dhd_pub, buf, arg,
+                                arglen, buf, buflen, IOV_GET);
+                else
+                        bcmerror = dhd_prot_iovar_op(dhd_pub, buf,
+                                NULL, 0, arg, arglen, IOV_SET);
+                if (bcmerror != BCME_UNSUPPORTED)
+                        break;
+
+                /* if still not found, try bus module */
+                if (ioc->cmd == DHD_GET_VAR) {
+                        bcmerror = dhd_bus_iovar_op(dhd_pub, buf,
+                                arg, arglen, buf, buflen, IOV_GET);
+                } else {
+                        bcmerror = dhd_bus_iovar_op(dhd_pub, buf,
+                                NULL, 0, arg, arglen, IOV_SET);
+                }
+
+                break;
+        }
+
+        default:
+                bcmerror = BCME_UNSUPPORTED;
+        }
+
+        return bcmerror;
+}
+
+#ifdef SHOW_EVENTS
+static void
+wl_show_host_event(wl_event_msg_t *event, void *event_data)
+{
+        uint i, status, reason;
+        bool group = FALSE, flush_txq = FALSE, link = FALSE;
+        const char *auth_str;
+        const char *event_name;
+        uchar *buf;
+        char err_msg[256], eabuf[ETHER_ADDR_STR_LEN];
+        uint event_type, flags, auth_type, datalen;
+
+        event_type = ntoh32(event->event_type);
+        flags = ntoh16(event->flags);
+        status = ntoh32(event->status);
+        reason = ntoh32(event->reason);
+        auth_type = ntoh32(event->auth_type);
+        datalen = ntoh32(event->datalen);
+
+        /* debug dump of event messages */
+        sprintf(eabuf, "%02x:%02x:%02x:%02x:%02x:%02x",
+                (uchar)event->addr.octet[0]&0xff,
+                (uchar)event->addr.octet[1]&0xff,
+                (uchar)event->addr.octet[2]&0xff,
+                (uchar)event->addr.octet[3]&0xff,
+                (uchar)event->addr.octet[4]&0xff,
+                (uchar)event->addr.octet[5]&0xff);
+
+        event_name = "UNKNOWN";
+        for (i = 0; i < (uint)bcmevent_names_size; i++)
+                if (bcmevent_names[i].event == event_type)
+                        event_name = bcmevent_names[i].name;
+
+        if (flags & WLC_EVENT_MSG_LINK)
+                link = TRUE;
+        if (flags & WLC_EVENT_MSG_GROUP)
+                group = TRUE;
+        if (flags & WLC_EVENT_MSG_FLUSHTXQ)
+                flush_txq = TRUE;
+
+        switch (event_type) {
+        case WLC_E_START:
+        case WLC_E_DEAUTH:
+        case WLC_E_DISASSOC:
+                DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+                break;
+
+        case WLC_E_ASSOC_IND:
+        case WLC_E_REASSOC_IND:
+
+                DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+                break;
+
+        case WLC_E_ASSOC:
+        case WLC_E_REASSOC:
+                if (status == WLC_E_STATUS_SUCCESS) {
+                        DHD_EVENT(("MACEVENT: %s, MAC %s, SUCCESS\n", event_name, eabuf));
+                } else if (status == WLC_E_STATUS_TIMEOUT) {
+                        DHD_EVENT(("MACEVENT: %s, MAC %s, TIMEOUT\n", event_name, eabuf));
+                } else if (status == WLC_E_STATUS_FAIL) {
+                        DHD_EVENT(("MACEVENT: %s, MAC %s, FAILURE, reason %d\n",
+                               event_name, eabuf, (int)reason));
+                } else {
+                        DHD_EVENT(("MACEVENT: %s, MAC %s, unexpected status %d\n",
+                               event_name, eabuf, (int)status));
+                }
+                break;
+
+        case WLC_E_DEAUTH_IND:
+        case WLC_E_DISASSOC_IND:
+                DHD_EVENT(("MACEVENT: %s, MAC %s, reason %d\n", event_name, eabuf, (int)reason));
+                break;
+
+        case WLC_E_AUTH:
+        case WLC_E_AUTH_IND:
+                if (auth_type == DOT11_OPEN_SYSTEM)
+                        auth_str = "Open System";
+                else if (auth_type == DOT11_SHARED_KEY)
+                        auth_str = "Shared Key";
+                else {
+                        sprintf(err_msg, "AUTH unknown: %d", (int)auth_type);
+                        auth_str = err_msg;
+                }
+                if (event_type == WLC_E_AUTH_IND) {
+                        DHD_EVENT(("MACEVENT: %s, MAC %s, %s\n", event_name, eabuf, auth_str));
+                } else if (status == WLC_E_STATUS_SUCCESS) {
+                        DHD_EVENT(("MACEVENT: %s, MAC %s, %s, SUCCESS\n",
+                                event_name, eabuf, auth_str));
+                } else if (status == WLC_E_STATUS_TIMEOUT) {
+                        DHD_EVENT(("MACEVENT: %s, MAC %s, %s, TIMEOUT\n",
+                                event_name, eabuf, auth_str));
+                } else if (status == WLC_E_STATUS_FAIL) {
+                        DHD_EVENT(("MACEVENT: %s, MAC %s, %s, FAILURE, reason %d\n",
+                               event_name, eabuf, auth_str, (int)reason));
+                }
+
+                break;
+
+        case WLC_E_JOIN:
+        case WLC_E_ROAM:
+        case WLC_E_SET_SSID:
+                if (status == WLC_E_STATUS_SUCCESS) {
+                        DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+                } else if (status == WLC_E_STATUS_FAIL) {
+                        DHD_EVENT(("MACEVENT: %s, failed\n", event_name));
+                } else if (status == WLC_E_STATUS_NO_NETWORKS) {
+                        DHD_EVENT(("MACEVENT: %s, no networks found\n", event_name));
+                } else {
+                        DHD_EVENT(("MACEVENT: %s, unexpected status %d\n",
+                                event_name, (int)status));
+                }
+                break;
+
+        case WLC_E_BEACON_RX:
+                if (status == WLC_E_STATUS_SUCCESS) {
+                        DHD_EVENT(("MACEVENT: %s, SUCCESS\n", event_name));
+                } else if (status == WLC_E_STATUS_FAIL) {
+                        DHD_EVENT(("MACEVENT: %s, FAIL\n", event_name));
+                } else {
+                        DHD_EVENT(("MACEVENT: %s, status %d\n", event_name, status));
+                }
+                break;
+
+        case WLC_E_LINK:
+                DHD_EVENT(("MACEVENT: %s %s\n", event_name, link?"UP":"DOWN"));
+                break;
+
+        case WLC_E_MIC_ERROR:
+                DHD_EVENT(("MACEVENT: %s, MAC %s, Group %d, Flush %d\n",
+                       event_name, eabuf, group, flush_txq));
+                break;
+
+        case WLC_E_ICV_ERROR:
+        case WLC_E_UNICAST_DECODE_ERROR:
+        case WLC_E_MULTICAST_DECODE_ERROR:
+                DHD_EVENT(("MACEVENT: %s, MAC %s\n",
+                       event_name, eabuf));
+                break;
+
+        case WLC_E_TXFAIL:
+                DHD_EVENT(("MACEVENT: %s, RA %s\n", event_name, eabuf));
+                break;
+
+        case WLC_E_SCAN_COMPLETE:
+        case WLC_E_PMKID_CACHE:
+                DHD_EVENT(("MACEVENT: %s\n", event_name));
+                break;
+
+        case WLC_E_PFN_NET_FOUND:
+        case WLC_E_PFN_NET_LOST:
+        case WLC_E_PFN_SCAN_COMPLETE:
+        case WLC_E_PFN_SCAN_NONE:
+        case WLC_E_PFN_SCAN_ALLGONE:
+                DHD_EVENT(("PNOEVENT: %s\n", event_name));
+                break;
+
+        case WLC_E_PSK_SUP:
+        case WLC_E_PRUNE:
+                DHD_EVENT(("MACEVENT: %s, status %d, reason %d\n",
+                           event_name, (int)status, (int)reason));
+                break;
+
+#ifdef WIFI_ACT_FRAME
+        case WLC_E_ACTION_FRAME:
+                DHD_TRACE(("MACEVENT: %s Bssid %s\n", event_name, eabuf));
+                break;
+#endif /* WIFI_ACT_FRAME */
+
+        case WLC_E_TRACE: {
+                static uint32 seqnum_prev = 0;
+                msgtrace_hdr_t hdr;
+                uint32 nblost;
+                char *s, *p;
+
+                buf = (uchar *) event_data;
+                memcpy(&hdr, buf, MSGTRACE_HDRLEN);
+
+                if (hdr.version != MSGTRACE_VERSION) {
+                        printf("\nMACEVENT: %s [unsupported version --> "
+                               "dhd version:%d dongle version:%d]\n",
+                               event_name, MSGTRACE_VERSION, hdr.version);
+                        /* Reset datalen to avoid display below */
+                        datalen = 0;
+                        break;
+                }
+
+                /* There are 2 bytes available at the end of data */
+                buf[MSGTRACE_HDRLEN + ntoh16(hdr.len)] = '\0';
+
+                if (ntoh32(hdr.discarded_bytes) || ntoh32(hdr.discarded_printf)) {
+                        printf("\nWLC_E_TRACE: [Discarded traces in dongle -->"
+                               "discarded_bytes %d discarded_printf %d]\n",
+                               ntoh32(hdr.discarded_bytes), ntoh32(hdr.discarded_printf));
+                }
+
+                nblost = ntoh32(hdr.seqnum) - seqnum_prev - 1;
+                if (nblost > 0) {
+                        printf("\nWLC_E_TRACE: [Event lost --> seqnum %d nblost %d\n",
+                               ntoh32(hdr.seqnum), nblost);
+                }
+                seqnum_prev = ntoh32(hdr.seqnum);
+
+                /* Display the trace buffer. Advance from \n to \n to avoid display big
+                 * printf (issue with Linux printk )
+                 */
+                p = (char *)&buf[MSGTRACE_HDRLEN];
+                while ((s = strstr(p, "\n")) != NULL) {
+                        *s = '\0';
+                        printf("%s\n", p);
+                        p = s+1;
+                }
+                printf("%s\n", p);
+
+                /* Reset datalen to avoid display below */
+                datalen = 0;
+                break;
+        }
+
+
+        case WLC_E_RSSI:
+                DHD_EVENT(("MACEVENT: %s %d\n", event_name, ntoh32(*((int *)event_data))));
+                break;
+
+        default:
+                DHD_EVENT(("MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d\n",
+                       event_name, event_type, eabuf, (int)status, (int)reason,
+                       (int)auth_type));
+                break;
+        }
+
+        /* show any appended data */
+        if (datalen) {
+                buf = (uchar *) event_data;
+                DHD_EVENT((" data (%d) : ", datalen));
+                for (i = 0; i < datalen; i++)
+                        DHD_EVENT((" 0x%02x ", *buf++));
+                DHD_EVENT(("\n"));
+        }
+}
+#endif /* SHOW_EVENTS */
+
+int
+wl_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata,
+              wl_event_msg_t *event, void **data_ptr)
+{
+        /* check whether packet is a BRCM event pkt */
+        bcm_event_t *pvt_data = (bcm_event_t *)pktdata;
+        uint8 *event_data;
+        uint32 type, status, reason, datalen;
+        uint16 flags;
+        int evlen;
+
+        if (bcmp(BRCM_OUI, &pvt_data->bcm_hdr.oui[0], DOT11_OUI_LEN)) {
+                DHD_ERROR(("%s: mismatched OUI, bailing\n", __FUNCTION__));
+                return (BCME_ERROR);
+        }
+
+        /* BRCM event pkt may be unaligned - use xxx_ua to load user_subtype. */
+        if (ntoh16_ua((void *)&pvt_data->bcm_hdr.usr_subtype) != BCMILCP_BCM_SUBTYPE_EVENT) {
+                DHD_ERROR(("%s: mismatched subtype, bailing\n", __FUNCTION__));
+                return (BCME_ERROR);
+        }
+
+        *data_ptr = &pvt_data[1];
+        event_data = *data_ptr;
+
+        /* memcpy since BRCM event pkt may be unaligned. */
+        memcpy(event, &pvt_data->event, sizeof(wl_event_msg_t));
+
+        type = ntoh32_ua((void *)&event->event_type);
+        flags = ntoh16_ua((void *)&event->flags);
+        status = ntoh32_ua((void *)&event->status);
+        reason = ntoh32_ua((void *)&event->reason);
+        datalen = ntoh32_ua((void *)&event->datalen);
+        evlen = datalen + sizeof(bcm_event_t);
+
+        switch (type) {
+#ifdef PROP_TXSTATUS
+        case WLC_E_FIFO_CREDIT_MAP:
+                dhd_wlfc_event(dhd_pub->info);
+                dhd_wlfc_FIFOcreditmap_event(dhd_pub->info, event_data);
+                WLFC_DBGMESG(("WLC_E_FIFO_CREDIT_MAP:(AC0,AC1,AC2,AC3),(BC_MC),(OTHER): "
+                        "(%d,%d,%d,%d),(%d),(%d)\n", event_data[0], event_data[1],
+                        event_data[2],
+                        event_data[3], event_data[4], event_data[5]));
+                break;
+#endif
+
+        case WLC_E_IF:
+                {
+                        dhd_if_event_t *ifevent = (dhd_if_event_t *)event_data;
+#ifdef PROP_TXSTATUS
+                        {
+                                uint8* ea = pvt_data->eth.ether_dhost;
+                                WLFC_DBGMESG(("WLC_E_IF: idx:%d, action:%s, iftype:%s, "
+                                                "[%02x:%02x:%02x:%02x:%02x:%02x]\n",
+                                                ifevent->ifidx,
+                                                ((ifevent->action == WLC_E_IF_ADD) ? "ADD":"DEL"),
+                                                ((ifevent->is_AP == 0) ? "STA":"AP "),
+                                                ea[0], ea[1], ea[2], ea[3], ea[4], ea[5]));
+                                (void)ea;
+
+                                dhd_wlfc_interface_event(dhd_pub->info,
+                                        ((ifevent->action == WLC_E_IF_ADD) ?
+                                        eWLFC_MAC_ENTRY_ACTION_ADD : eWLFC_MAC_ENTRY_ACTION_DEL),
+                                        ifevent->ifidx, ifevent->is_AP, ea);
+
+                                /* dhd already has created an interface by default, for 0 */
+                                if (ifevent->ifidx == 0)
+                                        break;
+                        }
+#endif /* PROP_TXSTATUS */
+
+#ifdef WL_CFG80211
+                        if (wl_cfg80211_is_progress_ifchange()) {
+                                DHD_ERROR(("%s:  ifidx %d for %s action %d\n",
+                                        __FUNCTION__, ifevent->ifidx,
+                                        event->ifname, ifevent->action));
+                                if (ifevent->action == WLC_E_IF_ADD)
+                                        wl_cfg80211_notify_ifchange();
+                                return (BCME_OK);
+                        }
+#endif /* WL_CFG80211 */
+                                if (ifevent->ifidx > 0 && ifevent->ifidx < DHD_MAX_IFS) {
+                                        if (ifevent->action == WLC_E_IF_ADD) {
+                                                if (dhd_add_if(dhd_pub->info, ifevent->ifidx,
+                                                        NULL, event->ifname,
+                                                        event->addr.octet,
+                                                        ifevent->flags, ifevent->bssidx)) {
+                                                        DHD_ERROR(("%s: dhd_add_if failed!!"
+                                                                        " ifidx: %d for %s\n",
+                                                                        __FUNCTION__,
+                                                                        ifevent->ifidx,
+                                                                        event->ifname));
+                                                        return (BCME_ERROR);
+                                                }
+                                        }
+                        else
+                                dhd_del_if(dhd_pub->info, ifevent->ifidx);
+                } else {
+#ifndef PROP_TXSTATUS
+                        DHD_ERROR(("%s: Invalid ifidx %d for %s\n",
+                                   __FUNCTION__, ifevent->ifidx, event->ifname));
+#endif /* !PROP_TXSTATUS */
+                }
+                        }
+                        /* send up the if event: btamp user needs it */
+                        *ifidx = dhd_ifname2idx(dhd_pub->info, event->ifname);
+                        /* push up to external supp/auth */
+                        dhd_event(dhd_pub->info, (char *)pvt_data, evlen, *ifidx);
+                        break;
+
+
+#ifdef WLMEDIA_HTSF
+        case WLC_E_HTSFSYNC:
+                htsf_update(dhd_pub->info, event_data);
+                break;
+#endif /* WLMEDIA_HTSF */
+        case WLC_E_NDIS_LINK: {
+                uint32 temp = hton32(WLC_E_LINK);
+
+                memcpy((void *)(&pvt_data->event.event_type), &temp,
+                       sizeof(pvt_data->event.event_type));
+        }
+                /* These are what external supplicant/authenticator wants */
+                /* fall through */
+        case WLC_E_LINK:
+        case WLC_E_DEAUTH:
+        case WLC_E_DEAUTH_IND:
+        case WLC_E_DISASSOC:
+        case WLC_E_DISASSOC_IND:
+                DHD_EVENT(("%s: Link event %d, flags %x, status %x\n",
+                           __FUNCTION__, type, flags, status));
+                /* fall through */
+        default:
+                *ifidx = dhd_ifname2idx(dhd_pub->info, event->ifname);
+                /* push up to external supp/auth */
+                dhd_event(dhd_pub->info, (char *)pvt_data, evlen, *ifidx);
+                DHD_TRACE(("%s: MAC event %d, flags %x, status %x\n",
+                           __FUNCTION__, type, flags, status));
+
+                /* put it back to WLC_E_NDIS_LINK */
+                if (type == WLC_E_NDIS_LINK) {
+                        uint32 temp;
+
+                        temp = ntoh32_ua((void *)&event->event_type);
+                        DHD_TRACE(("Converted to WLC_E_LINK type %d\n", temp));
+
+                        temp = ntoh32(WLC_E_NDIS_LINK);
+                        memcpy((void *)(&pvt_data->event.event_type), &temp,
+                               sizeof(pvt_data->event.event_type));
+                }
+                break;
+        }
+
+#ifdef SHOW_EVENTS
+        wl_show_host_event(event, (void *)event_data);
+#endif /* SHOW_EVENTS */
+
+        return (BCME_OK);
+}
+
+void
+wl_event_to_host_order(wl_event_msg_t * evt)
+{
+        /* Event struct members passed from dongle to host are stored in network
+         * byte order. Convert all members to host-order.
+         */
+        evt->event_type = ntoh32(evt->event_type);
+        evt->flags = ntoh16(evt->flags);
+        evt->status = ntoh32(evt->status);
+        evt->reason = ntoh32(evt->reason);
+        evt->auth_type = ntoh32(evt->auth_type);
+        evt->datalen = ntoh32(evt->datalen);
+        evt->version = ntoh16(evt->version);
+}
+
+void
+dhd_print_buf(void *pbuf, int len, int bytes_per_line)
+{
+#ifdef DHD_DEBUG
+        int i, j = 0;
+        unsigned char *buf = pbuf;
+
+        if (bytes_per_line == 0) {
+                bytes_per_line = len;
+        }
+
+        for (i = 0; i < len; i++) {
+                printf("%2.2x", *buf++);
+                j++;
+                if (j == bytes_per_line) {
+                        printf("\n");
+                        j = 0;
+                } else {
+                        printf(":");
+                }
+        }
+        printf("\n");
+#endif /* DHD_DEBUG */
+}
+
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+
+/* Convert user's input in hex pattern to byte-size mask */
+static int
+wl_pattern_atoh(char *src, char *dst)
+{
+        int i;
+        if (strncmp(src, "0x", 2) != 0 &&
+            strncmp(src, "0X", 2) != 0) {
+                DHD_ERROR(("Mask invalid format. Needs to start with 0x\n"));
+                return -1;
+        }
+        src = src + 2; /* Skip past 0x */
+        if (strlen(src) % 2 != 0) {
+                DHD_ERROR(("Mask invalid format. Needs to be of even length\n"));
+                return -1;
+        }
+        for (i = 0; *src != '\0'; i++) {
+                char num[3];
+                bcm_strncpy_s(num, sizeof(num), src, 2);
+                num[2] = '\0';
+                dst[i] = (uint8)strtoul(num, NULL, 16);
+                src += 2;
+        }
+        return i;
+}
+
+void
+dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode)
+{
+        char                            *argv[8];
+        int                                     i = 0;
+        const char                      *str;
+        int                                     buf_len;
+        int                                     str_len;
+        char                            *arg_save = 0, *arg_org = 0;
+        int                                     rc;
+        char                            buf[128];
+        wl_pkt_filter_enable_t  enable_parm;
+        wl_pkt_filter_enable_t  * pkt_filterp;
+
+        if (!arg)
+                return;
+
+        if (!(arg_save = MALLOC(dhd->osh, strlen(arg) + 1))) {
+                DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+                goto fail;
+        }
+        arg_org = arg_save;
+        memcpy(arg_save, arg, strlen(arg) + 1);
+
+        argv[i] = bcmstrtok(&arg_save, " ", 0);
+
+        i = 0;
+        if (argv[i] == NULL) {
+                DHD_ERROR(("No args provided\n"));
+                goto fail;
+        }
+
+        str = "pkt_filter_enable";
+        str_len = strlen(str);
+        bcm_strncpy_s(buf, sizeof(buf), str, str_len);
+        buf[str_len] = '\0';
+        buf_len = str_len + 1;
+
+        pkt_filterp = (wl_pkt_filter_enable_t *)(buf + str_len + 1);
+
+        /* Parse packet filter id. */
+        enable_parm.id = htod32(strtoul(argv[i], NULL, 0));
+
+        /* Parse enable/disable value. */
+        enable_parm.enable = htod32(enable);
+
+        buf_len += sizeof(enable_parm);
+        memcpy((char *)pkt_filterp,
+               &enable_parm,
+               sizeof(enable_parm));
+
+        /* Enable/disable the specified filter. */
+        rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+        rc = rc >= 0 ? 0 : rc;
+        if (rc)
+                DHD_TRACE(("%s: failed to add pktfilter %s, retcode = %d\n",
+                __FUNCTION__, arg, rc));
+        else
+                DHD_TRACE(("%s: successfully added pktfilter %s\n",
+                __FUNCTION__, arg));
+
+        /* Contorl the master mode */
+        bcm_mkiovar("pkt_filter_mode", (char *)&master_mode, 4, buf, sizeof(buf));
+        rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+        rc = rc >= 0 ? 0 : rc;
+        if (rc)
+                DHD_TRACE(("%s: failed to add pktfilter %s, retcode = %d\n",
+                __FUNCTION__, arg, rc));
+
+fail:
+        if (arg_org)
+                MFREE(dhd->osh, arg_org, strlen(arg) + 1);
+}
+
+void
+dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg)
+{
+        const char                      *str;
+        wl_pkt_filter_t         pkt_filter;
+        wl_pkt_filter_t         *pkt_filterp;
+        int                                     buf_len;
+        int                                     str_len;
+        int                             rc;
+        uint32                          mask_size;
+        uint32                          pattern_size;
+        char                            *argv[8], * buf = 0;
+        int                                     i = 0;
+        char                            *arg_save = 0, *arg_org = 0;
+#define BUF_SIZE                2048
+
+        if (!arg)
+                return;
+
+        if (!(arg_save = MALLOC(dhd->osh, strlen(arg) + 1))) {
+                DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+                goto fail;
+        }
+
+        arg_org = arg_save;
+
+        if (!(buf = MALLOC(dhd->osh, BUF_SIZE))) {
+                DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+                goto fail;
+        }
+
+        memcpy(arg_save, arg, strlen(arg) + 1);
+
+        if (strlen(arg) > BUF_SIZE) {
+                DHD_ERROR(("Not enough buffer %d < %d\n", (int)strlen(arg), (int)sizeof(buf)));
+                goto fail;
+        }
+
+        argv[i] = bcmstrtok(&arg_save, " ", 0);
+        while (argv[i++])
+                argv[i] = bcmstrtok(&arg_save, " ", 0);
+
+        i = 0;
+        if (argv[i] == NULL) {
+                DHD_ERROR(("No args provided\n"));
+                goto fail;
+        }
+
+        str = "pkt_filter_add";
+        str_len = strlen(str);
+        bcm_strncpy_s(buf, BUF_SIZE, str, str_len);
+        buf[ str_len ] = '\0';
+        buf_len = str_len + 1;
+
+        pkt_filterp = (wl_pkt_filter_t *) (buf + str_len + 1);
+
+        /* Parse packet filter id. */
+        pkt_filter.id = htod32(strtoul(argv[i], NULL, 0));
+
+        if (argv[++i] == NULL) {
+                DHD_ERROR(("Polarity not provided\n"));
+                goto fail;
+        }
+
+        /* Parse filter polarity. */
+        pkt_filter.negate_match = htod32(strtoul(argv[i], NULL, 0));
+
+        if (argv[++i] == NULL) {
+                DHD_ERROR(("Filter type not provided\n"));
+                goto fail;
+        }
+
+        /* Parse filter type. */
+        pkt_filter.type = htod32(strtoul(argv[i], NULL, 0));
+
+        if (argv[++i] == NULL) {
+                DHD_ERROR(("Offset not provided\n"));
+                goto fail;
+        }
+
+        /* Parse pattern filter offset. */
+        pkt_filter.u.pattern.offset = htod32(strtoul(argv[i], NULL, 0));
+
+        if (argv[++i] == NULL) {
+                DHD_ERROR(("Bitmask not provided\n"));
+                goto fail;
+        }
+
+        /* Parse pattern filter mask. */
+        mask_size =
+                htod32(wl_pattern_atoh(argv[i], (char *) pkt_filterp->u.pattern.mask_and_pattern));
+
+        if (argv[++i] == NULL) {
+                DHD_ERROR(("Pattern not provided\n"));
+                goto fail;
+        }
+
+        /* Parse pattern filter pattern. */
+        pattern_size =
+                htod32(wl_pattern_atoh(argv[i],
+                 (char *) &pkt_filterp->u.pattern.mask_and_pattern[mask_size]));
+
+        if (mask_size != pattern_size) {
+                DHD_ERROR(("Mask and pattern not the same size\n"));
+                goto fail;
+        }
+
+        pkt_filter.u.pattern.size_bytes = mask_size;
+        buf_len += WL_PKT_FILTER_FIXED_LEN;
+        buf_len += (WL_PKT_FILTER_PATTERN_FIXED_LEN + 2 * mask_size);
+
+        /* Keep-alive attributes are set in local       variable (keep_alive_pkt), and
+        ** then memcpy'ed into buffer (keep_alive_pktp) since there is no
+        ** guarantee that the buffer is properly aligned.
+        */
+        memcpy((char *)pkt_filterp,
+               &pkt_filter,
+               WL_PKT_FILTER_FIXED_LEN + WL_PKT_FILTER_PATTERN_FIXED_LEN);
+
+        rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+        rc = rc >= 0 ? 0 : rc;
+
+        if (rc)
+                DHD_TRACE(("%s: failed to add pktfilter %s, retcode = %d\n",
+                __FUNCTION__, arg, rc));
+        else
+                DHD_TRACE(("%s: successfully added pktfilter %s\n",
+                __FUNCTION__, arg));
+
+fail:
+        if (arg_org)
+                MFREE(dhd->osh, arg_org, strlen(arg) + 1);
+
+        if (buf)
+                MFREE(dhd->osh, buf, BUF_SIZE);
+}
+
+/* ========================== */
+/* ==== ARP OFFLOAD SUPPORT = */
+/* ========================== */
+#ifdef ARP_OFFLOAD_SUPPORT
+void
+dhd_arp_offload_set(dhd_pub_t * dhd, int arp_mode)
+{
+        char iovbuf[32];
+        int retcode;
+
+        bcm_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
+        retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+        retcode = retcode >= 0 ? 0 : retcode;
+        if (retcode)
+                DHD_TRACE(("%s: failed to set ARP offload mode to 0x%x, retcode = %d\n",
+                __FUNCTION__, arp_mode, retcode));
+        else
+                DHD_TRACE(("%s: successfully set ARP offload mode to 0x%x\n",
+                __FUNCTION__, arp_mode));
+}
+
+void
+dhd_arp_offload_enable(dhd_pub_t * dhd, int arp_enable)
+{
+        char iovbuf[32];
+        int retcode;
+
+        bcm_mkiovar("arpoe", (char *)&arp_enable, 4, iovbuf, sizeof(iovbuf));
+        retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+        retcode = retcode >= 0 ? 0 : retcode;
+        if (retcode)
+                DHD_TRACE(("%s: failed to enabe ARP offload to %d, retcode = %d\n",
+                __FUNCTION__, arp_enable, retcode));
+        else
+                DHD_TRACE(("%s: successfully enabed ARP offload to %d\n",
+                __FUNCTION__, arp_enable));
+}
+
+void
+dhd_aoe_arp_clr(dhd_pub_t *dhd)
+{
+        int ret = 0;
+        int iov_len = 0;
+        char iovbuf[128];
+
+        if (dhd == NULL) return;
+
+        iov_len = bcm_mkiovar("arp_table_clear", 0, 0, iovbuf, sizeof(iovbuf));
+        if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, 0) < 0))
+                DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+}
+
+void
+dhd_aoe_hostip_clr(dhd_pub_t *dhd)
+{
+        int ret = 0;
+        int iov_len = 0;
+        char iovbuf[128];
+
+        if (dhd == NULL) return;
+
+        iov_len = bcm_mkiovar("arp_hostip_clear", 0, 0, iovbuf, sizeof(iovbuf));
+        if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, 0)) < 0)
+                DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+}
+
+void
+dhd_arp_offload_add_ip(dhd_pub_t *dhd, uint32 ipaddr)
+{
+        int iov_len = 0;
+        char iovbuf[32];
+        int retcode;
+
+        iov_len = bcm_mkiovar("arp_hostip", (char *)&ipaddr, 4, iovbuf, sizeof(iovbuf));
+        retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, 0);
+
+        if (retcode)
+                DHD_TRACE(("%s: ARP ip addr add failed, retcode = %d\n",
+                __FUNCTION__, retcode));
+        else
+                DHD_TRACE(("%s: sARP H ipaddr entry added \n",
+                __FUNCTION__));
+}
+
+int
+dhd_arp_get_arp_hostip_table(dhd_pub_t *dhd, void *buf, int buflen)
+{
+        int retcode, i;
+        int iov_len = 0;
+        uint32 *ptr32 = buf;
+        bool clr_bottom = FALSE;
+
+        if (!buf)
+                return -1;
+
+        iov_len = bcm_mkiovar("arp_hostip", 0, 0, buf, buflen);
+        retcode = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, buflen, TRUE, 0);
+
+        if (retcode) {
+                DHD_TRACE(("%s: ioctl WLC_GET_VAR error %d\n",
+                __FUNCTION__, retcode));
+
+                return -1;
+        }
+
+        /* clean up the buf, ascii reminder */
+        for (i = 0; i < MAX_IPV4_ENTRIES; i++) {
+                if (!clr_bottom) {
+                        if (*ptr32 == 0)
+                                clr_bottom = TRUE;
+                } else {
+                        *ptr32 = 0;
+                }
+                ptr32++;
+        }
+
+        return 0;
+}
+#endif /* ARP_OFFLOAD_SUPPORT  */
+
+/* send up locally generated event */
+void
+dhd_sendup_event_common(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data)
+{
+        switch (ntoh32(event->event_type)) {
+        case WLC_E_BTA_HCI_EVENT:
+                break;
+        default:
+                break;
+        }
+
+        /* Call per-port handler. */
+        dhd_sendup_event(dhdp, event, data);
+}
+
+#ifdef SIMPLE_ISCAN
+
+uint iscan_thread_id = 0;
+iscan_buf_t * iscan_chain = 0;
+
+iscan_buf_t *
+dhd_iscan_allocate_buf(dhd_pub_t *dhd, iscan_buf_t **iscanbuf)
+{
+        iscan_buf_t *iscanbuf_alloc = 0;
+        iscan_buf_t *iscanbuf_head;
+
+        DHD_ISCAN(("%s: Entered\n", __FUNCTION__));
+        dhd_iscan_lock();
+
+        iscanbuf_alloc = (iscan_buf_t*)MALLOC(dhd->osh, sizeof(iscan_buf_t));
+        if (iscanbuf_alloc == NULL)
+                goto fail;
+
+        iscanbuf_alloc->next = NULL;
+        iscanbuf_head = *iscanbuf;
+
+        DHD_ISCAN(("%s: addr of allocated node = 0x%X"
+                   "addr of iscanbuf_head = 0x%X dhd = 0x%X\n",
+                   __FUNCTION__, iscanbuf_alloc, iscanbuf_head, dhd));
+
+        if (iscanbuf_head == NULL) {
+                *iscanbuf = iscanbuf_alloc;
+                DHD_ISCAN(("%s: Head is allocated\n", __FUNCTION__));
+                goto fail;
+        }
+
+        while (iscanbuf_head->next)
+                iscanbuf_head = iscanbuf_head->next;
+
+        iscanbuf_head->next = iscanbuf_alloc;
+
+fail:
+        dhd_iscan_unlock();
+        return iscanbuf_alloc;
+}
+
+void
+dhd_iscan_free_buf(void *dhdp, iscan_buf_t *iscan_delete)
+{
+        iscan_buf_t *iscanbuf_free = 0;
+        iscan_buf_t *iscanbuf_prv = 0;
+        iscan_buf_t *iscanbuf_cur;
+        dhd_pub_t *dhd = dhd_bus_pub(dhdp);
+        DHD_ISCAN(("%s: Entered\n", __FUNCTION__));
+
+        dhd_iscan_lock();
+
+        iscanbuf_cur = iscan_chain;
+
+        /* If iscan_delete is null then delete the entire
+         * chain or else delete specific one provided
+         */
+        if (!iscan_delete) {
+                while (iscanbuf_cur) {
+                        iscanbuf_free = iscanbuf_cur;
+                        iscanbuf_cur = iscanbuf_cur->next;
+                        iscanbuf_free->next = 0;
+                        MFREE(dhd->osh, iscanbuf_free, sizeof(iscan_buf_t));
+                }
+                iscan_chain = 0;
+        } else {
+                while (iscanbuf_cur) {
+                        if (iscanbuf_cur == iscan_delete)
+                                break;
+                        iscanbuf_prv = iscanbuf_cur;
+                        iscanbuf_cur = iscanbuf_cur->next;
+                }
+                if (iscanbuf_prv)
+                        iscanbuf_prv->next = iscan_delete->next;
+
+                iscan_delete->next = 0;
+                MFREE(dhd->osh, iscan_delete, sizeof(iscan_buf_t));
+
+                if (!iscanbuf_prv)
+                        iscan_chain = 0;
+        }
+        dhd_iscan_unlock();
+}
+
+iscan_buf_t *
+dhd_iscan_result_buf(void)
+{
+        return iscan_chain;
+}
+
+int
+dhd_iscan_issue_request(void * dhdp, wl_iscan_params_t *pParams, uint32 size)
+{
+        int rc = -1;
+        dhd_pub_t *dhd = dhd_bus_pub(dhdp);
+        char *buf;
+        char iovar[] = "iscan";
+        uint32 allocSize = 0;
+        wl_ioctl_t ioctl;
+
+        if (pParams) {
+                allocSize = (size + strlen(iovar) + 1);
+                if ((allocSize < size) || (allocSize < strlen(iovar)))
+                {
+                        DHD_ERROR(("%s: overflow - allocation size too large %d < %d + %d!\n",
+                                __FUNCTION__, allocSize, size, strlen(iovar)));
+                        goto cleanUp;
+                }
+                buf = MALLOC(dhd->osh, allocSize);
+
+                if (buf == NULL)
+                        {
+                        DHD_ERROR(("%s: malloc of size %d failed!\n", __FUNCTION__, allocSize));
+                        goto cleanUp;
+                        }
+                ioctl.cmd = WLC_SET_VAR;
+                bcm_mkiovar(iovar, (char *)pParams, size, buf, allocSize);
+                rc = dhd_wl_ioctl(dhd, 0, &ioctl, buf, allocSize);
+        }
+
+cleanUp:
+        if (buf) {
+                MFREE(dhd->osh, buf, allocSize);
+        }
+
+        return rc;
+}
+
+static int
+dhd_iscan_get_partial_result(void *dhdp, uint *scan_count)
+{
+        wl_iscan_results_t *list_buf;
+        wl_iscan_results_t list;
+        wl_scan_results_t *results;
+        iscan_buf_t *iscan_cur;
+        int status = -1;
+        dhd_pub_t *dhd = dhd_bus_pub(dhdp);
+        int rc;
+        wl_ioctl_t ioctl;
+
+        DHD_ISCAN(("%s: Enter\n", __FUNCTION__));
+
+        iscan_cur = dhd_iscan_allocate_buf(dhd, &iscan_chain);
+        if (!iscan_cur) {
+                DHD_ERROR(("%s: Failed to allocate node\n", __FUNCTION__));
+                dhd_iscan_free_buf(dhdp, 0);
+                dhd_iscan_request(dhdp, WL_SCAN_ACTION_ABORT);
+                dhd_ind_scan_confirm(dhdp, FALSE);
+                goto fail;
+        }
+
+        dhd_iscan_lock();
+
+        memset(iscan_cur->iscan_buf, 0, WLC_IW_ISCAN_MAXLEN);
+        list_buf = (wl_iscan_results_t*)iscan_cur->iscan_buf;
+        results = &list_buf->results;
+        results->buflen = WL_ISCAN_RESULTS_FIXED_SIZE;
+        results->version = 0;
+        results->count = 0;
+
+        memset(&list, 0, sizeof(list));
+        list.results.buflen = htod32(WLC_IW_ISCAN_MAXLEN);
+        bcm_mkiovar("iscanresults", (char *)&list, WL_ISCAN_RESULTS_FIXED_SIZE,
+                iscan_cur->iscan_buf, WLC_IW_ISCAN_MAXLEN);
+        ioctl.cmd = WLC_GET_VAR;
+        ioctl.set = FALSE;
+        rc = dhd_wl_ioctl(dhd, 0, &ioctl, iscan_cur->iscan_buf, WLC_IW_ISCAN_MAXLEN);
+
+        results->buflen = dtoh32(results->buflen);
+        results->version = dtoh32(results->version);
+        *scan_count = results->count = dtoh32(results->count);
+        status = dtoh32(list_buf->status);
+        DHD_ISCAN(("%s: Got %d resuls status = (%x)\n", __FUNCTION__, results->count, status));
+
+        dhd_iscan_unlock();
+
+        if (!(*scan_count)) {
+                 /* TODO: race condition when FLUSH already called */
+                dhd_iscan_free_buf(dhdp, 0);
+        }
+fail:
+        return status;
+}
+
+#endif /* SIMPLE_ISCAN */
+
+/*
+ * returns = TRUE if associated, FALSE if not associated
+ */
+bool dhd_is_associated(dhd_pub_t *dhd, void *bss_buf)
+{
+        char bssid[6], zbuf[6];
+        int ret = -1;
+
+        bzero(bssid, 6);
+        bzero(zbuf, 6);
+
+        ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_BSSID, (char *)&bssid, ETHER_ADDR_LEN, FALSE, 0);
+        DHD_TRACE((" %s WLC_GET_BSSID ioctl res = %d\n", __FUNCTION__, ret));
+
+        if (ret == BCME_NOTASSOCIATED) {
+                DHD_TRACE(("%s: not associated! res:%d\n", __FUNCTION__, ret));
+        }
+
+        if (ret < 0)
+                return FALSE;
+
+        if ((memcmp(bssid, zbuf, ETHER_ADDR_LEN) != 0)) {
+                /*  STA is assocoated BSSID is non zero */
+
+                if (bss_buf) {
+                        /* return bss if caller provided buf */
+                        memcpy(bss_buf, bssid, ETHER_ADDR_LEN);
+                }
+                return TRUE;
+        } else {
+                DHD_TRACE(("%s: WLC_GET_BSSID ioctl returned zero bssid\n", __FUNCTION__));
+                return FALSE;
+        }
+}
+
+
+/* Function to estimate possible DTIM_SKIP value */
+int
+dhd_get_dtim_skip(dhd_pub_t *dhd)
+{
+        int bcn_li_dtim;
+        int ret = -1;
+        int dtim_assoc = 0;
+
+        if ((dhd->dtim_skip == 0) || (dhd->dtim_skip == 1))
+                bcn_li_dtim = 3;
+        else
+                bcn_li_dtim = dhd->dtim_skip;
+
+        /* Check if associated */
+        if (dhd_is_associated(dhd, NULL) == FALSE) {
+                DHD_TRACE(("%s NOT assoc ret %d\n", __FUNCTION__, ret));
+                goto exit;
+        }
+
+        /* if assoc grab ap's dtim value */
+        if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_DTIMPRD,
+                &dtim_assoc, sizeof(dtim_assoc), FALSE, 0)) < 0) {
+                DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+                goto exit;
+        }
+
+        DHD_ERROR(("%s bcn_li_dtim=%d DTIM=%d Listen=%d\n",
+                __FUNCTION__, bcn_li_dtim, dtim_assoc, LISTEN_INTERVAL));
+
+        /* if not assocated just eixt */
+        if (dtim_assoc == 0) {
+                goto exit;
+        }
+
+        /* check if sta listen interval fits into AP dtim */
+        if (dtim_assoc > LISTEN_INTERVAL) {
+                /* AP DTIM to big for our Listen Interval : no dtim skiping */
+                bcn_li_dtim = 1;
+                DHD_ERROR(("%s DTIM=%d > Listen=%d : too big ...\n",
+                        __FUNCTION__, dtim_assoc, LISTEN_INTERVAL));
+                goto exit;
+        }
+
+        if ((bcn_li_dtim * dtim_assoc) > LISTEN_INTERVAL) {
+                /* Round up dtim_skip to fit into STAs Listen Interval */
+                bcn_li_dtim = (int)(LISTEN_INTERVAL / dtim_assoc);
+                DHD_TRACE(("%s agjust dtim_skip as %d\n", __FUNCTION__, bcn_li_dtim));
+        }
+
+exit:
+        return bcn_li_dtim;
+}
+
+/* Check if HostAPD or WFD mode setup */
+bool dhd_check_ap_wfd_mode_set(dhd_pub_t *dhd)
+{
+#ifdef  WL_CFG80211
+        if (((dhd->op_mode & HOSTAPD_MASK) == HOSTAPD_MASK) ||
+                ((dhd->op_mode & WFD_MASK) == WFD_MASK))
+                return TRUE;
+        else
+#endif /* WL_CFG80211 */
+                return FALSE;
+}
+
+#ifdef PNO_SUPPORT
+int
+dhd_pno_clean(dhd_pub_t *dhd)
+{
+        char iovbuf[128];
+        int pfn_enabled = 0;
+        int iov_len = 0;
+        int ret;
+
+        /* Disable pfn */
+        iov_len = bcm_mkiovar("pfn", (char *)&pfn_enabled, 4, iovbuf, sizeof(iovbuf));
+        if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) >= 0) {
+                /* clear pfn */
+                iov_len = bcm_mkiovar("pfnclear", 0, 0, iovbuf, sizeof(iovbuf));
+                if (iov_len) {
+                        if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                                                    iov_len, TRUE, 0)) < 0) {
+                                DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+                        }
+                }
+                else {
+                        ret = -1;
+                        DHD_ERROR(("%s failed code %d\n", __FUNCTION__, iov_len));
+                }
+        }
+        else
+                DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+
+        return ret;
+}
+
+int
+dhd_pno_enable(dhd_pub_t *dhd, int pfn_enabled)
+{
+        char iovbuf[128];
+        int ret = -1;
+
+        if ((!dhd) && ((pfn_enabled != 0) || (pfn_enabled != 1))) {
+                DHD_ERROR(("%s error exit\n", __FUNCTION__));
+                return ret;
+        }
+
+        if (dhd_check_ap_wfd_mode_set(dhd) == TRUE)
+                return (ret);
+
+        memset(iovbuf, 0, sizeof(iovbuf));
+
+        if ((pfn_enabled) && (dhd_is_associated(dhd, NULL) == TRUE)) {
+                DHD_ERROR(("%s pno is NOT enable : called in assoc mode , ignore\n", __FUNCTION__));
+                return ret;
+        }
+
+        /* Enable/disable PNO */
+        if ((ret = bcm_mkiovar("pfn", (char *)&pfn_enabled, 4, iovbuf, sizeof(iovbuf))) > 0) {
+                if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+                        iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+                        DHD_ERROR(("%s failed for error=%d\n", __FUNCTION__, ret));
+                        return ret;
+                }
+                else {
+                        dhd->pno_enable = pfn_enabled;
+                        DHD_TRACE(("%s set pno as %s\n",
+                                __FUNCTION__, dhd->pno_enable ? "Enable" : "Disable"));
+                }
+        }
+        else DHD_ERROR(("%s failed err=%d\n", __FUNCTION__, ret));
+
+        return ret;
+}
+
+/* Function to execute combined scan */
+int
+dhd_pno_set(dhd_pub_t *dhd, wlc_ssid_t* ssids_local, int nssid, ushort scan_fr,
+        int pno_repeat, int pno_freq_expo_max)
+{
+        int err = -1;
+        char iovbuf[128];
+        int k, i;
+        wl_pfn_param_t pfn_param;
+        wl_pfn_t        pfn_element;
+        uint len = 0;
+
+        DHD_TRACE(("%s nssid=%d nchan=%d\n", __FUNCTION__, nssid, scan_fr));
+
+        if ((!dhd) && (!ssids_local)) {
+                DHD_ERROR(("%s error exit\n", __FUNCTION__));
+                err = -1;
+        }
+
+        if (dhd_check_ap_wfd_mode_set(dhd) == TRUE)
+                return (err);
+
+        /* Check for broadcast ssid */
+        for (k = 0; k < nssid; k++) {
+                if (!ssids_local[k].SSID_len) {
+                        DHD_ERROR(("%d: Broadcast SSID is ilegal for PNO setting\n", k));
+                        return err;
+                }
+        }
+/* #define  PNO_DUMP 1 */
+#ifdef PNO_DUMP
+        {
+                int j;
+                for (j = 0; j < nssid; j++) {
+                        DHD_ERROR(("%d: scan  for  %s size =%d\n", j,
+                                ssids_local[j].SSID, ssids_local[j].SSID_len));
+                }
+        }
+#endif /* PNO_DUMP */
+
+        /* clean up everything */
+        if  ((err = dhd_pno_clean(dhd)) < 0) {
+                DHD_ERROR(("%s failed error=%d\n", __FUNCTION__, err));
+                return err;
+        }
+        memset(iovbuf, 0, sizeof(iovbuf));
+        memset(&pfn_param, 0, sizeof(pfn_param));
+        memset(&pfn_element, 0, sizeof(pfn_element));
+
+        /* set pfn parameters */
+        pfn_param.version = htod32(PFN_VERSION);
+        pfn_param.flags = htod16((PFN_LIST_ORDER << SORT_CRITERIA_BIT));
+
+        /* check and set extra pno params */
+        if ((pno_repeat != 0) || (pno_freq_expo_max != 0)) {
+                pfn_param.flags |= htod16(ENABLE << ENABLE_ADAPTSCAN_BIT);
+                pfn_param.repeat = (uchar) (pno_repeat);
+                pfn_param.exp = (uchar) (pno_freq_expo_max);
+        }
+        /* set up pno scan fr */
+        if (scan_fr  != 0)
+                pfn_param.scan_freq = htod32(scan_fr);
+
+        if (pfn_param.scan_freq > PNO_SCAN_MAX_FW_SEC) {
+                DHD_ERROR(("%s pno freq above %d sec\n", __FUNCTION__, PNO_SCAN_MAX_FW_SEC));
+                return err;
+        }
+        if (pfn_param.scan_freq < PNO_SCAN_MIN_FW_SEC) {
+                DHD_ERROR(("%s pno freq less %d sec\n", __FUNCTION__, PNO_SCAN_MIN_FW_SEC));
+                return err;
+        }
+
+        len = bcm_mkiovar("pfn_set", (char *)&pfn_param, sizeof(pfn_param), iovbuf, sizeof(iovbuf));
+        if ((err = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, len, TRUE, 0)) < 0) {
+                                DHD_ERROR(("%s pfn_set failed for error=%d\n",
+                                        __FUNCTION__, err));
+                                return err;
+        }
+
+        /* set all pfn ssid */
+        for (i = 0; i < nssid; i++) {
+
+                pfn_element.infra = htod32(DOT11_BSSTYPE_INFRASTRUCTURE);
+                pfn_element.auth = (DOT11_OPEN_SYSTEM);
+                pfn_element.wpa_auth = htod32(WPA_AUTH_PFN_ANY);
+                pfn_element.wsec = htod32(0);
+                pfn_element.infra = htod32(1);
+                pfn_element.flags = htod32(ENABLE << WL_PFN_HIDDEN_BIT);
+                memcpy((char *)pfn_element.ssid.SSID, ssids_local[i].SSID, ssids_local[i].SSID_len);
+                pfn_element.ssid.SSID_len = ssids_local[i].SSID_len;
+
+                if ((len =
+                bcm_mkiovar("pfn_add", (char *)&pfn_element,
+                        sizeof(pfn_element), iovbuf, sizeof(iovbuf))) > 0) {
+                        if ((err =
+                        dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, len, TRUE, 0)) < 0) {
+                                DHD_ERROR(("%s failed for i=%d error=%d\n",
+                                        __FUNCTION__, i, err));
+                                return err;
+                        }
+                        else
+                                DHD_TRACE(("%s set OK with PNO time=%d repeat=%d max_adjust=%d\n",
+                                        __FUNCTION__, pfn_param.scan_freq,
+                                        pfn_param.repeat, pfn_param.exp));
+                }
+                else DHD_ERROR(("%s failed err=%d\n", __FUNCTION__, err));
+        }
+
+        /* Enable PNO */
+        /* dhd_pno_enable(dhd, 1); */
+        return err;
+}
+
+int
+dhd_pno_get_status(dhd_pub_t *dhd)
+{
+        int ret = -1;
+
+        if (!dhd)
+                return ret;
+        else
+                return (dhd->pno_enable);
+}
+
+#endif /* PNO_SUPPORT */
+
+#if defined(KEEP_ALIVE)
+int dhd_keep_alive_onoff(dhd_pub_t *dhd)
+{
+        char                            buf[256];
+        const char                      *str;
+        wl_mkeep_alive_pkt_t    mkeep_alive_pkt;
+        wl_mkeep_alive_pkt_t    *mkeep_alive_pktp;
+        int                                     buf_len;
+        int                                     str_len;
+        int res                                 = -1;
+
+        if (dhd_check_ap_wfd_mode_set(dhd) == TRUE)
+                return (res);
+
+        DHD_TRACE(("%s execution\n", __FUNCTION__));
+
+        str = "mkeep_alive";
+        str_len = strlen(str);
+        strncpy(buf, str, str_len);
+        buf[ str_len ] = '\0';
+        mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) (buf + str_len + 1);
+        mkeep_alive_pkt.period_msec = KEEP_ALIVE_PERIOD;
+        buf_len = str_len + 1;
+        mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+        mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+        /* Setup keep alive zero for null packet generation */
+        mkeep_alive_pkt.keep_alive_id = 0;
+        mkeep_alive_pkt.len_bytes = 0;
+        buf_len += WL_MKEEP_ALIVE_FIXED_LEN;
+        /* Keep-alive attributes are set in local variable (mkeep_alive_pkt), and
+         * then memcpy'ed into buffer (mkeep_alive_pktp) since there is no
+         * guarantee that the buffer is properly aligned.
+         */
+        memcpy((char *)mkeep_alive_pktp, &mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN);
+
+        res = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+
+        return res;
+}
+#endif /* defined(KEEP_ALIVE) */
+/* Android ComboSCAN support */
+
+/*
+ *  data parsing from ComboScan tlv list
+*/
+int
+wl_iw_parse_data_tlv(char** list_str, void *dst, int dst_size, const char token,
+                     int input_size, int *bytes_left)
+{
+        char* str = *list_str;
+        uint16 short_temp;
+        uint32 int_temp;
+
+        if ((list_str == NULL) || (*list_str == NULL) ||(bytes_left == NULL) || (*bytes_left < 0)) {
+                DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+                return -1;
+        }
+
+        /* Clean all dest bytes */
+        memset(dst, 0, dst_size);
+        while (*bytes_left > 0) {
+
+                if (str[0] != token) {
+                        DHD_TRACE(("%s NOT Type=%d get=%d left_parse=%d \n",
+                                __FUNCTION__, token, str[0], *bytes_left));
+                        return -1;
+                }
+
+                *bytes_left -= 1;
+                str += 1;
+
+                if (input_size == 1) {
+                        memcpy(dst, str, input_size);
+                }
+                else if (input_size == 2) {
+                        memcpy(dst, (char *)htod16(memcpy(&short_temp, str, input_size)),
+                                input_size);
+                }
+                else if (input_size == 4) {
+                        memcpy(dst, (char *)htod32(memcpy(&int_temp, str, input_size)),
+                                input_size);
+                }
+
+                *bytes_left -= input_size;
+                str += input_size;
+                *list_str = str;
+                return 1;
+        }
+        return 1;
+}
+
+/*
+ *  channel list parsing from cscan tlv list
+*/
+int
+wl_iw_parse_channel_list_tlv(char** list_str, uint16* channel_list,
+                             int channel_num, int *bytes_left)
+{
+        char* str = *list_str;
+        int idx = 0;
+
+        if ((list_str == NULL) || (*list_str == NULL) ||(bytes_left == NULL) || (*bytes_left < 0)) {
+                DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+                return -1;
+        }
+
+        while (*bytes_left > 0) {
+
+                if (str[0] != CSCAN_TLV_TYPE_CHANNEL_IE) {
+                        *list_str = str;
+                        DHD_TRACE(("End channel=%d left_parse=%d %d\n", idx, *bytes_left, str[0]));
+                        return idx;
+                }
+                /* Get proper CSCAN_TLV_TYPE_CHANNEL_IE */
+                *bytes_left -= 1;
+                str += 1;
+
+                if (str[0] == 0) {
+                        /* All channels */
+                        channel_list[idx] = 0x0;
+                }
+                else {
+                        channel_list[idx] = (uint16)str[0];
+                        DHD_TRACE(("%s channel=%d \n", __FUNCTION__,  channel_list[idx]));
+                }
+                *bytes_left -= 1;
+                str += 1;
+
+                if (idx++ > 255) {
+                        DHD_ERROR(("%s Too many channels \n", __FUNCTION__));
+                        return -1;
+                }
+        }
+
+        *list_str = str;
+        return idx;
+}
+
+/*
+ *  SSIDs list parsing from cscan tlv list
+ */
+int
+wl_iw_parse_ssid_list_tlv(char** list_str, wlc_ssid_t* ssid, int max, int *bytes_left)
+{
+        char* str =  *list_str;
+        int idx = 0;
+
+        if ((list_str == NULL) || (*list_str == NULL) || (*bytes_left < 0)) {
+                DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+                return -1;
+        }
+
+        while (*bytes_left > 0) {
+
+                if (str[0] != CSCAN_TLV_TYPE_SSID_IE) {
+                        *list_str = str;
+                        DHD_TRACE(("nssid=%d left_parse=%d %d\n", idx, *bytes_left, str[0]));
+                        return idx;
+                }
+
+                /* Get proper CSCAN_TLV_TYPE_SSID_IE */
+                *bytes_left -= 1;
+                str += 1;
+
+                if (str[0] == 0) {
+                        /* Broadcast SSID */
+                        ssid[idx].SSID_len = 0;
+                        memset((char*)ssid[idx].SSID, 0x0, DOT11_MAX_SSID_LEN);
+                        *bytes_left -= 1;
+                        str += 1;
+
+                        DHD_TRACE(("BROADCAST SCAN  left=%d\n", *bytes_left));
+                }
+                else if (str[0] <= DOT11_MAX_SSID_LEN) {
+                        /* Get proper SSID size */
+                        ssid[idx].SSID_len = str[0];
+                        *bytes_left -= 1;
+                        str += 1;
+
+                        /* Get SSID */
+                        if (ssid[idx].SSID_len > *bytes_left) {
+                                DHD_ERROR(("%s out of memory range len=%d but left=%d\n",
+                                __FUNCTION__, ssid[idx].SSID_len, *bytes_left));
+                                return -1;
+                        }
+
+                        memcpy((char*)ssid[idx].SSID, str, ssid[idx].SSID_len);
+
+                        *bytes_left -= ssid[idx].SSID_len;
+                        str += ssid[idx].SSID_len;
+
+                        DHD_TRACE(("%s :size=%d left=%d\n",
+                                (char*)ssid[idx].SSID, ssid[idx].SSID_len, *bytes_left));
+                }
+                else {
+                        DHD_ERROR(("### SSID size more that %d\n", str[0]));
+                        return -1;
+                }
+
+                if (idx++ >  max) {
+                        DHD_ERROR(("%s number of SSIDs more that %d\n", __FUNCTION__, idx));
+                        return -1;
+                }
+        }
+
+        *list_str = str;
+        return idx;
+}
+
+/* Parse a comma-separated list from list_str into ssid array, starting
+ * at index idx.  Max specifies size of the ssid array.  Parses ssids
+ * and returns updated idx; if idx >= max not all fit, the excess have
+ * not been copied.  Returns -1 on empty string, or on ssid too long.
+ */
+int
+wl_iw_parse_ssid_list(char** list_str, wlc_ssid_t* ssid, int idx, int max)
+{
+        char* str, *ptr;
+
+        if ((list_str == NULL) || (*list_str == NULL))
+                return -1;
+
+        for (str = *list_str; str != NULL; str = ptr) {
+
+                /* check for next TAG */
+                if (!strncmp(str, GET_CHANNEL, strlen(GET_CHANNEL))) {
+                        *list_str        = str + strlen(GET_CHANNEL);
+                        return idx;
+                }
+
+                if ((ptr = strchr(str, ',')) != NULL) {
+                        *ptr++ = '\0';
+                }
+
+                if (strlen(str) > DOT11_MAX_SSID_LEN) {
+                        DHD_ERROR(("ssid <%s> exceeds %d\n", str, DOT11_MAX_SSID_LEN));
+                        return -1;
+                }
+
+                if (strlen(str) == 0)
+                        ssid[idx].SSID_len = 0;
+
+                if (idx < max) {
+                        bcm_strcpy_s((char*)ssid[idx].SSID, sizeof(ssid[idx].SSID), str);
+                        ssid[idx].SSID_len = strlen(str);
+                }
+                idx++;
+        }
+        return idx;
+}
+
+/*
+ * Parse channel list from iwpriv CSCAN
+ */
+int
+wl_iw_parse_channel_list(char** list_str, uint16* channel_list, int channel_num)
+{
+        int num;
+        int val;
+        char* str;
+        char* endptr = NULL;
+
+        if ((list_str == NULL)||(*list_str == NULL))
+                return -1;
+
+        str = *list_str;
+        num = 0;
+        while (strncmp(str, GET_NPROBE, strlen(GET_NPROBE))) {
+                val = (int)strtoul(str, &endptr, 0);
+                if (endptr == str) {
+                        printf("could not parse channel number starting at"
+                                " substring \"%s\" in list:\n%s\n",
+                                str, *list_str);
+                        return -1;
+                }
+                str = endptr + strspn(endptr, " ,");
+
+                if (num == channel_num) {
+                        DHD_ERROR(("too many channels (more than %d) in channel list:\n%s\n",
+                                channel_num, *list_str));
+                        return -1;
+                }
+
+                channel_list[num++] = (uint16)val;
+        }
+        *list_str = str;
+        return num;
+}
diff --git a/drivers/net/wireless/bcmdhd/dhd_custom_gpio.c b/drivers/net/wireless/bcmdhd/dhd_custom_gpio.c
new file mode 100644
index 00000000000..9750eeb23bc
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_custom_gpio.c
@@ -0,0 +1,293 @@
+/*
+* Customer code to add GPIO control during WLAN start/stop
+* Copyright (C) 1999-2011, Broadcom Corporation
+* 
+*         Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2 (the "GPL"),
+* available at http://www.broadcom.com/licenses/GPLv2.php, with the
+* following added to such license:
+* 
+*      As a special exception, the copyright holders of this software give you
+* permission to link this software with independent modules, and to copy and
+* distribute the resulting executable under terms of your choice, provided that
+* you also meet, for each linked independent module, the terms and conditions of
+* the license of that module.  An independent module is a module which is not
+* derived from this software.  The special exception does not apply to any
+* modifications of the software.
+* 
+*      Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a license
+* other than the GPL, without Broadcom's express prior written consent.
+*
+* $Id: dhd_custom_gpio.c,v 1.2.42.1 2010-10-19 00:41:09 Exp $
+*/
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <bcmutils.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#include <wlioctl.h>
+#include <wl_iw.h>
+
+#define WL_ERROR(x) printf x
+#define WL_TRACE(x)
+
+#ifdef CUSTOMER_HW
+extern  void bcm_wlan_power_off(int);
+extern  void bcm_wlan_power_on(int);
+#endif /* CUSTOMER_HW */
+#if defined(CUSTOMER_HW2)
+#ifdef CONFIG_WIFI_CONTROL_FUNC
+int wifi_set_power(int on, unsigned long msec);
+int wifi_get_irq_number(unsigned long *irq_flags_ptr);
+int wifi_get_mac_addr(unsigned char *buf);
+void *wifi_get_country_code(char *ccode);
+#else
+int wifi_set_power(int on, unsigned long msec) { return -1; }
+int wifi_get_irq_number(unsigned long *irq_flags_ptr) { return -1; }
+int wifi_get_mac_addr(unsigned char *buf) { return -1; }
+void *wifi_get_country_code(char *ccode) { return NULL; }
+#endif /* CONFIG_WIFI_CONTROL_FUNC */
+#endif /* CUSTOMER_HW2 */
+
+#if defined(OOB_INTR_ONLY)
+
+#if defined(BCMLXSDMMC)
+extern int sdioh_mmc_irq(int irq);
+#endif /* (BCMLXSDMMC)  */
+
+#ifdef CUSTOMER_HW3
+#include <mach/gpio.h>
+#endif
+
+/* Customer specific Host GPIO defintion  */
+static int dhd_oob_gpio_num = -1;
+
+module_param(dhd_oob_gpio_num, int, 0644);
+MODULE_PARM_DESC(dhd_oob_gpio_num, "DHD oob gpio number");
+
+/* This function will return:
+ *  1) return :  Host gpio interrupt number per customer platform
+ *  2) irq_flags_ptr : Type of Host interrupt as Level or Edge
+ *
+ *  NOTE :
+ *  Customer should check his platform definitions
+ *  and his Host Interrupt spec
+ *  to figure out the proper setting for his platform.
+ *  Broadcom provides just reference settings as example.
+ *
+ */
+int dhd_customer_oob_irq_map(unsigned long *irq_flags_ptr)
+{
+        int  host_oob_irq = 0;
+
+#ifdef CUSTOMER_HW2
+        host_oob_irq = wifi_get_irq_number(irq_flags_ptr);
+
+#else
+#if defined(CUSTOM_OOB_GPIO_NUM)
+        if (dhd_oob_gpio_num < 0) {
+                dhd_oob_gpio_num = CUSTOM_OOB_GPIO_NUM;
+        }
+#endif /* CUSTOMER_HW2 */
+
+        if (dhd_oob_gpio_num < 0) {
+                WL_ERROR(("%s: ERROR customer specific Host GPIO is NOT defined \n",
+                        __FUNCTION__));
+                return (dhd_oob_gpio_num);
+        }
+
+        WL_ERROR(("%s: customer specific Host GPIO number is (%d)\n",
+                 __FUNCTION__, dhd_oob_gpio_num));
+
+#if defined CUSTOMER_HW
+        host_oob_irq = MSM_GPIO_TO_INT(dhd_oob_gpio_num);
+#elif defined CUSTOMER_HW3
+        gpio_request(dhd_oob_gpio_num, "oob irq");
+        host_oob_irq = gpio_to_irq(dhd_oob_gpio_num);
+        gpio_direction_input(dhd_oob_gpio_num);
+#endif /* CUSTOMER_HW */
+#endif /* CUSTOMER_HW2 */
+
+        return (host_oob_irq);
+}
+#endif /* defined(OOB_INTR_ONLY) */
+
+/* Customer function to control hw specific wlan gpios */
+void
+dhd_customer_gpio_wlan_ctrl(int onoff)
+{
+        switch (onoff) {
+                case WLAN_RESET_OFF:
+                        WL_TRACE(("%s: call customer specific GPIO to insert WLAN RESET\n",
+                                __FUNCTION__));
+#ifdef CUSTOMER_HW
+                        bcm_wlan_power_off(2);
+#endif /* CUSTOMER_HW */
+#ifdef CUSTOMER_HW2
+                        wifi_set_power(0, 0);
+#endif
+                        WL_ERROR(("=========== WLAN placed in RESET ========\n"));
+                break;
+
+                case WLAN_RESET_ON:
+                        WL_TRACE(("%s: callc customer specific GPIO to remove WLAN RESET\n",
+                                __FUNCTION__));
+#ifdef CUSTOMER_HW
+                        bcm_wlan_power_on(2);
+#endif /* CUSTOMER_HW */
+#ifdef CUSTOMER_HW2
+                        wifi_set_power(1, 0);
+#endif
+                        WL_ERROR(("=========== WLAN going back to live  ========\n"));
+                break;
+
+                case WLAN_POWER_OFF:
+                        WL_TRACE(("%s: call customer specific GPIO to turn off WL_REG_ON\n",
+                                __FUNCTION__));
+#ifdef CUSTOMER_HW
+                        bcm_wlan_power_off(1);
+#endif /* CUSTOMER_HW */
+                break;
+
+                case WLAN_POWER_ON:
+                        WL_TRACE(("%s: call customer specific GPIO to turn on WL_REG_ON\n",
+                                __FUNCTION__));
+#ifdef CUSTOMER_HW
+                        bcm_wlan_power_on(1);
+                        /* Lets customer power to get stable */
+                        OSL_DELAY(200);
+#endif /* CUSTOMER_HW */
+                break;
+        }
+}
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+/* Function to get custom MAC address */
+int
+dhd_custom_get_mac_address(unsigned char *buf)
+{
+        int ret = 0;
+
+        WL_TRACE(("%s Enter\n", __FUNCTION__));
+        if (!buf)
+                return -EINVAL;
+
+        /* Customer access to MAC address stored outside of DHD driver */
+#if defined(CUSTOMER_HW2) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
+        ret = wifi_get_mac_addr(buf);
+#endif
+
+#ifdef EXAMPLE_GET_MAC
+        /* EXAMPLE code */
+        {
+                struct ether_addr ea_example = {{0x00, 0x11, 0x22, 0x33, 0x44, 0xFF}};
+                bcopy((char *)&ea_example, buf, sizeof(struct ether_addr));
+        }
+#endif /* EXAMPLE_GET_MAC */
+
+        return ret;
+}
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+/* Customized Locale table : OPTIONAL feature */
+const struct cntry_locales_custom translate_custom_table[] = {
+/* Table should be filled out based on custom platform regulatory requirement */
+#ifdef EXAMPLE_TABLE
+        {"",   "XY", 4},  /* Universal if Country code is unknown or empty */
+        {"US", "US", 69}, /* input ISO "US" to : US regrev 69 */
+        {"CA", "US", 69}, /* input ISO "CA" to : US regrev 69 */
+        {"EU", "EU", 5},  /* European union countries to : EU regrev 05 */
+        {"AT", "EU", 5},
+        {"BE", "EU", 5},
+        {"BG", "EU", 5},
+        {"CY", "EU", 5},
+        {"CZ", "EU", 5},
+        {"DK", "EU", 5},
+        {"EE", "EU", 5},
+        {"FI", "EU", 5},
+        {"FR", "EU", 5},
+        {"DE", "EU", 5},
+        {"GR", "EU", 5},
+        {"HU", "EU", 5},
+        {"IE", "EU", 5},
+        {"IT", "EU", 5},
+        {"LV", "EU", 5},
+        {"LI", "EU", 5},
+        {"LT", "EU", 5},
+        {"LU", "EU", 5},
+        {"MT", "EU", 5},
+        {"NL", "EU", 5},
+        {"PL", "EU", 5},
+        {"PT", "EU", 5},
+        {"RO", "EU", 5},
+        {"SK", "EU", 5},
+        {"SI", "EU", 5},
+        {"ES", "EU", 5},
+        {"SE", "EU", 5},
+        {"GB", "EU", 5},
+        {"KR", "XY", 3},
+        {"AU", "XY", 3},
+        {"CN", "XY", 3}, /* input ISO "CN" to : XY regrev 03 */
+        {"TW", "XY", 3},
+        {"AR", "XY", 3},
+        {"MX", "XY", 3},
+        {"IL", "IL", 0},
+        {"CH", "CH", 0},
+        {"TR", "TR", 0},
+        {"NO", "NO", 0},
+#endif /* EXMAPLE_TABLE */
+};
+
+
+/* Customized Locale convertor
+*  input : ISO 3166-1 country abbreviation
+*  output: customized cspec
+*/
+void get_customized_country_code(char *country_iso_code, wl_country_t *cspec)
+{
+#if defined(CUSTOMER_HW2) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+
+        struct cntry_locales_custom *cloc_ptr;
+
+        if (!cspec)
+                return;
+
+        cloc_ptr = wifi_get_country_code(country_iso_code);
+        if (cloc_ptr) {
+                strlcpy(cspec->ccode, cloc_ptr->custom_locale, WLC_CNTRY_BUF_SZ);
+                cspec->rev = cloc_ptr->custom_locale_rev;
+        }
+        return;
+#else
+        int size, i;
+
+        size = ARRAYSIZE(translate_custom_table);
+
+        if (cspec == 0)
+                 return;
+
+        if (size == 0)
+                 return;
+
+        for (i = 0; i < size; i++) {
+                if (strcmp(country_iso_code, translate_custom_table[i].iso_abbrev) == 0) {
+                        memcpy(cspec->ccode,
+                                translate_custom_table[i].custom_locale, WLC_CNTRY_BUF_SZ);
+                        cspec->rev = translate_custom_table[i].custom_locale_rev;
+                        return;
+                }
+        }
+#ifdef EXAMPLE_TABLE
+        /* if no country code matched return first universal code from translate_custom_table */
+        memcpy(cspec->ccode, translate_custom_table[0].custom_locale, WLC_CNTRY_BUF_SZ);
+        cspec->rev = translate_custom_table[0].custom_locale_rev;
+#endif /* EXMAPLE_TABLE */
+        return;
+#endif /* defined(CUSTOMER_HW2) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)) */
+}
diff --git a/drivers/net/wireless/bcmdhd/dhd_dbg.h b/drivers/net/wireless/bcmdhd/dhd_dbg.h
new file mode 100644
index 00000000000..a195cbe88e5
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_dbg.h
@@ -0,0 +1,105 @@
+/*
+ * Debug/trace/assert driver definitions for Dongle Host Driver.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_dbg.h 285933 2011-09-23 21:45:31Z $
+ */
+
+#ifndef _dhd_dbg_
+#define _dhd_dbg_
+
+#if defined(DHD_DEBUG)
+
+#define DHD_ERROR(args)        do {if ((dhd_msg_level & DHD_ERROR_VAL) && (net_ratelimit())) \
+                                                                printf args;} while (0)
+#define DHD_TRACE(args)         do {if (dhd_msg_level & DHD_TRACE_VAL) printf args;} while (0)
+#define DHD_INFO(args)          do {if (dhd_msg_level & DHD_INFO_VAL) printf args;} while (0)
+#define DHD_DATA(args)          do {if (dhd_msg_level & DHD_DATA_VAL) printf args;} while (0)
+#define DHD_CTL(args)           do {if (dhd_msg_level & DHD_CTL_VAL) printf args;} while (0)
+#define DHD_TIMER(args)         do {if (dhd_msg_level & DHD_TIMER_VAL) printf args;} while (0)
+#define DHD_HDRS(args)          do {if (dhd_msg_level & DHD_HDRS_VAL) printf args;} while (0)
+#define DHD_BYTES(args)         do {if (dhd_msg_level & DHD_BYTES_VAL) printf args;} while (0)
+#define DHD_INTR(args)          do {if (dhd_msg_level & DHD_INTR_VAL) printf args;} while (0)
+#define DHD_GLOM(args)          do {if (dhd_msg_level & DHD_GLOM_VAL) printf args;} while (0)
+#define DHD_EVENT(args)         do {if (dhd_msg_level & DHD_EVENT_VAL) printf args;} while (0)
+#define DHD_BTA(args)           do {if (dhd_msg_level & DHD_BTA_VAL) printf args;} while (0)
+#define DHD_ISCAN(args)         do {if (dhd_msg_level & DHD_ISCAN_VAL) printf args;} while (0)
+#define DHD_ARPOE(args)         do {if (dhd_msg_level & DHD_ARPOE_VAL) printf args;} while (0)
+
+#define DHD_ERROR_ON()          (dhd_msg_level & DHD_ERROR_VAL)
+#define DHD_TRACE_ON()          (dhd_msg_level & DHD_TRACE_VAL)
+#define DHD_INFO_ON()           (dhd_msg_level & DHD_INFO_VAL)
+#define DHD_DATA_ON()           (dhd_msg_level & DHD_DATA_VAL)
+#define DHD_CTL_ON()            (dhd_msg_level & DHD_CTL_VAL)
+#define DHD_TIMER_ON()          (dhd_msg_level & DHD_TIMER_VAL)
+#define DHD_HDRS_ON()           (dhd_msg_level & DHD_HDRS_VAL)
+#define DHD_BYTES_ON()          (dhd_msg_level & DHD_BYTES_VAL)
+#define DHD_INTR_ON()           (dhd_msg_level & DHD_INTR_VAL)
+#define DHD_GLOM_ON()           (dhd_msg_level & DHD_GLOM_VAL)
+#define DHD_EVENT_ON()          (dhd_msg_level & DHD_EVENT_VAL)
+#define DHD_BTA_ON()            (dhd_msg_level & DHD_BTA_VAL)
+#define DHD_ISCAN_ON()          (dhd_msg_level & DHD_ISCAN_VAL)
+#define DHD_ARPOE_ON()          (dhd_msg_level & DHD_ARPOE_VAL)
+
+#else /* defined(BCMDBG) || defined(DHD_DEBUG) */
+
+#define DHD_ERROR(args)         do {if (net_ratelimit()) printf args;} while (0)
+#define DHD_TRACE(args)
+#define DHD_INFO(args)
+#define DHD_DATA(args)
+#define DHD_CTL(args)
+#define DHD_TIMER(args)
+#define DHD_HDRS(args)
+#define DHD_BYTES(args)
+#define DHD_INTR(args)
+#define DHD_GLOM(args)
+#define DHD_EVENT(args)
+#define DHD_BTA(args)
+#define DHD_ISCAN(args)
+#define DHD_ARPOE(args)
+
+#define DHD_ERROR_ON()          0
+#define DHD_TRACE_ON()          0
+#define DHD_INFO_ON()           0
+#define DHD_DATA_ON()           0
+#define DHD_CTL_ON()            0
+#define DHD_TIMER_ON()          0
+#define DHD_HDRS_ON()           0
+#define DHD_BYTES_ON()          0
+#define DHD_INTR_ON()           0
+#define DHD_GLOM_ON()           0
+#define DHD_EVENT_ON()          0
+#define DHD_BTA_ON()            0
+#define DHD_ISCAN_ON()          0
+#define DHD_ARPOE_ON()          0
+#endif 
+
+#define DHD_LOG(args)
+
+#define DHD_BLOG(cp, size)
+#define DHD_NONE(args)
+extern int dhd_msg_level;
+
+/* Defines msg bits */
+#include <dhdioctl.h>
+
+#endif /* _dhd_dbg_ */
diff --git a/drivers/net/wireless/bcmdhd/dhd_linux.c b/drivers/net/wireless/bcmdhd/dhd_linux.c
new file mode 100644
index 00000000000..80a75699e27
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_linux.c
@@ -0,0 +1,5080 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux-specific network interface
+ * Basically selected code segments from usb-cdc.c and usb-rndis.c
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_linux.c 291449 2011-10-22 12:16:26Z $
+ */
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/device.h>
+
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+
+#include <proto/ethernet.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#ifdef CONFIG_HAS_WAKELOCK
+#include <linux/wakelock.h>
+#endif
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+
+#include <proto/802.11_bta.h>
+#include <proto/bt_amp_hci.h>
+#include <dhd_bta.h>
+
+#ifdef WLMEDIA_HTSF
+#include <linux/time.h>
+#include <htsf.h>
+
+#define HTSF_MINLEN 200    /* min. packet length to timestamp */
+#define HTSF_BUS_DELAY 150 /* assume a fix propagation in us  */
+#define TSMAX  1000        /* max no. of timing record kept   */
+#define NUMBIN 34
+
+static uint32 tsidx = 0;
+static uint32 htsf_seqnum = 0;
+uint32 tsfsync;
+struct timeval tsync;
+static uint32 tsport = 5010;
+
+typedef struct histo_ {
+        uint32 bin[NUMBIN];
+} histo_t;
+
+#if !ISPOWEROF2(DHD_SDALIGN)
+#error DHD_SDALIGN is not a power of 2!
+#endif
+
+static histo_t vi_d1, vi_d2, vi_d3, vi_d4;
+#endif /* WLMEDIA_HTSF */
+
+#if defined(SOFTAP)
+extern bool ap_cfg_running;
+extern bool ap_fw_loaded;
+#endif
+
+/* enable HOSTIP cache update from the host side when an eth0:N is up */
+#define AOE_IP_ALIAS_SUPPORT 1
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#include <wl_android.h>
+
+#ifdef ARP_OFFLOAD_SUPPORT
+static int dhd_device_event(struct notifier_block *this,
+        unsigned long event,
+        void *ptr);
+
+static struct notifier_block dhd_notifier = {
+        .notifier_call = dhd_device_event
+};
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+#include <linux/suspend.h>
+volatile bool dhd_mmc_suspend = FALSE;
+DECLARE_WAIT_QUEUE_HEAD(dhd_dpc_wait);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP) */
+
+#if defined(OOB_INTR_ONLY)
+extern void dhd_enable_oob_intr(struct dhd_bus *bus, bool enable);
+#endif /* defined(OOB_INTR_ONLY) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+MODULE_LICENSE("GPL v2");
+#endif /* LinuxVer */
+
+#include <dhd_bus.h>
+
+#ifndef PROP_TXSTATUS
+#define DBUS_RX_BUFFER_SIZE_DHD(net)    (net->mtu + net->hard_header_len + dhd->pub.hdrlen)
+#else
+#define DBUS_RX_BUFFER_SIZE_DHD(net)    (net->mtu + net->hard_header_len + dhd->pub.hdrlen + 128)
+#endif
+
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 15)
+const char *
+print_tainted()
+{
+        return "";
+}
+#endif  /* LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 15) */
+
+/* Linux wireless extension support */
+#if defined(CONFIG_BCMDHD_WEXT)
+#include <wl_iw.h>
+extern wl_iw_extra_params_t  g_wl_iw_params;
+#endif /* defined(CONFIG_BCMDHD_WEXT) */
+
+#if defined(CONFIG_HAS_EARLYSUSPEND)
+#include <linux/earlysuspend.h>
+extern int dhdcdc_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len);
+extern int dhd_get_dtim_skip(dhd_pub_t *dhd);
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) */
+
+#ifdef PKT_FILTER_SUPPORT
+extern void dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg);
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+#endif
+
+/* Interface control information */
+typedef struct dhd_if {
+        struct dhd_info *info;                  /* back pointer to dhd_info */
+        /* OS/stack specifics */
+        struct net_device *net;
+        struct net_device_stats stats;
+        int                     idx;                    /* iface idx in dongle */
+        dhd_if_state_t  state;                  /* interface state */
+        uint                    subunit;                /* subunit */
+        uint8                   mac_addr[ETHER_ADDR_LEN];       /* assigned MAC address */
+        bool                    attached;               /* Delayed attachment when unset */
+        bool                    txflowcontrol;  /* Per interface flow control indicator */
+        char                    name[IFNAMSIZ+1]; /* linux interface name */
+        uint8                   bssidx;                 /* bsscfg index for the interface */
+        bool                    set_multicast;
+} dhd_if_t;
+
+#ifdef WLMEDIA_HTSF
+typedef struct {
+        uint32 low;
+        uint32 high;
+} tsf_t;
+
+typedef struct {
+        uint32 last_cycle;
+        uint32 last_sec;
+        uint32 last_tsf;
+        uint32 coef;     /* scaling factor */
+        uint32 coefdec1; /* first decimal  */
+        uint32 coefdec2; /* second decimal */
+} htsf_t;
+
+typedef struct {
+        uint32 t1;
+        uint32 t2;
+        uint32 t3;
+        uint32 t4;
+} tstamp_t;
+
+static tstamp_t ts[TSMAX];
+static tstamp_t maxdelayts;
+static uint32 maxdelay = 0, tspktcnt = 0, maxdelaypktno = 0;
+
+#endif  /* WLMEDIA_HTSF */
+
+/* Local private structure (extension of pub) */
+typedef struct dhd_info {
+#if defined(CONFIG_BCMDHD_WEXT)
+        wl_iw_t         iw;             /* wireless extensions state (must be first) */
+#endif /* defined(CONFIG_BCMDHD_WEXT) */
+
+        dhd_pub_t pub;
+
+        /* For supporting multiple interfaces */
+        dhd_if_t *iflist[DHD_MAX_IFS];
+
+        struct semaphore proto_sem;
+#ifdef PROP_TXSTATUS
+        spinlock_t      wlfc_spinlock;
+#endif /* PROP_TXSTATUS */
+#ifdef WLMEDIA_HTSF
+        htsf_t  htsf;
+#endif
+        wait_queue_head_t ioctl_resp_wait;
+        struct timer_list timer;
+        bool wd_timer_valid;
+        struct tasklet_struct tasklet;
+        spinlock_t      sdlock;
+        spinlock_t      txqlock;
+        spinlock_t      dhd_lock;
+#ifdef DHDTHREAD
+        /* Thread based operation */
+        bool threads_only;
+        struct semaphore sdsem;
+
+        tsk_ctl_t       thr_dpc_ctl;
+        tsk_ctl_t       thr_wdt_ctl;
+
+#else
+        bool dhd_tasklet_create;
+#endif /* DHDTHREAD */
+        tsk_ctl_t       thr_sysioc_ctl;
+
+        /* Wakelocks */
+#if defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        struct wake_lock wl_wifi;   /* Wifi wakelock */
+        struct wake_lock wl_rxwake; /* Wifi rx wakelock */
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+        /* net_device interface lock, prevent race conditions among net_dev interface
+         * calls and wifi_on or wifi_off
+         */
+        struct mutex dhd_net_if_mutex;
+#endif
+        spinlock_t wakelock_spinlock;
+        int wakelock_counter;
+        int wakelock_timeout_enable;
+
+        /* Thread to issue ioctl for multicast */
+        bool set_macaddress;
+        struct ether_addr macvalue;
+        wait_queue_head_t ctrl_wait;
+        atomic_t pend_8021x_cnt;
+        dhd_attach_states_t dhd_state;
+
+#ifdef CONFIG_HAS_EARLYSUSPEND
+        struct early_suspend early_suspend;
+#endif /* CONFIG_HAS_EARLYSUSPEND */
+} dhd_info_t;
+
+/* Definitions to provide path to the firmware and nvram
+ * example nvram_path[MOD_PARAM_PATHLEN]="/projects/wlan/nvram.txt"
+ */
+char firmware_path[MOD_PARAM_PATHLEN];
+char nvram_path[MOD_PARAM_PATHLEN];
+
+extern int wl_control_wl_start(struct net_device *dev);
+extern int net_os_send_hang_message(struct net_device *dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+struct semaphore dhd_registration_sem;
+#define DHD_REGISTRATION_TIMEOUT  12000  /* msec : allowed time to finished dhd registration */
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+
+/* Spawn a thread for system ioctls (set mac, set mcast) */
+uint dhd_sysioc = TRUE;
+module_param(dhd_sysioc, uint, 0);
+
+/* Error bits */
+module_param(dhd_msg_level, int, 0);
+
+/* load firmware and/or nvram values from the filesystem */
+module_param_string(firmware_path, firmware_path, MOD_PARAM_PATHLEN, 0660);
+module_param_string(nvram_path, nvram_path, MOD_PARAM_PATHLEN, 0);
+
+/* Watchdog interval */
+uint dhd_watchdog_ms = 10;
+module_param(dhd_watchdog_ms, uint, 0);
+
+#if defined(DHD_DEBUG)
+/* Console poll interval */
+uint dhd_console_ms = 0;
+module_param(dhd_console_ms, uint, 0644);
+#endif /* defined(DHD_DEBUG) */
+
+/* ARP offload agent mode : Enable ARP Host Auto-Reply and ARP Peer Auto-Reply */
+uint dhd_arp_mode = 0xb;
+module_param(dhd_arp_mode, uint, 0);
+
+/* ARP offload enable */
+uint dhd_arp_enable = TRUE;
+module_param(dhd_arp_enable, uint, 0);
+
+/* Global Pkt filter enable control */
+uint dhd_pkt_filter_enable = TRUE;
+module_param(dhd_pkt_filter_enable, uint, 0);
+
+/*  Pkt filter init setup */
+uint dhd_pkt_filter_init = 0;
+module_param(dhd_pkt_filter_init, uint, 0);
+
+/* Pkt filter mode control */
+uint dhd_master_mode = TRUE;
+module_param(dhd_master_mode, uint, 0);
+
+#ifdef DHDTHREAD
+/* Watchdog thread priority, -1 to use kernel timer */
+int dhd_watchdog_prio = 97;
+module_param(dhd_watchdog_prio, int, 0);
+
+/* DPC thread priority, -1 to use tasklet */
+int dhd_dpc_prio = 98;
+module_param(dhd_dpc_prio, int, 0);
+
+/* DPC thread priority, -1 to use tasklet */
+extern int dhd_dongle_memsize;
+module_param(dhd_dongle_memsize, int, 0);
+#endif /* DHDTHREAD */
+/* Control fw roaming */
+uint dhd_roam_disable = 0;
+
+/* Control radio state */
+uint dhd_radio_up = 1;
+
+/* Network inteface name */
+char iface_name[IFNAMSIZ] = {'\0'};
+module_param_string(iface_name, iface_name, IFNAMSIZ, 0);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define DAEMONIZE(a) daemonize(a); \
+        allow_signal(SIGKILL); \
+        allow_signal(SIGTERM);
+#else /* Linux 2.4 (w/o preemption patch) */
+#define RAISE_RX_SOFTIRQ() \
+        cpu_raise_softirq(smp_processor_id(), NET_RX_SOFTIRQ)
+#define DAEMONIZE(a) daemonize(); \
+        do { if (a) \
+                strncpy(current->comm, a, MIN(sizeof(current->comm), (strlen(a) + 1))); \
+        } while (0);
+#endif /* LINUX_VERSION_CODE  */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define BLOCKABLE()     (!in_atomic())
+#else
+#define BLOCKABLE()     (!in_interrupt())
+#endif
+
+/* The following are specific to the SDIO dongle */
+
+/* IOCTL response timeout */
+int dhd_ioctl_timeout_msec = IOCTL_RESP_TIMEOUT;
+
+/* Idle timeout for backplane clock */
+int dhd_idletime = DHD_IDLETIME_TICKS;
+module_param(dhd_idletime, int, 0);
+
+/* Use polling */
+uint dhd_poll = FALSE;
+module_param(dhd_poll, uint, 0);
+
+/* Use interrupts */
+uint dhd_intr = TRUE;
+module_param(dhd_intr, uint, 0);
+
+/* SDIO Drive Strength (in milliamps) */
+uint dhd_sdiod_drive_strength = 6;
+module_param(dhd_sdiod_drive_strength, uint, 0);
+
+/* Tx/Rx bounds */
+extern uint dhd_txbound;
+extern uint dhd_rxbound;
+module_param(dhd_txbound, uint, 0);
+module_param(dhd_rxbound, uint, 0);
+
+/* Deferred transmits */
+extern uint dhd_deferred_tx;
+module_param(dhd_deferred_tx, uint, 0);
+
+#ifdef BCMDBGFS
+extern void dhd_dbg_init(dhd_pub_t *dhdp);
+extern void dhd_dbg_remove(void);
+#endif /* BCMDBGFS */
+
+
+
+#ifdef SDTEST
+/* Echo packet generator (pkts/s) */
+uint dhd_pktgen = 0;
+module_param(dhd_pktgen, uint, 0);
+
+/* Echo packet len (0 => sawtooth, max 2040) */
+uint dhd_pktgen_len = 0;
+module_param(dhd_pktgen_len, uint, 0);
+#endif /* SDTEST */
+
+/* Version string to report */
+#ifdef DHD_DEBUG
+#ifndef SRCBASE
+#define SRCBASE        "drivers/net/wireless/bcmdhd"
+#endif
+#define DHD_COMPILED "\nCompiled in " SRCBASE
+#else
+#define DHD_COMPILED
+#endif /* DHD_DEBUG */
+
+static char dhd_version[] = "Dongle Host Driver, version " EPI_VERSION_STR
+#ifdef DHD_DEBUG
+"\nCompiled in " SRCBASE " on " __DATE__ " at " __TIME__
+#endif
+;
+static void dhd_net_if_lock_local(dhd_info_t *dhd);
+static void dhd_net_if_unlock_local(dhd_info_t *dhd);
+
+#ifdef WLMEDIA_HTSF
+void htsf_update(dhd_info_t *dhd, void *data);
+tsf_t prev_tsf, cur_tsf;
+
+uint32 dhd_get_htsf(dhd_info_t *dhd, int ifidx);
+static int dhd_ioctl_htsf_get(dhd_info_t *dhd, int ifidx);
+static void dhd_dump_latency(void);
+static void dhd_htsf_addtxts(dhd_pub_t *dhdp, void *pktbuf);
+static void dhd_htsf_addrxts(dhd_pub_t *dhdp, void *pktbuf);
+static void dhd_dump_htsfhisto(histo_t *his, char *s);
+#endif /* WLMEDIA_HTSF */
+
+/* Monitor interface */
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+
+
+#if defined(CONFIG_BCMDHD_WEXT)
+struct iw_statistics *dhd_get_wireless_stats(struct net_device *dev);
+#endif /* defined(CONFIG_BCMDHD_WEXT) */
+
+static void dhd_dpc(ulong data);
+/* forward decl */
+extern int dhd_wait_pend8021x(struct net_device *dev);
+
+#ifdef TOE
+#ifndef BDC
+#error TOE requires BDC
+#endif /* !BDC */
+static int dhd_toe_get(dhd_info_t *dhd, int idx, uint32 *toe_ol);
+static int dhd_toe_set(dhd_info_t *dhd, int idx, uint32 toe_ol);
+#endif /* TOE */
+
+static int dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata,
+                             wl_event_msg_t *event_ptr, void **data_ptr);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+static int dhd_sleep_pm_callback(struct notifier_block *nfb, unsigned long action, void *ignored)
+{
+        int ret = NOTIFY_DONE;
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39))
+        switch (action) {
+                case PM_HIBERNATION_PREPARE:
+                case PM_SUSPEND_PREPARE:
+                        dhd_mmc_suspend = TRUE;
+                        ret = NOTIFY_OK;
+                break;
+                case PM_POST_HIBERNATION:
+                case PM_POST_SUSPEND:
+                        dhd_mmc_suspend = FALSE;
+                        ret = NOTIFY_OK;
+                break;
+        }
+        smp_mb();
+#endif
+        return ret;
+}
+
+static struct notifier_block dhd_sleep_pm_notifier = {
+        .notifier_call = dhd_sleep_pm_callback,
+        .priority = 0
+};
+extern int register_pm_notifier(struct notifier_block *nb);
+extern int unregister_pm_notifier(struct notifier_block *nb);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP) */
+
+static void dhd_set_packet_filter(int value, dhd_pub_t *dhd)
+{
+#ifdef PKT_FILTER_SUPPORT
+        DHD_TRACE(("%s: %d\n", __FUNCTION__, value));
+        /* 1 - Enable packet filter, only allow unicast packet to send up */
+        /* 0 - Disable packet filter */
+        if (dhd_pkt_filter_enable) {
+                int i;
+
+                for (i = 0; i < dhd->pktfilter_count; i++) {
+                        dhd_pktfilter_offload_set(dhd, dhd->pktfilter[i]);
+                        dhd_pktfilter_offload_enable(dhd, dhd->pktfilter[i],
+                                value, dhd_master_mode);
+                }
+        }
+#endif
+}
+
+#if defined(CONFIG_HAS_EARLYSUSPEND)
+static int dhd_set_suspend(int value, dhd_pub_t *dhd)
+{
+        int power_mode = PM_MAX;
+        /* wl_pkt_filter_enable_t       enable_parm; */
+        char iovbuf[32];
+        int bcn_li_dtim = 3;
+        uint roamvar = 1;
+
+        DHD_TRACE(("%s: enter, value = %d in_suspend=%d\n",
+                __FUNCTION__, value, dhd->in_suspend));
+
+        if (dhd && dhd->up) {
+                if (value && dhd->in_suspend) {
+
+                                /* Kernel suspended */
+                                DHD_ERROR(("%s: force extra Suspend setting \n", __FUNCTION__));
+
+                                dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode,
+                                                 sizeof(power_mode), TRUE, 0);
+
+                                /* Enable packet filter, only allow unicast packet to send up */
+                                dhd_set_packet_filter(1, dhd);
+
+                                /* If DTIM skip is set up as default, force it to wake
+                                 * each third DTIM for better power savings.  Note that
+                                 * one side effect is a chance to miss BC/MC packet.
+                                 */
+                                bcn_li_dtim = dhd_get_dtim_skip(dhd);
+                                bcm_mkiovar("bcn_li_dtim", (char *)&bcn_li_dtim,
+                                        4, iovbuf, sizeof(iovbuf));
+                                dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+                                /* Disable firmware roaming during suspend */
+                                bcm_mkiovar("roam_off", (char *)&roamvar, 4,
+                                        iovbuf, sizeof(iovbuf));
+                                dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+                        } else {
+
+                                /* Kernel resumed  */
+                                DHD_TRACE(("%s: Remove extra suspend setting \n", __FUNCTION__));
+
+                                power_mode = PM_FAST;
+                                dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode,
+                                                 sizeof(power_mode), TRUE, 0);
+
+                                /* disable pkt filter */
+                                dhd_set_packet_filter(0, dhd);
+
+                                /* restore pre-suspend setting for dtim_skip */
+                                bcm_mkiovar("bcn_li_dtim", (char *)&dhd->dtim_skip,
+                                        4, iovbuf, sizeof(iovbuf));
+
+                                dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+                                roamvar = dhd_roam_disable;
+                                bcm_mkiovar("roam_off", (char *)&roamvar, 4, iovbuf,
+                                        sizeof(iovbuf));
+                                dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+                        }
+        }
+
+        return 0;
+}
+
+static void dhd_suspend_resume_helper(struct dhd_info *dhd, int val)
+{
+        dhd_pub_t *dhdp = &dhd->pub;
+
+        DHD_OS_WAKE_LOCK(dhdp);
+        /* Set flag when early suspend was called */
+        dhdp->in_suspend = val;
+        if ((!dhdp->suspend_disable_flag) && (dhd_check_ap_wfd_mode_set(dhdp) == FALSE))
+                dhd_set_suspend(val, dhdp);
+        DHD_OS_WAKE_UNLOCK(dhdp);
+}
+
+static void dhd_early_suspend(struct early_suspend *h)
+{
+        struct dhd_info *dhd = container_of(h, struct dhd_info, early_suspend);
+
+        DHD_TRACE(("%s: enter\n", __FUNCTION__));
+
+        if (dhd)
+                dhd_suspend_resume_helper(dhd, 1);
+}
+
+static void dhd_late_resume(struct early_suspend *h)
+{
+        struct dhd_info *dhd = container_of(h, struct dhd_info, early_suspend);
+
+        DHD_TRACE(("%s: enter\n", __FUNCTION__));
+
+        if (dhd)
+                dhd_suspend_resume_helper(dhd, 0);
+}
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) */
+
+/*
+ * Generalized timeout mechanism.  Uses spin sleep with exponential back-off until
+ * the sleep time reaches one jiffy, then switches over to task delay.  Usage:
+ *
+ *      dhd_timeout_start(&tmo, usec);
+ *      while (!dhd_timeout_expired(&tmo))
+ *              if (poll_something())
+ *                      break;
+ *      if (dhd_timeout_expired(&tmo))
+ *              fatal();
+ */
+
+void
+dhd_timeout_start(dhd_timeout_t *tmo, uint usec)
+{
+        tmo->limit = usec;
+        tmo->increment = 0;
+        tmo->elapsed = 0;
+        tmo->tick = 1000000 / HZ;
+}
+
+int
+dhd_timeout_expired(dhd_timeout_t *tmo)
+{
+        /* Does nothing the first call */
+        if (tmo->increment == 0) {
+                tmo->increment = 1;
+                return 0;
+        }
+
+        if (tmo->elapsed >= tmo->limit)
+                return 1;
+
+        /* Add the delay that's about to take place */
+        tmo->elapsed += tmo->increment;
+
+        if (tmo->increment < tmo->tick) {
+                OSL_DELAY(tmo->increment);
+                tmo->increment *= 2;
+                if (tmo->increment > tmo->tick)
+                        tmo->increment = tmo->tick;
+        } else {
+                wait_queue_head_t delay_wait;
+                DECLARE_WAITQUEUE(wait, current);
+                int pending;
+                init_waitqueue_head(&delay_wait);
+                add_wait_queue(&delay_wait, &wait);
+                set_current_state(TASK_INTERRUPTIBLE);
+                schedule_timeout(1);
+                pending = signal_pending(current);
+                remove_wait_queue(&delay_wait, &wait);
+                set_current_state(TASK_RUNNING);
+                if (pending)
+                        return 1;       /* Interrupted */
+        }
+
+        return 0;
+}
+
+int
+dhd_net2idx(dhd_info_t *dhd, struct net_device *net)
+{
+        int i = 0;
+
+        ASSERT(dhd);
+        while (i < DHD_MAX_IFS) {
+                if (dhd->iflist[i] && (dhd->iflist[i]->net == net))
+                        return i;
+                i++;
+        }
+
+        return DHD_BAD_IF;
+}
+
+struct net_device * dhd_idx2net(struct dhd_pub *dhd_pub, int ifidx)
+{
+        struct dhd_info *dhd_info;
+
+        if (!dhd_pub || ifidx < 0 || ifidx >= DHD_MAX_IFS)
+                return NULL;
+        dhd_info = dhd_pub->info;
+        if (dhd_info && dhd_info->iflist[ifidx])
+                return dhd_info->iflist[ifidx]->net;
+        return NULL;
+}
+
+int
+dhd_ifname2idx(dhd_info_t *dhd, char *name)
+{
+        int i = DHD_MAX_IFS;
+
+        ASSERT(dhd);
+
+        if (name == NULL || *name == '\0')
+                return 0;
+
+        while (--i > 0)
+                if (dhd->iflist[i] && !strncmp(dhd->iflist[i]->name, name, IFNAMSIZ))
+                                break;
+
+        DHD_TRACE(("%s: return idx %d for \"%s\"\n", __FUNCTION__, i, name));
+
+        return i;       /* default - the primary interface */
+}
+
+char *
+dhd_ifname(dhd_pub_t *dhdp, int ifidx)
+{
+        dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+        ASSERT(dhd);
+
+        if (ifidx < 0 || ifidx >= DHD_MAX_IFS) {
+                DHD_ERROR(("%s: ifidx %d out of range\n", __FUNCTION__, ifidx));
+                return "<if_bad>";
+        }
+
+        if (dhd->iflist[ifidx] == NULL) {
+                DHD_ERROR(("%s: null i/f %d\n", __FUNCTION__, ifidx));
+                return "<if_null>";
+        }
+
+        if (dhd->iflist[ifidx]->net)
+                return dhd->iflist[ifidx]->net->name;
+
+        return "<if_none>";
+}
+
+uint8 *
+dhd_bssidx2bssid(dhd_pub_t *dhdp, int idx)
+{
+        int i;
+        dhd_info_t *dhd = (dhd_info_t *)dhdp;
+
+        ASSERT(dhd);
+        for (i = 0; i < DHD_MAX_IFS; i++)
+        if (dhd->iflist[i] && dhd->iflist[i]->bssidx == idx)
+                return dhd->iflist[i]->mac_addr;
+
+        return NULL;
+}
+
+
+static void
+_dhd_set_multicast_list(dhd_info_t *dhd, int ifidx)
+{
+        struct net_device *dev;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+        struct netdev_hw_addr *ha;
+#else
+        struct dev_mc_list *mclist;
+#endif
+        uint32 allmulti, cnt;
+
+        wl_ioctl_t ioc;
+        char *buf, *bufp;
+        uint buflen;
+        int ret;
+
+        ASSERT(dhd && dhd->iflist[ifidx]);
+        dev = dhd->iflist[ifidx]->net;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+        netif_addr_lock_bh(dev);
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+        cnt = netdev_mc_count(dev);
+#else
+        cnt = dev->mc_count;
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+        netif_addr_unlock_bh(dev);
+#endif
+
+        /* Determine initial value of allmulti flag */
+        allmulti = (dev->flags & IFF_ALLMULTI) ? TRUE : FALSE;
+
+        /* Send down the multicast list first. */
+
+
+        buflen = sizeof("mcast_list") + sizeof(cnt) + (cnt * ETHER_ADDR_LEN);
+        if (!(bufp = buf = MALLOC(dhd->pub.osh, buflen))) {
+                DHD_ERROR(("%s: out of memory for mcast_list, cnt %d\n",
+                           dhd_ifname(&dhd->pub, ifidx), cnt));
+                return;
+        }
+
+        strcpy(bufp, "mcast_list");
+        bufp += strlen("mcast_list") + 1;
+
+        cnt = htol32(cnt);
+        memcpy(bufp, &cnt, sizeof(cnt));
+        bufp += sizeof(cnt);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+        netif_addr_lock_bh(dev);
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+        netdev_for_each_mc_addr(ha, dev) {
+                if (!cnt)
+                        break;
+                memcpy(bufp, ha->addr, ETHER_ADDR_LEN);
+                bufp += ETHER_ADDR_LEN;
+                cnt--;
+        }
+#else
+        for (mclist = dev->mc_list; (mclist && (cnt > 0)); cnt--, mclist = mclist->next) {
+                memcpy(bufp, (void *)mclist->dmi_addr, ETHER_ADDR_LEN);
+                bufp += ETHER_ADDR_LEN;
+        }
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+        netif_addr_unlock_bh(dev);
+#endif
+
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = WLC_SET_VAR;
+        ioc.buf = buf;
+        ioc.len = buflen;
+        ioc.set = TRUE;
+
+        ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                DHD_ERROR(("%s: set mcast_list failed, cnt %d\n",
+                        dhd_ifname(&dhd->pub, ifidx), cnt));
+                allmulti = cnt ? TRUE : allmulti;
+        }
+
+        MFREE(dhd->pub.osh, buf, buflen);
+
+        /* Now send the allmulti setting.  This is based on the setting in the
+         * net_device flags, but might be modified above to be turned on if we
+         * were trying to set some addresses and dongle rejected it...
+         */
+
+        buflen = sizeof("allmulti") + sizeof(allmulti);
+        if (!(buf = MALLOC(dhd->pub.osh, buflen))) {
+                DHD_ERROR(("%s: out of memory for allmulti\n", dhd_ifname(&dhd->pub, ifidx)));
+                return;
+        }
+        allmulti = htol32(allmulti);
+
+        if (!bcm_mkiovar("allmulti", (void*)&allmulti, sizeof(allmulti), buf, buflen)) {
+                DHD_ERROR(("%s: mkiovar failed for allmulti, datalen %d buflen %u\n",
+                           dhd_ifname(&dhd->pub, ifidx), (int)sizeof(allmulti), buflen));
+                MFREE(dhd->pub.osh, buf, buflen);
+                return;
+        }
+
+
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = WLC_SET_VAR;
+        ioc.buf = buf;
+        ioc.len = buflen;
+        ioc.set = TRUE;
+
+        ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                DHD_ERROR(("%s: set allmulti %d failed\n",
+                           dhd_ifname(&dhd->pub, ifidx), ltoh32(allmulti)));
+        }
+
+        MFREE(dhd->pub.osh, buf, buflen);
+
+        /* Finally, pick up the PROMISC flag as well, like the NIC driver does */
+
+        allmulti = (dev->flags & IFF_PROMISC) ? TRUE : FALSE;
+        allmulti = htol32(allmulti);
+
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = WLC_SET_PROMISC;
+        ioc.buf = &allmulti;
+        ioc.len = sizeof(allmulti);
+        ioc.set = TRUE;
+
+        ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                DHD_ERROR(("%s: set promisc %d failed\n",
+                           dhd_ifname(&dhd->pub, ifidx), ltoh32(allmulti)));
+        }
+}
+
+static int
+_dhd_set_mac_address(dhd_info_t *dhd, int ifidx, struct ether_addr *addr)
+{
+        char buf[32];
+        wl_ioctl_t ioc;
+        int ret;
+
+        if (!bcm_mkiovar("cur_etheraddr", (char*)addr, ETHER_ADDR_LEN, buf, 32)) {
+                DHD_ERROR(("%s: mkiovar failed for cur_etheraddr\n", dhd_ifname(&dhd->pub, ifidx)));
+                return -1;
+        }
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = WLC_SET_VAR;
+        ioc.buf = buf;
+        ioc.len = 32;
+        ioc.set = TRUE;
+
+        ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                DHD_ERROR(("%s: set cur_etheraddr failed\n", dhd_ifname(&dhd->pub, ifidx)));
+        } else {
+                memcpy(dhd->iflist[ifidx]->net->dev_addr, addr, ETHER_ADDR_LEN);
+        }
+
+        return ret;
+}
+
+#ifdef SOFTAP
+extern struct net_device *ap_net_dev;
+extern tsk_ctl_t ap_eth_ctl; /* ap netdev heper thread ctl */
+#endif
+
+static void
+dhd_op_if(dhd_if_t *ifp)
+{
+        dhd_info_t *dhd;
+        int ret = 0, err = 0;
+#ifdef SOFTAP
+        unsigned long flags;
+#endif
+
+        ASSERT(ifp && ifp->info && ifp->idx);   /* Virtual interfaces only */
+
+        dhd = ifp->info;
+
+        DHD_TRACE(("%s: idx %d, state %d\n", __FUNCTION__, ifp->idx, ifp->state));
+
+#ifdef WL_CFG80211
+        if (wl_cfg80211_is_progress_ifchange())
+                        return;
+
+#endif
+        switch (ifp->state) {
+        case DHD_IF_ADD:
+                /*
+                 * Delete the existing interface before overwriting it
+                 * in case we missed the WLC_E_IF_DEL event.
+                 */
+                if (ifp->net != NULL) {
+                        DHD_ERROR(("%s: ERROR: netdev:%s already exists, try free & unregister \n",
+                         __FUNCTION__, ifp->net->name));
+                        netif_stop_queue(ifp->net);
+                        unregister_netdev(ifp->net);
+                        free_netdev(ifp->net);
+                }
+                /* Allocate etherdev, including space for private structure */
+                if (!(ifp->net = alloc_etherdev(sizeof(dhd)))) {
+                        DHD_ERROR(("%s: OOM - alloc_etherdev\n", __FUNCTION__));
+                        ret = -ENOMEM;
+                }
+                if (ret == 0) {
+                        strncpy(ifp->net->name, ifp->name, IFNAMSIZ);
+                        ifp->net->name[IFNAMSIZ - 1] = '\0';
+                        memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd));
+#ifdef WL_CFG80211
+                        if (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211)
+                                if (!wl_cfg80211_notify_ifadd(ifp->net, ifp->idx, ifp->bssidx,
+                                        dhd_net_attach)) {
+                                        ifp->state = DHD_IF_NONE;
+                                        return;
+                                }
+#endif
+                        if ((err = dhd_net_attach(&dhd->pub, ifp->idx)) != 0) {
+                                DHD_ERROR(("%s: dhd_net_attach failed, err %d\n",
+                                        __FUNCTION__, err));
+                                ret = -EOPNOTSUPP;
+                        } else {
+#if defined(SOFTAP)
+                if (ap_fw_loaded && !(dhd->dhd_state & DHD_ATTACH_STATE_CFG80211)) {
+                                 /* semaphore that the soft AP CODE waits on */
+                                flags = dhd_os_spin_lock(&dhd->pub);
+
+                                /* save ptr to wl0.1 netdev for use in wl_iw.c  */
+                                ap_net_dev = ifp->net;
+                                 /* signal to the SOFTAP 'sleeper' thread, wl0.1 is ready */
+                                up(&ap_eth_ctl.sema);
+                                dhd_os_spin_unlock(&dhd->pub, flags);
+                }
+#endif
+                                DHD_TRACE(("\n ==== pid:%x, net_device for if:%s created ===\n\n",
+                                        current->pid, ifp->net->name));
+                                ifp->state = DHD_IF_NONE;
+                        }
+                }
+                break;
+        case DHD_IF_DEL:
+                /* Make sure that we don't enter again here if .. */
+                /* dhd_op_if is called again from some other context */
+                ifp->state = DHD_IF_DELETING;
+                if (ifp->net != NULL) {
+                        DHD_TRACE(("\n%s: got 'DHD_IF_DEL' state\n", __FUNCTION__));
+#ifdef WL_CFG80211
+                        if (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211) {
+                                wl_cfg80211_notify_ifdel(ifp->net);
+                        }
+#endif
+                        netif_stop_queue(ifp->net);
+                        unregister_netdev(ifp->net);
+                        ret = DHD_DEL_IF;       /* Make sure the free_netdev() is called */
+                }
+                break;
+        case DHD_IF_DELETING:
+                break;
+        default:
+                DHD_ERROR(("%s: bad op %d\n", __FUNCTION__, ifp->state));
+                ASSERT(!ifp->state);
+                break;
+        }
+
+        if (ret < 0) {
+                ifp->set_multicast = FALSE;
+                if (ifp->net) {
+                        free_netdev(ifp->net);
+                }
+                dhd->iflist[ifp->idx] = NULL;
+#ifdef SOFTAP
+                flags = dhd_os_spin_lock(&dhd->pub);
+                if (ifp->net == ap_net_dev)
+                        ap_net_dev = NULL;   /*  NULL  SOFTAP global wl0.1 as well */
+                dhd_os_spin_unlock(&dhd->pub, flags);
+#endif /*  SOFTAP */
+                MFREE(dhd->pub.osh, ifp, sizeof(*ifp));
+        }
+}
+
+static int
+_dhd_sysioc_thread(void *data)
+{
+        tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+        dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+
+
+        int i;
+#ifdef SOFTAP
+        bool in_ap = FALSE;
+        unsigned long flags;
+#endif
+
+        DAEMONIZE("dhd_sysioc");
+
+        complete(&tsk->completed);
+
+        while (down_interruptible(&tsk->sema) == 0) {
+
+                SMP_RD_BARRIER_DEPENDS();
+                if (tsk->terminated) {
+                        break;
+                }
+
+                dhd_net_if_lock_local(dhd);
+                DHD_OS_WAKE_LOCK(&dhd->pub);
+
+                for (i = 0; i < DHD_MAX_IFS; i++) {
+                        if (dhd->iflist[i]) {
+                                DHD_TRACE(("%s: interface %d\n", __FUNCTION__, i));
+#ifdef SOFTAP
+                                flags = dhd_os_spin_lock(&dhd->pub);
+                                in_ap = (ap_net_dev != NULL);
+                                dhd_os_spin_unlock(&dhd->pub, flags);
+#endif /* SOFTAP */
+                                if (dhd->iflist[i] && dhd->iflist[i]->state)
+                                        dhd_op_if(dhd->iflist[i]);
+
+                                if (dhd->iflist[i] == NULL) {
+                                        DHD_TRACE(("\n\n %s: interface %d just been removed,"
+                                                "!\n\n", __FUNCTION__, i));
+                                        continue;
+                                }
+#ifdef SOFTAP
+                                if (in_ap && dhd->set_macaddress)  {
+                                        DHD_TRACE(("attempt to set MAC for %s in AP Mode,"
+                                                "blocked. \n", dhd->iflist[i]->net->name));
+                                        dhd->set_macaddress = FALSE;
+                                        continue;
+                                }
+
+                                if (in_ap && dhd->iflist[i]->set_multicast)  {
+                                        DHD_TRACE(("attempt to set MULTICAST list for %s"
+                                         "in AP Mode, blocked. \n", dhd->iflist[i]->net->name));
+                                        dhd->iflist[i]->set_multicast = FALSE;
+                                        continue;
+                                }
+#endif /* SOFTAP */
+                                if (dhd->iflist[i]->set_multicast) {
+                                        dhd->iflist[i]->set_multicast = FALSE;
+                                        _dhd_set_multicast_list(dhd, i);
+                                }
+                                if (dhd->set_macaddress) {
+                                        dhd->set_macaddress = FALSE;
+                                        _dhd_set_mac_address(dhd, i, &dhd->macvalue);
+                                }
+                        }
+                }
+
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                dhd_net_if_unlock_local(dhd);
+        }
+        DHD_TRACE(("%s: stopped\n", __FUNCTION__));
+        complete_and_exit(&tsk->completed, 0);
+}
+
+static int
+dhd_set_mac_address(struct net_device *dev, void *addr)
+{
+        int ret = 0;
+
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        struct sockaddr *sa = (struct sockaddr *)addr;
+        int ifidx;
+
+        ifidx = dhd_net2idx(dhd, dev);
+        if (ifidx == DHD_BAD_IF)
+                return -1;
+
+        ASSERT(&dhd->thr_sysioc_ctl.thr_pid >= 0);
+        memcpy(&dhd->macvalue, sa->sa_data, ETHER_ADDR_LEN);
+        dhd->set_macaddress = TRUE;
+        up(&dhd->thr_sysioc_ctl.sema);
+
+        return ret;
+}
+
+static void
+dhd_set_multicast_list(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        int ifidx;
+
+        ifidx = dhd_net2idx(dhd, dev);
+        if (ifidx == DHD_BAD_IF)
+                return;
+
+        ASSERT(&dhd->thr_sysioc_ctl.thr_pid >= 0);
+        dhd->iflist[ifidx]->set_multicast = TRUE;
+        up(&dhd->thr_sysioc_ctl.sema);
+}
+
+#ifdef PROP_TXSTATUS
+int
+dhd_os_wlfc_block(dhd_pub_t *pub)
+{
+        dhd_info_t *di = (dhd_info_t *)(pub->info);
+        ASSERT(di != NULL);
+        spin_lock_bh(&di->wlfc_spinlock);
+        return 1;
+}
+
+int
+dhd_os_wlfc_unblock(dhd_pub_t *pub)
+{
+        dhd_info_t *di = (dhd_info_t *)(pub->info);
+        ASSERT(di != NULL);
+        spin_unlock_bh(&di->wlfc_spinlock);
+        return 1;
+}
+
+const uint8 wme_fifo2ac[] = { 0, 1, 2, 3, 1, 1 };
+uint8 prio2fifo[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
+#define WME_PRIO2AC(prio)       wme_fifo2ac[prio2fifo[(prio)]]
+
+#endif /* PROP_TXSTATUS */
+int
+dhd_sendpkt(dhd_pub_t *dhdp, int ifidx, void *pktbuf)
+{
+        int ret;
+        dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+        struct ether_header *eh = NULL;
+
+        /* Reject if down */
+        if (!dhdp->up || (dhdp->busstate == DHD_BUS_DOWN)) {
+                /* free the packet here since the caller won't */
+                PKTFREE(dhdp->osh, pktbuf, TRUE);
+                return -ENODEV;
+        }
+
+        /* Update multicast statistic */
+        if (PKTLEN(dhdp->osh, pktbuf) >= ETHER_ADDR_LEN) {
+                uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, pktbuf);
+                eh = (struct ether_header *)pktdata;
+
+                if (ETHER_ISMULTI(eh->ether_dhost))
+                        dhdp->tx_multicast++;
+                if (ntoh16(eh->ether_type) == ETHER_TYPE_802_1X)
+                        atomic_inc(&dhd->pend_8021x_cnt);
+        }
+
+        /* Look into the packet and update the packet priority */
+        if (PKTPRIO(pktbuf) == 0)
+                pktsetprio(pktbuf, FALSE);
+
+#ifdef PROP_TXSTATUS
+        if (dhdp->wlfc_state) {
+                /* store the interface ID */
+                DHD_PKTTAG_SETIF(PKTTAG(pktbuf), ifidx);
+
+                /* store destination MAC in the tag as well */
+                DHD_PKTTAG_SETDSTN(PKTTAG(pktbuf), eh->ether_dhost);
+
+                /* decide which FIFO this packet belongs to */
+                if (ETHER_ISMULTI(eh->ether_dhost))
+                        /* one additional queue index (highest AC + 1) is used for bc/mc queue */
+                        DHD_PKTTAG_SETFIFO(PKTTAG(pktbuf), AC_COUNT);
+                else
+                        DHD_PKTTAG_SETFIFO(PKTTAG(pktbuf), WME_PRIO2AC(PKTPRIO(pktbuf)));
+        } else
+#endif /* PROP_TXSTATUS */
+        /* If the protocol uses a data header, apply it */
+        dhd_prot_hdrpush(dhdp, ifidx, pktbuf);
+
+        /* Use bus module to send data frame */
+#ifdef WLMEDIA_HTSF
+        dhd_htsf_addtxts(dhdp, pktbuf);
+#endif
+#ifdef PROP_TXSTATUS
+        if (dhdp->wlfc_state && ((athost_wl_status_info_t*)dhdp->wlfc_state)->proptxstatus_mode
+                        != WLFC_FCMODE_NONE) {
+                dhd_os_wlfc_block(dhdp);
+                ret = dhd_wlfc_enque_sendq(dhdp->wlfc_state, DHD_PKTTAG_FIFO(PKTTAG(pktbuf)),
+                        pktbuf);
+                dhd_wlfc_commit_packets(dhdp->wlfc_state,  (f_commitpkt_t)dhd_bus_txdata,
+                        dhdp->bus);
+                if (((athost_wl_status_info_t*)dhdp->wlfc_state)->toggle_host_if) {
+                        ((athost_wl_status_info_t*)dhdp->wlfc_state)->toggle_host_if = 0;
+                }
+                dhd_os_wlfc_unblock(dhdp);
+        }
+        else
+                /* non-proptxstatus way */
+        ret = dhd_bus_txdata(dhdp->bus, pktbuf);
+#else
+        ret = dhd_bus_txdata(dhdp->bus, pktbuf);
+#endif /* PROP_TXSTATUS */
+
+
+        return ret;
+}
+
+int
+dhd_start_xmit(struct sk_buff *skb, struct net_device *net)
+{
+        int ret;
+        void *pktbuf;
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(net);
+        int ifidx;
+#ifdef WLMEDIA_HTSF
+        uint8 htsfdlystat_sz = dhd->pub.htsfdlystat_sz;
+#else
+        uint8 htsfdlystat_sz = 0;
+#endif
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        DHD_OS_WAKE_LOCK(&dhd->pub);
+
+        /* Reject if down */
+        if (!dhd->pub.up || (dhd->pub.busstate == DHD_BUS_DOWN)) {
+                DHD_ERROR(("%s: xmit rejected pub.up=%d busstate=%d \n",
+                        __FUNCTION__, dhd->pub.up, dhd->pub.busstate));
+                netif_stop_queue(net);
+                /* Send Event when bus down detected during data session */
+                if (dhd->pub.busstate == DHD_BUS_DOWN)  {
+                        DHD_ERROR(("%s: Event HANG sent up\n", __FUNCTION__));
+                        net_os_send_hang_message(net);
+                }
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                return -ENODEV;
+        }
+
+        ifidx = dhd_net2idx(dhd, net);
+        if (ifidx == DHD_BAD_IF) {
+                DHD_ERROR(("%s: bad ifidx %d\n", __FUNCTION__, ifidx));
+                netif_stop_queue(net);
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                return -ENODEV;
+        }
+
+        /* Make sure there's enough room for any header */
+
+        if (skb_headroom(skb) < dhd->pub.hdrlen + htsfdlystat_sz) {
+                struct sk_buff *skb2;
+
+                DHD_INFO(("%s: insufficient headroom\n",
+                          dhd_ifname(&dhd->pub, ifidx)));
+                dhd->pub.tx_realloc++;
+
+                skb2 = skb_realloc_headroom(skb, dhd->pub.hdrlen + htsfdlystat_sz);
+
+                dev_kfree_skb(skb);
+                if ((skb = skb2) == NULL) {
+                        DHD_ERROR(("%s: skb_realloc_headroom failed\n",
+                                   dhd_ifname(&dhd->pub, ifidx)));
+                        ret = -ENOMEM;
+                        goto done;
+                }
+        }
+
+        /* Convert to packet */
+        if (!(pktbuf = PKTFRMNATIVE(dhd->pub.osh, skb))) {
+                DHD_ERROR(("%s: PKTFRMNATIVE failed\n",
+                           dhd_ifname(&dhd->pub, ifidx)));
+                dev_kfree_skb_any(skb);
+                ret = -ENOMEM;
+                goto done;
+        }
+#ifdef WLMEDIA_HTSF
+        if (htsfdlystat_sz && PKTLEN(dhd->pub.osh, pktbuf) >= ETHER_ADDR_LEN) {
+                uint8 *pktdata = (uint8 *)PKTDATA(dhd->pub.osh, pktbuf);
+                struct ether_header *eh = (struct ether_header *)pktdata;
+
+                if (!ETHER_ISMULTI(eh->ether_dhost) &&
+                        (ntoh16(eh->ether_type) == ETHER_TYPE_IP)) {
+                        eh->ether_type = hton16(ETHER_TYPE_BRCM_PKTDLYSTATS);
+                }
+        }
+#endif
+
+        ret = dhd_sendpkt(&dhd->pub, ifidx, pktbuf);
+
+
+done:
+        if (ret)
+                dhd->pub.dstats.tx_dropped++;
+        else
+                dhd->pub.tx_packets++;
+
+        DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+        /* Return ok: we always eat the packet */
+        return 0;
+}
+
+void
+dhd_txflowcontrol(dhd_pub_t *dhdp, int ifidx, bool state)
+{
+        struct net_device *net;
+        dhd_info_t *dhd = dhdp->info;
+        int i;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        dhdp->txoff = state;
+        ASSERT(dhd);
+
+        if (ifidx == ALL_INTERFACES) {
+                /* Flow control on all active interfaces */
+                for (i = 0; i < DHD_MAX_IFS; i++) {
+                        if (dhd->iflist[i]) {
+                                net = dhd->iflist[i]->net;
+                                if (state == ON)
+                                        netif_stop_queue(net);
+                                else
+                                        netif_wake_queue(net);
+                        }
+                }
+        }
+        else {
+                if (dhd->iflist[ifidx]) {
+                        net = dhd->iflist[ifidx]->net;
+                        if (state == ON)
+                                netif_stop_queue(net);
+                        else
+                                netif_wake_queue(net);
+                }
+        }
+}
+
+void
+dhd_rx_frame(dhd_pub_t *dhdp, int ifidx, void *pktbuf, int numpkt, uint8 chan)
+{
+        dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+        struct sk_buff *skb;
+        uchar *eth;
+        uint len;
+        void *data, *pnext = NULL, *save_pktbuf;
+        int i;
+        dhd_if_t *ifp;
+        wl_event_msg_t event;
+        int tout = DHD_PACKET_TIMEOUT;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        save_pktbuf = pktbuf;
+
+        for (i = 0; pktbuf && i < numpkt; i++, pktbuf = pnext) {
+                struct ether_header *eh;
+                struct dot11_llc_snap_header *lsh;
+
+                ifp = dhd->iflist[ifidx];
+                if (ifp == NULL) {
+                        DHD_ERROR(("%s: ifp is NULL. drop packet\n",
+                                __FUNCTION__));
+                        PKTFREE(dhdp->osh, pktbuf, TRUE);
+                        continue;
+                }
+
+                /* Dropping packets before registering net device to avoid kernel panic */
+                if (!ifp->net || ifp->net->reg_state != NETREG_REGISTERED ||
+                        !dhd->pub.up) {
+                        DHD_ERROR(("%s: net device is NOT registered yet. drop packet\n",
+                        __FUNCTION__));
+                        PKTFREE(dhdp->osh, pktbuf, TRUE);
+                        continue;
+                }
+
+                pnext = PKTNEXT(dhdp->osh, pktbuf);
+                PKTSETNEXT(wl->sh.osh, pktbuf, NULL);
+
+                eh = (struct ether_header *)PKTDATA(wl->sh.osh, pktbuf);
+                lsh = (struct dot11_llc_snap_header *)&eh[1];
+
+                if ((ntoh16(eh->ether_type) < ETHER_TYPE_MIN) &&
+                    (PKTLEN(wl->sh.osh, pktbuf) >= RFC1042_HDR_LEN) &&
+                    bcmp(lsh, BT_SIG_SNAP_MPROT, DOT11_LLC_SNAP_HDR_LEN - 2) == 0 &&
+                    lsh->type == HTON16(BTA_PROT_L2CAP)) {
+                        amp_hci_ACL_data_t *ACL_data = (amp_hci_ACL_data_t *)
+                                ((uint8 *)eh + RFC1042_HDR_LEN);
+                        ACL_data = NULL;
+                }
+
+#ifdef PROP_TXSTATUS
+                if (dhdp->wlfc_state && PKTLEN(wl->sh.osh, pktbuf) == 0) {
+                        /* WLFC may send header only packet when
+                        there is an urgent message but no packet to
+                        piggy-back on
+                        */
+                        ((athost_wl_status_info_t*)dhdp->wlfc_state)->stats.wlfc_header_only_pkt++;
+                        PKTFREE(dhdp->osh, pktbuf, TRUE);
+                        continue;
+                }
+#endif
+
+                skb = PKTTONATIVE(dhdp->osh, pktbuf);
+
+                /* Get the protocol, maintain skb around eth_type_trans()
+                 * The main reason for this hack is for the limitation of
+                 * Linux 2.4 where 'eth_type_trans' uses the 'net->hard_header_len'
+                 * to perform skb_pull inside vs ETH_HLEN. Since to avoid
+                 * coping of the packet coming from the network stack to add
+                 * BDC, Hardware header etc, during network interface registration
+                 * we set the 'net->hard_header_len' to ETH_HLEN + extra space required
+                 * for BDC, Hardware header etc. and not just the ETH_HLEN
+                 */
+                eth = skb->data;
+                len = skb->len;
+
+                ifp = dhd->iflist[ifidx];
+                if (ifp == NULL)
+                        ifp = dhd->iflist[0];
+
+                ASSERT(ifp);
+                skb->dev = ifp->net;
+                skb->protocol = eth_type_trans(skb, skb->dev);
+
+                if (skb->pkt_type == PACKET_MULTICAST) {
+                        dhd->pub.rx_multicast++;
+                }
+
+                skb->data = eth;
+                skb->len = len;
+
+#ifdef WLMEDIA_HTSF
+        dhd_htsf_addrxts(dhdp, pktbuf);
+#endif
+                /* Strip header, count, deliver upward */
+                skb_pull(skb, ETH_HLEN);
+
+                /* Process special event packets and then discard them */
+                if (ntoh16(skb->protocol) == ETHER_TYPE_BRCM) {
+                        dhd_wl_host_event(dhd, &ifidx,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+                        skb->mac_header,
+#else
+                        skb->mac.raw,
+#endif
+                        &event,
+                        &data);
+
+                        wl_event_to_host_order(&event);
+                        if (event.event_type == WLC_E_BTA_HCI_EVENT) {
+                                dhd_bta_doevt(dhdp, data, event.datalen);
+                        }
+                        tout = DHD_EVENT_TIMEOUT;
+                }
+
+                ASSERT(ifidx < DHD_MAX_IFS && dhd->iflist[ifidx]);
+                if (dhd->iflist[ifidx] && !dhd->iflist[ifidx]->state)
+                        ifp = dhd->iflist[ifidx];
+
+                if (ifp->net)
+                        ifp->net->last_rx = jiffies;
+
+                dhdp->dstats.rx_bytes += skb->len;
+                dhdp->rx_packets++; /* Local count */
+
+                if (in_interrupt()) {
+                        netif_rx(skb);
+                } else {
+                        /* If the receive is not processed inside an ISR,
+                         * the softirqd must be woken explicitly to service
+                         * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
+                         * by netif_rx_ni(), but in earlier kernels, we need
+                         * to do it manually.
+                         */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+                        netif_rx_ni(skb);
+#else
+                        ulong flags;
+                        netif_rx(skb);
+                        local_irq_save(flags);
+                        RAISE_RX_SOFTIRQ();
+                        local_irq_restore(flags);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0) */
+                }
+        }
+        DHD_OS_WAKE_LOCK_TIMEOUT_ENABLE(dhdp, tout);
+}
+
+void
+dhd_event(struct dhd_info *dhd, char *evpkt, int evlen, int ifidx)
+{
+        /* Linux version has nothing to do */
+        return;
+}
+
+void
+dhd_txcomplete(dhd_pub_t *dhdp, void *txp, bool success)
+{
+        uint ifidx;
+        dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+        struct ether_header *eh;
+        uint16 type;
+        uint len;
+
+        dhd_prot_hdrpull(dhdp, &ifidx, txp);
+
+        eh = (struct ether_header *)PKTDATA(dhdp->osh, txp);
+        type  = ntoh16(eh->ether_type);
+
+        if (type == ETHER_TYPE_802_1X)
+                atomic_dec(&dhd->pend_8021x_cnt);
+
+        /* Crack open the packet and check to see if it is BT HCI ACL data packet.
+         * If yes generate packet completion event.
+         */
+        len = PKTLEN(dhdp->osh, txp);
+
+        /* Generate ACL data tx completion event locally to avoid SDIO bus transaction */
+        if ((type < ETHER_TYPE_MIN) && (len >= RFC1042_HDR_LEN)) {
+                struct dot11_llc_snap_header *lsh = (struct dot11_llc_snap_header *)&eh[1];
+
+                if (bcmp(lsh, BT_SIG_SNAP_MPROT, DOT11_LLC_SNAP_HDR_LEN - 2) == 0 &&
+                    ntoh16(lsh->type) == BTA_PROT_L2CAP) {
+
+                        dhd_bta_tx_hcidata_complete(dhdp, txp, success);
+                }
+        }
+}
+
+static struct net_device_stats *
+dhd_get_stats(struct net_device *net)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(net);
+        dhd_if_t *ifp;
+        int ifidx;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        ifidx = dhd_net2idx(dhd, net);
+        if (ifidx == DHD_BAD_IF)
+                return NULL;
+
+        ifp = dhd->iflist[ifidx];
+        ASSERT(dhd && ifp);
+
+        if (dhd->pub.up) {
+                /* Use the protocol to get dongle stats */
+                dhd_prot_dstats(&dhd->pub);
+        }
+
+        /* Copy dongle stats to net device stats */
+        ifp->stats.rx_packets = dhd->pub.dstats.rx_packets;
+        ifp->stats.tx_packets = dhd->pub.dstats.tx_packets;
+        ifp->stats.rx_bytes = dhd->pub.dstats.rx_bytes;
+        ifp->stats.tx_bytes = dhd->pub.dstats.tx_bytes;
+        ifp->stats.rx_errors = dhd->pub.dstats.rx_errors;
+        ifp->stats.tx_errors = dhd->pub.dstats.tx_errors;
+        ifp->stats.rx_dropped = dhd->pub.dstats.rx_dropped;
+        ifp->stats.tx_dropped = dhd->pub.dstats.tx_dropped;
+        ifp->stats.multicast = dhd->pub.dstats.multicast;
+
+        return &ifp->stats;
+}
+
+#ifdef DHDTHREAD
+static int
+dhd_watchdog_thread(void *data)
+{
+        tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+        dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+        /* This thread doesn't need any user-level access,
+         * so get rid of all our resources
+         */
+        if (dhd_watchdog_prio > 0) {
+                struct sched_param param;
+                param.sched_priority = (dhd_watchdog_prio < MAX_RT_PRIO)?
+                        dhd_watchdog_prio:(MAX_RT_PRIO-1);
+                setScheduler(current, SCHED_FIFO, &param);
+        }
+
+        DAEMONIZE("dhd_watchdog");
+
+        /* Run until signal received */
+        complete(&tsk->completed);
+
+        while (1)
+                if (down_interruptible (&tsk->sema) == 0) {
+                        unsigned long flags;
+
+                        SMP_RD_BARRIER_DEPENDS();
+                        if (tsk->terminated) {
+                                break;
+                        }
+
+                        dhd_os_sdlock(&dhd->pub);
+                        if (dhd->pub.dongle_reset == FALSE) {
+                                DHD_TIMER(("%s:\n", __FUNCTION__));
+
+                                /* Call the bus module watchdog */
+                                dhd_bus_watchdog(&dhd->pub);
+
+                                flags = dhd_os_spin_lock(&dhd->pub);
+                                /* Count the tick for reference */
+                                dhd->pub.tickcnt++;
+                                /* Reschedule the watchdog */
+                                if (dhd->wd_timer_valid)
+                                        mod_timer(&dhd->timer,
+                                        jiffies + dhd_watchdog_ms * HZ / 1000);
+                                dhd_os_spin_unlock(&dhd->pub, flags);
+                        }
+                        dhd_os_sdunlock(&dhd->pub);
+                        DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                } else {
+                        break;
+                }
+
+        complete_and_exit(&tsk->completed, 0);
+}
+#endif /* DHDTHREAD */
+
+static void dhd_watchdog(ulong data)
+{
+        dhd_info_t *dhd = (dhd_info_t *)data;
+        unsigned long flags;
+
+        DHD_OS_WAKE_LOCK(&dhd->pub);
+        if (dhd->pub.dongle_reset) {
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                return;
+        }
+
+#ifdef DHDTHREAD
+        if (dhd->thr_wdt_ctl.thr_pid >= 0) {
+                up(&dhd->thr_wdt_ctl.sema);
+                return;
+        }
+#endif /* DHDTHREAD */
+
+        dhd_os_sdlock(&dhd->pub);
+        /* Call the bus module watchdog */
+        dhd_bus_watchdog(&dhd->pub);
+
+        flags = dhd_os_spin_lock(&dhd->pub);
+        /* Count the tick for reference */
+        dhd->pub.tickcnt++;
+
+        /* Reschedule the watchdog */
+        if (dhd->wd_timer_valid)
+                mod_timer(&dhd->timer, jiffies + dhd_watchdog_ms * HZ / 1000);
+        dhd_os_spin_unlock(&dhd->pub, flags);
+        dhd_os_sdunlock(&dhd->pub);
+        DHD_OS_WAKE_UNLOCK(&dhd->pub);
+}
+
+#ifdef DHDTHREAD
+static int
+dhd_dpc_thread(void *data)
+{
+        tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+        dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+
+        /* This thread doesn't need any user-level access,
+         * so get rid of all our resources
+         */
+        if (dhd_dpc_prio > 0)
+        {
+                struct sched_param param;
+                param.sched_priority = (dhd_dpc_prio < MAX_RT_PRIO)?dhd_dpc_prio:(MAX_RT_PRIO-1);
+                setScheduler(current, SCHED_FIFO, &param);
+        }
+
+        DAEMONIZE("dhd_dpc");
+        /* DHD_OS_WAKE_LOCK is called in dhd_sched_dpc[dhd_linux.c] down below  */
+
+        /*  signal: thread has started */
+        complete(&tsk->completed);
+
+        /* Run until signal received */
+        while (1) {
+                if (down_interruptible(&tsk->sema) == 0) {
+
+                        SMP_RD_BARRIER_DEPENDS();
+                        if (tsk->terminated) {
+                                break;
+                        }
+
+                        /* Call bus dpc unless it indicated down (then clean stop) */
+                        if (dhd->pub.busstate != DHD_BUS_DOWN) {
+                                if (dhd_bus_dpc(dhd->pub.bus)) {
+                                        up(&tsk->sema);
+                                }
+                                else {
+                                        DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                                }
+                        } else {
+                                if (dhd->pub.up)
+                                        dhd_bus_stop(dhd->pub.bus, TRUE);
+                                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                        }
+                }
+                else
+                        break;
+        }
+
+        complete_and_exit(&tsk->completed, 0);
+}
+#endif /* DHDTHREAD */
+
+static void
+dhd_dpc(ulong data)
+{
+        dhd_info_t *dhd;
+
+        dhd = (dhd_info_t *)data;
+
+        /* this (tasklet) can be scheduled in dhd_sched_dpc[dhd_linux.c]
+         * down below , wake lock is set,
+         * the tasklet is initialized in dhd_attach()
+         */
+        /* Call bus dpc unless it indicated down (then clean stop) */
+        if (dhd->pub.busstate != DHD_BUS_DOWN) {
+                if (dhd_bus_dpc(dhd->pub.bus))
+                        tasklet_schedule(&dhd->tasklet);
+                else
+                        DHD_OS_WAKE_UNLOCK(&dhd->pub);
+        } else {
+                dhd_bus_stop(dhd->pub.bus, TRUE);
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+        }
+}
+
+void
+dhd_sched_dpc(dhd_pub_t *dhdp)
+{
+        dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+        DHD_OS_WAKE_LOCK(dhdp);
+#ifdef DHDTHREAD
+        if (dhd->thr_dpc_ctl.thr_pid >= 0) {
+                up(&dhd->thr_dpc_ctl.sema);
+                return;
+        }
+#endif /* DHDTHREAD */
+
+        tasklet_schedule(&dhd->tasklet);
+}
+
+#ifdef TOE
+/* Retrieve current toe component enables, which are kept as a bitmap in toe_ol iovar */
+static int
+dhd_toe_get(dhd_info_t *dhd, int ifidx, uint32 *toe_ol)
+{
+        wl_ioctl_t ioc;
+        char buf[32];
+        int ret;
+
+        memset(&ioc, 0, sizeof(ioc));
+
+        ioc.cmd = WLC_GET_VAR;
+        ioc.buf = buf;
+        ioc.len = (uint)sizeof(buf);
+        ioc.set = FALSE;
+
+        strcpy(buf, "toe_ol");
+        if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+                /* Check for older dongle image that doesn't support toe_ol */
+                if (ret == -EIO) {
+                        DHD_ERROR(("%s: toe not supported by device\n",
+                                dhd_ifname(&dhd->pub, ifidx)));
+                        return -EOPNOTSUPP;
+                }
+
+                DHD_INFO(("%s: could not get toe_ol: ret=%d\n", dhd_ifname(&dhd->pub, ifidx), ret));
+                return ret;
+        }
+
+        memcpy(toe_ol, buf, sizeof(uint32));
+        return 0;
+}
+
+/* Set current toe component enables in toe_ol iovar, and set toe global enable iovar */
+static int
+dhd_toe_set(dhd_info_t *dhd, int ifidx, uint32 toe_ol)
+{
+        wl_ioctl_t ioc;
+        char buf[32];
+        int toe, ret;
+
+        memset(&ioc, 0, sizeof(ioc));
+
+        ioc.cmd = WLC_SET_VAR;
+        ioc.buf = buf;
+        ioc.len = (uint)sizeof(buf);
+        ioc.set = TRUE;
+
+        /* Set toe_ol as requested */
+
+        strcpy(buf, "toe_ol");
+        memcpy(&buf[sizeof("toe_ol")], &toe_ol, sizeof(uint32));
+
+        if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+                DHD_ERROR(("%s: could not set toe_ol: ret=%d\n",
+                        dhd_ifname(&dhd->pub, ifidx), ret));
+                return ret;
+        }
+
+        /* Enable toe globally only if any components are enabled. */
+
+        toe = (toe_ol != 0);
+
+        strcpy(buf, "toe");
+        memcpy(&buf[sizeof("toe")], &toe, sizeof(uint32));
+
+        if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+                DHD_ERROR(("%s: could not set toe: ret=%d\n", dhd_ifname(&dhd->pub, ifidx), ret));
+                return ret;
+        }
+
+        return 0;
+}
+#endif /* TOE */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+static void
+dhd_ethtool_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(net);
+
+        sprintf(info->driver, "wl");
+        sprintf(info->version, "%lu", dhd->pub.drv_version);
+}
+
+struct ethtool_ops dhd_ethtool_ops = {
+        .get_drvinfo = dhd_ethtool_get_drvinfo
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2)
+static int
+dhd_ethtool(dhd_info_t *dhd, void *uaddr)
+{
+        struct ethtool_drvinfo info;
+        char drvname[sizeof(info.driver)];
+        uint32 cmd;
+#ifdef TOE
+        struct ethtool_value edata;
+        uint32 toe_cmpnt, csum_dir;
+        int ret;
+#endif
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        /* all ethtool calls start with a cmd word */
+        if (copy_from_user(&cmd, uaddr, sizeof (uint32)))
+                return -EFAULT;
+
+        switch (cmd) {
+        case ETHTOOL_GDRVINFO:
+                /* Copy out any request driver name */
+                if (copy_from_user(&info, uaddr, sizeof(info)))
+                        return -EFAULT;
+                strncpy(drvname, info.driver, sizeof(info.driver));
+                drvname[sizeof(info.driver)-1] = '\0';
+
+                /* clear struct for return */
+                memset(&info, 0, sizeof(info));
+                info.cmd = cmd;
+
+                /* if dhd requested, identify ourselves */
+                if (strcmp(drvname, "?dhd") == 0) {
+                        sprintf(info.driver, "dhd");
+                        strcpy(info.version, EPI_VERSION_STR);
+                }
+
+                /* otherwise, require dongle to be up */
+                else if (!dhd->pub.up) {
+                        DHD_ERROR(("%s: dongle is not up\n", __FUNCTION__));
+                        return -ENODEV;
+                }
+
+                /* finally, report dongle driver type */
+                else if (dhd->pub.iswl)
+                        sprintf(info.driver, "wl");
+                else
+                        sprintf(info.driver, "xx");
+
+                sprintf(info.version, "%lu", dhd->pub.drv_version);
+                if (copy_to_user(uaddr, &info, sizeof(info)))
+                        return -EFAULT;
+                DHD_CTL(("%s: given %*s, returning %s\n", __FUNCTION__,
+                         (int)sizeof(drvname), drvname, info.driver));
+                break;
+
+#ifdef TOE
+        /* Get toe offload components from dongle */
+        case ETHTOOL_GRXCSUM:
+        case ETHTOOL_GTXCSUM:
+                if ((ret = dhd_toe_get(dhd, 0, &toe_cmpnt)) < 0)
+                        return ret;
+
+                csum_dir = (cmd == ETHTOOL_GTXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+                edata.cmd = cmd;
+                edata.data = (toe_cmpnt & csum_dir) ? 1 : 0;
+
+                if (copy_to_user(uaddr, &edata, sizeof(edata)))
+                        return -EFAULT;
+                break;
+
+        /* Set toe offload components in dongle */
+        case ETHTOOL_SRXCSUM:
+        case ETHTOOL_STXCSUM:
+                if (copy_from_user(&edata, uaddr, sizeof(edata)))
+                        return -EFAULT;
+
+                /* Read the current settings, update and write back */
+                if ((ret = dhd_toe_get(dhd, 0, &toe_cmpnt)) < 0)
+                        return ret;
+
+                csum_dir = (cmd == ETHTOOL_STXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+                if (edata.data != 0)
+                        toe_cmpnt |= csum_dir;
+                else
+                        toe_cmpnt &= ~csum_dir;
+
+                if ((ret = dhd_toe_set(dhd, 0, toe_cmpnt)) < 0)
+                        return ret;
+
+                /* If setting TX checksum mode, tell Linux the new mode */
+                if (cmd == ETHTOOL_STXCSUM) {
+                        if (edata.data)
+                                dhd->iflist[0]->net->features |= NETIF_F_IP_CSUM;
+                        else
+                                dhd->iflist[0]->net->features &= ~NETIF_F_IP_CSUM;
+                }
+
+                break;
+#endif /* TOE */
+
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        return 0;
+}
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2) */
+
+static bool dhd_check_hang(struct net_device *net, dhd_pub_t *dhdp, int error)
+{
+        if (!dhdp)
+                return FALSE;
+        if ((error == -ETIMEDOUT) || ((dhdp->busstate == DHD_BUS_DOWN) &&
+                (!dhdp->dongle_reset))) {
+                DHD_ERROR(("%s: Event HANG send up due to  re=%d te=%d e=%d s=%d\n", __FUNCTION__,
+                        dhdp->rxcnt_timeout, dhdp->txcnt_timeout, error, dhdp->busstate));
+                net_os_send_hang_message(net);
+                return TRUE;
+        }
+        return FALSE;
+}
+
+static int
+dhd_ioctl_entry(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(net);
+        dhd_ioctl_t ioc;
+        int bcmerror = 0;
+        int buflen = 0;
+        void *buf = NULL;
+        uint driver = 0;
+        int ifidx;
+        int ret;
+
+        DHD_OS_WAKE_LOCK(&dhd->pub);
+
+        /* send to dongle only if we are not waiting for reload already */
+        if (dhd->pub.hang_was_sent) {
+                DHD_ERROR(("%s: HANG was sent up earlier\n", __FUNCTION__));
+                DHD_OS_WAKE_LOCK_TIMEOUT_ENABLE(&dhd->pub, DHD_EVENT_TIMEOUT);
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                return OSL_ERROR(BCME_DONGLE_DOWN);
+        }
+
+        ifidx = dhd_net2idx(dhd, net);
+        DHD_TRACE(("%s: ifidx %d, cmd 0x%04x\n", __FUNCTION__, ifidx, cmd));
+
+        if (ifidx == DHD_BAD_IF) {
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                return -1;
+        }
+
+#if defined(CONFIG_BCMDHD_WEXT)
+        /* linux wireless extensions */
+        if ((cmd >= SIOCIWFIRST) && (cmd <= SIOCIWLAST)) {
+                /* may recurse, do NOT lock */
+                ret = wl_iw_ioctl(net, ifr, cmd);
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                return ret;
+        }
+#endif /* defined(CONFIG_BCMDHD_WEXT) */
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2)
+        if (cmd == SIOCETHTOOL) {
+                ret = dhd_ethtool(dhd, (void*)ifr->ifr_data);
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                return ret;
+        }
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2) */
+
+        if (cmd == SIOCDEVPRIVATE+1) {
+                ret = wl_android_priv_cmd(net, ifr, cmd);
+                dhd_check_hang(net, &dhd->pub, ret);
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                return ret;
+        }
+
+        if (cmd != SIOCDEVPRIVATE) {
+                DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                return -EOPNOTSUPP;
+        }
+
+        memset(&ioc, 0, sizeof(ioc));
+
+        /* Copy the ioc control structure part of ioctl request */
+        if (copy_from_user(&ioc, ifr->ifr_data, sizeof(wl_ioctl_t))) {
+                bcmerror = -BCME_BADADDR;
+                goto done;
+        }
+
+        /* Copy out any buffer passed */
+        if (ioc.buf) {
+                buflen = MIN(ioc.len, DHD_IOCTL_MAXLEN);
+                /* optimization for direct ioctl calls from kernel */
+                /*
+                if (segment_eq(get_fs(), KERNEL_DS)) {
+                        buf = ioc.buf;
+                } else {
+                */
+                {
+                        if (!(buf = (char*)MALLOC(dhd->pub.osh, buflen))) {
+                                bcmerror = -BCME_NOMEM;
+                                goto done;
+                        }
+                        if (copy_from_user(buf, ioc.buf, buflen)) {
+                                bcmerror = -BCME_BADADDR;
+                                goto done;
+                        }
+                }
+        }
+
+        /* To differentiate between wl and dhd read 4 more byes */
+        if ((copy_from_user(&driver, (char *)ifr->ifr_data + sizeof(wl_ioctl_t),
+                sizeof(uint)) != 0)) {
+                bcmerror = -BCME_BADADDR;
+                goto done;
+        }
+
+        if (!capable(CAP_NET_ADMIN)) {
+                bcmerror = -BCME_EPERM;
+                goto done;
+        }
+
+        /* check for local dhd ioctl and handle it */
+        if (driver == DHD_IOCTL_MAGIC) {
+                bcmerror = dhd_ioctl((void *)&dhd->pub, &ioc, buf, buflen);
+                if (bcmerror)
+                        dhd->pub.bcmerror = bcmerror;
+                goto done;
+        }
+
+        /* send to dongle (must be up, and wl). */
+        if (dhd->pub.busstate != DHD_BUS_DATA) {
+                bcmerror = BCME_DONGLE_DOWN;
+                goto done;
+        }
+
+        if (!dhd->pub.iswl) {
+                bcmerror = BCME_DONGLE_DOWN;
+                goto done;
+        }
+
+        /*
+         * Flush the TX queue if required for proper message serialization:
+         * Intercept WLC_SET_KEY IOCTL - serialize M4 send and set key IOCTL to
+         * prevent M4 encryption and
+         * intercept WLC_DISASSOC IOCTL - serialize WPS-DONE and WLC_DISASSOC IOCTL to
+         * prevent disassoc frame being sent before WPS-DONE frame.
+         */
+        if (ioc.cmd == WLC_SET_KEY ||
+            (ioc.cmd == WLC_SET_VAR && ioc.buf != NULL &&
+             strncmp("wsec_key", ioc.buf, 9) == 0) ||
+            (ioc.cmd == WLC_SET_VAR && ioc.buf != NULL &&
+             strncmp("bsscfg:wsec_key", ioc.buf, 15) == 0) ||
+            ioc.cmd == WLC_DISASSOC)
+                dhd_wait_pend8021x(net);
+
+#ifdef WLMEDIA_HTSF
+        if (ioc.buf) {
+                /*  short cut wl ioctl calls here  */
+                if (strcmp("htsf", ioc.buf) == 0) {
+                        dhd_ioctl_htsf_get(dhd, 0);
+                        return BCME_OK;
+                }
+
+                if (strcmp("htsflate", ioc.buf) == 0) {
+                        if (ioc.set) {
+                                memset(ts, 0, sizeof(tstamp_t)*TSMAX);
+                                memset(&maxdelayts, 0, sizeof(tstamp_t));
+                                maxdelay = 0;
+                                tspktcnt = 0;
+                                maxdelaypktno = 0;
+                                memset(&vi_d1.bin, 0, sizeof(uint32)*NUMBIN);
+                                memset(&vi_d2.bin, 0, sizeof(uint32)*NUMBIN);
+                                memset(&vi_d3.bin, 0, sizeof(uint32)*NUMBIN);
+                                memset(&vi_d4.bin, 0, sizeof(uint32)*NUMBIN);
+                        } else {
+                                dhd_dump_latency();
+                        }
+                        return BCME_OK;
+                }
+                if (strcmp("htsfclear", ioc.buf) == 0) {
+                        memset(&vi_d1.bin, 0, sizeof(uint32)*NUMBIN);
+                        memset(&vi_d2.bin, 0, sizeof(uint32)*NUMBIN);
+                        memset(&vi_d3.bin, 0, sizeof(uint32)*NUMBIN);
+                        memset(&vi_d4.bin, 0, sizeof(uint32)*NUMBIN);
+                        htsf_seqnum = 0;
+                        return BCME_OK;
+                }
+                if (strcmp("htsfhis", ioc.buf) == 0) {
+                        dhd_dump_htsfhisto(&vi_d1, "H to D");
+                        dhd_dump_htsfhisto(&vi_d2, "D to D");
+                        dhd_dump_htsfhisto(&vi_d3, "D to H");
+                        dhd_dump_htsfhisto(&vi_d4, "H to H");
+                        return BCME_OK;
+                }
+                if (strcmp("tsport", ioc.buf) == 0) {
+                        if (ioc.set) {
+                                memcpy(&tsport, ioc.buf + 7, 4);
+                        } else {
+                                DHD_ERROR(("current timestamp port: %d \n", tsport));
+                        }
+                        return BCME_OK;
+                }
+        }
+#endif /* WLMEDIA_HTSF */
+
+        bcmerror = dhd_wl_ioctl(&dhd->pub, ifidx, (wl_ioctl_t *)&ioc, buf, buflen);
+
+done:
+        dhd_check_hang(net, &dhd->pub, bcmerror);
+
+        if (!bcmerror && buf && ioc.buf) {
+                if (copy_to_user(ioc.buf, buf, buflen))
+                        bcmerror = -EFAULT;
+        }
+
+        if (buf)
+                MFREE(dhd->pub.osh, buf, buflen);
+
+        DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+        return OSL_ERROR(bcmerror);
+}
+
+#ifdef WL_CFG80211
+static int
+dhd_cleanup_virt_ifaces(dhd_info_t *dhd)
+{
+        int i = 1; /* Leave ifidx 0 [Primary Interface] */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        int rollback_lock = FALSE;
+#endif
+
+        DHD_TRACE(("%s: Enter \n", __func__));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        /* release lock for unregister_netdev */
+        if (rtnl_is_locked()) {
+                rtnl_unlock();
+                rollback_lock = TRUE;
+        }
+#endif
+
+        for (i = 1; i < DHD_MAX_IFS; i++) {
+                if (dhd->iflist[i]) {
+                        DHD_TRACE(("Deleting IF: %d \n", i));
+                        if ((dhd->iflist[i]->state != DHD_IF_DEL) &&
+                                (dhd->iflist[i]->state != DHD_IF_DELETING)) {
+                                dhd->iflist[i]->state = DHD_IF_DEL;
+                                dhd->iflist[i]->idx = i;
+                                dhd_op_if(dhd->iflist[i]);
+                        }
+                }
+        }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        if (rollback_lock)
+                rtnl_lock();
+#endif
+
+        return 0;
+}
+#endif /* WL_CFG80211 */
+
+static int
+dhd_stop(struct net_device *net)
+{
+        int ifidx;
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(net);
+        DHD_OS_WAKE_LOCK(&dhd->pub);
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+        if (dhd->pub.up == 0) {
+                goto exit;
+        }
+        ifidx = dhd_net2idx(dhd, net);
+
+#ifdef WL_CFG80211
+        if (ifidx == 0) {
+                wl_cfg80211_down();
+
+                /*
+                 * For CFG80211: Clean up all the left over virtual interfaces
+                 * when the primary Interface is brought down. [ifconfig wlan0 down]
+                 */
+                if ((dhd->dhd_state & DHD_ATTACH_STATE_ADD_IF) &&
+                        (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211)) {
+                        dhd_cleanup_virt_ifaces(dhd);
+                }
+        }
+#endif
+
+#ifdef PROP_TXSTATUS
+        dhd_wlfc_cleanup(&dhd->pub);
+#endif
+        /* Set state and stop OS transmissions */
+        dhd->pub.up = 0;
+        netif_stop_queue(net);
+
+        /* Stop the protocol module */
+        dhd_prot_stop(&dhd->pub);
+
+#if defined(WL_CFG80211)
+        if (ifidx == 0 && !dhd_download_fw_on_driverload)
+                wl_android_wifi_off(net);
+#endif
+        dhd->pub.hang_was_sent = 0;
+        dhd->pub.rxcnt_timeout = 0;
+        dhd->pub.txcnt_timeout = 0;
+        OLD_MOD_DEC_USE_COUNT;
+exit:
+        DHD_OS_WAKE_UNLOCK(&dhd->pub);
+        return 0;
+}
+
+static int
+dhd_open(struct net_device *net)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(net);
+
+#ifdef TOE
+        uint32 toe_ol;
+#endif
+        int ifidx;
+        int32 ret = 0;
+
+        DHD_OS_WAKE_LOCK(&dhd->pub);
+        /* Update FW path if it was changed */
+        if ((firmware_path != NULL) && (firmware_path[0] != '\0')) {
+                if (firmware_path[strlen(firmware_path)-1] == '\n')
+                        firmware_path[strlen(firmware_path)-1] = '\0';
+                strcpy(fw_path, firmware_path);
+                firmware_path[0] = '\0';
+        }
+
+#if !defined(WL_CFG80211)
+        /*
+         * Force start if ifconfig_up gets called before START command
+         * We keep WEXT's wl_control_wl_start to provide backward compatibility
+         * This should be removed in the future
+         */
+        wl_control_wl_start(net);
+#endif
+
+        ifidx = dhd_net2idx(dhd, net);
+        DHD_TRACE(("%s: ifidx %d\n", __FUNCTION__, ifidx));
+
+        if (ifidx < 0) {
+                DHD_ERROR(("%s: Error: called with invalid IF\n", __FUNCTION__));
+                ret = -1;
+                goto exit;
+        }
+
+        if (!dhd->iflist[ifidx] || dhd->iflist[ifidx]->state == DHD_IF_DEL) {
+                DHD_ERROR(("%s: Error: called when IF already deleted\n", __FUNCTION__));
+                ret = -1;
+                goto exit;
+        }
+
+        if (ifidx == 0) {
+                atomic_set(&dhd->pend_8021x_cnt, 0);
+#if defined(WL_CFG80211)
+                DHD_ERROR(("\n%s\n", dhd_version));
+                if (!dhd_download_fw_on_driverload)
+                        wl_android_wifi_on(net);
+#endif /* defined(WL_CFG80211) */
+
+                if (dhd->pub.busstate != DHD_BUS_DATA) {
+                        int ret;
+
+                        /* try to bring up bus */
+                        if ((ret = dhd_bus_start(&dhd->pub)) != 0) {
+                                DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+                                ret = -1;
+                                goto exit;
+                        }
+
+                }
+
+                /* dhd_prot_init has been called in dhd_bus_start or wl_android_wifi_on */
+                memcpy(net->dev_addr, dhd->pub.mac.octet, ETHER_ADDR_LEN);
+
+#ifdef TOE
+                /* Get current TOE mode from dongle */
+                if (dhd_toe_get(dhd, ifidx, &toe_ol) >= 0 && (toe_ol & TOE_TX_CSUM_OL) != 0)
+                        dhd->iflist[ifidx]->net->features |= NETIF_F_IP_CSUM;
+                else
+                        dhd->iflist[ifidx]->net->features &= ~NETIF_F_IP_CSUM;
+#endif /* TOE */
+
+#if defined(WL_CFG80211)
+                if (unlikely(wl_cfg80211_up())) {
+                        DHD_ERROR(("%s: failed to bring up cfg80211\n", __FUNCTION__));
+                        ret = -1;
+                        goto exit;
+                }
+#endif /* WL_CFG80211 */
+        }
+
+        /* Allow transmit calls */
+        netif_start_queue(net);
+        dhd->pub.up = 1;
+
+#ifdef BCMDBGFS
+        dhd_dbg_init(&dhd->pub);
+#endif
+
+        OLD_MOD_INC_USE_COUNT;
+exit:
+        DHD_OS_WAKE_UNLOCK(&dhd->pub);
+        return ret;
+}
+
+osl_t *
+dhd_osl_attach(void *pdev, uint bustype)
+{
+        return osl_attach(pdev, bustype, TRUE);
+}
+
+void
+dhd_osl_detach(osl_t *osh)
+{
+        if (MALLOCED(osh)) {
+                DHD_ERROR(("%s: MEMORY LEAK %d bytes\n", __FUNCTION__, MALLOCED(osh)));
+        }
+        osl_detach(osh);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        up(&dhd_registration_sem);
+#endif
+}
+
+int
+dhd_add_if(dhd_info_t *dhd, int ifidx, void *handle, char *name,
+        uint8 *mac_addr, uint32 flags, uint8 bssidx)
+{
+        dhd_if_t *ifp;
+
+        DHD_TRACE(("%s: idx %d, handle->%p\n", __FUNCTION__, ifidx, handle));
+
+        ASSERT(dhd && (ifidx < DHD_MAX_IFS));
+
+        ifp = dhd->iflist[ifidx];
+        if (ifp != NULL) {
+                if (ifp->net != NULL) {
+                        netif_stop_queue(ifp->net);
+                        unregister_netdev(ifp->net);
+                        free_netdev(ifp->net);
+                }
+        } else
+                if ((ifp = MALLOC(dhd->pub.osh, sizeof(dhd_if_t))) == NULL) {
+                        DHD_ERROR(("%s: OOM - dhd_if_t\n", __FUNCTION__));
+                        return -ENOMEM;
+                }
+
+        memset(ifp, 0, sizeof(dhd_if_t));
+        ifp->info = dhd;
+        dhd->iflist[ifidx] = ifp;
+        strncpy(ifp->name, name, IFNAMSIZ);
+        ifp->name[IFNAMSIZ] = '\0';
+        if (mac_addr != NULL)
+                memcpy(&ifp->mac_addr, mac_addr, ETHER_ADDR_LEN);
+
+        if (handle == NULL) {
+                ifp->state = DHD_IF_ADD;
+                ifp->idx = ifidx;
+                ifp->bssidx = bssidx;
+                ASSERT(&dhd->thr_sysioc_ctl.thr_pid >= 0);
+                up(&dhd->thr_sysioc_ctl.sema);
+        } else
+                ifp->net = (struct net_device *)handle;
+
+        return 0;
+}
+
+void
+dhd_del_if(dhd_info_t *dhd, int ifidx)
+{
+        dhd_if_t *ifp;
+
+        DHD_TRACE(("%s: idx %d\n", __FUNCTION__, ifidx));
+
+        ASSERT(dhd && ifidx && (ifidx < DHD_MAX_IFS));
+        ifp = dhd->iflist[ifidx];
+        if (!ifp) {
+                DHD_ERROR(("%s: Null interface\n", __FUNCTION__));
+                return;
+        }
+
+        ifp->state = DHD_IF_DEL;
+        ifp->idx = ifidx;
+        ASSERT(&dhd->thr_sysioc_ctl.thr_pid >= 0);
+        up(&dhd->thr_sysioc_ctl.sema);
+}
+
+dhd_pub_t *
+dhd_attach(osl_t *osh, struct dhd_bus *bus, uint bus_hdrlen, void *dev)
+{
+        dhd_info_t *dhd = NULL;
+        struct net_device *net = NULL;
+
+        dhd_attach_states_t dhd_state = DHD_ATTACH_STATE_INIT;
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        /* updates firmware nvram path if it was provided as module parameters */
+        if ((firmware_path != NULL) && (firmware_path[0] != '\0'))
+                strcpy(fw_path, firmware_path);
+        if ((nvram_path != NULL) && (nvram_path[0] != '\0'))
+                strcpy(nv_path, nvram_path);
+
+        /* Allocate etherdev, including space for private structure */
+        if (!(net = alloc_etherdev(sizeof(dhd)))) {
+                DHD_ERROR(("%s: OOM - alloc_etherdev\n", __FUNCTION__));
+                goto fail;
+        }
+        dhd_state |= DHD_ATTACH_STATE_NET_ALLOC;
+
+        SET_NETDEV_DEV(net, (struct device *)dev);
+        /* Allocate primary dhd_info */
+        if (!(dhd = MALLOC(osh, sizeof(dhd_info_t)))) {
+                DHD_ERROR(("%s: OOM - alloc dhd_info\n", __FUNCTION__));
+                goto fail;
+        }
+        memset(dhd, 0, sizeof(dhd_info_t));
+
+#ifdef DHDTHREAD
+        dhd->thr_dpc_ctl.thr_pid = DHD_PID_KT_TL_INVALID;
+        dhd->thr_wdt_ctl.thr_pid = DHD_PID_KT_INVALID;
+#else
+        dhd->dhd_tasklet_create = FALSE;
+#endif /* DHDTHREAD */
+        dhd->thr_sysioc_ctl.thr_pid = DHD_PID_KT_INVALID;
+        dhd_state |= DHD_ATTACH_STATE_DHD_ALLOC;
+
+        /*
+         * Save the dhd_info into the priv
+         */
+        memcpy((void *)netdev_priv(net), &dhd, sizeof(dhd));
+        dhd->pub.osh = osh;
+
+        /* Link to info module */
+        dhd->pub.info = dhd;
+        /* Link to bus module */
+        dhd->pub.bus = bus;
+        dhd->pub.hdrlen = bus_hdrlen;
+
+        /* Set network interface name if it was provided as module parameter */
+        if (iface_name[0]) {
+                int len;
+                char ch;
+                strncpy(net->name, iface_name, IFNAMSIZ);
+                net->name[IFNAMSIZ - 1] = 0;
+                len = strlen(net->name);
+                ch = net->name[len - 1];
+                if ((ch > '9' || ch < '0') && (len < IFNAMSIZ - 2))
+                        strcat(net->name, "%d");
+        }
+
+        if (dhd_add_if(dhd, 0, (void *)net, net->name, NULL, 0, 0) == DHD_BAD_IF)
+                goto fail;
+        dhd_state |= DHD_ATTACH_STATE_ADD_IF;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+        net->open = NULL;
+#else
+        net->netdev_ops = NULL;
+#endif
+
+        sema_init(&dhd->proto_sem, 1);
+
+#ifdef PROP_TXSTATUS
+        spin_lock_init(&dhd->wlfc_spinlock);
+        dhd->pub.wlfc_enabled = TRUE;
+#endif /* PROP_TXSTATUS */
+
+        /* Initialize other structure content */
+        init_waitqueue_head(&dhd->ioctl_resp_wait);
+        init_waitqueue_head(&dhd->ctrl_wait);
+
+        /* Initialize the spinlocks */
+        spin_lock_init(&dhd->sdlock);
+        spin_lock_init(&dhd->txqlock);
+        spin_lock_init(&dhd->dhd_lock);
+
+        /* Initialize Wakelock stuff */
+        spin_lock_init(&dhd->wakelock_spinlock);
+        dhd->wakelock_counter = 0;
+        dhd->wakelock_timeout_enable = 0;
+#ifdef CONFIG_HAS_WAKELOCK
+        wake_lock_init(&dhd->wl_wifi, WAKE_LOCK_SUSPEND, "wlan_wake");
+        wake_lock_init(&dhd->wl_rxwake, WAKE_LOCK_SUSPEND, "wlan_rx_wake");
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+        mutex_init(&dhd->dhd_net_if_mutex);
+#endif
+        dhd_state |= DHD_ATTACH_STATE_WAKELOCKS_INIT;
+
+        /* Attach and link in the protocol */
+        if (dhd_prot_attach(&dhd->pub) != 0) {
+                DHD_ERROR(("dhd_prot_attach failed\n"));
+                goto fail;
+        }
+        dhd_state |= DHD_ATTACH_STATE_PROT_ATTACH;
+
+#ifdef WL_CFG80211
+        /* Attach and link in the cfg80211 */
+        if (unlikely(wl_cfg80211_attach(net, &dhd->pub))) {
+                DHD_ERROR(("wl_cfg80211_attach failed\n"));
+                goto fail;
+        }
+
+        dhd_monitor_init(&dhd->pub);
+        dhd_state |= DHD_ATTACH_STATE_CFG80211;
+#endif
+#if defined(CONFIG_BCMDHD_WEXT)
+        /* Attach and link in the iw */
+        if (!(dhd_state &  DHD_ATTACH_STATE_CFG80211)) {
+                if (wl_iw_attach(net, (void *)&dhd->pub) != 0) {
+                        DHD_ERROR(("wl_iw_attach failed\n"));
+                        goto fail;
+                }
+        dhd_state |= DHD_ATTACH_STATE_WL_ATTACH;
+        }
+#endif /* defined(CONFIG_BCMDHD_WEXT) */
+
+
+        /* Set up the watchdog timer */
+        init_timer(&dhd->timer);
+        dhd->timer.data = (ulong)dhd;
+        dhd->timer.function = dhd_watchdog;
+
+#ifdef DHDTHREAD
+        /* Initialize thread based operation and lock */
+        sema_init(&dhd->sdsem, 1);
+        if ((dhd_watchdog_prio >= 0) && (dhd_dpc_prio >= 0)) {
+                dhd->threads_only = TRUE;
+        }
+        else {
+                dhd->threads_only = FALSE;
+        }
+
+        if (dhd_dpc_prio >= 0) {
+                /* Initialize watchdog thread */
+                PROC_START(dhd_watchdog_thread, dhd, &dhd->thr_wdt_ctl, 0);
+        } else {
+                dhd->thr_wdt_ctl.thr_pid = -1;
+        }
+
+        /* Set up the bottom half handler */
+        if (dhd_dpc_prio >= 0) {
+                /* Initialize DPC thread */
+                PROC_START(dhd_dpc_thread, dhd, &dhd->thr_dpc_ctl, 0);
+        } else {
+                /*  use tasklet for dpc */
+                tasklet_init(&dhd->tasklet, dhd_dpc, (ulong)dhd);
+                dhd->thr_dpc_ctl.thr_pid = -1;
+        }
+#else
+        /* Set up the bottom half handler */
+        tasklet_init(&dhd->tasklet, dhd_dpc, (ulong)dhd);
+        dhd->dhd_tasklet_create = TRUE;
+#endif /* DHDTHREAD */
+
+        if (dhd_sysioc) {
+                PROC_START(_dhd_sysioc_thread, dhd, &dhd->thr_sysioc_ctl, 0);
+        } else {
+                dhd->thr_sysioc_ctl.thr_pid = -1;
+        }
+        dhd_state |= DHD_ATTACH_STATE_THREADS_CREATED;
+
+        /*
+         * Save the dhd_info into the priv
+         */
+        memcpy(netdev_priv(net), &dhd, sizeof(dhd));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+        register_pm_notifier(&dhd_sleep_pm_notifier);
+#endif /*  (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP) */
+
+#ifdef CONFIG_HAS_EARLYSUSPEND
+        dhd->early_suspend.level = EARLY_SUSPEND_LEVEL_BLANK_SCREEN + 20;
+        dhd->early_suspend.suspend = dhd_early_suspend;
+        dhd->early_suspend.resume = dhd_late_resume;
+        register_early_suspend(&dhd->early_suspend);
+        dhd_state |= DHD_ATTACH_STATE_EARLYSUSPEND_DONE;
+#endif
+
+#ifdef ARP_OFFLOAD_SUPPORT
+        register_inetaddr_notifier(&dhd_notifier);
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+        dhd_state |= DHD_ATTACH_STATE_DONE;
+        dhd->dhd_state = dhd_state;
+        return &dhd->pub;
+
+fail:
+        if (dhd_state < DHD_ATTACH_STATE_DHD_ALLOC) {
+                if (net) free_netdev(net);
+        } else {
+                DHD_TRACE(("%s: Calling dhd_detach dhd_state 0x%x &dhd->pub %p\n",
+                        __FUNCTION__, dhd_state, &dhd->pub));
+                dhd->dhd_state = dhd_state;
+                dhd_detach(&dhd->pub);
+                dhd_free(&dhd->pub);
+        }
+
+        return NULL;
+}
+
+int
+dhd_bus_start(dhd_pub_t *dhdp)
+{
+        int ret = -1;
+        dhd_info_t *dhd = (dhd_info_t*)dhdp->info;
+        unsigned long flags;
+
+        ASSERT(dhd);
+
+        DHD_TRACE(("Enter %s:\n", __FUNCTION__));
+
+#ifdef DHDTHREAD
+        dhd_os_sdlock(dhdp);
+#endif /* DHDTHREAD */
+
+        /* try to download image and nvram to the dongle */
+        if  ((dhd->pub.busstate == DHD_BUS_DOWN) &&
+                (fw_path != NULL) && (fw_path[0] != '\0') &&
+                (nv_path != NULL) && (nv_path[0] != '\0')) {
+                /* wake lock moved to dhdsdio_download_firmware */
+                if (!(dhd_bus_download_firmware(dhd->pub.bus, dhd->pub.osh,
+                                                fw_path, nv_path))) {
+                        DHD_ERROR(("%s: dhdsdio_probe_download failed. firmware = %s nvram = %s\n",
+                                   __FUNCTION__, fw_path, nv_path));
+#ifdef DHDTHREAD
+                        dhd_os_sdunlock(dhdp);
+#endif /* DHDTHREAD */
+                        return -1;
+                }
+        }
+        if (dhd->pub.busstate != DHD_BUS_LOAD) {
+#ifdef DHDTHREAD
+                dhd_os_sdunlock(dhdp);
+#endif /* DHDTHREAD */
+                return -ENETDOWN;
+        }
+
+        /* Start the watchdog timer */
+        dhd->pub.tickcnt = 0;
+        dhd_os_wd_timer(&dhd->pub, dhd_watchdog_ms);
+
+        /* Bring up the bus */
+        if ((ret = dhd_bus_init(&dhd->pub, FALSE)) != 0) {
+
+                DHD_ERROR(("%s, dhd_bus_init failed %d\n", __FUNCTION__, ret));
+#ifdef DHDTHREAD
+                dhd_os_sdunlock(dhdp);
+#endif /* DHDTHREAD */
+                return ret;
+        }
+#if defined(OOB_INTR_ONLY)
+        /* Host registration for OOB interrupt */
+        if (bcmsdh_register_oob_intr(dhdp)) {
+                /* deactivate timer and wait for the handler to finish */
+
+                flags = dhd_os_spin_lock(&dhd->pub);
+                dhd->wd_timer_valid = FALSE;
+                dhd_os_spin_unlock(&dhd->pub, flags);
+                del_timer_sync(&dhd->timer);
+
+                DHD_ERROR(("%s Host failed to register for OOB\n", __FUNCTION__));
+#ifdef DHDTHREAD
+                dhd_os_sdunlock(dhdp);
+#endif /* DHDTHREAD */
+                return -ENODEV;
+        }
+
+        /* Enable oob at firmware */
+        dhd_enable_oob_intr(dhd->pub.bus, TRUE);
+#endif /* defined(OOB_INTR_ONLY) */
+
+        /* If bus is not ready, can't come up */
+        if (dhd->pub.busstate != DHD_BUS_DATA) {
+                flags = dhd_os_spin_lock(&dhd->pub);
+                dhd->wd_timer_valid = FALSE;
+                dhd_os_spin_unlock(&dhd->pub, flags);
+                del_timer_sync(&dhd->timer);
+                DHD_ERROR(("%s failed bus is not ready\n", __FUNCTION__));
+#ifdef DHDTHREAD
+                dhd_os_sdunlock(dhdp);
+#endif /* DHDTHREAD */
+                return -ENODEV;
+        }
+
+#ifdef DHDTHREAD
+        dhd_os_sdunlock(dhdp);
+#endif /* DHDTHREAD */
+
+#ifdef READ_MACADDR
+        dhd_read_macaddr(dhd);
+#endif
+
+        /* Bus is ready, do any protocol initialization */
+        if ((ret = dhd_prot_init(&dhd->pub)) < 0)
+                return ret;
+
+#ifdef WRITE_MACADDR
+        dhd_write_macaddr(dhd->pub.mac.octet);
+#endif
+
+        return 0;
+}
+
+int
+dhd_preinit_ioctls(dhd_pub_t *dhd)
+{
+        int ret = 0;
+        char eventmask[WL_EVENTING_MASK_LEN];
+        char iovbuf[WL_EVENTING_MASK_LEN + 12]; /*  Room for "event_msgs" + '\0' + bitvec  */
+
+        uint up = 0;
+        uint power_mode = PM_FAST;
+        uint32 dongle_align = DHD_SDALIGN;
+        uint32 glom = 0;
+        uint bcn_timeout = 4;
+        uint retry_max = 3;
+#if defined(ARP_OFFLOAD_SUPPORT)
+        int arpoe = 1;
+#endif
+        int scan_assoc_time = 40;
+        int scan_unassoc_time = 40;
+        int scan_passive_time = 130;
+        char buf[WLC_IOCTL_SMLEN];
+        char *ptr;
+        uint32 listen_interval = LISTEN_INTERVAL; /* Default Listen Interval in Beacons */
+#if defined(SOFTAP)
+        uint dtim = 1;
+#endif
+#if (defined(AP) && !defined(WLP2P)) || (!defined(AP) && defined(WL_CFG80211))
+        uint32 mpc = 0; /* Turn MPC off for AP/APSTA mode */
+#endif
+
+#if defined(AP) || defined(WLP2P)
+        uint32 apsta = 1; /* Enable APSTA mode */
+#endif /* defined(AP) || defined(WLP2P) */
+#ifdef GET_CUSTOM_MAC_ENABLE
+        struct ether_addr ea_addr;
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+        DHD_TRACE(("Enter %s\n", __FUNCTION__));
+        dhd->op_mode = 0;
+#ifdef GET_CUSTOM_MAC_ENABLE
+        ret = dhd_custom_get_mac_address(ea_addr.octet);
+        if (!ret) {
+                memset(buf, 0, sizeof(buf));
+                bcm_mkiovar("cur_etheraddr", (void *)&ea_addr, ETHER_ADDR_LEN, buf, sizeof(buf));
+                ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+                if (ret < 0) {
+                        DHD_ERROR(("%s: can't set MAC address , error=%d\n", __FUNCTION__, ret));
+                        return BCME_NOTUP;
+                }
+        } else {
+#endif /* GET_CUSTOM_MAC_ENABLE */
+                /* Get the default device MAC address directly from firmware */
+                memset(buf, 0, sizeof(buf));
+                bcm_mkiovar("cur_etheraddr", 0, 0, buf, sizeof(buf));
+                if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf),
+                        FALSE, 0)) < 0) {
+                        DHD_ERROR(("%s: can't get MAC address , error=%d\n", __FUNCTION__, ret));
+                        return BCME_NOTUP;
+                }
+                /* Update public MAC address after reading from Firmware */
+                memcpy(dhd->mac.octet, buf, ETHER_ADDR_LEN);
+#ifdef GET_CUSTOM_MAC_ENABLE
+        }
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+#ifdef SET_RANDOM_MAC_SOFTAP
+        if (strstr(fw_path, "_apsta") != NULL) {
+                uint rand_mac;
+
+                srandom32((uint)jiffies);
+                rand_mac = random32();
+                iovbuf[0] = 0x02;              /* locally administered bit */
+                iovbuf[1] = 0x1A;
+                iovbuf[2] = 0x11;
+                iovbuf[3] = (unsigned char)(rand_mac & 0x0F) | 0xF0;
+                iovbuf[4] = (unsigned char)(rand_mac >> 8);
+                iovbuf[5] = (unsigned char)(rand_mac >> 16);
+
+                bcm_mkiovar("cur_etheraddr", (void *)iovbuf, ETHER_ADDR_LEN, buf, sizeof(buf));
+                ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+                if (ret < 0) {
+                        DHD_ERROR(("%s: can't set MAC address , error=%d\n", __FUNCTION__, ret));
+                } else
+                        memcpy(dhd->mac.octet, iovbuf, ETHER_ADDR_LEN);
+        }
+#endif /* SET_RANDOM_MAC_SOFTAP */
+
+        DHD_TRACE(("Firmware = %s\n", fw_path));
+#if !defined(AP) && defined(WLP2P)
+        /* Check if firmware with WFD support used */
+        if (strstr(fw_path, "_p2p") != NULL) {
+                bcm_mkiovar("apsta", (char *)&apsta, 4, iovbuf, sizeof(iovbuf));
+                if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+                        iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+                        DHD_ERROR(("%s APSTA for WFD failed ret= %d\n", __FUNCTION__, ret));
+                } else {
+                        dhd->op_mode |= WFD_MASK;
+#if defined(ARP_OFFLOAD_SUPPORT)
+                        arpoe = 0;
+#endif /* (ARP_OFFLOAD_SUPPORT) */
+                        dhd_pkt_filter_enable = FALSE;
+                }
+        }
+#endif
+
+#if !defined(AP) && defined(WL_CFG80211)
+        /* Check if firmware with HostAPD support used */
+        if (strstr(fw_path, "_apsta") != NULL) {
+                        /* Turn off MPC in AP mode */
+                        bcm_mkiovar("mpc", (char *)&mpc, 4, iovbuf, sizeof(iovbuf));
+                        if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                                sizeof(iovbuf), TRUE, 0)) < 0) {
+                                DHD_ERROR(("%s mpc for HostAPD failed  %d\n", __FUNCTION__, ret));
+                        } else {
+                                dhd->op_mode |= HOSTAPD_MASK;
+#if defined(ARP_OFFLOAD_SUPPORT)
+                                arpoe = 0;
+#endif /* (ARP_OFFLOAD_SUPPORT) */
+                                dhd_pkt_filter_enable = FALSE;
+                        }
+        }
+#endif
+
+        if ((dhd->op_mode != WFD_MASK) && (dhd->op_mode != HOSTAPD_MASK)) {
+                /* STA only operation mode */
+                dhd->op_mode |= STA_MASK;
+                dhd_pkt_filter_enable = TRUE;
+        }
+
+        DHD_ERROR(("Firmware up: fw_path=%s op_mode=%d, "
+                        "Broadcom Dongle Host Driver mac=%.2x:%.2x:%.2x:%.2x:%.2x:%.2x\n",
+                        fw_path,
+                        dhd->op_mode,
+                        dhd->mac.octet[0], dhd->mac.octet[1], dhd->mac.octet[2],
+                        dhd->mac.octet[3], dhd->mac.octet[4], dhd->mac.octet[5]));
+
+        /* Set Country code  */
+        if (dhd->dhd_cspec.ccode[0] != 0) {
+                bcm_mkiovar("country", (char *)&dhd->dhd_cspec,
+                        sizeof(wl_country_t), iovbuf, sizeof(iovbuf));
+                if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+                        DHD_ERROR(("%s: country code setting failed\n", __FUNCTION__));
+        }
+
+        /* Set Listen Interval */
+        bcm_mkiovar("assoc_listen", (char *)&listen_interval, 4, iovbuf, sizeof(iovbuf));
+        if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+                DHD_ERROR(("%s assoc_listen failed %d\n", __FUNCTION__, ret));
+
+        /* Set PowerSave mode */
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode, sizeof(power_mode), TRUE, 0);
+
+        /* Match Host and Dongle rx alignment */
+        bcm_mkiovar("bus:txglomalign", (char *)&dongle_align, 4, iovbuf, sizeof(iovbuf));
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+        /* disable glom option per default */
+        bcm_mkiovar("bus:txglom", (char *)&glom, 4, iovbuf, sizeof(iovbuf));
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+        /* Setup timeout if Beacons are lost and roam is off to report link down */
+        bcm_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf, sizeof(iovbuf));
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+        /* Setup assoc_retry_max count to reconnect target AP in dongle */
+        bcm_mkiovar("assoc_retry_max", (char *)&retry_max, 4, iovbuf, sizeof(iovbuf));
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#if defined(AP) && !defined(WLP2P)
+        /* Turn off MPC in AP mode */
+        bcm_mkiovar("mpc", (char *)&mpc, 4, iovbuf, sizeof(iovbuf));
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+        bcm_mkiovar("apsta", (char *)&apsta, 4, iovbuf, sizeof(iovbuf));
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* defined(AP) && !defined(WLP2P) */
+
+#if defined(SOFTAP)
+        if (ap_fw_loaded == TRUE) {
+                dhd_wl_ioctl_cmd(dhd, WLC_SET_DTIMPRD, (char *)&dtim, sizeof(dtim), TRUE, 0);
+        }
+#endif
+
+#if defined(KEEP_ALIVE)
+        {
+        /* Set Keep Alive : be sure to use FW with -keepalive */
+        int res;
+
+#if defined(SOFTAP)
+        if (ap_fw_loaded == FALSE)
+#endif
+                if ((res = dhd_keep_alive_onoff(dhd)) < 0)
+                        DHD_ERROR(("%s set keeplive failed %d\n",
+                        __FUNCTION__, res));
+        }
+#endif /* defined(KEEP_ALIVE) */
+
+        /* Read event_msgs mask */
+        bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf, sizeof(iovbuf));
+        if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0)) < 0) {
+                DHD_ERROR(("%s read Event mask failed %d\n", __FUNCTION__, ret));
+                goto done;
+        }
+        bcopy(iovbuf, eventmask, WL_EVENTING_MASK_LEN);
+
+        /* Setup event_msgs */
+        setbit(eventmask, WLC_E_SET_SSID);
+        setbit(eventmask, WLC_E_PRUNE);
+        setbit(eventmask, WLC_E_AUTH);
+        setbit(eventmask, WLC_E_REASSOC);
+        setbit(eventmask, WLC_E_REASSOC_IND);
+        setbit(eventmask, WLC_E_DEAUTH);
+        setbit(eventmask, WLC_E_DEAUTH_IND);
+        setbit(eventmask, WLC_E_DISASSOC_IND);
+        setbit(eventmask, WLC_E_DISASSOC);
+        setbit(eventmask, WLC_E_JOIN);
+        setbit(eventmask, WLC_E_ASSOC_IND);
+        setbit(eventmask, WLC_E_PSK_SUP);
+        setbit(eventmask, WLC_E_LINK);
+        setbit(eventmask, WLC_E_NDIS_LINK);
+        setbit(eventmask, WLC_E_MIC_ERROR);
+        setbit(eventmask, WLC_E_PMKID_CACHE);
+        setbit(eventmask, WLC_E_JOIN_START);
+        setbit(eventmask, WLC_E_SCAN_COMPLETE);
+#ifdef WLMEDIA_HTSF
+        setbit(eventmask, WLC_E_HTSFSYNC);
+#endif /* WLMEDIA_HTSF */
+#ifdef PNO_SUPPORT
+        setbit(eventmask, WLC_E_PFN_NET_FOUND);
+#endif /* PNO_SUPPORT */
+        /* enable dongle roaming event */
+        setbit(eventmask, WLC_E_ROAM);
+#ifdef WL_CFG80211
+        setbit(eventmask, WLC_E_ESCAN_RESULT);
+        if ((dhd->op_mode & WFD_MASK) == WFD_MASK) {
+                setbit(eventmask, WLC_E_ACTION_FRAME_RX);
+                setbit(eventmask, WLC_E_ACTION_FRAME_COMPLETE);
+                setbit(eventmask, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE);
+                setbit(eventmask, WLC_E_P2P_PROBREQ_MSG);
+                setbit(eventmask, WLC_E_P2P_DISC_LISTEN_COMPLETE);
+        }
+#endif /* WL_CFG80211 */
+
+        /* Write updated Event mask */
+        bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf, sizeof(iovbuf));
+        if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+                DHD_ERROR(("%s Set Event mask failed %d\n", __FUNCTION__, ret));
+                goto done;
+        }
+
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_CHANNEL_TIME, (char *)&scan_assoc_time,
+                sizeof(scan_assoc_time), TRUE, 0);
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_UNASSOC_TIME, (char *)&scan_unassoc_time,
+                sizeof(scan_unassoc_time), TRUE, 0);
+        dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_PASSIVE_TIME, (char *)&scan_passive_time,
+                sizeof(scan_passive_time), TRUE, 0);
+
+#ifdef ARP_OFFLOAD_SUPPORT
+        /* Set and enable ARP offload feature for STA only  */
+#if defined(SOFTAP)
+        if (arpoe && !ap_fw_loaded) {
+#else
+        if (arpoe) {
+#endif 
+                dhd_arp_offload_set(dhd, dhd_arp_mode);
+                dhd_arp_offload_enable(dhd, arpoe);
+        } else {
+                dhd_arp_offload_set(dhd, 0);
+                dhd_arp_offload_enable(dhd, FALSE);
+        }
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#ifdef PKT_FILTER_SUPPORT
+        /* Setup defintions for pktfilter , enable in suspend */
+        dhd->pktfilter_count = 4;
+        /* Setup filter to allow only unicast */
+        dhd->pktfilter[0] = "100 0 0 0 0x01 0x00";
+        dhd->pktfilter[1] = NULL;
+        dhd->pktfilter[2] = NULL;
+        dhd->pktfilter[3] = NULL;
+#if defined(SOFTAP)
+        if (ap_fw_loaded) {
+                int i;
+                for (i = 0; i < dhd->pktfilter_count; i++) {
+                        dhd_pktfilter_offload_enable(dhd, dhd->pktfilter[i],
+                                0, dhd_master_mode);
+                }
+        }
+#endif /* defined(SOFTAP) */
+#endif /* PKT_FILTER_SUPPORT */
+
+        /* Force STA UP */
+        if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_UP, (char *)&up, sizeof(up), TRUE, 0)) < 0) {
+                DHD_ERROR(("%s Setting WL UP failed %d\n", __FUNCTION__, ret));
+                goto done;
+        }
+
+        /* query for 'ver' to get version info from firmware */
+        memset(buf, 0, sizeof(buf));
+        ptr = buf;
+        bcm_mkiovar("ver", (char *)&buf, 4, buf, sizeof(buf));
+        if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf), FALSE, 0)) < 0)
+                DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+        else {
+                bcmstrtok(&ptr, "\n", 0);
+                /* Print fw version info */
+                DHD_ERROR(("Firmware version = %s\n", buf));
+                DHD_BLOG(buf, strlen(buf) + 1);
+                DHD_BLOG(dhd_version, strlen(dhd_version) + 1);
+        }
+
+done:
+        return ret;
+}
+
+
+int
+dhd_iovar(dhd_pub_t *pub, int ifidx, char *name, char *cmd_buf, uint cmd_len, int set)
+{
+        char buf[strlen(name) + 1 + cmd_len];
+        int len = sizeof(buf);
+        wl_ioctl_t ioc;
+        int ret;
+
+        len = bcm_mkiovar(name, cmd_buf, cmd_len, buf, len);
+
+        memset(&ioc, 0, sizeof(ioc));
+
+        ioc.cmd = set? WLC_SET_VAR : WLC_GET_VAR;
+        ioc.buf = buf;
+        ioc.len = len;
+        ioc.set = TRUE;
+
+        ret = dhd_wl_ioctl(pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (!set && ret >= 0)
+                memcpy(cmd_buf, buf, cmd_len);
+
+        return ret;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+static struct net_device_ops dhd_ops_pri = {
+        .ndo_open = dhd_open,
+        .ndo_stop = dhd_stop,
+        .ndo_get_stats = dhd_get_stats,
+        .ndo_do_ioctl = dhd_ioctl_entry,
+        .ndo_start_xmit = dhd_start_xmit,
+        .ndo_set_mac_address = dhd_set_mac_address,
+        .ndo_set_multicast_list = dhd_set_multicast_list,
+};
+
+static struct net_device_ops dhd_ops_virt = {
+        .ndo_get_stats = dhd_get_stats,
+        .ndo_do_ioctl = dhd_ioctl_entry,
+        .ndo_start_xmit = dhd_start_xmit,
+        .ndo_set_mac_address = dhd_set_mac_address,
+        .ndo_set_multicast_list = dhd_set_multicast_list,
+};
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)) */
+
+int dhd_change_mtu(dhd_pub_t *dhdp, int new_mtu, int ifidx)
+{
+        struct dhd_info *dhd = dhdp->info;
+        struct net_device *dev = NULL;
+
+        ASSERT(dhd && dhd->iflist[ifidx]);
+        dev = dhd->iflist[ifidx]->net;
+        ASSERT(dev);
+
+        if (netif_running(dev)) {
+                DHD_ERROR(("%s: Must be down to change its MTU", dev->name));
+                return BCME_NOTDOWN;
+        }
+
+#define DHD_MIN_MTU 1500
+#define DHD_MAX_MTU 1752
+
+        if ((new_mtu < DHD_MIN_MTU) || (new_mtu > DHD_MAX_MTU)) {
+                DHD_ERROR(("%s: MTU size %d is invalid.\n", __FUNCTION__, new_mtu));
+                return BCME_BADARG;
+        }
+
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+#ifdef ARP_OFFLOAD_SUPPORT
+/* add or remove AOE host ip(s) (up to 8 IPs on the interface)  */
+void
+aoe_update_host_ipv4_table(dhd_pub_t *dhd_pub, u32 ipa, bool add)
+{
+        u32 ipv4_buf[MAX_IPV4_ENTRIES]; /* temp save for AOE host_ip table */
+        int i;
+        int ret;
+
+        bzero(ipv4_buf, sizeof(ipv4_buf));
+
+        /* display what we've got */
+        ret = dhd_arp_get_arp_hostip_table(dhd_pub, ipv4_buf, sizeof(ipv4_buf));
+        DHD_ARPOE(("%s: hostip table read from Dongle:\n", __FUNCTION__));
+#ifdef AOE_DBG
+        dhd_print_buf(ipv4_buf, 32, 4); /* max 8 IPs 4b each */
+#endif
+        /* now we saved hoste_ip table, clr it in the dongle AOE */
+        dhd_aoe_hostip_clr(dhd_pub);
+
+        if (ret) {
+                DHD_ERROR(("%s failed\n", __FUNCTION__));
+                return;
+        }
+
+        for (i = 0; i < MAX_IPV4_ENTRIES; i++) {
+                if (add && (ipv4_buf[i] == 0)) {
+                                ipv4_buf[i] = ipa;
+                                add = FALSE; /* added ipa to local table  */
+                                DHD_ARPOE(("%s: Saved new IP in temp arp_hostip[%d]\n",
+                                __FUNCTION__, i));
+                } else if (ipv4_buf[i] == ipa) {
+                        ipv4_buf[i]     = 0;
+                        DHD_ARPOE(("%s: removed IP:%x from temp table %d\n",
+                                __FUNCTION__, ipa, i));
+                }
+
+                if (ipv4_buf[i] != 0) {
+                        /* add back host_ip entries from our local cache */
+                        dhd_arp_offload_add_ip(dhd_pub, ipv4_buf[i]);
+                        DHD_ARPOE(("%s: added IP:%x to dongle arp_hostip[%d]\n\n",
+                                __FUNCTION__, ipv4_buf[i], i));
+                }
+        }
+#ifdef AOE_DBG
+        /* see the resulting hostip table */
+        dhd_arp_get_arp_hostip_table(dhd_pub, ipv4_buf, sizeof(ipv4_buf));
+        DHD_ARPOE(("%s: read back arp_hostip table:\n", __FUNCTION__));
+        dhd_print_buf(ipv4_buf, 32, 4); /* max 8 IPs 4b each */
+#endif
+}
+
+static int dhd_device_event(struct notifier_block *this,
+        unsigned long event,
+        void *ptr)
+{
+        struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
+
+        dhd_info_t *dhd;
+        dhd_pub_t *dhd_pub;
+
+        if (!ifa)
+                return NOTIFY_DONE;
+
+        dhd = *(dhd_info_t **)netdev_priv(ifa->ifa_dev->dev);
+        dhd_pub = &dhd->pub;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+        if (ifa->ifa_dev->dev->netdev_ops == &dhd_ops_pri) {
+#else
+        if (ifa->ifa_dev->dev) {
+#endif
+                switch (event) {
+                case NETDEV_UP:
+                        DHD_ARPOE(("%s: [%s] Up IP: 0x%x\n",
+                                __FUNCTION__, ifa->ifa_label, ifa->ifa_address));
+
+                        /* firmware not downloaded, do nothing */
+                        if (dhd->pub.busstate == DHD_BUS_DOWN) {
+                                DHD_ERROR(("%s: bus is down, exit\n", __FUNCTION__));
+                                break;
+                        }
+
+#ifdef AOE_IP_ALIAS_SUPPORT
+                        if (ifa->ifa_label[strlen(ifa->ifa_label)-2] == 0x3a) {
+                                DHD_ARPOE(("%s:add aliased IP to AOE hostip cache\n",
+                                        __FUNCTION__));
+                                aoe_update_host_ipv4_table(dhd_pub, ifa->ifa_address, TRUE);
+                        }
+                        else
+                                aoe_update_host_ipv4_table(dhd_pub, ifa->ifa_address, TRUE);
+#endif
+                        break;
+
+                case NETDEV_DOWN:
+                        DHD_ARPOE(("%s: [%s] Down IP: 0x%x\n",
+                                __FUNCTION__, ifa->ifa_label, ifa->ifa_address));
+
+#ifdef AOE_IP_ALIAS_SUPPORT
+                if (!(ifa->ifa_label[strlen(ifa->ifa_label)-2] == 0x3a)) {
+                                DHD_ARPOE(("%s: primary interface is down, AOE clr all\n",
+                                           __FUNCTION__));
+                                dhd_aoe_hostip_clr(&dhd->pub);
+                                dhd_aoe_arp_clr(&dhd->pub);
+                } else
+                        aoe_update_host_ipv4_table(dhd_pub, ifa->ifa_address, FALSE);
+#else
+                        dhd_aoe_hostip_clr(&dhd->pub);
+                        dhd_aoe_arp_clr(&dhd->pub);
+#endif
+                        break;
+
+                default:
+                        DHD_ARPOE(("%s: do noting for [%s] Event: %lu\n",
+                                __func__, ifa->ifa_label, event));
+                        break;
+                }
+        }
+        return NOTIFY_DONE;
+}
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+int
+dhd_net_attach(dhd_pub_t *dhdp, int ifidx)
+{
+        dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+        struct net_device *net = NULL;
+        int err = 0;
+        uint8 temp_addr[ETHER_ADDR_LEN] = { 0x00, 0x90, 0x4c, 0x11, 0x22, 0x33 };
+
+        DHD_TRACE(("%s: ifidx %d\n", __FUNCTION__, ifidx));
+
+        ASSERT(dhd && dhd->iflist[ifidx]);
+
+        net = dhd->iflist[ifidx]->net;
+        ASSERT(net);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+        ASSERT(!net->open);
+        net->get_stats = dhd_get_stats;
+        net->do_ioctl = dhd_ioctl_entry;
+        net->hard_start_xmit = dhd_start_xmit;
+        net->set_mac_address = dhd_set_mac_address;
+        net->set_multicast_list = dhd_set_multicast_list;
+        net->open = net->stop = NULL;
+#else
+        ASSERT(!net->netdev_ops);
+        net->netdev_ops = &dhd_ops_virt;
+#endif
+
+        /* Ok, link into the network layer... */
+        if (ifidx == 0) {
+                /*
+                 * device functions for the primary interface only
+                 */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+                net->open = dhd_open;
+                net->stop = dhd_stop;
+#else
+                net->netdev_ops = &dhd_ops_pri;
+#endif
+        } else {
+                /*
+                 * We have to use the primary MAC for virtual interfaces
+                 */
+                memcpy(temp_addr, dhd->iflist[ifidx]->mac_addr, ETHER_ADDR_LEN);
+                /*
+                 * Android sets the locally administered bit to indicate that this is a
+                 * portable hotspot.  This will not work in simultaneous AP/STA mode,
+                 * nor with P2P.  Need to set the Donlge's MAC address, and then use that.
+                 */
+                if (ifidx > 0) {
+                        DHD_ERROR(("%s interface [%s]: set locally administered bit in MAC\n",
+                        __func__, net->name));
+                        temp_addr[0] |= 0x02;
+                }
+        }
+
+        net->hard_header_len = ETH_HLEN + dhd->pub.hdrlen;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+        net->ethtool_ops = &dhd_ethtool_ops;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+#if defined(CONFIG_BCMDHD_WEXT)
+#if WIRELESS_EXT < 19
+        net->get_wireless_stats = dhd_get_wireless_stats;
+#endif /* WIRELESS_EXT < 19 */
+#if WIRELESS_EXT > 12
+        net->wireless_handlers = (struct iw_handler_def *)&wl_iw_handler_def;
+#endif /* WIRELESS_EXT > 12 */
+#endif /* defined(CONFIG_BCMDHD_WEXT) */
+
+        dhd->pub.rxsz = DBUS_RX_BUFFER_SIZE_DHD(net);
+
+        memcpy(net->dev_addr, temp_addr, ETHER_ADDR_LEN);
+
+        if ((err = register_netdev(net)) != 0) {
+                DHD_ERROR(("couldn't register the net device, err %d\n", err));
+                goto fail;
+        }
+        printf("Broadcom Dongle Host Driver: register interface [%s]"
+                " MAC: %.2x:%.2x:%.2x:%.2x:%.2x:%.2x\n",
+                net->name,
+                net->dev_addr[0], net->dev_addr[1], net->dev_addr[2],
+                net->dev_addr[3], net->dev_addr[4], net->dev_addr[5]);
+
+#if defined(SOFTAP) && defined(CONFIG_BCMDHD_WEXT) && !defined(WL_CFG80211)
+                wl_iw_iscan_set_scan_broadcast_prep(net, 1);
+#endif
+
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        if (ifidx == 0) {
+                up(&dhd_registration_sem);
+        }
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+        return 0;
+
+fail:
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+        net->open = NULL;
+#else
+        net->netdev_ops = NULL;
+#endif
+        return err;
+}
+
+void
+dhd_bus_detach(dhd_pub_t *dhdp)
+{
+        dhd_info_t *dhd;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (dhdp) {
+                dhd = (dhd_info_t *)dhdp->info;
+                if (dhd) {
+
+                        /*
+                         * In case of Android cfg80211 driver, the bus is down in dhd_stop,
+                         * calling stop again will cuase SD read/write errors.
+                         */
+                        if (dhd->pub.busstate != DHD_BUS_DOWN) {
+                                /* Stop the protocol module */
+                                dhd_prot_stop(&dhd->pub);
+
+                                /* Stop the bus module */
+                                dhd_bus_stop(dhd->pub.bus, TRUE);
+                        }
+
+#if defined(OOB_INTR_ONLY)
+                        bcmsdh_unregister_oob_intr();
+#endif /* defined(OOB_INTR_ONLY) */
+                }
+        }
+}
+
+
+void dhd_detach(dhd_pub_t *dhdp)
+{
+        dhd_info_t *dhd;
+        unsigned long flags;
+        int timer_valid = FALSE;
+
+        if (!dhdp)
+                return;
+
+        dhd = (dhd_info_t *)dhdp->info;
+        if (!dhd)
+                return;
+
+        DHD_TRACE(("%s: Enter state 0x%x\n", __FUNCTION__, dhd->dhd_state));
+
+        if (!(dhd->dhd_state & DHD_ATTACH_STATE_DONE)) {
+                /* Give sufficient time for threads to start running in case
+                 * dhd_attach() has failed
+                 */
+                osl_delay(1000*100);
+        }
+
+#ifdef ARP_OFFLOAD_SUPPORT
+        unregister_inetaddr_notifier(&dhd_notifier);
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#if defined(CONFIG_HAS_EARLYSUSPEND)
+        if (dhd->dhd_state & DHD_ATTACH_STATE_EARLYSUSPEND_DONE) {
+                if (dhd->early_suspend.suspend)
+                        unregister_early_suspend(&dhd->early_suspend);
+        }
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) */
+
+#if defined(CONFIG_BCMDHD_WEXT)
+        if (dhd->dhd_state & DHD_ATTACH_STATE_WL_ATTACH) {
+                /* Detatch and unlink in the iw */
+                wl_iw_detach();
+        }
+#endif /* defined(CONFIG_BCMDHD_WEXT) */
+
+        if (&dhd->thr_sysioc_ctl.thr_pid >= 0) {
+                PROC_STOP(&dhd->thr_sysioc_ctl);
+        }
+
+        /* delete all interfaces, start with virtual  */
+        if (dhd->dhd_state & DHD_ATTACH_STATE_ADD_IF) {
+                int i = 1;
+                dhd_if_t *ifp;
+
+                /* Cleanup virtual interfaces */
+                for (i = 1; i < DHD_MAX_IFS; i++)
+                        if (dhd->iflist[i]) {
+                                dhd->iflist[i]->state = DHD_IF_DEL;
+                                dhd->iflist[i]->idx = i;
+                                dhd_op_if(dhd->iflist[i]);
+                        }
+
+                /*  delete primary interface 0 */
+                ifp = dhd->iflist[0];
+                ASSERT(ifp);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+                if (ifp->net->open)
+#else
+                if (ifp->net->netdev_ops == &dhd_ops_pri)
+#endif
+                {
+                        if (ifp->net) {
+                                unregister_netdev(ifp->net);
+                                free_netdev(ifp->net);
+                                ifp->net = NULL;
+                        }
+                        MFREE(dhd->pub.osh, ifp, sizeof(*ifp));
+                        dhd->iflist[0] = NULL;
+                }
+        }
+
+        /* Clear the watchdog timer */
+        flags = dhd_os_spin_lock(&dhd->pub);
+        timer_valid = dhd->wd_timer_valid;
+        dhd->wd_timer_valid = FALSE;
+        dhd_os_spin_unlock(&dhd->pub, flags);
+        if (timer_valid)
+                del_timer_sync(&dhd->timer);
+
+        if (dhd->dhd_state & DHD_ATTACH_STATE_THREADS_CREATED) {
+#ifdef DHDTHREAD
+                if (dhd->thr_wdt_ctl.thr_pid >= 0) {
+                        PROC_STOP(&dhd->thr_wdt_ctl);
+                }
+
+                if (dhd->thr_dpc_ctl.thr_pid >= 0) {
+                        PROC_STOP(&dhd->thr_dpc_ctl);
+                }
+                else
+#endif /* DHDTHREAD */
+                tasklet_kill(&dhd->tasklet);
+        }
+        if (dhd->dhd_state & DHD_ATTACH_STATE_PROT_ATTACH) {
+                dhd_bus_detach(dhdp);
+
+                if (dhdp->prot)
+                        dhd_prot_detach(dhdp);
+        }
+
+#ifdef WL_CFG80211
+        if (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211) {
+                wl_cfg80211_detach();
+                dhd_monitor_uninit();
+        }
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+                unregister_pm_notifier(&dhd_sleep_pm_notifier);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP) */
+
+        if (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT) {
+#ifdef CONFIG_HAS_WAKELOCK
+                wake_lock_destroy(&dhd->wl_wifi);
+                wake_lock_destroy(&dhd->wl_rxwake);
+#endif
+        }
+}
+
+
+void
+dhd_free(dhd_pub_t *dhdp)
+{
+        dhd_info_t *dhd;
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (dhdp) {
+                dhd = (dhd_info_t *)dhdp->info;
+                if (dhd)
+                        MFREE(dhd->pub.osh, dhd, sizeof(*dhd));
+        }
+}
+
+static void __exit
+dhd_module_cleanup(void)
+{
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        dhd_bus_unregister();
+
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+        wl_android_wifictrl_func_del();
+#endif /* CONFIG_WIFI_CONTROL_FUNC */
+        wl_android_exit();
+
+        /* Call customer gpio to turn off power with WL_REG_ON signal */
+        dhd_customer_gpio_wlan_ctrl(WLAN_POWER_OFF);
+}
+
+
+static int __init
+dhd_module_init(void)
+{
+        int error = 0;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        wl_android_init();
+
+#ifdef DHDTHREAD
+        /* Sanity check on the module parameters */
+        do {
+                /* Both watchdog and DPC as tasklets are ok */
+                if ((dhd_watchdog_prio < 0) && (dhd_dpc_prio < 0))
+                        break;
+
+                /* If both watchdog and DPC are threads, TX must be deferred */
+                if ((dhd_watchdog_prio >= 0) && (dhd_dpc_prio >= 0) && dhd_deferred_tx)
+                        break;
+
+                DHD_ERROR(("Invalid module parameters.\n"));
+                return -EINVAL;
+        } while (0);
+#endif /* DHDTHREAD */
+
+        /* Call customer gpio to turn on power with WL_REG_ON signal */
+        dhd_customer_gpio_wlan_ctrl(WLAN_POWER_ON);
+
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+        if (wl_android_wifictrl_func_add() < 0)
+                goto fail_1;
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                sema_init(&dhd_registration_sem, 0);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+        error = dhd_bus_register();
+
+        if (!error)
+                printf("\n%s\n", dhd_version);
+        else {
+                DHD_ERROR(("%s: sdio_register_driver failed\n", __FUNCTION__));
+                goto fail_1;
+        }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                /*
+                 * Wait till MMC sdio_register_driver callback called and made driver attach.
+                 * It's needed to make sync up exit from dhd insmod  and
+                 * Kernel MMC sdio device callback registration
+                 */
+        if (down_timeout(&dhd_registration_sem,  msecs_to_jiffies(DHD_REGISTRATION_TIMEOUT)) != 0) {
+                error = -EINVAL;
+                DHD_ERROR(("%s: sdio_register_driver timeout\n", __FUNCTION__));
+                goto fail_2;
+                }
+#endif
+#if defined(WL_CFG80211)
+        error = wl_android_post_init();
+#endif
+
+        return error;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && 1
+fail_2:
+        dhd_bus_unregister();
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+fail_1:
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+        wl_android_wifictrl_func_del();
+#endif 
+
+        /* Call customer gpio to turn off power with WL_REG_ON signal */
+        dhd_customer_gpio_wlan_ctrl(WLAN_POWER_OFF);
+
+        return error;
+}
+
+late_initcall(dhd_module_init);
+module_exit(dhd_module_cleanup);
+
+/*
+ * OS specific functions required to implement DHD driver in OS independent way
+ */
+int
+dhd_os_proto_block(dhd_pub_t *pub)
+{
+        dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+        if (dhd) {
+                down(&dhd->proto_sem);
+                return 1;
+        }
+
+        return 0;
+}
+
+int
+dhd_os_proto_unblock(dhd_pub_t *pub)
+{
+        dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+        if (dhd) {
+                up(&dhd->proto_sem);
+                return 1;
+        }
+
+        return 0;
+}
+
+unsigned int
+dhd_os_get_ioctl_resp_timeout(void)
+{
+        return ((unsigned int)dhd_ioctl_timeout_msec);
+}
+
+void
+dhd_os_set_ioctl_resp_timeout(unsigned int timeout_msec)
+{
+        dhd_ioctl_timeout_msec = (int)timeout_msec;
+}
+
+int
+dhd_os_ioctl_resp_wait(dhd_pub_t *pub, uint *condition, bool *pending)
+{
+        dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+        DECLARE_WAITQUEUE(wait, current);
+        int timeout = dhd_ioctl_timeout_msec;
+
+        /* Convert timeout in millsecond to jiffies */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        timeout = msecs_to_jiffies(timeout);
+#else
+        timeout = timeout * HZ / 1000;
+#endif
+
+        /* Wait until control frame is available */
+        add_wait_queue(&dhd->ioctl_resp_wait, &wait);
+        set_current_state(TASK_INTERRUPTIBLE);
+
+        /* Memory barrier to support multi-processing
+         * As the variable "condition", which points to dhd->rxlen (dhd_bus_rxctl[dhd_sdio.c])
+         * Can be changed by another processor.
+         */
+        smp_mb();
+        while (!(*condition) && (!signal_pending(current) && timeout)) {
+                timeout = schedule_timeout(timeout);
+                smp_mb();
+        }
+
+        if (signal_pending(current))
+                *pending = TRUE;
+
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(&dhd->ioctl_resp_wait, &wait);
+
+        return timeout;
+}
+
+int
+dhd_os_ioctl_resp_wake(dhd_pub_t *pub)
+{
+        dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+        if (waitqueue_active(&dhd->ioctl_resp_wait)) {
+                wake_up_interruptible(&dhd->ioctl_resp_wait);
+        }
+
+        return 0;
+}
+
+void
+dhd_os_wd_timer(void *bus, uint wdtick)
+{
+        dhd_pub_t *pub = bus;
+        dhd_info_t *dhd = (dhd_info_t *)pub->info;
+        unsigned long flags;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        flags = dhd_os_spin_lock(pub);
+
+        /* don't start the wd until fw is loaded */
+        if (pub->busstate == DHD_BUS_DOWN) {
+                dhd_os_spin_unlock(pub, flags);
+                return;
+        }
+
+        /* Totally stop the timer */
+        if (!wdtick && dhd->wd_timer_valid == TRUE) {
+                dhd->wd_timer_valid = FALSE;
+                dhd_os_spin_unlock(pub, flags);
+#ifdef DHDTHREAD
+                del_timer_sync(&dhd->timer);
+#else
+                del_timer(&dhd->timer);
+#endif /* DHDTHREAD */
+                return;
+        }
+
+        if (wdtick) {
+                dhd_watchdog_ms = (uint)wdtick;
+                /* Re arm the timer, at last watchdog period */
+                mod_timer(&dhd->timer, jiffies + dhd_watchdog_ms * HZ / 1000);
+                dhd->wd_timer_valid = TRUE;
+        }
+        dhd_os_spin_unlock(pub, flags);
+}
+
+void *
+dhd_os_open_image(char *filename)
+{
+        struct file *fp;
+
+        fp = filp_open(filename, O_RDONLY, 0);
+        /*
+         * 2.6.11 (FC4) supports filp_open() but later revs don't?
+         * Alternative:
+         * fp = open_namei(AT_FDCWD, filename, O_RD, 0);
+         * ???
+         */
+         if (IS_ERR(fp))
+                 fp = NULL;
+
+         return fp;
+}
+
+int
+dhd_os_get_image_block(char *buf, int len, void *image)
+{
+        struct file *fp = (struct file *)image;
+        int rdlen;
+
+        if (!image)
+                return 0;
+
+        rdlen = kernel_read(fp, fp->f_pos, buf, len);
+        if (rdlen > 0)
+                fp->f_pos += rdlen;
+
+        return rdlen;
+}
+
+void
+dhd_os_close_image(void *image)
+{
+        if (image)
+                filp_close((struct file *)image, NULL);
+}
+
+
+void
+dhd_os_sdlock(dhd_pub_t *pub)
+{
+        dhd_info_t *dhd;
+
+        dhd = (dhd_info_t *)(pub->info);
+
+#ifdef DHDTHREAD
+        if (dhd->threads_only)
+                down(&dhd->sdsem);
+        else
+#endif /* DHDTHREAD */
+        spin_lock_bh(&dhd->sdlock);
+}
+
+void
+dhd_os_sdunlock(dhd_pub_t *pub)
+{
+        dhd_info_t *dhd;
+
+        dhd = (dhd_info_t *)(pub->info);
+
+#ifdef DHDTHREAD
+        if (dhd->threads_only)
+                up(&dhd->sdsem);
+        else
+#endif /* DHDTHREAD */
+        spin_unlock_bh(&dhd->sdlock);
+}
+
+void
+dhd_os_sdlock_txq(dhd_pub_t *pub)
+{
+        dhd_info_t *dhd;
+
+        dhd = (dhd_info_t *)(pub->info);
+        spin_lock_bh(&dhd->txqlock);
+}
+
+void
+dhd_os_sdunlock_txq(dhd_pub_t *pub)
+{
+        dhd_info_t *dhd;
+
+        dhd = (dhd_info_t *)(pub->info);
+        spin_unlock_bh(&dhd->txqlock);
+}
+
+void
+dhd_os_sdlock_rxq(dhd_pub_t *pub)
+{
+}
+
+void
+dhd_os_sdunlock_rxq(dhd_pub_t *pub)
+{
+}
+
+void
+dhd_os_sdtxlock(dhd_pub_t *pub)
+{
+        dhd_os_sdlock(pub);
+}
+
+void
+dhd_os_sdtxunlock(dhd_pub_t *pub)
+{
+        dhd_os_sdunlock(pub);
+}
+
+#if defined(DHD_USE_STATIC_BUF)
+uint8* dhd_os_prealloc(void *osh, int section, uint size)
+{
+        return (uint8*)wl_android_prealloc(section, size);
+}
+
+void dhd_os_prefree(void *osh, void *addr, uint size)
+{
+}
+#endif /* defined(CONFIG_WIFI_CONTROL_FUNC) */
+
+#if defined(CONFIG_BCMDHD_WEXT)
+struct iw_statistics *
+dhd_get_wireless_stats(struct net_device *dev)
+{
+        int res = 0;
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        if (!dhd->pub.up) {
+                return NULL;
+        }
+
+        res = wl_iw_get_wireless_stats(dev, &dhd->iw.wstats);
+
+        if (res == 0)
+                return &dhd->iw.wstats;
+        else
+                return NULL;
+}
+#endif /* defined(CONFIG_BCMDHD_WEXT) */
+
+static int
+dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata,
+        wl_event_msg_t *event, void **data)
+{
+        int bcmerror = 0;
+        ASSERT(dhd != NULL);
+
+        bcmerror = wl_host_event(&dhd->pub, ifidx, pktdata, event, data);
+        if (bcmerror != BCME_OK)
+                return (bcmerror);
+
+#if defined(CONFIG_BCMDHD_WEXT)
+        if (event->bsscfgidx == 0) {
+                /*
+                 * Wireless ext is on primary interface only
+                 */
+
+                ASSERT(dhd->iflist[*ifidx] != NULL);
+                ASSERT(dhd->iflist[*ifidx]->net != NULL);
+
+                if (dhd->iflist[*ifidx]->net) {
+                        wl_iw_event(dhd->iflist[*ifidx]->net, event, *data);
+                }
+        }
+#endif /* defined(CONFIG_BCMDHD_WEXT)  */
+
+#ifdef WL_CFG80211
+
+        if ((wl_cfg80211_is_progress_ifchange() ||
+                wl_cfg80211_is_progress_ifadd()) && (*ifidx != 0)) {
+                /*
+                 * If IF_ADD/CHANGE operation is going on,
+                 *  discard any event received on the virtual I/F
+                 */
+                return (BCME_OK);
+        }
+
+        ASSERT(dhd->iflist[*ifidx] != NULL);
+        ASSERT(dhd->iflist[*ifidx]->net != NULL);
+        if (dhd->iflist[*ifidx]->net) {
+                wl_cfg80211_event(dhd->iflist[*ifidx]->net, event, *data);
+        }
+#endif /* defined(WL_CFG80211) */
+
+        return (bcmerror);
+}
+
+/* send up locally generated event */
+void
+dhd_sendup_event(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data)
+{
+        switch (ntoh32(event->event_type)) {
+        /* Send up locally generated AMP HCI Events */
+        case WLC_E_BTA_HCI_EVENT: {
+                struct sk_buff *p, *skb;
+                bcm_event_t *msg;
+                wl_event_msg_t *p_bcm_event;
+                char *ptr;
+                uint32 len;
+                uint32 pktlen;
+                dhd_if_t *ifp;
+                dhd_info_t *dhd;
+                uchar *eth;
+                int ifidx;
+
+                len = ntoh32(event->datalen);
+                pktlen = sizeof(bcm_event_t) + len + 2;
+                dhd = dhdp->info;
+                ifidx = dhd_ifname2idx(dhd, event->ifname);
+
+                if ((p = PKTGET(dhdp->osh, pktlen, FALSE))) {
+                        ASSERT(ISALIGNED((uintptr)PKTDATA(dhdp->osh, p), sizeof(uint32)));
+
+                        msg = (bcm_event_t *) PKTDATA(dhdp->osh, p);
+
+                        bcopy(&dhdp->mac, &msg->eth.ether_dhost, ETHER_ADDR_LEN);
+                        bcopy(&dhdp->mac, &msg->eth.ether_shost, ETHER_ADDR_LEN);
+                        ETHER_TOGGLE_LOCALADDR(&msg->eth.ether_shost);
+
+                        msg->eth.ether_type = hton16(ETHER_TYPE_BRCM);
+
+                        /* BCM Vendor specific header... */
+                        msg->bcm_hdr.subtype = hton16(BCMILCP_SUBTYPE_VENDOR_LONG);
+                        msg->bcm_hdr.version = BCMILCP_BCM_SUBTYPEHDR_VERSION;
+                        bcopy(BRCM_OUI, &msg->bcm_hdr.oui[0], DOT11_OUI_LEN);
+
+                        /* vendor spec header length + pvt data length (private indication
+                         *  hdr + actual message itself)
+                         */
+                        msg->bcm_hdr.length = hton16(BCMILCP_BCM_SUBTYPEHDR_MINLENGTH +
+                                BCM_MSG_LEN + sizeof(wl_event_msg_t) + (uint16)len);
+                        msg->bcm_hdr.usr_subtype = hton16(BCMILCP_BCM_SUBTYPE_EVENT);
+
+                        PKTSETLEN(dhdp->osh, p, (sizeof(bcm_event_t) + len + 2));
+
+                        /* copy  wl_event_msg_t into sk_buf */
+
+                        /* pointer to wl_event_msg_t in sk_buf */
+                        p_bcm_event = &msg->event;
+                        bcopy(event, p_bcm_event, sizeof(wl_event_msg_t));
+
+                        /* copy hci event into sk_buf */
+                        bcopy(data, (p_bcm_event + 1), len);
+
+                        msg->bcm_hdr.length  = hton16(sizeof(wl_event_msg_t) +
+                                ntoh16(msg->bcm_hdr.length));
+                        PKTSETLEN(dhdp->osh, p, (sizeof(bcm_event_t) + len + 2));
+
+                        ptr = (char *)(msg + 1);
+                        /* Last 2 bytes of the message are 0x00 0x00 to signal that there
+                         * are no ethertypes which are following this
+                         */
+                        ptr[len+0] = 0x00;
+                        ptr[len+1] = 0x00;
+
+                        skb = PKTTONATIVE(dhdp->osh, p);
+                        eth = skb->data;
+                        len = skb->len;
+
+                        ifp = dhd->iflist[ifidx];
+                        if (ifp == NULL)
+                             ifp = dhd->iflist[0];
+
+                        ASSERT(ifp);
+                        skb->dev = ifp->net;
+                        skb->protocol = eth_type_trans(skb, skb->dev);
+
+                        skb->data = eth;
+                        skb->len = len;
+
+                        /* Strip header, count, deliver upward */
+                        skb_pull(skb, ETH_HLEN);
+
+                        /* Send the packet */
+                        if (in_interrupt()) {
+                                netif_rx(skb);
+                        } else {
+                                netif_rx_ni(skb);
+                        }
+                }
+                else {
+                        /* Could not allocate a sk_buf */
+                        DHD_ERROR(("%s: unable to alloc sk_buf", __FUNCTION__));
+                }
+                break;
+        } /* case WLC_E_BTA_HCI_EVENT */
+
+        default:
+                break;
+        }
+}
+
+void dhd_wait_for_event(dhd_pub_t *dhd, bool *lockvar)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+        struct dhd_info *dhdinfo =  dhd->info;
+        dhd_os_sdunlock(dhd);
+        wait_event_interruptible_timeout(dhdinfo->ctrl_wait, (*lockvar == FALSE), HZ * 2);
+        dhd_os_sdlock(dhd);
+#endif
+        return;
+}
+
+void dhd_wait_event_wakeup(dhd_pub_t *dhd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+        struct dhd_info *dhdinfo =  dhd->info;
+        if (waitqueue_active(&dhdinfo->ctrl_wait))
+                wake_up_interruptible(&dhdinfo->ctrl_wait);
+#endif
+        return;
+}
+
+int
+dhd_dev_reset(struct net_device *dev, uint8 flag)
+{
+        int ret;
+
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        ret = dhd_bus_devreset(&dhd->pub, flag);
+        if (ret) {
+                DHD_ERROR(("%s: dhd_bus_devreset: %d\n", __FUNCTION__, ret));
+                return ret;
+        }
+
+        return ret;
+}
+
+int net_os_set_suspend_disable(struct net_device *dev, int val)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        int ret = 0;
+
+        if (dhd) {
+                ret = dhd->pub.suspend_disable_flag;
+                dhd->pub.suspend_disable_flag = val;
+        }
+        return ret;
+}
+
+int net_os_set_suspend(struct net_device *dev, int val)
+{
+        int ret = 0;
+#if defined(CONFIG_HAS_EARLYSUSPEND)
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        if (dhd) {
+                ret = dhd_set_suspend(val, &dhd->pub);
+        }
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) */
+        return ret;
+}
+
+int net_os_set_dtim_skip(struct net_device *dev, int val)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        if (dhd)
+                dhd->pub.dtim_skip = val;
+
+        return 0;
+}
+
+int net_os_rxfilter_add_remove(struct net_device *dev, int add_remove, int num)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        char *filterp = NULL;
+        int ret = 0;
+
+        if (!dhd || (num == DHD_UNICAST_FILTER_NUM))
+                return ret;
+        if (num >= dhd->pub.pktfilter_count)
+                return -EINVAL;
+        if (add_remove) {
+                switch (num) {
+                case DHD_BROADCAST_FILTER_NUM:
+                        filterp = "101 0 0 0 0xFFFFFFFFFFFF 0xFFFFFFFFFFFF";
+                        break;
+                case DHD_MULTICAST4_FILTER_NUM:
+                        filterp = "102 0 0 0 0xFFFFFF 0x01005E";
+                        break;
+                case DHD_MULTICAST6_FILTER_NUM:
+                        filterp = "103 0 0 0 0xFFFF 0x3333";
+                        break;
+                default:
+                        return -EINVAL;
+                }
+        }
+        dhd->pub.pktfilter[num] = filterp;
+        return ret;
+}
+
+int net_os_set_packet_filter(struct net_device *dev, int val)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        int ret = 0;
+
+        /* Packet filtering is set only if we still in early-suspend and
+         * we need either to turn it ON or turn it OFF
+         * We can always turn it OFF in case of early-suspend, but we turn it
+         * back ON only if suspend_disable_flag was not set
+        */
+        if (dhd && dhd->pub.up) {
+                if (dhd->pub.in_suspend) {
+                        if (!val || (val && !dhd->pub.suspend_disable_flag))
+                                dhd_set_packet_filter(val, &dhd->pub);
+                }
+        }
+        return ret;
+}
+
+
+void
+dhd_dev_init_ioctl(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        dhd_preinit_ioctls(&dhd->pub);
+}
+
+#ifdef PNO_SUPPORT
+/* Linux wrapper to call common dhd_pno_clean */
+int
+dhd_dev_pno_reset(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        return (dhd_pno_clean(&dhd->pub));
+}
+
+
+/* Linux wrapper to call common dhd_pno_enable */
+int
+dhd_dev_pno_enable(struct net_device *dev,  int pfn_enabled)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        return (dhd_pno_enable(&dhd->pub, pfn_enabled));
+}
+
+
+/* Linux wrapper to call common dhd_pno_set */
+int
+dhd_dev_pno_set(struct net_device *dev, wlc_ssid_t* ssids_local, int nssid,
+        ushort  scan_fr, int pno_repeat, int pno_freq_expo_max)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        return (dhd_pno_set(&dhd->pub, ssids_local, nssid, scan_fr, pno_repeat, pno_freq_expo_max));
+}
+
+/* Linux wrapper to get  pno status */
+int
+dhd_dev_get_pno_status(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        return (dhd_pno_get_status(&dhd->pub));
+}
+
+#endif /* PNO_SUPPORT */
+
+int net_os_send_hang_message(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        int ret = 0;
+
+        if (dhd) {
+                if (!dhd->pub.hang_was_sent) {
+                        dhd->pub.hang_was_sent = 1;
+#if defined(CONFIG_BCMDHD_WEXT)
+                        ret = wl_iw_send_priv_event(dev, "HANG");
+#endif
+#if defined(WL_CFG80211)
+                        ret = wl_cfg80211_hang(dev, WLAN_REASON_UNSPECIFIED);
+#endif
+                }
+        }
+        return ret;
+}
+
+void dhd_bus_country_set(struct net_device *dev, wl_country_t *cspec)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+        if (dhd && dhd->pub.up)
+                        memcpy(&dhd->pub.dhd_cspec, cspec, sizeof(wl_country_t));
+}
+
+
+void dhd_net_if_lock(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        dhd_net_if_lock_local(dhd);
+}
+
+void dhd_net_if_unlock(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        dhd_net_if_unlock_local(dhd);
+}
+
+static void dhd_net_if_lock_local(dhd_info_t *dhd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+        if (dhd)
+                mutex_lock(&dhd->dhd_net_if_mutex);
+#endif
+}
+
+static void dhd_net_if_unlock_local(dhd_info_t *dhd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+        if (dhd)
+                mutex_unlock(&dhd->dhd_net_if_mutex);
+#endif
+}
+
+unsigned long dhd_os_spin_lock(dhd_pub_t *pub)
+{
+        dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+        unsigned long flags = 0;
+
+        if (dhd)
+                spin_lock_irqsave(&dhd->dhd_lock, flags);
+
+        return flags;
+}
+
+void dhd_os_spin_unlock(dhd_pub_t *pub, unsigned long flags)
+{
+        dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+        if (dhd)
+                spin_unlock_irqrestore(&dhd->dhd_lock, flags);
+}
+
+static int
+dhd_get_pend_8021x_cnt(dhd_info_t *dhd)
+{
+        return (atomic_read(&dhd->pend_8021x_cnt));
+}
+
+#define MAX_WAIT_FOR_8021X_TX   10
+
+int
+dhd_wait_pend8021x(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        int timeout = 10 * HZ / 1000;
+        int ntimes = MAX_WAIT_FOR_8021X_TX;
+        int pend = dhd_get_pend_8021x_cnt(dhd);
+
+        while (ntimes && pend) {
+                if (pend) {
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        schedule_timeout(timeout);
+                        set_current_state(TASK_RUNNING);
+                        ntimes--;
+                }
+                pend = dhd_get_pend_8021x_cnt(dhd);
+        }
+        return pend;
+}
+
+#ifdef DHD_DEBUG
+int
+write_to_file(dhd_pub_t *dhd, uint8 *buf, int size)
+{
+        int ret = 0;
+        struct file *fp;
+        mm_segment_t old_fs;
+        loff_t pos = 0;
+
+        /* change to KERNEL_DS address limit */
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+
+        /* open file to write */
+        fp = filp_open("/tmp/mem_dump", O_WRONLY|O_CREAT, 0640);
+        if (!fp) {
+                printf("%s: open file error\n", __FUNCTION__);
+                ret = -1;
+                goto exit;
+        }
+
+        /* Write buf to file */
+        fp->f_op->write(fp, buf, size, &pos);
+
+exit:
+        /* free buf before return */
+        MFREE(dhd->osh, buf, size);
+        /* close file before return */
+        if (fp)
+                filp_close(fp, current->files);
+        /* restore previous address limit */
+        set_fs(old_fs);
+
+        return ret;
+}
+#endif /* DHD_DEBUG */
+
+int dhd_os_wake_lock_timeout(dhd_pub_t *pub)
+{
+        dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+        unsigned long flags;
+        int ret = 0;
+
+        if (dhd) {
+                spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+                ret = dhd->wakelock_timeout_enable;
+#ifdef CONFIG_HAS_WAKELOCK
+                if (dhd->wakelock_timeout_enable)
+                        wake_lock_timeout(&dhd->wl_rxwake,
+                                dhd->wakelock_timeout_enable * HZ);
+#endif
+                dhd->wakelock_timeout_enable = 0;
+                spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+        }
+        return ret;
+}
+
+int net_os_wake_lock_timeout(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        int ret = 0;
+
+        if (dhd)
+                ret = dhd_os_wake_lock_timeout(&dhd->pub);
+        return ret;
+}
+
+int dhd_os_wake_lock_timeout_enable(dhd_pub_t *pub, int val)
+{
+        dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+        unsigned long flags;
+
+        if (dhd) {
+                spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+                if (val > dhd->wakelock_timeout_enable)
+                        dhd->wakelock_timeout_enable = val;
+                spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+        }
+        return 0;
+}
+
+int net_os_wake_lock_timeout_enable(struct net_device *dev, int val)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        int ret = 0;
+
+        if (dhd)
+                ret = dhd_os_wake_lock_timeout_enable(&dhd->pub, val);
+        return ret;
+}
+
+int dhd_os_wake_lock(dhd_pub_t *pub)
+{
+        dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+        unsigned long flags;
+        int ret = 0;
+
+        if (dhd) {
+                spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+#ifdef CONFIG_HAS_WAKELOCK
+                if (!dhd->wakelock_counter)
+                        wake_lock(&dhd->wl_wifi);
+#endif
+                dhd->wakelock_counter++;
+                ret = dhd->wakelock_counter;
+                spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+        }
+        return ret;
+}
+
+int net_os_wake_lock(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        int ret = 0;
+
+        if (dhd)
+                ret = dhd_os_wake_lock(&dhd->pub);
+        return ret;
+}
+
+int dhd_os_wake_unlock(dhd_pub_t *pub)
+{
+        dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+        unsigned long flags;
+        int ret = 0;
+
+        dhd_os_wake_lock_timeout(pub);
+        if (dhd) {
+                spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+                if (dhd->wakelock_counter) {
+                        dhd->wakelock_counter--;
+#ifdef CONFIG_HAS_WAKELOCK
+                        if (!dhd->wakelock_counter)
+                                wake_unlock(&dhd->wl_wifi);
+#endif
+                        ret = dhd->wakelock_counter;
+                }
+                spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+        }
+        return ret;
+}
+
+int dhd_os_check_wakelock(void *dhdp)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+        dhd_pub_t *pub = (dhd_pub_t *)dhdp;
+        dhd_info_t *dhd;
+
+        if (!pub)
+                return 0;
+        dhd = (dhd_info_t *)(pub->info);
+
+        if (dhd && wake_lock_active(&dhd->wl_wifi))
+                return 1;
+#endif
+        return 0;
+}
+
+int dhd_os_check_if_up(void *dhdp)
+{
+        dhd_pub_t *pub = (dhd_pub_t *)dhdp;
+
+        if (!pub)
+                return 0;
+        return pub->up;
+}
+
+int net_os_wake_unlock(struct net_device *dev)
+{
+        dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+        int ret = 0;
+
+        if (dhd)
+                ret = dhd_os_wake_unlock(&dhd->pub);
+        return ret;
+}
+
+int dhd_ioctl_entry_local(struct net_device *net, wl_ioctl_t *ioc, int cmd)
+{
+        int ifidx;
+        int ret = 0;
+        dhd_info_t *dhd = NULL;
+
+        if (!net || !netdev_priv(net)) {
+                DHD_ERROR(("%s invalid parameter\n", __FUNCTION__));
+                return -EINVAL;
+        }
+
+        dhd = *(dhd_info_t **)netdev_priv(net);
+        ifidx = dhd_net2idx(dhd, net);
+        if (ifidx == DHD_BAD_IF) {
+                DHD_ERROR(("%s bad ifidx\n", __FUNCTION__));
+                return -ENODEV;
+        }
+
+        DHD_OS_WAKE_LOCK(&dhd->pub);
+        ret = dhd_wl_ioctl(&dhd->pub, ifidx, ioc, ioc->buf, ioc->len);
+        dhd_check_hang(net, &dhd->pub, ret);
+        DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+        return ret;
+}
+
+bool dhd_os_check_hang(dhd_pub_t *dhdp, int ifidx, int ret)
+{
+        struct net_device *net;
+
+        net = dhd_idx2net(dhdp, ifidx);
+        return dhd_check_hang(net, dhdp, ret);
+}
+
+#ifdef PROP_TXSTATUS
+extern int dhd_wlfc_interface_entry_update(void* state, ewlfc_mac_entry_action_t action, uint8 ifid,
+        uint8 iftype, uint8* ea);
+extern int dhd_wlfc_FIFOcreditmap_update(void* state, uint8* credits);
+
+int dhd_wlfc_interface_event(struct dhd_info *dhd, uint8 action, uint8 ifid, uint8 iftype,
+        uint8* ea)
+{
+        if (dhd->pub.wlfc_state == NULL)
+                return BCME_OK;
+
+        return dhd_wlfc_interface_entry_update(dhd->pub.wlfc_state, action, ifid, iftype, ea);
+}
+
+int dhd_wlfc_FIFOcreditmap_event(struct dhd_info *dhd, uint8* event_data)
+{
+        if (dhd->pub.wlfc_state == NULL)
+                return BCME_OK;
+
+        return dhd_wlfc_FIFOcreditmap_update(dhd->pub.wlfc_state, event_data);
+}
+
+int dhd_wlfc_event(struct dhd_info *dhd)
+{
+        return dhd_wlfc_enable(&dhd->pub);
+}
+#endif /* PROP_TXSTATUS */
+
+#ifdef BCMDBGFS
+
+#include <linux/debugfs.h>
+
+extern uint32 dhd_readregl(void *bp, uint32 addr);
+extern uint32 dhd_writeregl(void *bp, uint32 addr, uint32 data);
+
+typedef struct dhd_dbgfs {
+        struct dentry   *debugfs_dir;
+        struct dentry   *debugfs_mem;
+        dhd_pub_t       *dhdp;
+        uint32          size;
+} dhd_dbgfs_t;
+
+dhd_dbgfs_t g_dbgfs;
+
+static int
+dhd_dbg_state_open(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+static ssize_t
+dhd_dbg_state_read(struct file *file, char __user *ubuf,
+                       size_t count, loff_t *ppos)
+{
+        ssize_t rval;
+        uint32 tmp;
+        loff_t pos = *ppos;
+        size_t ret;
+
+        if (pos < 0)
+                return -EINVAL;
+        if (pos >= g_dbgfs.size || !count)
+                return 0;
+        if (count > g_dbgfs.size - pos)
+                count = g_dbgfs.size - pos;
+
+        /* Basically enforce aligned 4 byte reads. It's up to the user to work out the details */
+        tmp = dhd_readregl(g_dbgfs.dhdp->bus, file->f_pos & (~3));
+
+        ret = copy_to_user(ubuf, &tmp, 4);
+        if (ret == count)
+                return -EFAULT;
+
+        count -= ret;
+        *ppos = pos + count;
+        rval = count;
+
+        return rval;
+}
+
+
+static ssize_t
+dhd_debugfs_write(struct file *file, const char __user *ubuf, size_t count, loff_t *ppos)
+{
+        loff_t pos = *ppos;
+        size_t ret;
+        uint32 buf;
+
+        if (pos < 0)
+                return -EINVAL;
+        if (pos >= g_dbgfs.size || !count)
+                return 0;
+        if (count > g_dbgfs.size - pos)
+                count = g_dbgfs.size - pos;
+
+        ret = copy_from_user(&buf, ubuf, sizeof(uint32));
+        if (ret == count)
+                return -EFAULT;
+
+        /* Basically enforce aligned 4 byte writes. It's up to the user to work out the details */
+        dhd_writeregl(g_dbgfs.dhdp->bus, file->f_pos & (~3), buf);
+
+        return count;
+}
+
+
+loff_t
+dhd_debugfs_lseek(struct file *file, loff_t off, int whence)
+{
+        loff_t pos = -1;
+
+        switch (whence) {
+                case 0:
+                        pos = off;
+                        break;
+                case 1:
+                        pos = file->f_pos + off;
+                        break;
+                case 2:
+                        pos = g_dbgfs.size - off;
+        }
+        return (pos < 0 || pos > g_dbgfs.size) ? -EINVAL : (file->f_pos = pos);
+}
+
+static const struct file_operations dhd_dbg_state_ops = {
+        .read   = dhd_dbg_state_read,
+        .write  = dhd_debugfs_write,
+        .open   = dhd_dbg_state_open,
+        .llseek = dhd_debugfs_lseek
+};
+
+static void dhd_dbg_create(void)
+{
+        if (g_dbgfs.debugfs_dir) {
+                g_dbgfs.debugfs_mem = debugfs_create_file("mem", 0644, g_dbgfs.debugfs_dir,
+                        NULL, &dhd_dbg_state_ops);
+        }
+}
+
+void dhd_dbg_init(dhd_pub_t *dhdp)
+{
+        int err;
+
+        g_dbgfs.dhdp = dhdp;
+        g_dbgfs.size = 0x20000000; /* Allow access to various cores regs */
+
+        g_dbgfs.debugfs_dir = debugfs_create_dir("dhd", 0);
+        if (IS_ERR(g_dbgfs.debugfs_dir)) {
+                err = PTR_ERR(g_dbgfs.debugfs_dir);
+                g_dbgfs.debugfs_dir = NULL;
+                return;
+        }
+
+        dhd_dbg_create();
+
+        return;
+}
+
+void dhd_dbg_remove(void)
+{
+        debugfs_remove(g_dbgfs.debugfs_mem);
+        debugfs_remove(g_dbgfs.debugfs_dir);
+
+        bzero((unsigned char *) &g_dbgfs, sizeof(g_dbgfs));
+
+}
+#endif /* ifdef BCMDBGFS */
+
+#ifdef WLMEDIA_HTSF
+
+static
+void dhd_htsf_addtxts(dhd_pub_t *dhdp, void *pktbuf)
+{
+        dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+        struct sk_buff *skb;
+        uint32 htsf = 0;
+        uint16 dport = 0, oldmagic = 0xACAC;
+        char *p1;
+        htsfts_t ts;
+
+        /*  timestamp packet  */
+
+        p1 = (char*) PKTDATA(dhdp->osh, pktbuf);
+
+        if (PKTLEN(dhdp->osh, pktbuf) > HTSF_MINLEN) {
+/*              memcpy(&proto, p1+26, 4);       */
+                memcpy(&dport, p1+40, 2);
+/*      proto = ((ntoh32(proto))>> 16) & 0xFF;  */
+                dport = ntoh16(dport);
+        }
+
+        /* timestamp only if  icmp or udb iperf with port 5555 */
+/*      if (proto == 17 && dport == tsport) { */
+        if (dport >= tsport && dport <= tsport + 20) {
+
+                skb = (struct sk_buff *) pktbuf;
+
+                htsf = dhd_get_htsf(dhd, 0);
+                memset(skb->data + 44, 0, 2); /* clear checksum */
+                memcpy(skb->data+82, &oldmagic, 2);
+                memcpy(skb->data+84, &htsf, 4);
+
+                memset(&ts, 0, sizeof(htsfts_t));
+                ts.magic  = HTSFMAGIC;
+                ts.prio   = PKTPRIO(pktbuf);
+                ts.seqnum = htsf_seqnum++;
+                ts.c10    = get_cycles();
+                ts.t10    = htsf;
+                ts.endmagic = HTSFENDMAGIC;
+
+                memcpy(skb->data + HTSF_HOSTOFFSET, &ts, sizeof(ts));
+        }
+}
+
+static void dhd_dump_htsfhisto(histo_t *his, char *s)
+{
+        int pktcnt = 0, curval = 0, i;
+        for (i = 0; i < (NUMBIN-2); i++) {
+                curval += 500;
+                printf("%d ",  his->bin[i]);
+                pktcnt += his->bin[i];
+        }
+        printf(" max: %d TotPkt: %d neg: %d [%s]\n", his->bin[NUMBIN-2], pktcnt,
+                his->bin[NUMBIN-1], s);
+}
+
+static
+void sorttobin(int value, histo_t *histo)
+{
+        int i, binval = 0;
+
+        if (value < 0) {
+                histo->bin[NUMBIN-1]++;
+                return;
+        }
+        if (value > histo->bin[NUMBIN-2])  /* store the max value  */
+                histo->bin[NUMBIN-2] = value;
+
+        for (i = 0; i < (NUMBIN-2); i++) {
+                binval += 500; /* 500m s bins */
+                if (value <= binval) {
+                        histo->bin[i]++;
+                        return;
+                }
+        }
+        histo->bin[NUMBIN-3]++;
+}
+
+static
+void dhd_htsf_addrxts(dhd_pub_t *dhdp, void *pktbuf)
+{
+        dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+        struct sk_buff *skb;
+        char *p1;
+        uint16 old_magic;
+        int d1, d2, d3, end2end;
+        htsfts_t *htsf_ts;
+        uint32 htsf;
+
+        skb = PKTTONATIVE(dhdp->osh, pktbuf);
+        p1 = (char*)PKTDATA(dhdp->osh, pktbuf);
+
+        if (PKTLEN(osh, pktbuf) > HTSF_MINLEN) {
+                memcpy(&old_magic, p1+78, 2);
+                htsf_ts = (htsfts_t*) (p1 + HTSF_HOSTOFFSET - 4);
+        }
+        else
+                return;
+
+        if (htsf_ts->magic == HTSFMAGIC) {
+                htsf_ts->tE0 = dhd_get_htsf(dhd, 0);
+                htsf_ts->cE0 = get_cycles();
+        }
+
+        if (old_magic == 0xACAC) {
+
+                tspktcnt++;
+                htsf = dhd_get_htsf(dhd, 0);
+                memcpy(skb->data+92, &htsf, sizeof(uint32));
+
+                memcpy(&ts[tsidx].t1, skb->data+80, 16);
+
+                d1 = ts[tsidx].t2 - ts[tsidx].t1;
+                d2 = ts[tsidx].t3 - ts[tsidx].t2;
+                d3 = ts[tsidx].t4 - ts[tsidx].t3;
+                end2end = ts[tsidx].t4 - ts[tsidx].t1;
+
+                sorttobin(d1, &vi_d1);
+                sorttobin(d2, &vi_d2);
+                sorttobin(d3, &vi_d3);
+                sorttobin(end2end, &vi_d4);
+
+                if (end2end > 0 && end2end >  maxdelay) {
+                        maxdelay = end2end;
+                        maxdelaypktno = tspktcnt;
+                        memcpy(&maxdelayts, &ts[tsidx], 16);
+                }
+                if (++tsidx >= TSMAX)
+                        tsidx = 0;
+        }
+}
+
+uint32 dhd_get_htsf(dhd_info_t *dhd, int ifidx)
+{
+        uint32 htsf = 0, cur_cycle, delta, delta_us;
+        uint32    factor, baseval, baseval2;
+        cycles_t t;
+
+        t = get_cycles();
+        cur_cycle = t;
+
+        if (cur_cycle >  dhd->htsf.last_cycle)
+                delta = cur_cycle -  dhd->htsf.last_cycle;
+        else {
+                delta = cur_cycle + (0xFFFFFFFF -  dhd->htsf.last_cycle);
+        }
+
+        delta = delta >> 4;
+
+        if (dhd->htsf.coef) {
+                /* times ten to get the first digit */
+                factor = (dhd->htsf.coef*10 + dhd->htsf.coefdec1);
+                baseval  = (delta*10)/factor;
+                baseval2 = (delta*10)/(factor+1);
+                delta_us  = (baseval -  (((baseval - baseval2) * dhd->htsf.coefdec2)) / 10);
+                htsf = (delta_us << 4) +  dhd->htsf.last_tsf + HTSF_BUS_DELAY;
+        }
+        else {
+                DHD_ERROR(("-------dhd->htsf.coef = 0 -------\n"));
+        }
+
+        return htsf;
+}
+
+static void dhd_dump_latency(void)
+{
+        int i, max = 0;
+        int d1, d2, d3, d4, d5;
+
+        printf("T1       T2       T3       T4           d1  d2   t4-t1     i    \n");
+        for (i = 0; i < TSMAX; i++) {
+                d1 = ts[i].t2 - ts[i].t1;
+                d2 = ts[i].t3 - ts[i].t2;
+                d3 = ts[i].t4 - ts[i].t3;
+                d4 = ts[i].t4 - ts[i].t1;
+                d5 = ts[max].t4-ts[max].t1;
+                if (d4 > d5 && d4 > 0)  {
+                        max = i;
+                }
+                printf("%08X %08X %08X %08X \t%d %d %d   %d i=%d\n",
+                        ts[i].t1, ts[i].t2, ts[i].t3, ts[i].t4,
+                        d1, d2, d3, d4, i);
+        }
+
+        printf("current idx = %d \n", tsidx);
+
+        printf("Highest latency %d pkt no.%d total=%d\n", maxdelay, maxdelaypktno, tspktcnt);
+        printf("%08X %08X %08X %08X \t%d %d %d   %d\n",
+        maxdelayts.t1, maxdelayts.t2, maxdelayts.t3, maxdelayts.t4,
+        maxdelayts.t2 - maxdelayts.t1,
+        maxdelayts.t3 - maxdelayts.t2,
+        maxdelayts.t4 - maxdelayts.t3,
+        maxdelayts.t4 - maxdelayts.t1);
+}
+
+
+static int
+dhd_ioctl_htsf_get(dhd_info_t *dhd, int ifidx)
+{
+        wl_ioctl_t ioc;
+        char buf[32];
+        int ret;
+        uint32 s1, s2;
+
+        struct tsf {
+                uint32 low;
+                uint32 high;
+        } tsf_buf;
+
+        memset(&ioc, 0, sizeof(ioc));
+        memset(&tsf_buf, 0, sizeof(tsf_buf));
+
+        ioc.cmd = WLC_GET_VAR;
+        ioc.buf = buf;
+        ioc.len = (uint)sizeof(buf);
+        ioc.set = FALSE;
+
+        strcpy(buf, "tsf");
+        s1 = dhd_get_htsf(dhd, 0);
+        if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+                if (ret == -EIO) {
+                        DHD_ERROR(("%s: tsf is not supported by device\n",
+                                dhd_ifname(&dhd->pub, ifidx)));
+                        return -EOPNOTSUPP;
+                }
+                return ret;
+        }
+        s2 = dhd_get_htsf(dhd, 0);
+
+        memcpy(&tsf_buf, buf, sizeof(tsf_buf));
+        printf(" TSF_h=%04X lo=%08X Calc:htsf=%08X, coef=%d.%d%d delta=%d ",
+                tsf_buf.high, tsf_buf.low, s2, dhd->htsf.coef, dhd->htsf.coefdec1,
+                dhd->htsf.coefdec2, s2-tsf_buf.low);
+        printf("lasttsf=%08X lastcycle=%08X\n", dhd->htsf.last_tsf, dhd->htsf.last_cycle);
+        return 0;
+}
+
+void htsf_update(dhd_info_t *dhd, void *data)
+{
+        static ulong  cur_cycle = 0, prev_cycle = 0;
+        uint32 htsf, tsf_delta = 0;
+        uint32 hfactor = 0, cyc_delta, dec1 = 0, dec2, dec3, tmp;
+        ulong b, a;
+        cycles_t t;
+
+        /* cycles_t in inlcude/mips/timex.h */
+
+        t = get_cycles();
+
+        prev_cycle = cur_cycle;
+        cur_cycle = t;
+
+        if (cur_cycle > prev_cycle)
+                cyc_delta = cur_cycle - prev_cycle;
+        else {
+                b = cur_cycle;
+                a = prev_cycle;
+                cyc_delta = cur_cycle + (0xFFFFFFFF - prev_cycle);
+        }
+
+        if (data == NULL)
+                printf(" tsf update ata point er is null \n");
+
+        memcpy(&prev_tsf, &cur_tsf, sizeof(tsf_t));
+        memcpy(&cur_tsf, data, sizeof(tsf_t));
+
+        if (cur_tsf.low == 0) {
+                DHD_INFO((" ---- 0 TSF, do not update, return\n"));
+                return;
+        }
+
+        if (cur_tsf.low > prev_tsf.low)
+                tsf_delta = (cur_tsf.low - prev_tsf.low);
+        else {
+                DHD_INFO((" ---- tsf low is smaller cur_tsf= %08X, prev_tsf=%08X, \n",
+                 cur_tsf.low, prev_tsf.low));
+                if (cur_tsf.high > prev_tsf.high) {
+                        tsf_delta = cur_tsf.low + (0xFFFFFFFF - prev_tsf.low);
+                        DHD_INFO((" ---- Wrap around tsf coutner  adjusted TSF=%08X\n", tsf_delta));
+                }
+                else
+                        return; /* do not update */
+        }
+
+        if (tsf_delta)  {
+                hfactor = cyc_delta / tsf_delta;
+                tmp  =  (cyc_delta - (hfactor * tsf_delta))*10;
+                dec1 =  tmp/tsf_delta;
+                dec2 =  ((tmp - dec1*tsf_delta)*10) / tsf_delta;
+                tmp  =  (tmp   - (dec1*tsf_delta))*10;
+                dec3 =  ((tmp - dec2*tsf_delta)*10) / tsf_delta;
+
+                if (dec3 > 4) {
+                        if (dec2 == 9) {
+                                dec2 = 0;
+                                if (dec1 == 9) {
+                                        dec1 = 0;
+                                        hfactor++;
+                                }
+                                else {
+                                        dec1++;
+                                }
+                        }
+                        else
+                                dec2++;
+                }
+        }
+
+        if (hfactor) {
+                htsf = ((cyc_delta * 10)  / (hfactor*10+dec1)) + prev_tsf.low;
+                dhd->htsf.coef = hfactor;
+                dhd->htsf.last_cycle = cur_cycle;
+                dhd->htsf.last_tsf = cur_tsf.low;
+                dhd->htsf.coefdec1 = dec1;
+                dhd->htsf.coefdec2 = dec2;
+        }
+        else {
+                htsf = prev_tsf.low;
+        }
+}
+
+#endif /* WLMEDIA_HTSF */
diff --git a/drivers/net/wireless/bcmdhd/dhd_linux_mon.c b/drivers/net/wireless/bcmdhd/dhd_linux_mon.c
new file mode 100644
index 00000000000..dd9c71f75be
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_linux_mon.c
@@ -0,0 +1,393 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux monitor network interface
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ *
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_linux_mon.c,v 1.131.2.55 2011-02-09 05:31:56 Exp $
+ */
+
+#include <linux/string.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <linux/ieee80211.h>
+#include <linux/rtnetlink.h>
+#include <net/ieee80211_radiotap.h>
+
+#include <wlioctl.h>
+#include <bcmutils.h>
+#include <linux_osl.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+
+typedef enum monitor_states
+{
+        MONITOR_STATE_DEINIT = 0x0,
+        MONITOR_STATE_INIT = 0x1,
+        MONITOR_STATE_INTERFACE_ADDED = 0x2,
+        MONITOR_STATE_INTERFACE_DELETED = 0x4
+} monitor_states_t;
+extern int dhd_start_xmit(struct sk_buff *skb, struct net_device *net);
+
+/**
+ * Local declarations and defintions (not exposed)
+ */
+#define MON_PRINT(format, ...) printk("DHD-MON: %s " format, __func__, ##__VA_ARGS__)
+#define MON_TRACE MON_PRINT
+
+typedef struct monitor_interface {
+        int radiotap_enabled;
+        struct net_device* real_ndev;   /* The real interface that the monitor is on */
+        struct net_device* mon_ndev;
+} monitor_interface;
+
+typedef struct dhd_linux_monitor {
+        void *dhd_pub;
+        monitor_states_t monitor_state;
+        monitor_interface mon_if[DHD_MAX_IFS];
+        struct mutex lock;              /* lock to protect mon_if */
+} dhd_linux_monitor_t;
+
+static dhd_linux_monitor_t g_monitor;
+
+static struct net_device* lookup_real_netdev(char *name);
+static monitor_interface* ndev_to_monif(struct net_device *ndev);
+static int dhd_mon_if_open(struct net_device *ndev);
+static int dhd_mon_if_stop(struct net_device *ndev);
+static int dhd_mon_if_subif_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+static void dhd_mon_if_set_multicast_list(struct net_device *ndev);
+static int dhd_mon_if_change_mac(struct net_device *ndev, void *addr);
+
+static const struct net_device_ops dhd_mon_if_ops = {
+        .ndo_open               = dhd_mon_if_open,
+        .ndo_stop               = dhd_mon_if_stop,
+        .ndo_start_xmit         = dhd_mon_if_subif_start_xmit,
+        .ndo_set_multicast_list = dhd_mon_if_set_multicast_list,
+        .ndo_set_mac_address    = dhd_mon_if_change_mac,
+};
+
+/**
+ * Local static function defintions
+ */
+
+/* Look up dhd's net device table to find a match (e.g. interface "eth0" is a match for "mon.eth0"
+ * "p2p-eth0-0" is a match for "mon.p2p-eth0-0")
+ */
+static struct net_device* lookup_real_netdev(char *name)
+{
+        int i;
+        int last_name_len = 0;
+        struct net_device *ndev;
+        struct net_device *ndev_found = NULL;
+
+        /* We want to find interface "p2p-eth0-0" for monitor interface "mon.p2p-eth0-0", so
+         * we skip "eth0" even if "mon.p2p-eth0-0" contains "eth0"
+         */
+        for (i = 0; i < DHD_MAX_IFS; i++) {
+                ndev = dhd_idx2net(g_monitor.dhd_pub, i);
+                if (ndev && strstr(name, ndev->name)) {
+                        if (strlen(ndev->name) > last_name_len) {
+                                ndev_found = ndev;
+                                last_name_len = strlen(ndev->name);
+                        }
+                }
+        }
+
+        return ndev_found;
+}
+
+static monitor_interface* ndev_to_monif(struct net_device *ndev)
+{
+        int i;
+
+        for (i = 0; i < DHD_MAX_IFS; i++) {
+                if (g_monitor.mon_if[i].mon_ndev == ndev)
+                        return &g_monitor.mon_if[i];
+        }
+
+        return NULL;
+}
+
+static int dhd_mon_if_open(struct net_device *ndev)
+{
+        int ret = 0;
+
+        MON_PRINT("enter\n");
+        return ret;
+}
+
+static int dhd_mon_if_stop(struct net_device *ndev)
+{
+        int ret = 0;
+
+        MON_PRINT("enter\n");
+        return ret;
+}
+
+static int dhd_mon_if_subif_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+        int ret = 0;
+        int rtap_len;
+        int qos_len = 0;
+        int dot11_hdr_len = 24;
+        int snap_len = 6;
+        unsigned char *pdata;
+        unsigned short frame_ctl;
+        unsigned char src_mac_addr[6];
+        unsigned char dst_mac_addr[6];
+        struct ieee80211_hdr *dot11_hdr;
+        struct ieee80211_radiotap_header *rtap_hdr;
+        monitor_interface* mon_if;
+
+        MON_PRINT("enter\n");
+
+        mon_if = ndev_to_monif(ndev);
+        if (mon_if == NULL || mon_if->real_ndev == NULL) {
+                MON_PRINT(" cannot find matched net dev, skip the packet\n");
+                goto fail;
+        }
+
+        if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
+                goto fail;
+
+        rtap_hdr = (struct ieee80211_radiotap_header *)skb->data;
+        if (unlikely(rtap_hdr->it_version))
+                goto fail;
+
+        rtap_len = ieee80211_get_radiotap_len(skb->data);
+        if (unlikely(skb->len < rtap_len))
+                goto fail;
+
+        MON_PRINT("radiotap len (should be 14): %d\n", rtap_len);
+
+        /* Skip the ratio tap header */
+        skb_pull(skb, rtap_len);
+
+        dot11_hdr = (struct ieee80211_hdr *)skb->data;
+        frame_ctl = le16_to_cpu(dot11_hdr->frame_control);
+        /* Check if the QoS bit is set */
+        if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
+                /* Check if this ia a Wireless Distribution System (WDS) frame
+                 * which has 4 MAC addresses
+                 */
+                if (dot11_hdr->frame_control & 0x0080)
+                        qos_len = 2;
+                if ((dot11_hdr->frame_control & 0x0300) == 0x0300)
+                        dot11_hdr_len += 6;
+
+                memcpy(dst_mac_addr, dot11_hdr->addr1, sizeof(dst_mac_addr));
+                memcpy(src_mac_addr, dot11_hdr->addr2, sizeof(src_mac_addr));
+
+                /* Skip the 802.11 header, QoS (if any) and SNAP, but leave spaces for
+                 * for two MAC addresses
+                 */
+                skb_pull(skb, dot11_hdr_len + qos_len + snap_len - sizeof(src_mac_addr) * 2);
+                pdata = (unsigned char*)skb->data;
+                memcpy(pdata, dst_mac_addr, sizeof(dst_mac_addr));
+                memcpy(pdata + sizeof(dst_mac_addr), src_mac_addr, sizeof(src_mac_addr));
+
+                MON_PRINT("if name: %s, matched if name %s\n", ndev->name, mon_if->real_ndev->name);
+
+                /* Use the real net device to transmit the packet */
+                ret = dhd_start_xmit(skb, mon_if->real_ndev);
+
+                return ret;
+        }
+fail:
+        dev_kfree_skb(skb);
+        return 0;
+}
+
+static void dhd_mon_if_set_multicast_list(struct net_device *ndev)
+{
+        monitor_interface* mon_if;
+
+        mon_if = ndev_to_monif(ndev);
+        if (mon_if == NULL || mon_if->real_ndev == NULL) {
+                MON_PRINT(" cannot find matched net dev, skip the packet\n");
+        }
+
+        MON_PRINT("enter, if name: %s, matched if name %s\n", ndev->name, mon_if->real_ndev->name);
+}
+
+static int dhd_mon_if_change_mac(struct net_device *ndev, void *addr)
+{
+        int ret = 0;
+        monitor_interface* mon_if;
+
+        mon_if = ndev_to_monif(ndev);
+        if (mon_if == NULL || mon_if->real_ndev == NULL) {
+                MON_PRINT(" cannot find matched net dev, skip the packet\n");
+        }
+
+        MON_PRINT("enter, if name: %s, matched if name %s\n", ndev->name, mon_if->real_ndev->name);
+        return ret;
+}
+
+/**
+ * Global function definitions (declared in dhd_linux_mon.h)
+ */
+
+int dhd_add_monitor(char *name, struct net_device **new_ndev)
+{
+        int i;
+        int idx = -1;
+        int ret = 0;
+        struct net_device* ndev = NULL;
+        dhd_linux_monitor_t **dhd_mon;
+
+        mutex_lock(&g_monitor.lock);
+
+        MON_TRACE("enter, if name: %s\n", name);
+        if (!name || !new_ndev) {
+                MON_PRINT("invalid parameters\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        /*
+         * Find a vacancy
+         */
+        for (i = 0; i < DHD_MAX_IFS; i++)
+                if (g_monitor.mon_if[i].mon_ndev == NULL) {
+                        idx = i;
+                        break;
+                }
+        if (idx == -1) {
+                MON_PRINT("exceeds maximum interfaces\n");
+                ret = -EFAULT;
+                goto out;
+        }
+
+        ndev = alloc_etherdev(sizeof(dhd_linux_monitor_t*));
+        if (!ndev) {
+                MON_PRINT("failed to allocate memory\n");
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ndev->type = ARPHRD_IEEE80211_RADIOTAP;
+        strncpy(ndev->name, name, IFNAMSIZ);
+        ndev->name[IFNAMSIZ - 1] = 0;
+        ndev->netdev_ops = &dhd_mon_if_ops;
+
+        ret = register_netdevice(ndev);
+        if (ret) {
+                MON_PRINT(" register_netdevice failed (%d)\n", ret);
+                goto out;
+        }
+
+        *new_ndev = ndev;
+        g_monitor.mon_if[idx].radiotap_enabled = TRUE;
+        g_monitor.mon_if[idx].mon_ndev = ndev;
+        g_monitor.mon_if[idx].real_ndev = lookup_real_netdev(name);
+        dhd_mon = (dhd_linux_monitor_t **)netdev_priv(ndev);
+        *dhd_mon = &g_monitor;
+        g_monitor.monitor_state = MONITOR_STATE_INTERFACE_ADDED;
+        MON_PRINT("net device returned: 0x%p\n", ndev);
+        MON_PRINT("found a matched net device, name %s\n", g_monitor.mon_if[idx].real_ndev->name);
+
+out:
+        if (ret && ndev)
+                free_netdev(ndev);
+
+        mutex_unlock(&g_monitor.lock);
+        return ret;
+
+}
+
+int dhd_del_monitor(struct net_device *ndev)
+{
+        int i;
+        bool rollback_lock = false;
+        if (!ndev)
+                return -EINVAL;
+        mutex_lock(&g_monitor.lock);
+        for (i = 0; i < DHD_MAX_IFS; i++) {
+                if (g_monitor.mon_if[i].mon_ndev == ndev ||
+                        g_monitor.mon_if[i].real_ndev == ndev) {
+                        g_monitor.mon_if[i].real_ndev = NULL;
+                        if (rtnl_is_locked()) {
+                                rtnl_unlock();
+                                rollback_lock = true;
+                        }
+                        unregister_netdev(g_monitor.mon_if[i].mon_ndev);
+                        free_netdev(g_monitor.mon_if[i].mon_ndev);
+                        g_monitor.mon_if[i].mon_ndev = NULL;
+                        g_monitor.monitor_state = MONITOR_STATE_INTERFACE_DELETED;
+                        break;
+                }
+        }
+        if (rollback_lock) {
+                rtnl_lock();
+                rollback_lock = false;
+        }
+
+        if (g_monitor.monitor_state !=
+        MONITOR_STATE_INTERFACE_DELETED)
+                MON_PRINT("interface not found in monitor IF array, is this a monitor IF? 0x%p\n",
+                        ndev);
+        mutex_unlock(&g_monitor.lock);
+
+        return 0;
+}
+
+int dhd_monitor_init(void *dhd_pub)
+{
+        if (g_monitor.monitor_state == MONITOR_STATE_DEINIT) {
+                g_monitor.dhd_pub = dhd_pub;
+                mutex_init(&g_monitor.lock);
+                g_monitor.monitor_state = MONITOR_STATE_INIT;
+        }
+        return 0;
+}
+
+int dhd_monitor_uninit(void)
+{
+        int i;
+        struct net_device *ndev;
+        bool rollback_lock = false;
+        mutex_lock(&g_monitor.lock);
+        if (g_monitor.monitor_state != MONITOR_STATE_DEINIT) {
+                for (i = 0; i < DHD_MAX_IFS; i++) {
+                        ndev = g_monitor.mon_if[i].mon_ndev;
+                        if (ndev) {
+                                if (rtnl_is_locked()) {
+                                        rtnl_unlock();
+                                        rollback_lock = true;
+                                }
+                                unregister_netdev(ndev);
+                                free_netdev(ndev);
+                                g_monitor.mon_if[i].real_ndev = NULL;
+                                g_monitor.mon_if[i].mon_ndev = NULL;
+                                if (rollback_lock) {
+                                        rtnl_lock();
+                                        rollback_lock = false;
+                                }
+                        }
+                }
+                g_monitor.monitor_state = MONITOR_STATE_DEINIT;
+        }
+        mutex_unlock(&g_monitor.lock);
+        return 0;
+}
diff --git a/drivers/net/wireless/bcmdhd/dhd_linux_sched.c b/drivers/net/wireless/bcmdhd/dhd_linux_sched.c
new file mode 100644
index 00000000000..aadd122f5b0
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_linux_sched.c
@@ -0,0 +1,39 @@
+/*
+ * Expose some of the kernel scheduler routines
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_linux_sched.c,v 1.3 2009-04-10 04:14:49 Exp $
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <typedefs.h>
+#include <linuxver.h>
+
+int setScheduler(struct task_struct *p, int policy, struct sched_param *param)
+{
+        int rc = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+        rc = sched_setscheduler(p, policy, param);
+#endif /* LinuxVer */
+        return rc;
+}
diff --git a/drivers/net/wireless/bcmdhd/dhd_proto.h b/drivers/net/wireless/bcmdhd/dhd_proto.h
new file mode 100644
index 00000000000..e0a54ad0269
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_proto.h
@@ -0,0 +1,105 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_proto.h,v 1.8.10.6 2010-12-22 23:47:24 Exp $
+ */
+
+#ifndef _dhd_proto_h_
+#define _dhd_proto_h_
+
+#include <dhdioctl.h>
+#include <wlioctl.h>
+
+#ifndef IOCTL_RESP_TIMEOUT
+#define IOCTL_RESP_TIMEOUT  20000 /* In milli second */
+#endif
+
+/*
+ * Exported from the dhd protocol module (dhd_cdc, dhd_rndis)
+ */
+
+/* Linkage, sets prot link and updates hdrlen in pub */
+extern int dhd_prot_attach(dhd_pub_t *dhdp);
+
+/* Unlink, frees allocated protocol memory (including dhd_prot) */
+extern void dhd_prot_detach(dhd_pub_t *dhdp);
+
+/* Initialize protocol: sync w/dongle state.
+ * Sets dongle media info (iswl, drv_version, mac address).
+ */
+extern int dhd_prot_init(dhd_pub_t *dhdp);
+
+/* Stop protocol: sync w/dongle state. */
+extern void dhd_prot_stop(dhd_pub_t *dhdp);
+
+/* Add any protocol-specific data header.
+ * Caller must reserve prot_hdrlen prepend space.
+ */
+extern void dhd_prot_hdrpush(dhd_pub_t *, int ifidx, void *txp);
+
+/* Remove any protocol-specific data header. */
+extern int dhd_prot_hdrpull(dhd_pub_t *, int *ifidx, void *rxp);
+
+/* Use protocol to issue ioctl to dongle */
+extern int dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len);
+
+/* Handles a protocol control response asynchronously */
+extern int dhd_prot_ctl_complete(dhd_pub_t *dhd);
+
+/* Check for and handle local prot-specific iovar commands */
+extern int dhd_prot_iovar_op(dhd_pub_t *dhdp, const char *name,
+                             void *params, int plen, void *arg, int len, bool set);
+
+/* Add prot dump output to a buffer */
+extern void dhd_prot_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+
+/* Update local copy of dongle statistics */
+extern void dhd_prot_dstats(dhd_pub_t *dhdp);
+
+extern int dhd_ioctl(dhd_pub_t * dhd_pub, dhd_ioctl_t *ioc, void * buf, uint buflen);
+
+extern int dhd_preinit_ioctls(dhd_pub_t *dhd);
+
+#ifdef PROP_TXSTATUS
+extern int dhd_wlfc_enque_sendq(void* state, int prec, void* p);
+extern int dhd_wlfc_commit_packets(void* state, f_commitpkt_t fcommit, void* commit_ctx);
+extern void dhd_wlfc_cleanup(dhd_pub_t *dhd);
+#endif /* PROP_TXSTATUS */
+
+/********************************
+ * For version-string expansion *
+ */
+#if defined(BDC)
+#define DHD_PROTOCOL "bdc"
+#elif defined(CDC)
+#define DHD_PROTOCOL "cdc"
+#elif defined(RNDIS)
+#define DHD_PROTOCOL "rndis"
+#else
+#define DHD_PROTOCOL "unknown"
+#endif /* proto */
+
+#endif /* _dhd_proto_h_ */
diff --git a/drivers/net/wireless/bcmdhd/dhd_sdio.c b/drivers/net/wireless/bcmdhd/dhd_sdio.c
new file mode 100644
index 00000000000..57aee570545
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_sdio.c
@@ -0,0 +1,6289 @@
+/*
+ * DHD Bus Module for SDIO
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_sdio.c 288105 2011-10-06 01:58:02Z $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmsdh.h>
+
+#ifdef BCMEMBEDIMAGE
+#include BCMEMBEDIMAGE
+#endif /* BCMEMBEDIMAGE */
+
+#include <bcmdefs.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+
+#include <siutils.h>
+#include <hndpmu.h>
+#include <hndsoc.h>
+#include <bcmsdpcm.h>
+#if defined(DHD_DEBUG)
+#include <hndrte_armtrap.h>
+#include <hndrte_cons.h>
+#endif /* defined(DHD_DEBUG) */
+#include <sbchipc.h>
+#include <sbhnddma.h>
+
+#include <sdio.h>
+#include <sbsdio.h>
+#include <sbsdpcmdev.h>
+#include <bcmsdpcm.h>
+#include <bcmsdbus.h>
+
+#include <proto/ethernet.h>
+#include <proto/802.1d.h>
+#include <proto/802.11.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <sdiovar.h>
+
+#ifndef DHDSDIO_MEM_DUMP_FNAME
+#define DHDSDIO_MEM_DUMP_FNAME         "mem_dump"
+#endif
+
+#define QLEN            256     /* bulk rx and tx queue lengths */
+#define FCHI            (QLEN - 10)
+#define FCLOW           (FCHI / 2)
+#define PRIOMASK        7
+
+#define TXRETRIES       2       /* # of retries for tx frames */
+
+#define DHD_RXBOUND     50      /* Default for max rx frames in one scheduling */
+
+#define DHD_TXBOUND     20      /* Default for max tx frames in one scheduling */
+
+#define DHD_TXMINMAX    1       /* Max tx frames if rx still pending */
+
+#define MEMBLOCK        2048            /* Block size used for downloading of dongle image */
+#define MAX_NVRAMBUF_SIZE       4096    /* max nvram buf size */
+#define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold biggest possible glom */
+
+#ifndef DHD_FIRSTREAD
+#define DHD_FIRSTREAD   32
+#endif
+#if !ISPOWEROF2(DHD_FIRSTREAD)
+#error DHD_FIRSTREAD is not a power of 2!
+#endif
+
+/* Total length of frame header for dongle protocol */
+#define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
+#ifdef SDTEST
+#define SDPCM_RESERVE   (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN)
+#else
+#define SDPCM_RESERVE   (SDPCM_HDRLEN + DHD_SDALIGN)
+#endif
+
+/* Space for header read, limit for data packets */
+#ifndef MAX_HDR_READ
+#define MAX_HDR_READ    32
+#endif
+#if !ISPOWEROF2(MAX_HDR_READ)
+#error MAX_HDR_READ is not a power of 2!
+#endif
+
+#define MAX_RX_DATASZ   2048
+
+/* Maximum milliseconds to wait for F2 to come up */
+#define DHD_WAIT_F2RDY  3000
+
+/* Bump up limit on waiting for HT to account for first startup;
+ * if the image is doing a CRC calculation before programming the PMU
+ * for HT availability, it could take a couple hundred ms more, so
+ * max out at a 1 second (1000000us).
+ */
+#if (PMU_MAX_TRANSITION_DLY <= 1000000)
+#undef PMU_MAX_TRANSITION_DLY
+#define PMU_MAX_TRANSITION_DLY 1000000
+#endif
+
+/* Value for ChipClockCSR during initial setup */
+#define DHD_INIT_CLKCTL1        (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ)
+#define DHD_INIT_CLKCTL2        (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP)
+
+/* Flags for SDH calls */
+#define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
+
+/* Packet free applicable unconditionally for sdio and sdspi.  Conditional if
+ * bufpool was present for gspi bus.
+ */
+#define PKTFREE2()              if ((bus->bus != SPI_BUS) || bus->usebufpool) \
+                                        PKTFREE(bus->dhd->osh, pkt, FALSE);
+DHD_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
+#if defined(OOB_INTR_ONLY)
+extern void bcmsdh_set_irq(int flag);
+#endif /* defined(OOB_INTR_ONLY) */
+#ifdef PROP_TXSTATUS
+extern void dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success);
+#endif
+
+#ifdef DHD_DEBUG
+/* Device console log buffer state */
+#define CONSOLE_LINE_MAX        192
+#define CONSOLE_BUFFER_MAX      2024
+typedef struct dhd_console {
+        uint            count;                  /* Poll interval msec counter */
+        uint            log_addr;               /* Log struct address (fixed) */
+        hndrte_log_t    log;                    /* Log struct (host copy) */
+        uint            bufsize;                /* Size of log buffer */
+        uint8           *buf;                   /* Log buffer (host copy) */
+        uint            last;                   /* Last buffer read index */
+} dhd_console_t;
+#endif /* DHD_DEBUG */
+
+/* Private data for SDIO bus interaction */
+typedef struct dhd_bus {
+        dhd_pub_t       *dhd;
+
+        bcmsdh_info_t   *sdh;                   /* Handle for BCMSDH calls */
+        si_t            *sih;                   /* Handle for SI calls */
+        char            *vars;                  /* Variables (from CIS and/or other) */
+        uint            varsz;                  /* Size of variables buffer */
+        uint32          sbaddr;                 /* Current SB window pointer (-1, invalid) */
+
+        sdpcmd_regs_t   *regs;                  /* Registers for SDIO core */
+        uint            sdpcmrev;               /* SDIO core revision */
+        uint            armrev;                 /* CPU core revision */
+        uint            ramrev;                 /* SOCRAM core revision */
+        uint32          ramsize;                /* Size of RAM in SOCRAM (bytes) */
+        uint32          orig_ramsize;           /* Size of RAM in SOCRAM (bytes) */
+
+        uint32          bus;                    /* gSPI or SDIO bus */
+        uint32          hostintmask;            /* Copy of Host Interrupt Mask */
+        uint32          intstatus;              /* Intstatus bits (events) pending */
+        bool            dpc_sched;              /* Indicates DPC schedule (intrpt rcvd) */
+        bool            fcstate;                /* State of dongle flow-control */
+
+        uint16          cl_devid;               /* cached devid for dhdsdio_probe_attach() */
+        char            *fw_path; /* module_param: path to firmware image */
+        char            *nv_path; /* module_param: path to nvram vars file */
+        const char      *nvram_params;          /* user specified nvram params. */
+
+        uint            blocksize;              /* Block size of SDIO transfers */
+        uint            roundup;                /* Max roundup limit */
+
+        struct pktq     txq;                    /* Queue length used for flow-control */
+        uint8           flowcontrol;            /* per prio flow control bitmask */
+        uint8           tx_seq;                 /* Transmit sequence number (next) */
+        uint8           tx_max;                 /* Maximum transmit sequence allowed */
+
+        uint8           hdrbuf[MAX_HDR_READ + DHD_SDALIGN];
+        uint8           *rxhdr;                 /* Header of current rx frame (in hdrbuf) */
+        uint16          nextlen;                /* Next Read Len from last header */
+        uint8           rx_seq;                 /* Receive sequence number (expected) */
+        bool            rxskip;                 /* Skip receive (awaiting NAK ACK) */
+
+        void            *glomd;                 /* Packet containing glomming descriptor */
+        void            *glom;                  /* Packet chain for glommed superframe */
+        uint            glomerr;                /* Glom packet read errors */
+
+        uint8           *rxbuf;                 /* Buffer for receiving control packets */
+        uint            rxblen;                 /* Allocated length of rxbuf */
+        uint8           *rxctl;                 /* Aligned pointer into rxbuf */
+        uint8           *databuf;               /* Buffer for receiving big glom packet */
+        uint8           *dataptr;               /* Aligned pointer into databuf */
+        uint            rxlen;                  /* Length of valid data in buffer */
+
+        uint8           sdpcm_ver;              /* Bus protocol reported by dongle */
+
+        bool            intr;                   /* Use interrupts */
+        bool            poll;                   /* Use polling */
+        bool            ipend;                  /* Device interrupt is pending */
+        bool            intdis;                 /* Interrupts disabled by isr */
+        uint            intrcount;              /* Count of device interrupt callbacks */
+        uint            lastintrs;              /* Count as of last watchdog timer */
+        uint            spurious;               /* Count of spurious interrupts */
+        uint            pollrate;               /* Ticks between device polls */
+        uint            polltick;               /* Tick counter */
+        uint            pollcnt;                /* Count of active polls */
+
+#ifdef DHD_DEBUG
+        dhd_console_t   console;                /* Console output polling support */
+        uint            console_addr;           /* Console address from shared struct */
+#endif /* DHD_DEBUG */
+
+        uint            regfails;               /* Count of R_REG/W_REG failures */
+
+        uint            clkstate;               /* State of sd and backplane clock(s) */
+        bool            activity;               /* Activity flag for clock down */
+        int32           idletime;               /* Control for activity timeout */
+        int32           idlecount;              /* Activity timeout counter */
+        int32           idleclock;              /* How to set bus driver when idle */
+        int32           sd_divisor;             /* Speed control to bus driver */
+        int32           sd_mode;                /* Mode control to bus driver */
+        int32           sd_rxchain;             /* If bcmsdh api accepts PKT chains */
+        bool            use_rxchain;            /* If dhd should use PKT chains */
+        bool            sleeping;               /* Is SDIO bus sleeping? */
+        bool            rxflow_mode;    /* Rx flow control mode */
+        bool            rxflow;                 /* Is rx flow control on */
+        uint            prev_rxlim_hit;         /* Is prev rx limit exceeded (per dpc schedule) */
+        bool            alp_only;               /* Don't use HT clock (ALP only) */
+        /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
+        bool            usebufpool;
+
+#ifdef SDTEST
+        /* external loopback */
+        bool            ext_loop;
+        uint8           loopid;
+
+        /* pktgen configuration */
+        uint            pktgen_freq;            /* Ticks between bursts */
+        uint            pktgen_count;           /* Packets to send each burst */
+        uint            pktgen_print;           /* Bursts between count displays */
+        uint            pktgen_total;           /* Stop after this many */
+        uint            pktgen_minlen;          /* Minimum packet data len */
+        uint            pktgen_maxlen;          /* Maximum packet data len */
+        uint            pktgen_mode;            /* Configured mode: tx, rx, or echo */
+        uint            pktgen_stop;            /* Number of tx failures causing stop */
+
+        /* active pktgen fields */
+        uint            pktgen_tick;            /* Tick counter for bursts */
+        uint            pktgen_ptick;           /* Burst counter for printing */
+        uint            pktgen_sent;            /* Number of test packets generated */
+        uint            pktgen_rcvd;            /* Number of test packets received */
+        uint            pktgen_fail;            /* Number of failed send attempts */
+        uint16          pktgen_len;             /* Length of next packet to send */
+#define PKTGEN_RCV_IDLE     (0)
+#define PKTGEN_RCV_ONGOING  (1)
+        uint16          pktgen_rcv_state;               /* receive state */
+        uint            pktgen_rcvd_rcvsession; /* test pkts rcvd per rcv session. */
+#endif /* SDTEST */
+
+        /* Some additional counters */
+        uint            tx_sderrs;              /* Count of tx attempts with sd errors */
+        uint            fcqueued;               /* Tx packets that got queued */
+        uint            rxrtx;                  /* Count of rtx requests (NAK to dongle) */
+        uint            rx_toolong;             /* Receive frames too long to receive */
+        uint            rxc_errors;             /* SDIO errors when reading control frames */
+        uint            rx_hdrfail;             /* SDIO errors on header reads */
+        uint            rx_badhdr;              /* Bad received headers (roosync?) */
+        uint            rx_badseq;              /* Mismatched rx sequence number */
+        uint            fc_rcvd;                /* Number of flow-control events received */
+        uint            fc_xoff;                /* Number which turned on flow-control */
+        uint            fc_xon;                 /* Number which turned off flow-control */
+        uint            rxglomfail;             /* Failed deglom attempts */
+        uint            rxglomframes;           /* Number of glom frames (superframes) */
+        uint            rxglompkts;             /* Number of packets from glom frames */
+        uint            f2rxhdrs;               /* Number of header reads */
+        uint            f2rxdata;               /* Number of frame data reads */
+        uint            f2txdata;               /* Number of f2 frame writes */
+        uint            f1regdata;              /* Number of f1 register accesses */
+
+        uint8           *ctrl_frame_buf;
+        uint32          ctrl_frame_len;
+        bool            ctrl_frame_stat;
+        uint32          rxint_mode;     /* rx interrupt mode */
+} dhd_bus_t;
+
+/* clkstate */
+#define CLK_NONE        0
+#define CLK_SDONLY      1
+#define CLK_PENDING     2       /* Not used yet */
+#define CLK_AVAIL       3
+
+#define DHD_NOPMU(dhd)  (FALSE)
+
+#ifdef DHD_DEBUG
+static int qcount[NUMPRIO];
+static int tx_packets[NUMPRIO];
+#endif /* DHD_DEBUG */
+
+/* Deferred transmit */
+const uint dhd_deferred_tx = 1;
+
+extern uint dhd_watchdog_ms;
+extern void dhd_os_wd_timer(void *bus, uint wdtick);
+
+/* Tx/Rx bounds */
+uint dhd_txbound;
+uint dhd_rxbound;
+uint dhd_txminmax = DHD_TXMINMAX;
+
+/* override the RAM size if possible */
+#define DONGLE_MIN_MEMSIZE (128 *1024)
+int dhd_dongle_memsize;
+
+static bool dhd_doflow;
+static bool dhd_alignctl;
+
+static bool sd1idle;
+
+static bool retrydata;
+#define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
+
+static const uint watermark = 8;
+static const uint firstread = DHD_FIRSTREAD;
+
+#define HDATLEN (firstread - (SDPCM_HDRLEN))
+
+/* Retry count for register access failures */
+static const uint retry_limit = 2;
+
+/* Force even SD lengths (some host controllers mess up on odd bytes) */
+static bool forcealign;
+
+/* Flag to indicate if we should download firmware on driver load */
+uint dhd_download_fw_on_driverload = TRUE;
+
+#define ALIGNMENT  4
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+extern void bcmsdh_enable_hw_oob_intr(void *sdh, bool enable);
+#endif
+
+#if defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD)
+#error OOB_INTR_ONLY is NOT working with SDIO_ISR_THREAD
+#endif /* defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD) */
+#define PKTALIGN(osh, p, len, align)                                    \
+        do {                                                            \
+                uint datalign;                                          \
+                datalign = (uintptr)PKTDATA((osh), (p));                \
+                datalign = ROUNDUP(datalign, (align)) - datalign;       \
+                ASSERT(datalign < (align));                             \
+                ASSERT(PKTLEN((osh), (p)) >= ((len) + datalign));       \
+                if (datalign)                                           \
+                        PKTPULL((osh), (p), datalign);                  \
+                PKTSETLEN((osh), (p), (len));                           \
+        } while (0)
+
+/* Limit on rounding up frames */
+static const uint max_roundup = 512;
+
+/* Try doing readahead */
+static bool dhd_readahead;
+
+/* To check if there's window offered */
+#define DATAOK(bus) \
+        (((uint8)(bus->tx_max - bus->tx_seq) > 2) && \
+        (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
+
+/* To check if there's window offered for ctrl frame */
+#define TXCTLOK(bus) \
+        (((uint8)(bus->tx_max - bus->tx_seq) != 0) && \
+        (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
+
+/* Macros to get register read/write status */
+/* NOTE: these assume a local dhdsdio_bus_t *bus! */
+#define R_SDREG(regvar, regaddr, retryvar) \
+do { \
+        retryvar = 0; \
+        do { \
+                regvar = R_REG(bus->dhd->osh, regaddr); \
+        } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
+        if (retryvar) { \
+                bus->regfails += (retryvar-1); \
+                if (retryvar > retry_limit) { \
+                        DHD_ERROR(("%s: FAILED" #regvar "READ, LINE %d\n", \
+                                   __FUNCTION__, __LINE__)); \
+                        regvar = 0; \
+                } \
+        } \
+} while (0)
+
+#define W_SDREG(regval, regaddr, retryvar) \
+do { \
+        retryvar = 0; \
+        do { \
+                W_REG(bus->dhd->osh, regaddr, regval); \
+        } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
+        if (retryvar) { \
+                bus->regfails += (retryvar-1); \
+                if (retryvar > retry_limit) \
+                        DHD_ERROR(("%s: FAILED REGISTER WRITE, LINE %d\n", \
+                                   __FUNCTION__, __LINE__)); \
+        } \
+} while (0)
+
+#define BUS_WAKE(bus) \
+        do { \
+                if ((bus)->sleeping) \
+                        dhdsdio_bussleep((bus), FALSE); \
+        } while (0);
+
+/*
+ * pktavail interrupts from dongle to host can be managed in 3 different ways
+ * whenever there is a packet available in dongle to transmit to host.
+ *
+ * Mode 0:      Dongle writes the software host mailbox and host is interrupted.
+ * Mode 1:      (sdiod core rev >= 4)
+ *              Device sets a new bit in the intstatus whenever there is a packet
+ *              available in fifo.  Host can't clear this specific status bit until all the
+ *              packets are read from the FIFO.  No need to ack dongle intstatus.
+ * Mode 2:      (sdiod core rev >= 4)
+ *              Device sets a bit in the intstatus, and host acks this by writing
+ *              one to this bit.  Dongle won't generate anymore packet interrupts
+ *              until host reads all the packets from the dongle and reads a zero to
+ *              figure that there are no more packets.  No need to disable host ints.
+ *              Need to ack the intstatus.
+ */
+
+#define SDIO_DEVICE_HMB_RXINT           0       /* default old way */
+#define SDIO_DEVICE_RXDATAINT_MODE_0    1       /* from sdiod rev 4 */
+#define SDIO_DEVICE_RXDATAINT_MODE_1    2       /* from sdiod rev 4 */
+
+
+#define FRAME_AVAIL_MASK(bus)   \
+        ((bus->rxint_mode == SDIO_DEVICE_HMB_RXINT) ? I_HMB_FRAME_IND : I_XMTDATA_AVAIL)
+
+#define DHD_BUS                 SDIO_BUS
+
+#define PKT_AVAILABLE(bus, intstatus)   ((intstatus) & (FRAME_AVAIL_MASK(bus)))
+
+#define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
+
+#define GSPI_PR55150_BAILOUT
+
+
+#ifdef SDTEST
+static void dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq);
+static void dhdsdio_sdtest_set(dhd_bus_t *bus, uint8 count);
+#endif
+
+#ifdef DHD_DEBUG
+static int dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size);
+static int dhd_serialconsole(dhd_bus_t *bus, bool get, bool enable, int *bcmerror);
+#endif /* DHD_DEBUG */
+
+static int dhdsdio_download_state(dhd_bus_t *bus, bool enter);
+
+static void dhdsdio_release(dhd_bus_t *bus, osl_t *osh);
+static void dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh);
+static void dhdsdio_disconnect(void *ptr);
+static bool dhdsdio_chipmatch(uint16 chipid);
+static bool dhdsdio_probe_attach(dhd_bus_t *bus, osl_t *osh, void *sdh,
+                                 void * regsva, uint16  devid);
+static bool dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static bool dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static void dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation,
+        bool reset_flag);
+
+static void dhd_dongle_setmemsize(struct dhd_bus *bus, int mem_size);
+static int dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
+        uint8 *buf, uint nbytes,
+        void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
+static int dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
+        uint8 *buf, uint nbytes,
+        void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
+
+static bool dhdsdio_download_firmware(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static int _dhdsdio_download_firmware(dhd_bus_t *bus);
+
+static int dhdsdio_download_code_file(dhd_bus_t *bus, char *image_path);
+static int dhdsdio_download_nvram(dhd_bus_t *bus);
+#ifdef BCMEMBEDIMAGE
+static int dhdsdio_download_code_array(dhd_bus_t *bus);
+#endif
+
+#ifdef WLMEDIA_HTSF
+#include <htsf.h>
+extern uint32 dhd_get_htsf(void *dhd, int ifidx);
+#endif /* WLMEDIA_HTSF */
+
+static void
+dhd_dongle_setmemsize(struct dhd_bus *bus, int mem_size)
+{
+        int32 min_size =  DONGLE_MIN_MEMSIZE;
+        /* Restrict the memsize to user specified limit */
+        DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d\n",
+                dhd_dongle_memsize, min_size));
+        if ((dhd_dongle_memsize > min_size) &&
+                (dhd_dongle_memsize < (int32)bus->orig_ramsize))
+                bus->ramsize = dhd_dongle_memsize;
+}
+
+static int
+dhdsdio_set_siaddr_window(dhd_bus_t *bus, uint32 address)
+{
+        int err = 0;
+        bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+                         (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+        if (!err)
+                bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
+                                 (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
+        if (!err)
+                bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
+                                 (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
+        return err;
+}
+
+
+/* Turn backplane clock on or off */
+static int
+dhdsdio_htclk(dhd_bus_t *bus, bool on, bool pendok)
+{
+        int err;
+        uint8 clkctl, clkreq, devctl;
+        bcmsdh_info_t *sdh;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#if defined(OOB_INTR_ONLY)
+        pendok = FALSE;
+#endif
+        clkctl = 0;
+        sdh = bus->sdh;
+
+
+        if (on) {
+                /* Request HT Avail */
+                clkreq = bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
+
+
+
+
+                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+                if (err) {
+                        DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
+                        return BCME_ERROR;
+                }
+
+                if (pendok &&
+                    ((bus->sih->buscoretype == PCMCIA_CORE_ID) && (bus->sih->buscorerev == 9))) {
+                        uint32 dummy, retries;
+                        R_SDREG(dummy, &bus->regs->clockctlstatus, retries);
+                }
+
+                /* Check current status */
+                clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+                if (err) {
+                        DHD_ERROR(("%s: HT Avail read error: %d\n", __FUNCTION__, err));
+                        return BCME_ERROR;
+                }
+
+                /* Go to pending and await interrupt if appropriate */
+                if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
+                        /* Allow only clock-available interrupt */
+                        devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                        if (err) {
+                                DHD_ERROR(("%s: Devctl access error setting CA: %d\n",
+                                           __FUNCTION__, err));
+                                return BCME_ERROR;
+                        }
+
+                        devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
+                        bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                        DHD_INFO(("CLKCTL: set PENDING\n"));
+                        bus->clkstate = CLK_PENDING;
+                        return BCME_OK;
+                } else if (bus->clkstate == CLK_PENDING) {
+                        /* Cancel CA-only interrupt filter */
+                        devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                        devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                        bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                }
+
+                /* Otherwise, wait here (polling) for HT Avail */
+                if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+                        SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+                                ((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                            SBSDIO_FUNC1_CHIPCLKCSR, &err)),
+                                  !SBSDIO_CLKAV(clkctl, bus->alp_only)), PMU_MAX_TRANSITION_DLY);
+                }
+                if (err) {
+                        DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
+                        return BCME_ERROR;
+                }
+                if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+                        DHD_ERROR(("%s: HT Avail timeout (%d): clkctl 0x%02x\n",
+                                   __FUNCTION__, PMU_MAX_TRANSITION_DLY, clkctl));
+                        return BCME_ERROR;
+                }
+
+
+                /* Mark clock available */
+                bus->clkstate = CLK_AVAIL;
+                DHD_INFO(("CLKCTL: turned ON\n"));
+
+#if defined(DHD_DEBUG)
+                if (bus->alp_only == TRUE) {
+#if !defined(BCMLXSDMMC)
+                        if (!SBSDIO_ALPONLY(clkctl)) {
+                                DHD_ERROR(("%s: HT Clock, when ALP Only\n", __FUNCTION__));
+                        }
+#endif /* !defined(BCMLXSDMMC) */
+                } else {
+                        if (SBSDIO_ALPONLY(clkctl)) {
+                                DHD_ERROR(("%s: HT Clock should be on.\n", __FUNCTION__));
+                        }
+                }
+#endif /* defined (DHD_DEBUG) */
+
+                bus->activity = TRUE;
+        } else {
+                clkreq = 0;
+
+                if (bus->clkstate == CLK_PENDING) {
+                        /* Cancel CA-only interrupt filter */
+                        devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                        devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                        bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                }
+
+                bus->clkstate = CLK_SDONLY;
+                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+                DHD_INFO(("CLKCTL: turned OFF\n"));
+                if (err) {
+                        DHD_ERROR(("%s: Failed access turning clock off: %d\n",
+                                   __FUNCTION__, err));
+                        return BCME_ERROR;
+                }
+        }
+        return BCME_OK;
+}
+
+/* Change idle/active SD state */
+static int
+dhdsdio_sdclk(dhd_bus_t *bus, bool on)
+{
+        int err;
+        int32 iovalue;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (on) {
+                if (bus->idleclock == DHD_IDLE_STOP) {
+                        /* Turn on clock and restore mode */
+                        iovalue = 1;
+                        err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
+                                              &iovalue, sizeof(iovalue), TRUE);
+                        if (err) {
+                                DHD_ERROR(("%s: error enabling sd_clock: %d\n",
+                                           __FUNCTION__, err));
+                                return BCME_ERROR;
+                        }
+
+                        iovalue = bus->sd_mode;
+                        err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+                                              &iovalue, sizeof(iovalue), TRUE);
+                        if (err) {
+                                DHD_ERROR(("%s: error changing sd_mode: %d\n",
+                                           __FUNCTION__, err));
+                                return BCME_ERROR;
+                        }
+                } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
+                        /* Restore clock speed */
+                        iovalue = bus->sd_divisor;
+                        err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+                                              &iovalue, sizeof(iovalue), TRUE);
+                        if (err) {
+                                DHD_ERROR(("%s: error restoring sd_divisor: %d\n",
+                                           __FUNCTION__, err));
+                                return BCME_ERROR;
+                        }
+                }
+                bus->clkstate = CLK_SDONLY;
+        } else {
+                /* Stop or slow the SD clock itself */
+                if ((bus->sd_divisor == -1) || (bus->sd_mode == -1)) {
+                        DHD_TRACE(("%s: can't idle clock, divisor %d mode %d\n",
+                                   __FUNCTION__, bus->sd_divisor, bus->sd_mode));
+                        return BCME_ERROR;
+                }
+                if (bus->idleclock == DHD_IDLE_STOP) {
+                        if (sd1idle) {
+                                /* Change to SD1 mode and turn off clock */
+                                iovalue = 1;
+                                err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+                                                      &iovalue, sizeof(iovalue), TRUE);
+                                if (err) {
+                                        DHD_ERROR(("%s: error changing sd_clock: %d\n",
+                                                   __FUNCTION__, err));
+                                        return BCME_ERROR;
+                                }
+                        }
+
+                        iovalue = 0;
+                        err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
+                                              &iovalue, sizeof(iovalue), TRUE);
+                        if (err) {
+                                DHD_ERROR(("%s: error disabling sd_clock: %d\n",
+                                           __FUNCTION__, err));
+                                return BCME_ERROR;
+                        }
+                } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
+                        /* Set divisor to idle value */
+                        iovalue = bus->idleclock;
+                        err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+                                              &iovalue, sizeof(iovalue), TRUE);
+                        if (err) {
+                                DHD_ERROR(("%s: error changing sd_divisor: %d\n",
+                                           __FUNCTION__, err));
+                                return BCME_ERROR;
+                        }
+                }
+                bus->clkstate = CLK_NONE;
+        }
+
+        return BCME_OK;
+}
+
+/* Transition SD and backplane clock readiness */
+static int
+dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok)
+{
+        int ret = BCME_OK;
+#ifdef DHD_DEBUG
+        uint oldstate = bus->clkstate;
+#endif /* DHD_DEBUG */
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        /* Early exit if we're already there */
+        if (bus->clkstate == target) {
+                if (target == CLK_AVAIL) {
+                        dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+                        bus->activity = TRUE;
+                }
+                return ret;
+        }
+
+        switch (target) {
+        case CLK_AVAIL:
+                /* Make sure SD clock is available */
+                if (bus->clkstate == CLK_NONE)
+                        dhdsdio_sdclk(bus, TRUE);
+                /* Now request HT Avail on the backplane */
+                ret = dhdsdio_htclk(bus, TRUE, pendok);
+                if (ret == BCME_OK) {
+                        dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+                        bus->activity = TRUE;
+                }
+                break;
+
+        case CLK_SDONLY:
+                /* Remove HT request, or bring up SD clock */
+                if (bus->clkstate == CLK_NONE)
+                        ret = dhdsdio_sdclk(bus, TRUE);
+                else if (bus->clkstate == CLK_AVAIL)
+                        ret = dhdsdio_htclk(bus, FALSE, FALSE);
+                else
+                        DHD_ERROR(("dhdsdio_clkctl: request for %d -> %d\n",
+                                   bus->clkstate, target));
+                if (ret == BCME_OK) {
+                        dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+                }
+                break;
+
+        case CLK_NONE:
+                /* Make sure to remove HT request */
+                if (bus->clkstate == CLK_AVAIL)
+                        ret = dhdsdio_htclk(bus, FALSE, FALSE);
+                /* Now remove the SD clock */
+                ret = dhdsdio_sdclk(bus, FALSE);
+#ifdef DHD_DEBUG
+                if (dhd_console_ms == 0)
+#endif /* DHD_DEBUG */
+                dhd_os_wd_timer(bus->dhd, 0);
+                break;
+        }
+#ifdef DHD_DEBUG
+        DHD_INFO(("dhdsdio_clkctl: %d -> %d\n", oldstate, bus->clkstate));
+#endif /* DHD_DEBUG */
+
+        return ret;
+}
+
+static int
+dhdsdio_bussleep(dhd_bus_t *bus, bool sleep)
+{
+        bcmsdh_info_t *sdh = bus->sdh;
+        sdpcmd_regs_t *regs = bus->regs;
+        uint retries = 0;
+
+        DHD_INFO(("dhdsdio_bussleep: request %s (currently %s)\n",
+                  (sleep ? "SLEEP" : "WAKE"),
+                  (bus->sleeping ? "SLEEP" : "WAKE")));
+
+        /* Done if we're already in the requested state */
+        if (sleep == bus->sleeping)
+                return BCME_OK;
+
+        /* Going to sleep: set the alarm and turn off the lights... */
+        if (sleep) {
+                /* Don't sleep if something is pending */
+                if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
+                        return BCME_BUSY;
+
+
+                /* Disable SDIO interrupts (no longer interested) */
+                bcmsdh_intr_disable(bus->sdh);
+
+                /* Make sure the controller has the bus up */
+                dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+                /* Tell device to start using OOB wakeup */
+                W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+                if (retries > retry_limit)
+                        DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+
+                /* Turn off our contribution to the HT clock request */
+                dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                 SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
+
+                /* Isolate the bus */
+                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL,
+                                 SBSDIO_DEVCTL_PADS_ISO, NULL);
+
+                /* Change state */
+                bus->sleeping = TRUE;
+
+        } else {
+                /* Waking up: bus power up is ok, set local state */
+
+                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                 0, NULL);
+
+                /* Force pad isolation off if possible (in case power never toggled) */
+                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, 0, NULL);
+
+
+                /* Make sure the controller has the bus up */
+                dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+                /* Send misc interrupt to indicate OOB not needed */
+                W_SDREG(0, &regs->tosbmailboxdata, retries);
+                if (retries <= retry_limit)
+                        W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+
+                if (retries > retry_limit)
+                        DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
+
+                /* Make sure we have SD bus access */
+                dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+                /* Change state */
+                bus->sleeping = FALSE;
+
+                /* Enable interrupts again */
+                if (bus->intr && (bus->dhd->busstate == DHD_BUS_DATA)) {
+                        bus->intdis = FALSE;
+                        bcmsdh_intr_enable(bus->sdh);
+                }
+        }
+
+        return BCME_OK;
+}
+
+#if defined(OOB_INTR_ONLY)
+void
+dhd_enable_oob_intr(struct dhd_bus *bus, bool enable)
+{
+#if defined(HW_OOB)
+        bcmsdh_enable_hw_oob_intr(bus->sdh, enable);
+#else
+        sdpcmd_regs_t *regs = bus->regs;
+        uint retries = 0;
+
+        dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+        if (enable == TRUE) {
+
+                /* Tell device to start using OOB wakeup */
+                W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+                if (retries > retry_limit)
+                        DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+
+        } else {
+                /* Send misc interrupt to indicate OOB not needed */
+                W_SDREG(0, &regs->tosbmailboxdata, retries);
+                if (retries <= retry_limit)
+                        W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+        }
+
+        /* Turn off our contribution to the HT clock request */
+        dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+#endif /* !defined(HW_OOB) */
+}
+#endif /* defined(OOB_INTR_ONLY) */
+
+/* Writes a HW/SW header into the packet and sends it. */
+/* Assumes: (a) header space already there, (b) caller holds lock */
+static int
+dhdsdio_txpkt(dhd_bus_t *bus, void *pkt, uint chan, bool free_pkt)
+{
+        int ret;
+        osl_t *osh;
+        uint8 *frame;
+        uint16 len, pad1 = 0;
+        uint32 swheader;
+        uint retries = 0;
+        bcmsdh_info_t *sdh;
+        void *new;
+        int i;
+#ifdef WLMEDIA_HTSF
+        char *p;
+        htsfts_t *htsf_ts;
+#endif
+
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        sdh = bus->sdh;
+        osh = bus->dhd->osh;
+
+        if (bus->dhd->dongle_reset) {
+                ret = BCME_NOTREADY;
+                goto done;
+        }
+
+        frame = (uint8*)PKTDATA(osh, pkt);
+
+#ifdef WLMEDIA_HTSF
+        if (PKTLEN(osh, pkt) >= 100) {
+                p = PKTDATA(osh, pkt);
+                htsf_ts = (htsfts_t*) (p + HTSF_HOSTOFFSET + 12);
+                if (htsf_ts->magic == HTSFMAGIC) {
+                        htsf_ts->c20 = get_cycles();
+                        htsf_ts->t20 = dhd_get_htsf(bus->dhd->info, 0);
+                }
+        }
+#endif /* WLMEDIA_HTSF */
+
+        /* Add alignment padding, allocate new packet if needed */
+        if ((pad1 = ((uintptr)frame % DHD_SDALIGN))) {
+                if (PKTHEADROOM(osh, pkt) < pad1) {
+                        DHD_INFO(("%s: insufficient headroom %d for %d pad1\n",
+                                  __FUNCTION__, (int)PKTHEADROOM(osh, pkt), pad1));
+                        bus->dhd->tx_realloc++;
+                        new = PKTGET(osh, (PKTLEN(osh, pkt) + DHD_SDALIGN), TRUE);
+                        if (!new) {
+                                DHD_ERROR(("%s: couldn't allocate new %d-byte packet\n",
+                                           __FUNCTION__, PKTLEN(osh, pkt) + DHD_SDALIGN));
+                                ret = BCME_NOMEM;
+                                goto done;
+                        }
+
+                        PKTALIGN(osh, new, PKTLEN(osh, pkt), DHD_SDALIGN);
+                        bcopy(PKTDATA(osh, pkt), PKTDATA(osh, new), PKTLEN(osh, pkt));
+                        if (free_pkt)
+                                PKTFREE(osh, pkt, TRUE);
+                        /* free the pkt if canned one is not used */
+                        free_pkt = TRUE;
+                        pkt = new;
+                        frame = (uint8*)PKTDATA(osh, pkt);
+                        ASSERT(((uintptr)frame % DHD_SDALIGN) == 0);
+                        pad1 = 0;
+                } else {
+                        PKTPUSH(osh, pkt, pad1);
+                        frame = (uint8*)PKTDATA(osh, pkt);
+
+                        ASSERT((pad1 + SDPCM_HDRLEN) <= (int) PKTLEN(osh, pkt));
+                        bzero(frame, pad1 + SDPCM_HDRLEN);
+                }
+        }
+        ASSERT(pad1 < DHD_SDALIGN);
+
+        /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
+        len = (uint16)PKTLEN(osh, pkt);
+        *(uint16*)frame = htol16(len);
+        *(((uint16*)frame) + 1) = htol16(~len);
+
+        /* Software tag: channel, sequence number, data offset */
+        swheader = ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
+                (((pad1 + SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+        htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
+        htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
+
+#ifdef DHD_DEBUG
+        if (PKTPRIO(pkt) < ARRAYSIZE(tx_packets)) {
+                tx_packets[PKTPRIO(pkt)]++;
+        }
+        if (DHD_BYTES_ON() &&
+            (((DHD_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
+              (DHD_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
+                prhex("Tx Frame", frame, len);
+        } else if (DHD_HDRS_ON()) {
+                prhex("TxHdr", frame, MIN(len, 16));
+        }
+#endif
+
+        /* Raise len to next SDIO block to eliminate tail command */
+        if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
+                uint16 pad2 = bus->blocksize - (len % bus->blocksize);
+                if ((pad2 <= bus->roundup) && (pad2 < bus->blocksize))
+#ifdef NOTUSED
+                        if (pad2 <= PKTTAILROOM(osh, pkt))
+#endif /* NOTUSED */
+                                len += pad2;
+        } else if (len % DHD_SDALIGN) {
+                len += DHD_SDALIGN - (len % DHD_SDALIGN);
+        }
+
+        /* Some controllers have trouble with odd bytes -- round to even */
+        if (forcealign && (len & (ALIGNMENT - 1))) {
+#ifdef NOTUSED
+                if (PKTTAILROOM(osh, pkt))
+#endif
+                        len = ROUNDUP(len, ALIGNMENT);
+#ifdef NOTUSED
+                else
+                        DHD_ERROR(("%s: sending unrounded %d-byte packet\n", __FUNCTION__, len));
+#endif
+        }
+
+        do {
+                ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                          frame, len, pkt, NULL, NULL);
+                bus->f2txdata++;
+                ASSERT(ret != BCME_PENDING);
+
+                if (ret < 0) {
+                        /* On failure, abort the command and terminate the frame */
+                        DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
+                                  __FUNCTION__, ret));
+                        bus->tx_sderrs++;
+
+                        bcmsdh_abort(sdh, SDIO_FUNC_2);
+                        bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
+                                         SFC_WF_TERM, NULL);
+                        bus->f1regdata++;
+
+                        for (i = 0; i < 3; i++) {
+                                uint8 hi, lo;
+                                hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                     SBSDIO_FUNC1_WFRAMEBCHI, NULL);
+                                lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                     SBSDIO_FUNC1_WFRAMEBCLO, NULL);
+                                bus->f1regdata += 2;
+                                if ((hi == 0) && (lo == 0))
+                                        break;
+                        }
+
+                }
+                if (ret == 0) {
+                        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+                }
+        } while ((ret < 0) && retrydata && retries++ < TXRETRIES);
+
+done:
+        /* restore pkt buffer pointer before calling tx complete routine */
+        PKTPULL(osh, pkt, SDPCM_HDRLEN + pad1);
+#ifdef PROP_TXSTATUS
+        if (bus->dhd->wlfc_state) {
+                dhd_os_sdunlock(bus->dhd);
+                dhd_wlfc_txcomplete(bus->dhd, pkt, ret == 0);
+                dhd_os_sdlock(bus->dhd);
+        } else {
+#endif /* PROP_TXSTATUS */
+        dhd_txcomplete(bus->dhd, pkt, ret != 0);
+        if (free_pkt)
+                PKTFREE(osh, pkt, TRUE);
+
+#ifdef PROP_TXSTATUS
+        }
+#endif
+        return ret;
+}
+
+int
+dhd_bus_txdata(struct dhd_bus *bus, void *pkt)
+{
+        int ret = BCME_ERROR;
+        osl_t *osh;
+        uint datalen, prec;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        osh = bus->dhd->osh;
+        datalen = PKTLEN(osh, pkt);
+
+#ifdef SDTEST
+        /* Push the test header if doing loopback */
+        if (bus->ext_loop) {
+                uint8* data;
+                PKTPUSH(osh, pkt, SDPCM_TEST_HDRLEN);
+                data = PKTDATA(osh, pkt);
+                *data++ = SDPCM_TEST_ECHOREQ;
+                *data++ = (uint8)bus->loopid++;
+                *data++ = (datalen >> 0);
+                *data++ = (datalen >> 8);
+                datalen += SDPCM_TEST_HDRLEN;
+        }
+#endif /* SDTEST */
+
+        /* Add space for the header */
+        PKTPUSH(osh, pkt, SDPCM_HDRLEN);
+        ASSERT(ISALIGNED((uintptr)PKTDATA(osh, pkt), 2));
+
+        prec = PRIO2PREC((PKTPRIO(pkt) & PRIOMASK));
+#ifndef DHDTHREAD
+        /* Lock: we're about to use shared data/code (and SDIO) */
+        dhd_os_sdlock(bus->dhd);
+#endif /* DHDTHREAD */
+
+        /* Check for existing queue, current flow-control, pending event, or pending clock */
+        if (dhd_deferred_tx || bus->fcstate || pktq_len(&bus->txq) || bus->dpc_sched ||
+            (!DATAOK(bus)) || (bus->flowcontrol & NBITVAL(prec)) ||
+            (bus->clkstate != CLK_AVAIL)) {
+                DHD_TRACE(("%s: deferring pktq len %d\n", __FUNCTION__,
+                        pktq_len(&bus->txq)));
+                bus->fcqueued++;
+
+                /* Priority based enq */
+                dhd_os_sdlock_txq(bus->dhd);
+                if (dhd_prec_enq(bus->dhd, &bus->txq, pkt, prec) == FALSE) {
+                        PKTPULL(osh, pkt, SDPCM_HDRLEN);
+#ifndef DHDTHREAD
+                        /* Need to also release txqlock before releasing sdlock.
+                         * This thread still has txqlock and releases sdlock.
+                         * Deadlock happens when dpc() grabs sdlock first then
+                         * attempts to grab txqlock.
+                         */
+                        dhd_os_sdunlock_txq(bus->dhd);
+                        dhd_os_sdunlock(bus->dhd);
+#endif
+#ifdef PROP_TXSTATUS
+                        if (bus->dhd->wlfc_state)
+                                dhd_wlfc_txcomplete(bus->dhd, pkt, FALSE);
+                        else
+#endif
+                        dhd_txcomplete(bus->dhd, pkt, FALSE);
+#ifndef DHDTHREAD
+                        dhd_os_sdlock(bus->dhd);
+                        dhd_os_sdlock_txq(bus->dhd);
+#endif
+#ifdef PROP_TXSTATUS
+                        /* let the caller decide whether to free the packet */
+                if (!bus->dhd->wlfc_state)
+#endif
+                        PKTFREE(osh, pkt, TRUE);
+                        ret = BCME_NORESOURCE;
+                }
+                else
+                        ret = BCME_OK;
+                dhd_os_sdunlock_txq(bus->dhd);
+
+                if ((pktq_len(&bus->txq) >= FCHI) && dhd_doflow)
+                        dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+
+#ifdef DHD_DEBUG
+                if (pktq_plen(&bus->txq, prec) > qcount[prec])
+                        qcount[prec] = pktq_plen(&bus->txq, prec);
+#endif
+                /* Schedule DPC if needed to send queued packet(s) */
+                if (dhd_deferred_tx && !bus->dpc_sched) {
+                        bus->dpc_sched = TRUE;
+                        dhd_sched_dpc(bus->dhd);
+                }
+        } else {
+#ifdef DHDTHREAD
+                /* Lock: we're about to use shared data/code (and SDIO) */
+                dhd_os_sdlock(bus->dhd);
+#endif /* DHDTHREAD */
+
+                /* Otherwise, send it now */
+                BUS_WAKE(bus);
+                /* Make sure back plane ht clk is on, no pending allowed */
+                dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
+#ifndef SDTEST
+                ret = dhdsdio_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, TRUE);
+#else
+                ret = dhdsdio_txpkt(bus, pkt,
+                        (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL), TRUE);
+#endif
+                if (ret)
+                        bus->dhd->tx_errors++;
+                else
+                        bus->dhd->dstats.tx_bytes += datalen;
+
+                if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                        bus->activity = FALSE;
+                        dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+                }
+
+#ifdef DHDTHREAD
+                dhd_os_sdunlock(bus->dhd);
+#endif /* DHDTHREAD */
+        }
+
+#ifndef DHDTHREAD
+        dhd_os_sdunlock(bus->dhd);
+#endif /* DHDTHREAD */
+
+        return ret;
+}
+
+static uint
+dhdsdio_sendfromq(dhd_bus_t *bus, uint maxframes)
+{
+        void *pkt;
+        uint32 intstatus = 0;
+        uint retries = 0;
+        int ret = 0, prec_out;
+        uint cnt = 0;
+        uint datalen;
+        uint8 tx_prec_map;
+
+        dhd_pub_t *dhd = bus->dhd;
+        sdpcmd_regs_t *regs = bus->regs;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        tx_prec_map = ~bus->flowcontrol;
+
+        /* Send frames until the limit or some other event */
+        for (cnt = 0; (cnt < maxframes) && DATAOK(bus); cnt++) {
+                dhd_os_sdlock_txq(bus->dhd);
+                if ((pkt = pktq_mdeq(&bus->txq, tx_prec_map, &prec_out)) == NULL) {
+                        dhd_os_sdunlock_txq(bus->dhd);
+                        break;
+                }
+                dhd_os_sdunlock_txq(bus->dhd);
+                datalen = PKTLEN(bus->dhd->osh, pkt) - SDPCM_HDRLEN;
+
+#ifndef SDTEST
+                ret = dhdsdio_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, TRUE);
+#else
+                ret = dhdsdio_txpkt(bus, pkt,
+                        (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL), TRUE);
+#endif
+                if (ret)
+                        bus->dhd->tx_errors++;
+                else
+                        bus->dhd->dstats.tx_bytes += datalen;
+
+                /* In poll mode, need to check for other events */
+                if (!bus->intr && cnt)
+                {
+                        /* Check device status, signal pending interrupt */
+                        R_SDREG(intstatus, &regs->intstatus, retries);
+                        bus->f2txdata++;
+                        if (bcmsdh_regfail(bus->sdh))
+                                break;
+                        if (intstatus & bus->hostintmask)
+                                bus->ipend = TRUE;
+                }
+        }
+
+        /* Deflow-control stack if needed */
+        if (dhd_doflow && dhd->up && (dhd->busstate == DHD_BUS_DATA) &&
+            dhd->txoff && (pktq_len(&bus->txq) < FCLOW))
+                dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);
+
+        return cnt;
+}
+
+int
+dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen)
+{
+        uint8 *frame;
+        uint16 len;
+        uint32 swheader;
+        uint retries = 0;
+        bcmsdh_info_t *sdh = bus->sdh;
+        uint8 doff = 0;
+        int ret = -1;
+        int i;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (bus->dhd->dongle_reset)
+                return -EIO;
+
+        /* Back the pointer to make a room for bus header */
+        frame = msg - SDPCM_HDRLEN;
+        len = (msglen += SDPCM_HDRLEN);
+
+        /* Add alignment padding (optional for ctl frames) */
+        if (dhd_alignctl) {
+                if ((doff = ((uintptr)frame % DHD_SDALIGN))) {
+                        frame -= doff;
+                        len += doff;
+                        msglen += doff;
+                        bzero(frame, doff + SDPCM_HDRLEN);
+                }
+                ASSERT(doff < DHD_SDALIGN);
+        }
+        doff += SDPCM_HDRLEN;
+
+        /* Round send length to next SDIO block */
+        if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
+                uint16 pad = bus->blocksize - (len % bus->blocksize);
+                if ((pad <= bus->roundup) && (pad < bus->blocksize))
+                        len += pad;
+        } else if (len % DHD_SDALIGN) {
+                len += DHD_SDALIGN - (len % DHD_SDALIGN);
+        }
+
+        /* Satisfy length-alignment requirements */
+        if (forcealign && (len & (ALIGNMENT - 1)))
+                len = ROUNDUP(len, ALIGNMENT);
+
+        ASSERT(ISALIGNED((uintptr)frame, 2));
+
+
+        /* Need to lock here to protect txseq and SDIO tx calls */
+        dhd_os_sdlock(bus->dhd);
+
+        BUS_WAKE(bus);
+
+        /* Make sure backplane clock is on */
+        dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+        /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
+        *(uint16*)frame = htol16((uint16)msglen);
+        *(((uint16*)frame) + 1) = htol16(~msglen);
+
+        /* Software tag: channel, sequence number, data offset */
+        swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+                | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+        htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
+        htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
+
+        if (!TXCTLOK(bus)) {
+                DHD_INFO(("%s: No bus credit bus->tx_max %d, bus->tx_seq %d\n",
+                        __FUNCTION__, bus->tx_max, bus->tx_seq));
+                bus->ctrl_frame_stat = TRUE;
+                /* Send from dpc */
+                bus->ctrl_frame_buf = frame;
+                bus->ctrl_frame_len = len;
+
+                dhd_wait_for_event(bus->dhd, &bus->ctrl_frame_stat);
+
+                if (bus->ctrl_frame_stat == FALSE) {
+                        DHD_INFO(("%s: ctrl_frame_stat == FALSE\n", __FUNCTION__));
+                        ret = 0;
+                } else {
+                        bus->dhd->txcnt_timeout++;
+                        if (!bus->dhd->hang_was_sent)
+                                DHD_ERROR(("%s: ctrl_frame_stat == TRUE txcnt_timeout=%d\n",
+                                        __FUNCTION__, bus->dhd->txcnt_timeout));
+                        ret = -1;
+                        bus->ctrl_frame_stat = FALSE;
+                        goto done;
+                }
+        }
+
+        bus->dhd->txcnt_timeout = 0;
+
+        if (ret == -1) {
+#ifdef DHD_DEBUG
+                if (DHD_BYTES_ON() && DHD_CTL_ON()) {
+                        prhex("Tx Frame", frame, len);
+                } else if (DHD_HDRS_ON()) {
+                        prhex("TxHdr", frame, MIN(len, 16));
+                }
+#endif
+
+                do {
+                        ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                                  frame, len, NULL, NULL, NULL);
+                        ASSERT(ret != BCME_PENDING);
+
+                        if (ret < 0) {
+                        /* On failure, abort the command and terminate the frame */
+                                DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
+                                          __FUNCTION__, ret));
+                                bus->tx_sderrs++;
+
+                                bcmsdh_abort(sdh, SDIO_FUNC_2);
+
+                                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
+                                                 SFC_WF_TERM, NULL);
+                                bus->f1regdata++;
+
+                                for (i = 0; i < 3; i++) {
+                                        uint8 hi, lo;
+                                        hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                             SBSDIO_FUNC1_WFRAMEBCHI, NULL);
+                                        lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                             SBSDIO_FUNC1_WFRAMEBCLO, NULL);
+                                        bus->f1regdata += 2;
+                                        if ((hi == 0) && (lo == 0))
+                                                break;
+                                }
+
+                        }
+                        if (ret == 0) {
+                                bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+                        }
+                } while ((ret < 0) && retries++ < TXRETRIES);
+        }
+
+done:
+        if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                bus->activity = FALSE;
+                dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+        }
+
+        dhd_os_sdunlock(bus->dhd);
+
+        if (ret)
+                bus->dhd->tx_ctlerrs++;
+        else
+                bus->dhd->tx_ctlpkts++;
+
+        if (bus->dhd->txcnt_timeout >= MAX_CNTL_TIMEOUT)
+                return -ETIMEDOUT;
+
+        return ret ? -EIO : 0;
+}
+
+int
+dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen)
+{
+        int timeleft;
+        uint rxlen = 0;
+        bool pending;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (bus->dhd->dongle_reset)
+                return -EIO;
+
+        /* Wait until control frame is available */
+        timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->rxlen, &pending);
+
+        dhd_os_sdlock(bus->dhd);
+        rxlen = bus->rxlen;
+        bcopy(bus->rxctl, msg, MIN(msglen, rxlen));
+        bus->rxlen = 0;
+        dhd_os_sdunlock(bus->dhd);
+
+        if (rxlen) {
+                DHD_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
+                         __FUNCTION__, rxlen, msglen));
+        } else if (timeleft == 0) {
+                DHD_ERROR(("%s: resumed on timeout\n", __FUNCTION__));
+#ifdef DHD_DEBUG
+                dhd_os_sdlock(bus->dhd);
+                dhdsdio_checkdied(bus, NULL, 0);
+                dhd_os_sdunlock(bus->dhd);
+#endif /* DHD_DEBUG */
+        } else if (pending == TRUE) {
+                DHD_CTL(("%s: canceled\n", __FUNCTION__));
+                return -ERESTARTSYS;
+        } else {
+                DHD_CTL(("%s: resumed for unknown reason?\n", __FUNCTION__));
+#ifdef DHD_DEBUG
+                dhd_os_sdlock(bus->dhd);
+                dhdsdio_checkdied(bus, NULL, 0);
+                dhd_os_sdunlock(bus->dhd);
+#endif /* DHD_DEBUG */
+        }
+        if (timeleft == 0) {
+                bus->dhd->rxcnt_timeout++;
+                DHD_ERROR(("%s: rxcnt_timeout=%d\n", __FUNCTION__, bus->dhd->rxcnt_timeout));
+        }
+        else
+                bus->dhd->rxcnt_timeout = 0;
+
+        if (rxlen)
+                bus->dhd->rx_ctlpkts++;
+        else
+                bus->dhd->rx_ctlerrs++;
+
+        if (bus->dhd->rxcnt_timeout >= MAX_CNTL_TIMEOUT)
+                return -ETIMEDOUT;
+
+        return rxlen ? (int)rxlen : -EIO;
+}
+
+/* IOVar table */
+enum {
+        IOV_INTR = 1,
+        IOV_POLLRATE,
+        IOV_SDREG,
+        IOV_SBREG,
+        IOV_SDCIS,
+        IOV_MEMBYTES,
+        IOV_MEMSIZE,
+#ifdef DHD_DEBUG
+        IOV_CHECKDIED,
+        IOV_SERIALCONS,
+#endif
+        IOV_DOWNLOAD,
+        IOV_SOCRAM_STATE,
+        IOV_FORCEEVEN,
+        IOV_SDIOD_DRIVE,
+        IOV_READAHEAD,
+        IOV_SDRXCHAIN,
+        IOV_ALIGNCTL,
+        IOV_SDALIGN,
+        IOV_DEVRESET,
+        IOV_CPU,
+#ifdef SDTEST
+        IOV_PKTGEN,
+        IOV_EXTLOOP,
+#endif /* SDTEST */
+        IOV_SPROM,
+        IOV_TXBOUND,
+        IOV_RXBOUND,
+        IOV_TXMINMAX,
+        IOV_IDLETIME,
+        IOV_IDLECLOCK,
+        IOV_SD1IDLE,
+        IOV_SLEEP,
+        IOV_DONGLEISOLATION,
+        IOV_VARS,
+#ifdef SOFTAP
+        IOV_FWPATH
+#endif
+};
+
+const bcm_iovar_t dhdsdio_iovars[] = {
+        {"intr",        IOV_INTR,       0,      IOVT_BOOL,      0 },
+        {"sleep",       IOV_SLEEP,      0,      IOVT_BOOL,      0 },
+        {"pollrate",    IOV_POLLRATE,   0,      IOVT_UINT32,    0 },
+        {"idletime",    IOV_IDLETIME,   0,      IOVT_INT32,     0 },
+        {"idleclock",   IOV_IDLECLOCK,  0,      IOVT_INT32,     0 },
+        {"sd1idle",     IOV_SD1IDLE,    0,      IOVT_BOOL,      0 },
+        {"membytes",    IOV_MEMBYTES,   0,      IOVT_BUFFER,    2 * sizeof(int) },
+        {"memsize",     IOV_MEMSIZE,    0,      IOVT_UINT32,    0 },
+        {"download",    IOV_DOWNLOAD,   0,      IOVT_BOOL,      0 },
+        {"socram_state",        IOV_SOCRAM_STATE,       0,      IOVT_BOOL,      0 },
+        {"vars",        IOV_VARS,       0,      IOVT_BUFFER,    0 },
+        {"sdiod_drive", IOV_SDIOD_DRIVE, 0,     IOVT_UINT32,    0 },
+        {"readahead",   IOV_READAHEAD,  0,      IOVT_BOOL,      0 },
+        {"sdrxchain",   IOV_SDRXCHAIN,  0,      IOVT_BOOL,      0 },
+        {"alignctl",    IOV_ALIGNCTL,   0,      IOVT_BOOL,      0 },
+        {"sdalign",     IOV_SDALIGN,    0,      IOVT_BOOL,      0 },
+        {"devreset",    IOV_DEVRESET,   0,      IOVT_BOOL,      0 },
+#ifdef DHD_DEBUG
+        {"sdreg",       IOV_SDREG,      0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+        {"sbreg",       IOV_SBREG,      0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+        {"sd_cis",      IOV_SDCIS,      0,      IOVT_BUFFER,    DHD_IOCTL_MAXLEN },
+        {"forcealign",  IOV_FORCEEVEN,  0,      IOVT_BOOL,      0 },
+        {"txbound",     IOV_TXBOUND,    0,      IOVT_UINT32,    0 },
+        {"rxbound",     IOV_RXBOUND,    0,      IOVT_UINT32,    0 },
+        {"txminmax",    IOV_TXMINMAX,   0,      IOVT_UINT32,    0 },
+        {"cpu",         IOV_CPU,        0,      IOVT_BOOL,      0 },
+#ifdef DHD_DEBUG
+        {"checkdied",   IOV_CHECKDIED,  0,      IOVT_BUFFER,    0 },
+        {"serial",      IOV_SERIALCONS, 0,      IOVT_UINT32,    0 },
+#endif /* DHD_DEBUG  */
+#endif /* DHD_DEBUG */
+#ifdef SDTEST
+        {"extloop",     IOV_EXTLOOP,    0,      IOVT_BOOL,      0 },
+        {"pktgen",      IOV_PKTGEN,     0,      IOVT_BUFFER,    sizeof(dhd_pktgen_t) },
+#endif /* SDTEST */
+        {"dngl_isolation", IOV_DONGLEISOLATION, 0,      IOVT_UINT32,    0 },
+#ifdef SOFTAP
+        {"fwpath", IOV_FWPATH, 0, IOVT_BUFFER, 0 },
+#endif
+        {NULL, 0, 0, 0, 0 }
+};
+
+static void
+dhd_dump_pct(struct bcmstrbuf *strbuf, char *desc, uint num, uint div)
+{
+        uint q1, q2;
+
+        if (!div) {
+                bcm_bprintf(strbuf, "%s N/A", desc);
+        } else {
+                q1 = num / div;
+                q2 = (100 * (num - (q1 * div))) / div;
+                bcm_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
+        }
+}
+
+void
+dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+        dhd_bus_t *bus = dhdp->bus;
+
+        bcm_bprintf(strbuf, "Bus SDIO structure:\n");
+        bcm_bprintf(strbuf, "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
+                    bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
+        bcm_bprintf(strbuf, "fcstate %d qlen %d tx_seq %d, max %d, rxskip %d rxlen %d rx_seq %d\n",
+                    bus->fcstate, pktq_len(&bus->txq), bus->tx_seq, bus->tx_max, bus->rxskip,
+                    bus->rxlen, bus->rx_seq);
+        bcm_bprintf(strbuf, "intr %d intrcount %d lastintrs %d spurious %d\n",
+                    bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
+        bcm_bprintf(strbuf, "pollrate %d pollcnt %d regfails %d\n",
+                    bus->pollrate, bus->pollcnt, bus->regfails);
+
+        bcm_bprintf(strbuf, "\nAdditional counters:\n");
+        bcm_bprintf(strbuf, "tx_sderrs %d fcqueued %d rxrtx %d rx_toolong %d rxc_errors %d\n",
+                    bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
+                    bus->rxc_errors);
+        bcm_bprintf(strbuf, "rx_hdrfail %d badhdr %d badseq %d\n",
+                    bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
+        bcm_bprintf(strbuf, "fc_rcvd %d, fc_xoff %d, fc_xon %d\n",
+                    bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
+        bcm_bprintf(strbuf, "rxglomfail %d, rxglomframes %d, rxglompkts %d\n",
+                    bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
+        bcm_bprintf(strbuf, "f2rx (hdrs/data) %d (%d/%d), f2tx %d f1regs %d\n",
+                    (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs, bus->f2rxdata,
+                    bus->f2txdata, bus->f1regdata);
+        {
+                dhd_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->dhd->rx_packets,
+                             (bus->f2rxhdrs + bus->f2rxdata));
+                dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->rx_packets, bus->f1regdata);
+                dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->rx_packets,
+                             (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
+                dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->rx_packets, bus->intrcount);
+                bcm_bprintf(strbuf, "\n");
+
+                dhd_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
+                             bus->dhd->rx_packets);
+                dhd_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts, bus->rxglomframes);
+                bcm_bprintf(strbuf, "\n");
+
+                dhd_dump_pct(strbuf, "Tx: pkts/f2wr", bus->dhd->tx_packets, bus->f2txdata);
+                dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->tx_packets, bus->f1regdata);
+                dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->tx_packets,
+                             (bus->f2txdata + bus->f1regdata));
+                dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->tx_packets, bus->intrcount);
+                bcm_bprintf(strbuf, "\n");
+
+                dhd_dump_pct(strbuf, "Total: pkts/f2rw",
+                             (bus->dhd->tx_packets + bus->dhd->rx_packets),
+                             (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
+                dhd_dump_pct(strbuf, ", pkts/f1sd",
+                             (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->f1regdata);
+                dhd_dump_pct(strbuf, ", pkts/sd",
+                             (bus->dhd->tx_packets + bus->dhd->rx_packets),
+                             (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
+                dhd_dump_pct(strbuf, ", pkts/int",
+                             (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->intrcount);
+                bcm_bprintf(strbuf, "\n\n");
+        }
+
+#ifdef SDTEST
+        if (bus->pktgen_count) {
+                bcm_bprintf(strbuf, "pktgen config and count:\n");
+                bcm_bprintf(strbuf, "freq %d count %d print %d total %d min %d len %d\n",
+                            bus->pktgen_freq, bus->pktgen_count, bus->pktgen_print,
+                            bus->pktgen_total, bus->pktgen_minlen, bus->pktgen_maxlen);
+                bcm_bprintf(strbuf, "send attempts %d rcvd %d fail %d\n",
+                            bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
+        }
+#endif /* SDTEST */
+#ifdef DHD_DEBUG
+        bcm_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
+                    bus->dpc_sched, (bcmsdh_intr_pending(bus->sdh) ? " " : " not "));
+        bcm_bprintf(strbuf, "blocksize %d roundup %d\n", bus->blocksize, bus->roundup);
+#endif /* DHD_DEBUG */
+        bcm_bprintf(strbuf, "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
+                    bus->clkstate, bus->activity, bus->idletime, bus->idlecount, bus->sleeping);
+}
+
+void
+dhd_bus_clearcounts(dhd_pub_t *dhdp)
+{
+        dhd_bus_t *bus = (dhd_bus_t *)dhdp->bus;
+
+        bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
+        bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
+        bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
+        bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
+        bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
+        bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
+}
+
+#ifdef SDTEST
+static int
+dhdsdio_pktgen_get(dhd_bus_t *bus, uint8 *arg)
+{
+        dhd_pktgen_t pktgen;
+
+        pktgen.version = DHD_PKTGEN_VERSION;
+        pktgen.freq = bus->pktgen_freq;
+        pktgen.count = bus->pktgen_count;
+        pktgen.print = bus->pktgen_print;
+        pktgen.total = bus->pktgen_total;
+        pktgen.minlen = bus->pktgen_minlen;
+        pktgen.maxlen = bus->pktgen_maxlen;
+        pktgen.numsent = bus->pktgen_sent;
+        pktgen.numrcvd = bus->pktgen_rcvd;
+        pktgen.numfail = bus->pktgen_fail;
+        pktgen.mode = bus->pktgen_mode;
+        pktgen.stop = bus->pktgen_stop;
+
+        bcopy(&pktgen, arg, sizeof(pktgen));
+
+        return 0;
+}
+
+static int
+dhdsdio_pktgen_set(dhd_bus_t *bus, uint8 *arg)
+{
+        dhd_pktgen_t pktgen;
+        uint oldcnt, oldmode;
+
+        bcopy(arg, &pktgen, sizeof(pktgen));
+        if (pktgen.version != DHD_PKTGEN_VERSION)
+                return BCME_BADARG;
+
+        oldcnt = bus->pktgen_count;
+        oldmode = bus->pktgen_mode;
+
+        bus->pktgen_freq = pktgen.freq;
+        bus->pktgen_count = pktgen.count;
+        bus->pktgen_print = pktgen.print;
+        bus->pktgen_total = pktgen.total;
+        bus->pktgen_minlen = pktgen.minlen;
+        bus->pktgen_maxlen = pktgen.maxlen;
+        bus->pktgen_mode = pktgen.mode;
+        bus->pktgen_stop = pktgen.stop;
+
+        bus->pktgen_tick = bus->pktgen_ptick = 0;
+        bus->pktgen_len = MAX(bus->pktgen_len, bus->pktgen_minlen);
+        bus->pktgen_len = MIN(bus->pktgen_len, bus->pktgen_maxlen);
+
+        /* Clear counts for a new pktgen (mode change, or was stopped) */
+        if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode))
+                bus->pktgen_sent = bus->pktgen_rcvd = bus->pktgen_fail = 0;
+
+        return 0;
+}
+#endif /* SDTEST */
+
+static int
+dhdsdio_membytes(dhd_bus_t *bus, bool write, uint32 address, uint8 *data, uint size)
+{
+        int bcmerror = 0;
+        uint32 sdaddr;
+        uint dsize;
+
+        /* Determine initial transfer parameters */
+        sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
+        if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
+                dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
+        else
+                dsize = size;
+
+        /* Set the backplane window to include the start address */
+        if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
+                DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
+                goto xfer_done;
+        }
+
+        /* Do the transfer(s) */
+        while (size) {
+                DHD_INFO(("%s: %s %d bytes at offset 0x%08x in window 0x%08x\n",
+                          __FUNCTION__, (write ? "write" : "read"), dsize, sdaddr,
+                          (address & SBSDIO_SBWINDOW_MASK)));
+                if ((bcmerror = bcmsdh_rwdata(bus->sdh, write, sdaddr, data, dsize))) {
+                        DHD_ERROR(("%s: membytes transfer failed\n", __FUNCTION__));
+                        break;
+                }
+
+                /* Adjust for next transfer (if any) */
+                if ((size -= dsize)) {
+                        data += dsize;
+                        address += dsize;
+                        if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
+                                DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
+                                break;
+                        }
+                        sdaddr = 0;
+                        dsize = MIN(SBSDIO_SB_OFT_ADDR_LIMIT, size);
+                }
+
+        }
+
+xfer_done:
+        /* Return the window to backplane enumeration space for core access */
+        if (dhdsdio_set_siaddr_window(bus, bcmsdh_cur_sbwad(bus->sdh))) {
+                DHD_ERROR(("%s: FAILED to set window back to 0x%x\n", __FUNCTION__,
+                        bcmsdh_cur_sbwad(bus->sdh)));
+        }
+
+        return bcmerror;
+}
+
+#ifdef DHD_DEBUG
+static int
+dhdsdio_readshared(dhd_bus_t *bus, sdpcm_shared_t *sh)
+{
+        uint32 addr;
+        int rv;
+
+        /* Read last word in memory to determine address of sdpcm_shared structure */
+        if ((rv = dhdsdio_membytes(bus, FALSE, bus->ramsize - 4, (uint8 *)&addr, 4)) < 0)
+                return rv;
+
+        addr = ltoh32(addr);
+
+        DHD_INFO(("sdpcm_shared address 0x%08X\n", addr));
+
+        /*
+         * Check if addr is valid.
+         * NVRAM length at the end of memory should have been overwritten.
+         */
+        if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
+                DHD_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n", __FUNCTION__, addr));
+                return BCME_ERROR;
+        }
+
+        /* Read hndrte_shared structure */
+        if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)sh, sizeof(sdpcm_shared_t))) < 0)
+                return rv;
+
+        /* Endianness */
+        sh->flags = ltoh32(sh->flags);
+        sh->trap_addr = ltoh32(sh->trap_addr);
+        sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
+        sh->assert_file_addr = ltoh32(sh->assert_file_addr);
+        sh->assert_line = ltoh32(sh->assert_line);
+        sh->console_addr = ltoh32(sh->console_addr);
+        sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
+
+        if ((sh->flags & SDPCM_SHARED_VERSION_MASK) == 3 && SDPCM_SHARED_VERSION == 1)
+                return BCME_OK;
+
+        if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
+                DHD_ERROR(("%s: sdpcm_shared version %d in dhd "
+                           "is different than sdpcm_shared version %d in dongle\n",
+                           __FUNCTION__, SDPCM_SHARED_VERSION,
+                           sh->flags & SDPCM_SHARED_VERSION_MASK));
+                return BCME_ERROR;
+        }
+
+        return BCME_OK;
+}
+
+
+static int
+dhdsdio_readconsole(dhd_bus_t *bus)
+{
+        dhd_console_t *c = &bus->console;
+        uint8 line[CONSOLE_LINE_MAX], ch;
+        uint32 n, idx, addr;
+        int rv;
+
+        /* Don't do anything until FWREADY updates console address */
+        if (bus->console_addr == 0)
+                return 0;
+
+        /* Read console log struct */
+        addr = bus->console_addr + OFFSETOF(hndrte_cons_t, log);
+        if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
+                return rv;
+
+        /* Allocate console buffer (one time only) */
+        if (c->buf == NULL) {
+                c->bufsize = ltoh32(c->log.buf_size);
+                if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
+                        return BCME_NOMEM;
+        }
+
+        idx = ltoh32(c->log.idx);
+
+        /* Protect against corrupt value */
+        if (idx > c->bufsize)
+                return BCME_ERROR;
+
+        /* Skip reading the console buffer if the index pointer has not moved */
+        if (idx == c->last)
+                return BCME_OK;
+
+        /* Read the console buffer */
+        addr = ltoh32(c->log.buf);
+        if ((rv = dhdsdio_membytes(bus, FALSE, addr, c->buf, c->bufsize)) < 0)
+                return rv;
+
+        while (c->last != idx) {
+                for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                        if (c->last == idx) {
+                                /* This would output a partial line.  Instead, back up
+                                 * the buffer pointer and output this line next time around.
+                                 */
+                                if (c->last >= n)
+                                        c->last -= n;
+                                else
+                                        c->last = c->bufsize - n;
+                                goto break2;
+                        }
+                        ch = c->buf[c->last];
+                        c->last = (c->last + 1) % c->bufsize;
+                        if (ch == '\n')
+                                break;
+                        line[n] = ch;
+                }
+
+                if (n > 0) {
+                        if (line[n - 1] == '\r')
+                                n--;
+                        line[n] = 0;
+                        printf("CONSOLE: %s\n", line);
+                }
+        }
+break2:
+
+        return BCME_OK;
+}
+
+static int
+dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size)
+{
+        int bcmerror = 0;
+        uint msize = 512;
+        char *mbuffer = NULL;
+        char *console_buffer = NULL;
+        uint maxstrlen = 256;
+        char *str = NULL;
+        trap_t tr;
+        sdpcm_shared_t sdpcm_shared;
+        struct bcmstrbuf strbuf;
+        uint32 console_ptr, console_size, console_index;
+        uint8 line[CONSOLE_LINE_MAX], ch;
+        uint32 n, i, addr;
+        int rv;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (data == NULL) {
+                /*
+                 * Called after a rx ctrl timeout. "data" is NULL.
+                 * allocate memory to trace the trap or assert.
+                 */
+                size = msize;
+                mbuffer = data = MALLOC(bus->dhd->osh, msize);
+                if (mbuffer == NULL) {
+                        DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
+                        bcmerror = BCME_NOMEM;
+                        goto done;
+                }
+        }
+
+        if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
+                DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
+                bcmerror = BCME_NOMEM;
+                goto done;
+        }
+
+        if ((bcmerror = dhdsdio_readshared(bus, &sdpcm_shared)) < 0)
+                goto done;
+
+        bcm_binit(&strbuf, data, size);
+
+        bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
+                    sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
+
+        if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
+                /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                 * (Avoids conflict with real asserts for programmatic parsing of output.)
+                 */
+                bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
+        }
+
+        if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT|SDPCM_SHARED_TRAP)) == 0) {
+                /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                 * (Avoids conflict with real asserts for programmatic parsing of output.)
+                 */
+                bcm_bprintf(&strbuf, "No trap%s in dongle",
+                          (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
+                          ?"/assrt" :"");
+        } else {
+                if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
+                        /* Download assert */
+                        bcm_bprintf(&strbuf, "Dongle assert");
+                        if (sdpcm_shared.assert_exp_addr != 0) {
+                                str[0] = '\0';
+                                if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+                                                                 sdpcm_shared.assert_exp_addr,
+                                                                 (uint8 *)str, maxstrlen)) < 0)
+                                        goto done;
+
+                                str[maxstrlen - 1] = '\0';
+                                bcm_bprintf(&strbuf, " expr \"%s\"", str);
+                        }
+
+                        if (sdpcm_shared.assert_file_addr != 0) {
+                                str[0] = '\0';
+                                if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+                                                                 sdpcm_shared.assert_file_addr,
+                                                                 (uint8 *)str, maxstrlen)) < 0)
+                                        goto done;
+
+                                str[maxstrlen - 1] = '\0';
+                                bcm_bprintf(&strbuf, " file \"%s\"", str);
+                        }
+
+                        bcm_bprintf(&strbuf, " line %d ", sdpcm_shared.assert_line);
+                }
+
+                if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
+                        if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+                                                         sdpcm_shared.trap_addr,
+                                                         (uint8*)&tr, sizeof(trap_t))) < 0)
+                                goto done;
+
+                        bcm_bprintf(&strbuf,
+                        "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
+                        "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
+                        "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, "
+                        "r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n\n",
+                        ltoh32(tr.type), ltoh32(tr.epc), ltoh32(tr.cpsr), ltoh32(tr.spsr),
+                        ltoh32(tr.r13), ltoh32(tr.r14), ltoh32(tr.pc),
+                        ltoh32(sdpcm_shared.trap_addr),
+                        ltoh32(tr.r0), ltoh32(tr.r1), ltoh32(tr.r2), ltoh32(tr.r3),
+                        ltoh32(tr.r4), ltoh32(tr.r5), ltoh32(tr.r6), ltoh32(tr.r7));
+
+                        addr = sdpcm_shared.console_addr + OFFSETOF(hndrte_cons_t, log);
+                        if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+                                (uint8 *)&console_ptr, sizeof(console_ptr))) < 0)
+                                goto printbuf;
+
+                        addr = sdpcm_shared.console_addr + OFFSETOF(hndrte_cons_t, log.buf_size);
+                        if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+                                (uint8 *)&console_size, sizeof(console_size))) < 0)
+                                goto printbuf;
+
+                        addr = sdpcm_shared.console_addr + OFFSETOF(hndrte_cons_t, log.idx);
+                        if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+                                (uint8 *)&console_index, sizeof(console_index))) < 0)
+                                goto printbuf;
+
+                        console_ptr = ltoh32(console_ptr);
+                        console_size = ltoh32(console_size);
+                        console_index = ltoh32(console_index);
+
+                        if (console_size > CONSOLE_BUFFER_MAX ||
+                                !(console_buffer = MALLOC(bus->dhd->osh, console_size)))
+                                goto printbuf;
+
+                        if ((rv = dhdsdio_membytes(bus, FALSE, console_ptr,
+                                (uint8 *)console_buffer, console_size)) < 0)
+                                goto printbuf;
+
+                        for (i = 0, n = 0; i < console_size; i += n + 1) {
+                                for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                                        ch = console_buffer[(console_index + i + n) % console_size];
+                                        if (ch == '\n')
+                                                break;
+                                        line[n] = ch;
+                                }
+
+
+                                if (n > 0) {
+                                        if (line[n - 1] == '\r')
+                                                n--;
+                                        line[n] = 0;
+                                        /* Don't use DHD_ERROR macro since we print
+                                         * a lot of information quickly. The macro
+                                         * will truncate a lot of the printfs
+                                         */
+
+                                        if (dhd_msg_level & DHD_ERROR_VAL) {
+                                                printf("CONSOLE: %s\n", line);
+                                                DHD_BLOG(line, strlen(line) + 1);
+                                        }
+                                }
+                        }
+                }
+        }
+
+printbuf:
+        if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) {
+                DHD_ERROR(("%s: %s\n", __FUNCTION__, strbuf.origbuf));
+        }
+
+
+done:
+        if (mbuffer)
+                MFREE(bus->dhd->osh, mbuffer, msize);
+        if (str)
+                MFREE(bus->dhd->osh, str, maxstrlen);
+        if (console_buffer)
+                MFREE(bus->dhd->osh, console_buffer, console_size);
+
+        return bcmerror;
+}
+#endif /* #ifdef DHD_DEBUG */
+
+
+int
+dhdsdio_downloadvars(dhd_bus_t *bus, void *arg, int len)
+{
+        int bcmerror = BCME_OK;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        /* Basic sanity checks */
+        if (bus->dhd->up) {
+                bcmerror = BCME_NOTDOWN;
+                goto err;
+        }
+        if (!len) {
+                bcmerror = BCME_BUFTOOSHORT;
+                goto err;
+        }
+
+        /* Free the old ones and replace with passed variables */
+        if (bus->vars)
+                MFREE(bus->dhd->osh, bus->vars, bus->varsz);
+
+        bus->vars = MALLOC(bus->dhd->osh, len);
+        bus->varsz = bus->vars ? len : 0;
+        if (bus->vars == NULL) {
+                bcmerror = BCME_NOMEM;
+                goto err;
+        }
+
+        /* Copy the passed variables, which should include the terminating double-null */
+        bcopy(arg, bus->vars, bus->varsz);
+err:
+        return bcmerror;
+}
+
+#ifdef DHD_DEBUG
+
+#define CC_PLL_CHIPCTRL_SERIAL_ENAB     (1  << 24)
+static int
+dhd_serialconsole(dhd_bus_t *bus, bool set, bool enable, int *bcmerror)
+{
+        int int_val;
+        uint32 addr, data;
+
+
+        addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
+        data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
+        *bcmerror = 0;
+
+        bcmsdh_reg_write(bus->sdh, addr, 4, 1);
+        if (bcmsdh_regfail(bus->sdh)) {
+                *bcmerror = BCME_SDIO_ERROR;
+                return -1;
+        }
+        int_val = bcmsdh_reg_read(bus->sdh, data, 4);
+        if (bcmsdh_regfail(bus->sdh)) {
+                *bcmerror = BCME_SDIO_ERROR;
+                return -1;
+        }
+        if (!set)
+                return (int_val & CC_PLL_CHIPCTRL_SERIAL_ENAB);
+        if (enable)
+                int_val |= CC_PLL_CHIPCTRL_SERIAL_ENAB;
+        else
+                int_val &= ~CC_PLL_CHIPCTRL_SERIAL_ENAB;
+        bcmsdh_reg_write(bus->sdh, data, 4, int_val);
+        if (bcmsdh_regfail(bus->sdh)) {
+                *bcmerror = BCME_SDIO_ERROR;
+                return -1;
+        }
+        if (bus->sih->chip == BCM4330_CHIP_ID) {
+                uint32 chipcontrol;
+                addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol);
+                chipcontrol = bcmsdh_reg_read(bus->sdh, addr, 4);
+                chipcontrol &= ~0x8;
+                if (enable) {
+                        chipcontrol |=  0x8;
+                        chipcontrol &= ~0x3;
+                }
+                bcmsdh_reg_write(bus->sdh, addr, 4, chipcontrol);
+        }
+
+        return (int_val & CC_PLL_CHIPCTRL_SERIAL_ENAB);
+}
+#endif 
+
+static int
+dhdsdio_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+                void *params, int plen, void *arg, int len, int val_size)
+{
+        int bcmerror = 0;
+        int32 int_val = 0;
+        bool bool_val = 0;
+
+        DHD_ERROR(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
+                   __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
+
+        if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+                goto exit;
+
+        if (plen >= (int)sizeof(int_val))
+                bcopy(params, &int_val, sizeof(int_val));
+
+        bool_val = (int_val != 0) ? TRUE : FALSE;
+
+
+        /* Some ioctls use the bus */
+        dhd_os_sdlock(bus->dhd);
+
+        /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
+        if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
+                                        actionid == IOV_GVAL(IOV_DEVRESET))) {
+                bcmerror = BCME_NOTREADY;
+                goto exit;
+        }
+
+        /* Handle sleep stuff before any clock mucking */
+        if (vi->varid == IOV_SLEEP) {
+                if (IOV_ISSET(actionid)) {
+                        bcmerror = dhdsdio_bussleep(bus, bool_val);
+                } else {
+                        int_val = (int32)bus->sleeping;
+                        bcopy(&int_val, arg, val_size);
+                }
+                goto exit;
+        }
+
+        /* Request clock to allow SDIO accesses */
+        if (!bus->dhd->dongle_reset) {
+                BUS_WAKE(bus);
+                dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+        }
+
+        switch (actionid) {
+        case IOV_GVAL(IOV_INTR):
+                int_val = (int32)bus->intr;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_INTR):
+                bus->intr = bool_val;
+                bus->intdis = FALSE;
+                if (bus->dhd->up) {
+                        if (bus->intr) {
+                                DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
+                                bcmsdh_intr_enable(bus->sdh);
+                        } else {
+                                DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+                                bcmsdh_intr_disable(bus->sdh);
+                        }
+                }
+                break;
+
+        case IOV_GVAL(IOV_POLLRATE):
+                int_val = (int32)bus->pollrate;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_POLLRATE):
+                bus->pollrate = (uint)int_val;
+                bus->poll = (bus->pollrate != 0);
+                break;
+
+        case IOV_GVAL(IOV_IDLETIME):
+                int_val = bus->idletime;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_IDLETIME):
+                if ((int_val < 0) && (int_val != DHD_IDLE_IMMEDIATE)) {
+                        bcmerror = BCME_BADARG;
+                } else {
+                        bus->idletime = int_val;
+                }
+                break;
+
+        case IOV_GVAL(IOV_IDLECLOCK):
+                int_val = (int32)bus->idleclock;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_IDLECLOCK):
+                bus->idleclock = int_val;
+                break;
+
+        case IOV_GVAL(IOV_SD1IDLE):
+                int_val = (int32)sd1idle;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_SD1IDLE):
+                sd1idle = bool_val;
+                break;
+
+
+        case IOV_SVAL(IOV_MEMBYTES):
+        case IOV_GVAL(IOV_MEMBYTES):
+        {
+                uint32 address;
+                uint size, dsize;
+                uint8 *data;
+
+                bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
+
+                ASSERT(plen >= 2*sizeof(int));
+
+                address = (uint32)int_val;
+                bcopy((char *)params + sizeof(int_val), &int_val, sizeof(int_val));
+                size = (uint)int_val;
+
+                /* Do some validation */
+                dsize = set ? plen - (2 * sizeof(int)) : len;
+                if (dsize < size) {
+                        DHD_ERROR(("%s: error on %s membytes, addr 0x%08x size %d dsize %d\n",
+                                   __FUNCTION__, (set ? "set" : "get"), address, size, dsize));
+                        bcmerror = BCME_BADARG;
+                        break;
+                }
+
+                DHD_INFO(("%s: Request to %s %d bytes at address 0x%08x\n", __FUNCTION__,
+                          (set ? "write" : "read"), size, address));
+
+                /* If we know about SOCRAM, check for a fit */
+                if ((bus->orig_ramsize) &&
+                    ((address > bus->orig_ramsize) || (address + size > bus->orig_ramsize)))
+                {
+                        uint8 enable, protect;
+                        si_socdevram(bus->sih, FALSE, &enable, &protect);
+                        if (!enable || protect) {
+                                DHD_ERROR(("%s: ramsize 0x%08x doesn't have %d bytes at 0x%08x\n",
+                                        __FUNCTION__, bus->orig_ramsize, size, address));
+                                DHD_ERROR(("%s: socram enable %d, protect %d\n",
+                                        __FUNCTION__, enable, protect));
+                                bcmerror = BCME_BADARG;
+                                break;
+                        }
+                        if (enable && (bus->sih->chip == BCM4330_CHIP_ID)) {
+                                uint32 devramsize = si_socdevram_size(bus->sih);
+                                if ((address < SOCDEVRAM_4330_ARM_ADDR) ||
+                                        (address + size > (SOCDEVRAM_4330_ARM_ADDR + devramsize))) {
+                                        DHD_ERROR(("%s: bad address 0x%08x, size 0x%08x\n",
+                                                __FUNCTION__, address, size));
+                                        DHD_ERROR(("%s: socram range 0x%08x,size 0x%08x\n",
+                                                __FUNCTION__, SOCDEVRAM_4330_ARM_ADDR, devramsize));
+                                        bcmerror = BCME_BADARG;
+                                        break;
+                                }
+                                /* move it such that address is real now */
+                                address -= SOCDEVRAM_4330_ARM_ADDR;
+                                address += SOCDEVRAM_4330_BP_ADDR;
+                                DHD_INFO(("%s: Request to %s %d bytes @ Mapped address 0x%08x\n",
+                                        __FUNCTION__, (set ? "write" : "read"), size, address));
+                        }
+                }
+
+                /* Generate the actual data pointer */
+                data = set ? (uint8*)params + 2 * sizeof(int): (uint8*)arg;
+
+                /* Call to do the transfer */
+                bcmerror = dhdsdio_membytes(bus, set, address, data, size);
+
+                break;
+        }
+
+        case IOV_GVAL(IOV_MEMSIZE):
+                int_val = (int32)bus->ramsize;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_GVAL(IOV_SDIOD_DRIVE):
+                int_val = (int32)dhd_sdiod_drive_strength;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_SDIOD_DRIVE):
+                dhd_sdiod_drive_strength = int_val;
+                si_sdiod_drive_strength_init(bus->sih, bus->dhd->osh, dhd_sdiod_drive_strength);
+                break;
+
+        case IOV_SVAL(IOV_DOWNLOAD):
+                bcmerror = dhdsdio_download_state(bus, bool_val);
+                break;
+
+        case IOV_SVAL(IOV_SOCRAM_STATE):
+                bcmerror = dhdsdio_download_state(bus, bool_val);
+                break;
+
+        case IOV_SVAL(IOV_VARS):
+                bcmerror = dhdsdio_downloadvars(bus, arg, len);
+                break;
+
+        case IOV_GVAL(IOV_READAHEAD):
+                int_val = (int32)dhd_readahead;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_READAHEAD):
+                if (bool_val && !dhd_readahead)
+                        bus->nextlen = 0;
+                dhd_readahead = bool_val;
+                break;
+
+        case IOV_GVAL(IOV_SDRXCHAIN):
+                int_val = (int32)bus->use_rxchain;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_SDRXCHAIN):
+                if (bool_val && !bus->sd_rxchain)
+                        bcmerror = BCME_UNSUPPORTED;
+                else
+                        bus->use_rxchain = bool_val;
+                break;
+        case IOV_GVAL(IOV_ALIGNCTL):
+                int_val = (int32)dhd_alignctl;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_ALIGNCTL):
+                dhd_alignctl = bool_val;
+                break;
+
+        case IOV_GVAL(IOV_SDALIGN):
+                int_val = DHD_SDALIGN;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+#ifdef DHD_DEBUG
+        case IOV_GVAL(IOV_VARS):
+                if (bus->varsz < (uint)len)
+                        bcopy(bus->vars, arg, bus->varsz);
+                else
+                        bcmerror = BCME_BUFTOOSHORT;
+                break;
+#endif /* DHD_DEBUG */
+
+#ifdef DHD_DEBUG
+        case IOV_GVAL(IOV_SDREG):
+        {
+                sdreg_t *sd_ptr;
+                uint32 addr, size;
+
+                sd_ptr = (sdreg_t *)params;
+
+                addr = (uintptr)bus->regs + sd_ptr->offset;
+                size = sd_ptr->func;
+                int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
+                if (bcmsdh_regfail(bus->sdh))
+                        bcmerror = BCME_SDIO_ERROR;
+                bcopy(&int_val, arg, sizeof(int32));
+                break;
+        }
+
+        case IOV_SVAL(IOV_SDREG):
+        {
+                sdreg_t *sd_ptr;
+                uint32 addr, size;
+
+                sd_ptr = (sdreg_t *)params;
+
+                addr = (uintptr)bus->regs + sd_ptr->offset;
+                size = sd_ptr->func;
+                bcmsdh_reg_write(bus->sdh, addr, size, sd_ptr->value);
+                if (bcmsdh_regfail(bus->sdh))
+                        bcmerror = BCME_SDIO_ERROR;
+                break;
+        }
+
+        /* Same as above, but offset is not backplane (not SDIO core) */
+        case IOV_GVAL(IOV_SBREG):
+        {
+                sdreg_t sdreg;
+                uint32 addr, size;
+
+                bcopy(params, &sdreg, sizeof(sdreg));
+
+                addr = SI_ENUM_BASE + sdreg.offset;
+                size = sdreg.func;
+                int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
+                if (bcmsdh_regfail(bus->sdh))
+                        bcmerror = BCME_SDIO_ERROR;
+                bcopy(&int_val, arg, sizeof(int32));
+                break;
+        }
+
+        case IOV_SVAL(IOV_SBREG):
+        {
+                sdreg_t sdreg;
+                uint32 addr, size;
+
+                bcopy(params, &sdreg, sizeof(sdreg));
+
+                addr = SI_ENUM_BASE + sdreg.offset;
+                size = sdreg.func;
+                bcmsdh_reg_write(bus->sdh, addr, size, sdreg.value);
+                if (bcmsdh_regfail(bus->sdh))
+                        bcmerror = BCME_SDIO_ERROR;
+                break;
+        }
+
+        case IOV_GVAL(IOV_SDCIS):
+        {
+                *(char *)arg = 0;
+
+                bcmstrcat(arg, "\nFunc 0\n");
+                bcmsdh_cis_read(bus->sdh, 0x10, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+                bcmstrcat(arg, "\nFunc 1\n");
+                bcmsdh_cis_read(bus->sdh, 0x11, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+                bcmstrcat(arg, "\nFunc 2\n");
+                bcmsdh_cis_read(bus->sdh, 0x12, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+                break;
+        }
+
+        case IOV_GVAL(IOV_FORCEEVEN):
+                int_val = (int32)forcealign;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_FORCEEVEN):
+                forcealign = bool_val;
+                break;
+
+        case IOV_GVAL(IOV_TXBOUND):
+                int_val = (int32)dhd_txbound;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_TXBOUND):
+                dhd_txbound = (uint)int_val;
+                break;
+
+        case IOV_GVAL(IOV_RXBOUND):
+                int_val = (int32)dhd_rxbound;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_RXBOUND):
+                dhd_rxbound = (uint)int_val;
+                break;
+
+        case IOV_GVAL(IOV_TXMINMAX):
+                int_val = (int32)dhd_txminmax;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_TXMINMAX):
+                dhd_txminmax = (uint)int_val;
+                break;
+
+        case IOV_GVAL(IOV_SERIALCONS):
+                int_val = dhd_serialconsole(bus, FALSE, 0, &bcmerror);
+                if (bcmerror != 0)
+                        break;
+
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_SERIALCONS):
+                dhd_serialconsole(bus, TRUE, bool_val, &bcmerror);
+                break;
+
+
+
+#endif /* DHD_DEBUG */
+
+
+#ifdef SDTEST
+        case IOV_GVAL(IOV_EXTLOOP):
+                int_val = (int32)bus->ext_loop;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_EXTLOOP):
+                bus->ext_loop = bool_val;
+                break;
+
+        case IOV_GVAL(IOV_PKTGEN):
+                bcmerror = dhdsdio_pktgen_get(bus, arg);
+                break;
+
+        case IOV_SVAL(IOV_PKTGEN):
+                bcmerror = dhdsdio_pktgen_set(bus, arg);
+                break;
+#endif /* SDTEST */
+
+
+        case IOV_GVAL(IOV_DONGLEISOLATION):
+                int_val = bus->dhd->dongle_isolation;
+                bcopy(&int_val, arg, val_size);
+                break;
+
+        case IOV_SVAL(IOV_DONGLEISOLATION):
+                bus->dhd->dongle_isolation = bool_val;
+                break;
+
+        case IOV_SVAL(IOV_DEVRESET):
+                DHD_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d busstate=%d\n",
+                           __FUNCTION__, bool_val, bus->dhd->dongle_reset,
+                           bus->dhd->busstate));
+
+                ASSERT(bus->dhd->osh);
+                /* ASSERT(bus->cl_devid); */
+
+                dhd_bus_devreset(bus->dhd, (uint8)bool_val);
+
+                break;
+#ifdef SOFTAP
+        case IOV_GVAL(IOV_FWPATH):
+        {
+                uint32  fw_path_len;
+
+                fw_path_len = strlen(bus->fw_path);
+                DHD_INFO(("[softap] get fwpath, l=%d\n", len));
+
+                if (fw_path_len > len-1) {
+                        bcmerror = BCME_BUFTOOSHORT;
+                        break;
+                }
+
+                if (fw_path_len) {
+                        bcopy(bus->fw_path, arg, fw_path_len);
+                        ((uchar*)arg)[fw_path_len] = 0;
+                }
+                break;
+        }
+
+        case IOV_SVAL(IOV_FWPATH):
+                DHD_INFO(("[softap] set fwpath, idx=%d\n", int_val));
+
+                switch (int_val) {
+                case 1:
+                        bus->fw_path = fw_path; /* ordinary one */
+                        break;
+                case 2:
+                        bus->fw_path = fw_path2;
+                        break;
+                default:
+                        bcmerror = BCME_BADARG;
+                        break;
+                }
+
+                DHD_INFO(("[softap] new fw path: %s\n", (bus->fw_path[0] ? bus->fw_path : "NULL")));
+                break;
+
+#endif /* SOFTAP */
+        case IOV_GVAL(IOV_DEVRESET):
+                DHD_TRACE(("%s: Called get IOV_DEVRESET\n", __FUNCTION__));
+
+                /* Get its status */
+                int_val = (bool) bus->dhd->dongle_reset;
+                bcopy(&int_val, arg, val_size);
+
+                break;
+
+        default:
+                bcmerror = BCME_UNSUPPORTED;
+                break;
+        }
+
+exit:
+        if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                bus->activity = FALSE;
+                dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+        }
+
+        dhd_os_sdunlock(bus->dhd);
+
+        if (actionid == IOV_SVAL(IOV_DEVRESET) && bool_val == FALSE)
+                dhd_preinit_ioctls((dhd_pub_t *) bus->dhd);
+
+        return bcmerror;
+}
+
+static int
+dhdsdio_write_vars(dhd_bus_t *bus)
+{
+        int bcmerror = 0;
+        uint32 varsize;
+        uint32 varaddr;
+        uint8 *vbuffer;
+        uint32 varsizew;
+#ifdef DHD_DEBUG
+        uint8 *nvram_ularray;
+#endif /* DHD_DEBUG */
+
+        /* Even if there are no vars are to be written, we still need to set the ramsize. */
+        varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
+        varaddr = (bus->ramsize - 4) - varsize;
+
+        if (bus->vars) {
+                if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 7)) {
+                        if (((varaddr & 0x3C) == 0x3C) && (varsize > 4)) {
+                                DHD_ERROR(("PR85623WAR in place\n"));
+                                varsize += 4;
+                                varaddr -= 4;
+                        }
+                }
+
+                vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
+                if (!vbuffer)
+                        return BCME_NOMEM;
+
+                bzero(vbuffer, varsize);
+                bcopy(bus->vars, vbuffer, bus->varsz);
+
+                /* Write the vars list */
+                bcmerror = dhdsdio_membytes(bus, TRUE, varaddr, vbuffer, varsize);
+#ifdef DHD_DEBUG
+                /* Verify NVRAM bytes */
+                DHD_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
+                nvram_ularray = (uint8*)MALLOC(bus->dhd->osh, varsize);
+                if (!nvram_ularray)
+                        return BCME_NOMEM;
+
+                /* Upload image to verify downloaded contents. */
+                memset(nvram_ularray, 0xaa, varsize);
+
+                /* Read the vars list to temp buffer for comparison */
+                bcmerror = dhdsdio_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
+                if (bcmerror) {
+                                DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
+                                        __FUNCTION__, bcmerror, varsize, varaddr));
+                }
+                /* Compare the org NVRAM with the one read from RAM */
+                if (memcmp(vbuffer, nvram_ularray, varsize)) {
+                        DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
+                } else
+                        DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
+                        __FUNCTION__));
+
+                MFREE(bus->dhd->osh, nvram_ularray, varsize);
+#endif /* DHD_DEBUG */
+
+                MFREE(bus->dhd->osh, vbuffer, varsize);
+        }
+
+        /* adjust to the user specified RAM */
+        DHD_INFO(("Physical memory size: %d, usable memory size: %d\n",
+                bus->orig_ramsize, bus->ramsize));
+        DHD_INFO(("Vars are at %d, orig varsize is %d\n",
+                varaddr, varsize));
+        varsize = ((bus->orig_ramsize - 4) - varaddr);
+
+        /*
+         * Determine the length token:
+         * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
+         */
+        if (bcmerror) {
+                varsizew = 0;
+        } else {
+                varsizew = varsize / 4;
+                varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
+                varsizew = htol32(varsizew);
+        }
+
+        DHD_INFO(("New varsize is %d, length token=0x%08x\n", varsize, varsizew));
+
+        /* Write the length token to the last word */
+        bcmerror = dhdsdio_membytes(bus, TRUE, (bus->orig_ramsize - 4),
+                (uint8*)&varsizew, 4);
+
+        return bcmerror;
+}
+
+static int
+dhdsdio_download_state(dhd_bus_t *bus, bool enter)
+{
+        uint retries;
+        int bcmerror = 0;
+
+        /* To enter download state, disable ARM and reset SOCRAM.
+         * To exit download state, simply reset ARM (default is RAM boot).
+         */
+        if (enter) {
+                bus->alp_only = TRUE;
+
+                if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                    !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+                        DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                        bcmerror = BCME_ERROR;
+                        goto fail;
+                }
+
+                si_core_disable(bus->sih, 0);
+                if (bcmsdh_regfail(bus->sdh)) {
+                        bcmerror = BCME_SDIO_ERROR;
+                        goto fail;
+                }
+
+                if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                        DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                        bcmerror = BCME_ERROR;
+                        goto fail;
+                }
+
+                si_core_reset(bus->sih, 0, 0);
+                if (bcmsdh_regfail(bus->sdh)) {
+                        DHD_ERROR(("%s: Failure trying reset SOCRAM core?\n", __FUNCTION__));
+                        bcmerror = BCME_SDIO_ERROR;
+                        goto fail;
+                }
+
+                /* Clear the top bit of memory */
+                if (bus->ramsize) {
+                        uint32 zeros = 0;
+                        if (dhdsdio_membytes(bus, TRUE, bus->ramsize - 4, (uint8*)&zeros, 4) < 0) {
+                                bcmerror = BCME_SDIO_ERROR;
+                                goto fail;
+                        }
+                }
+        } else {
+                if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                        DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                        bcmerror = BCME_ERROR;
+                        goto fail;
+                }
+
+                if (!si_iscoreup(bus->sih)) {
+                        DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
+                        bcmerror = BCME_ERROR;
+                        goto fail;
+                }
+
+                if ((bcmerror = dhdsdio_write_vars(bus))) {
+                        DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+                        goto fail;
+                }
+
+                if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+                    !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+                        DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+                        bcmerror = BCME_ERROR;
+                        goto fail;
+                }
+                W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
+
+
+                if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                    !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+                        DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                        bcmerror = BCME_ERROR;
+                        goto fail;
+                }
+
+                si_core_reset(bus->sih, 0, 0);
+                if (bcmsdh_regfail(bus->sdh)) {
+                        DHD_ERROR(("%s: Failure trying to reset ARM core?\n", __FUNCTION__));
+                        bcmerror = BCME_SDIO_ERROR;
+                        goto fail;
+                }
+
+                /* Allow HT Clock now that the ARM is running. */
+                bus->alp_only = FALSE;
+
+                bus->dhd->busstate = DHD_BUS_LOAD;
+        }
+
+fail:
+        /* Always return to SDIOD core */
+        if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0))
+                si_setcore(bus->sih, SDIOD_CORE_ID, 0);
+
+        return bcmerror;
+}
+
+int
+dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                 void *params, int plen, void *arg, int len, bool set)
+{
+        dhd_bus_t *bus = dhdp->bus;
+        const bcm_iovar_t *vi = NULL;
+        int bcmerror = 0;
+        int val_size;
+        uint32 actionid;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        ASSERT(name);
+        ASSERT(len >= 0);
+
+        /* Get MUST have return space */
+        ASSERT(set || (arg && len));
+
+        /* Set does NOT take qualifiers */
+        ASSERT(!set || (!params && !plen));
+
+        /* Look up var locally; if not found pass to host driver */
+        if ((vi = bcm_iovar_lookup(dhdsdio_iovars, name)) == NULL) {
+                dhd_os_sdlock(bus->dhd);
+
+                BUS_WAKE(bus);
+
+                /* Turn on clock in case SD command needs backplane */
+                dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+                bcmerror = bcmsdh_iovar_op(bus->sdh, name, params, plen, arg, len, set);
+
+                /* Check for bus configuration changes of interest */
+
+                /* If it was divisor change, read the new one */
+                if (set && strcmp(name, "sd_divisor") == 0) {
+                        if (bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+                                            &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
+                                bus->sd_divisor = -1;
+                                DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
+                        } else {
+                                DHD_INFO(("%s: noted %s update, value now %d\n",
+                                          __FUNCTION__, name, bus->sd_divisor));
+                        }
+                }
+                /* If it was a mode change, read the new one */
+                if (set && strcmp(name, "sd_mode") == 0) {
+                        if (bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+                                            &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
+                                bus->sd_mode = -1;
+                                DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
+                        } else {
+                                DHD_INFO(("%s: noted %s update, value now %d\n",
+                                          __FUNCTION__, name, bus->sd_mode));
+                        }
+                }
+                /* Similar check for blocksize change */
+                if (set && strcmp(name, "sd_blocksize") == 0) {
+                        int32 fnum = 2;
+                        if (bcmsdh_iovar_op(bus->sdh, "sd_blocksize", &fnum, sizeof(int32),
+                                            &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
+                                bus->blocksize = 0;
+                                DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
+                        } else {
+                                DHD_INFO(("%s: noted %s update, value now %d\n",
+                                          __FUNCTION__, "sd_blocksize", bus->blocksize));
+                        }
+                }
+                bus->roundup = MIN(max_roundup, bus->blocksize);
+
+                if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                        bus->activity = FALSE;
+                        dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+                }
+
+                dhd_os_sdunlock(bus->dhd);
+                goto exit;
+        }
+
+        DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+                 name, (set ? "set" : "get"), len, plen));
+
+        /* set up 'params' pointer in case this is a set command so that
+         * the convenience int and bool code can be common to set and get
+         */
+        if (params == NULL) {
+                params = arg;
+                plen = len;
+        }
+
+        if (vi->type == IOVT_VOID)
+                val_size = 0;
+        else if (vi->type == IOVT_BUFFER)
+                val_size = len;
+        else
+                /* all other types are integer sized */
+                val_size = sizeof(int);
+
+        actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+        bcmerror = dhdsdio_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+        return bcmerror;
+}
+
+void
+dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
+{
+        osl_t *osh;
+        uint32 local_hostintmask;
+        uint8 saveclk;
+        uint retries;
+        int err;
+        if (!bus->dhd)
+                return;
+
+        osh = bus->dhd->osh;
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        bcmsdh_waitlockfree(NULL);
+
+        if (enforce_mutex)
+                dhd_os_sdlock(bus->dhd);
+
+        BUS_WAKE(bus);
+
+        /* Change our idea of bus state */
+        bus->dhd->busstate = DHD_BUS_DOWN;
+
+        /* Enable clock for device interrupts */
+        dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+        /* Disable and clear interrupts at the chip level also */
+        W_SDREG(0, &bus->regs->hostintmask, retries);
+        local_hostintmask = bus->hostintmask;
+        bus->hostintmask = 0;
+
+        /* Force clocks on backplane to be sure F2 interrupt propagates */
+        saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+        if (!err) {
+                bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                 (saveclk | SBSDIO_FORCE_HT), &err);
+        }
+        if (err) {
+                DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
+        }
+
+        /* Turn off the bus (F2), free any pending packets */
+        DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+        bcmsdh_intr_disable(bus->sdh);
+        bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
+
+        /* Clear any pending interrupts now that F2 is disabled */
+        W_SDREG(local_hostintmask, &bus->regs->intstatus, retries);
+
+        /* Turn off the backplane clock (only) */
+        dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+        /* Clear the data packet queues */
+        pktq_flush(osh, &bus->txq, TRUE, NULL, 0);
+
+        /* Clear any held glomming stuff */
+        if (bus->glomd)
+                PKTFREE(osh, bus->glomd, FALSE);
+
+        if (bus->glom)
+                PKTFREE(osh, bus->glom, FALSE);
+
+        bus->glom = bus->glomd = NULL;
+
+        /* Clear rx control and wake any waiters */
+        bus->rxlen = 0;
+        dhd_os_ioctl_resp_wake(bus->dhd);
+
+        /* Reset some F2 state stuff */
+        bus->rxskip = FALSE;
+        bus->tx_seq = bus->rx_seq = 0;
+
+        if (enforce_mutex)
+                dhd_os_sdunlock(bus->dhd);
+}
+
+
+int
+dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
+{
+        dhd_bus_t *bus = dhdp->bus;
+        dhd_timeout_t tmo;
+        uint retries = 0;
+        uint8 ready, enable;
+        int err, ret = 0;
+        uint8 saveclk;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        ASSERT(bus->dhd);
+        if (!bus->dhd)
+                return 0;
+
+        if (enforce_mutex)
+                dhd_os_sdlock(bus->dhd);
+
+        /* Make sure backplane clock is on, needed to generate F2 interrupt */
+        dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+        if (bus->clkstate != CLK_AVAIL) {
+                DHD_ERROR(("%s: clock state is wrong. state = %d\n", __FUNCTION__, bus->clkstate));
+                goto exit;
+        }
+
+
+        /* Force clocks on backplane to be sure F2 interrupt propagates */
+        saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+        if (!err) {
+                bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                 (saveclk | SBSDIO_FORCE_HT), &err);
+        }
+        if (err) {
+                DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
+                goto exit;
+        }
+
+        /* Enable function 2 (frame transfers) */
+        W_SDREG((SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT),
+                &bus->regs->tosbmailboxdata, retries);
+        enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
+
+        bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
+
+        /* Give the dongle some time to do its thing and set IOR2 */
+        dhd_timeout_start(&tmo, DHD_WAIT_F2RDY * 1000);
+
+        ready = 0;
+        while (ready != enable && !dhd_timeout_expired(&tmo))
+                ready = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IORDY, NULL);
+
+
+        DHD_INFO(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
+                  __FUNCTION__, enable, ready, tmo.elapsed));
+
+
+        /* If F2 successfully enabled, set core and enable interrupts */
+        if (ready == enable) {
+                /* Make sure we're talking to the core. */
+                if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)))
+                        bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0);
+                ASSERT(bus->regs != NULL);
+
+                /* Set up the interrupt mask and enable interrupts */
+                bus->hostintmask = HOSTINTMASK;
+                /* corerev 4 could use the newer interrupt logic to detect the frames */
+                if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 4) &&
+                        (bus->rxint_mode != SDIO_DEVICE_HMB_RXINT)) {
+                        bus->hostintmask &= ~I_HMB_FRAME_IND;
+                        bus->hostintmask |= I_XMTDATA_AVAIL;
+                }
+                W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
+
+                bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, (uint8)watermark, &err);
+
+                /* Set bus state according to enable result */
+                dhdp->busstate = DHD_BUS_DATA;
+
+                /* bcmsdh_intr_unmask(bus->sdh); */
+
+                bus->intdis = FALSE;
+                if (bus->intr) {
+                        DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
+                        bcmsdh_intr_enable(bus->sdh);
+                } else {
+                        DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+                        bcmsdh_intr_disable(bus->sdh);
+                }
+
+        }
+
+
+        else {
+                /* Disable F2 again */
+                enable = SDIO_FUNC_ENABLE_1;
+                bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
+        }
+
+        /* Restore previous clock setting */
+        bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
+
+
+        /* If we didn't come up, turn off backplane clock */
+        if (dhdp->busstate != DHD_BUS_DATA)
+                dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+
+exit:
+        if (enforce_mutex)
+                dhd_os_sdunlock(bus->dhd);
+
+        return ret;
+}
+
+static void
+dhdsdio_rxfail(dhd_bus_t *bus, bool abort, bool rtx)
+{
+        bcmsdh_info_t *sdh = bus->sdh;
+        sdpcmd_regs_t *regs = bus->regs;
+        uint retries = 0;
+        uint16 lastrbc;
+        uint8 hi, lo;
+        int err;
+
+        DHD_ERROR(("%s: %sterminate frame%s\n", __FUNCTION__,
+                   (abort ? "abort command, " : ""), (rtx ? ", send NAK" : "")));
+
+        if (abort) {
+                bcmsdh_abort(sdh, SDIO_FUNC_2);
+        }
+
+        bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM, &err);
+        bus->f1regdata++;
+
+        /* Wait until the packet has been flushed (device/FIFO stable) */
+        for (lastrbc = retries = 0xffff; retries > 0; retries--) {
+                hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCHI, NULL);
+                lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCLO, NULL);
+                bus->f1regdata += 2;
+
+                if ((hi == 0) && (lo == 0))
+                        break;
+
+                if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
+                        DHD_ERROR(("%s: count growing: last 0x%04x now 0x%04x\n",
+                                   __FUNCTION__, lastrbc, ((hi << 8) + lo)));
+                }
+                lastrbc = (hi << 8) + lo;
+        }
+
+        if (!retries) {
+                DHD_ERROR(("%s: count never zeroed: last 0x%04x\n", __FUNCTION__, lastrbc));
+        } else {
+                DHD_INFO(("%s: flush took %d iterations\n", __FUNCTION__, (0xffff - retries)));
+        }
+
+        if (rtx) {
+                bus->rxrtx++;
+                W_SDREG(SMB_NAK, &regs->tosbmailbox, retries);
+                bus->f1regdata++;
+                if (retries <= retry_limit) {
+                        bus->rxskip = TRUE;
+                }
+        }
+
+        /* Clear partial in any case */
+        bus->nextlen = 0;
+
+        /* If we can't reach the device, signal failure */
+        if (err || bcmsdh_regfail(sdh))
+                bus->dhd->busstate = DHD_BUS_DOWN;
+}
+
+static void
+dhdsdio_read_control(dhd_bus_t *bus, uint8 *hdr, uint len, uint doff)
+{
+        bcmsdh_info_t *sdh = bus->sdh;
+        uint rdlen, pad;
+
+        int sdret;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        /* Control data already received in aligned rxctl */
+        if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
+                goto gotpkt;
+
+        ASSERT(bus->rxbuf);
+        /* Set rxctl for frame (w/optional alignment) */
+        bus->rxctl = bus->rxbuf;
+        if (dhd_alignctl) {
+                bus->rxctl += firstread;
+                if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
+                        bus->rxctl += (DHD_SDALIGN - pad);
+                bus->rxctl -= firstread;
+        }
+        ASSERT(bus->rxctl >= bus->rxbuf);
+
+        /* Copy the already-read portion over */
+        bcopy(hdr, bus->rxctl, firstread);
+        if (len <= firstread)
+                goto gotpkt;
+
+        /* Copy the full data pkt in gSPI case and process ioctl. */
+        if (bus->bus == SPI_BUS) {
+                bcopy(hdr, bus->rxctl, len);
+                goto gotpkt;
+        }
+
+        /* Raise rdlen to next SDIO block to avoid tail command */
+        rdlen = len - firstread;
+        if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+                pad = bus->blocksize - (rdlen % bus->blocksize);
+                if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                    ((len + pad) < bus->dhd->maxctl))
+                        rdlen += pad;
+        } else if (rdlen % DHD_SDALIGN) {
+                rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+        }
+
+        /* Satisfy length-alignment requirements */
+        if (forcealign && (rdlen & (ALIGNMENT - 1)))
+                rdlen = ROUNDUP(rdlen, ALIGNMENT);
+
+        /* Drop if the read is too big or it exceeds our maximum */
+        if ((rdlen + firstread) > bus->dhd->maxctl) {
+                DHD_ERROR(("%s: %d-byte control read exceeds %d-byte buffer\n",
+                           __FUNCTION__, rdlen, bus->dhd->maxctl));
+                bus->dhd->rx_errors++;
+                dhdsdio_rxfail(bus, FALSE, FALSE);
+                goto done;
+        }
+
+        if ((len - doff) > bus->dhd->maxctl) {
+                DHD_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
+                           __FUNCTION__, len, (len - doff), bus->dhd->maxctl));
+                bus->dhd->rx_errors++; bus->rx_toolong++;
+                dhdsdio_rxfail(bus, FALSE, FALSE);
+                goto done;
+        }
+
+
+        /* Read remainder of frame body into the rxctl buffer */
+        sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                    (bus->rxctl + firstread), rdlen, NULL, NULL, NULL);
+        bus->f2rxdata++;
+        ASSERT(sdret != BCME_PENDING);
+
+        /* Control frame failures need retransmission */
+        if (sdret < 0) {
+                DHD_ERROR(("%s: read %d control bytes failed: %d\n", __FUNCTION__, rdlen, sdret));
+                bus->rxc_errors++; /* dhd.rx_ctlerrs is higher level */
+                dhdsdio_rxfail(bus, TRUE, TRUE);
+                goto done;
+        }
+
+gotpkt:
+
+#ifdef DHD_DEBUG
+        if (DHD_BYTES_ON() && DHD_CTL_ON()) {
+                prhex("RxCtrl", bus->rxctl, len);
+        }
+#endif
+
+        /* Point to valid data and indicate its length */
+        bus->rxctl += doff;
+        bus->rxlen = len - doff;
+
+done:
+        /* Awake any waiters */
+        dhd_os_ioctl_resp_wake(bus->dhd);
+}
+
+static uint8
+dhdsdio_rxglom(dhd_bus_t *bus, uint8 rxseq)
+{
+        uint16 dlen, totlen;
+        uint8 *dptr, num = 0;
+
+        uint16 sublen, check;
+        void *pfirst, *plast, *pnext, *save_pfirst;
+        osl_t *osh = bus->dhd->osh;
+
+        int errcode;
+        uint8 chan, seq, doff, sfdoff;
+        uint8 txmax;
+
+        int ifidx = 0;
+        bool usechain = bus->use_rxchain;
+
+        /* If packets, issue read(s) and send up packet chain */
+        /* Return sequence numbers consumed? */
+
+        DHD_TRACE(("dhdsdio_rxglom: start: glomd %p glom %p\n", bus->glomd, bus->glom));
+
+        /* If there's a descriptor, generate the packet chain */
+        if (bus->glomd) {
+                dhd_os_sdlock_rxq(bus->dhd);
+
+                pfirst = plast = pnext = NULL;
+                dlen = (uint16)PKTLEN(osh, bus->glomd);
+                dptr = PKTDATA(osh, bus->glomd);
+                if (!dlen || (dlen & 1)) {
+                        DHD_ERROR(("%s: bad glomd len (%d), ignore descriptor\n",
+                                   __FUNCTION__, dlen));
+                        dlen = 0;
+                }
+
+                for (totlen = num = 0; dlen; num++) {
+                        /* Get (and move past) next length */
+                        sublen = ltoh16_ua(dptr);
+                        dlen -= sizeof(uint16);
+                        dptr += sizeof(uint16);
+                        if ((sublen < SDPCM_HDRLEN) ||
+                            ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
+                                DHD_ERROR(("%s: descriptor len %d bad: %d\n",
+                                           __FUNCTION__, num, sublen));
+                                pnext = NULL;
+                                break;
+                        }
+                        if (sublen % DHD_SDALIGN) {
+                                DHD_ERROR(("%s: sublen %d not a multiple of %d\n",
+                                           __FUNCTION__, sublen, DHD_SDALIGN));
+                                usechain = FALSE;
+                        }
+                        totlen += sublen;
+
+                        /* For last frame, adjust read len so total is a block multiple */
+                        if (!dlen) {
+                                sublen += (ROUNDUP(totlen, bus->blocksize) - totlen);
+                                totlen = ROUNDUP(totlen, bus->blocksize);
+                        }
+
+                        /* Allocate/chain packet for next subframe */
+                        if ((pnext = PKTGET(osh, sublen + DHD_SDALIGN, FALSE)) == NULL) {
+                                DHD_ERROR(("%s: PKTGET failed, num %d len %d\n",
+                                           __FUNCTION__, num, sublen));
+                                break;
+                        }
+                        ASSERT(!PKTLINK(pnext));
+                        if (!pfirst) {
+                                ASSERT(!plast);
+                                pfirst = plast = pnext;
+                        } else {
+                                ASSERT(plast);
+                                PKTSETNEXT(osh, plast, pnext);
+                                plast = pnext;
+                        }
+
+                        /* Adhere to start alignment requirements */
+                        PKTALIGN(osh, pnext, sublen, DHD_SDALIGN);
+                }
+
+                /* If all allocations succeeded, save packet chain in bus structure */
+                if (pnext) {
+                        DHD_GLOM(("%s: allocated %d-byte packet chain for %d subframes\n",
+                                  __FUNCTION__, totlen, num));
+                        if (DHD_GLOM_ON() && bus->nextlen) {
+                                if (totlen != bus->nextlen) {
+                                        DHD_GLOM(("%s: glomdesc mismatch: nextlen %d glomdesc %d "
+                                                  "rxseq %d\n", __FUNCTION__, bus->nextlen,
+                                                  totlen, rxseq));
+                                }
+                        }
+                        bus->glom = pfirst;
+                        pfirst = pnext = NULL;
+                } else {
+                        if (pfirst)
+                                PKTFREE(osh, pfirst, FALSE);
+                        bus->glom = NULL;
+                        num = 0;
+                }
+
+                /* Done with descriptor packet */
+                PKTFREE(osh, bus->glomd, FALSE);
+                bus->glomd = NULL;
+                bus->nextlen = 0;
+
+                dhd_os_sdunlock_rxq(bus->dhd);
+        }
+
+        /* Ok -- either we just generated a packet chain, or had one from before */
+        if (bus->glom) {
+                if (DHD_GLOM_ON()) {
+                        DHD_GLOM(("%s: attempt superframe read, packet chain:\n", __FUNCTION__));
+                        for (pnext = bus->glom; pnext; pnext = PKTNEXT(osh, pnext)) {
+                                DHD_GLOM(("    %p: %p len 0x%04x (%d)\n",
+                                          pnext, (uint8*)PKTDATA(osh, pnext),
+                                          PKTLEN(osh, pnext), PKTLEN(osh, pnext)));
+                        }
+                }
+
+                pfirst = bus->glom;
+                dlen = (uint16)pkttotlen(osh, pfirst);
+
+                /* Do an SDIO read for the superframe.  Configurable iovar to
+                 * read directly into the chained packet, or allocate a large
+                 * packet and and copy into the chain.
+                 */
+                if (usechain) {
+                        errcode = dhd_bcmsdh_recv_buf(bus,
+                                                      bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
+                                                      F2SYNC, (uint8*)PKTDATA(osh, pfirst),
+                                                      dlen, pfirst, NULL, NULL);
+                } else if (bus->dataptr) {
+                        errcode = dhd_bcmsdh_recv_buf(bus,
+                                                      bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
+                                                      F2SYNC, bus->dataptr,
+                                                      dlen, NULL, NULL, NULL);
+                        sublen = (uint16)pktfrombuf(osh, pfirst, 0, dlen, bus->dataptr);
+                        if (sublen != dlen) {
+                                DHD_ERROR(("%s: FAILED TO COPY, dlen %d sublen %d\n",
+                                           __FUNCTION__, dlen, sublen));
+                                errcode = -1;
+                        }
+                        pnext = NULL;
+                } else {
+                        DHD_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n", dlen));
+                        errcode = -1;
+                }
+                bus->f2rxdata++;
+                ASSERT(errcode != BCME_PENDING);
+
+                /* On failure, kill the superframe, allow a couple retries */
+                if (errcode < 0) {
+                        DHD_ERROR(("%s: glom read of %d bytes failed: %d\n",
+                                   __FUNCTION__, dlen, errcode));
+                        bus->dhd->rx_errors++;
+
+                        if (bus->glomerr++ < 3) {
+                                dhdsdio_rxfail(bus, TRUE, TRUE);
+                        } else {
+                                bus->glomerr = 0;
+                                dhdsdio_rxfail(bus, TRUE, FALSE);
+                                dhd_os_sdlock_rxq(bus->dhd);
+                                PKTFREE(osh, bus->glom, FALSE);
+                                dhd_os_sdunlock_rxq(bus->dhd);
+                                bus->rxglomfail++;
+                                bus->glom = NULL;
+                        }
+                        return 0;
+                }
+
+#ifdef DHD_DEBUG
+                if (DHD_GLOM_ON()) {
+                        prhex("SUPERFRAME", PKTDATA(osh, pfirst),
+                              MIN(PKTLEN(osh, pfirst), 48));
+                }
+#endif
+
+
+                /* Validate the superframe header */
+                dptr = (uint8 *)PKTDATA(osh, pfirst);
+                sublen = ltoh16_ua(dptr);
+                check = ltoh16_ua(dptr + sizeof(uint16));
+
+                chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+                bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+                if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                        DHD_INFO(("%s: got frame w/nextlen too large (%d) seq %d\n",
+                                  __FUNCTION__, bus->nextlen, seq));
+                        bus->nextlen = 0;
+                }
+                doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+                txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+                errcode = 0;
+                if ((uint16)~(sublen^check)) {
+                        DHD_ERROR(("%s (superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
+                                   __FUNCTION__, sublen, check));
+                        errcode = -1;
+                } else if (ROUNDUP(sublen, bus->blocksize) != dlen) {
+                        DHD_ERROR(("%s (superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
+                                   __FUNCTION__, sublen, ROUNDUP(sublen, bus->blocksize), dlen));
+                        errcode = -1;
+                } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) != SDPCM_GLOM_CHANNEL) {
+                        DHD_ERROR(("%s (superframe): bad channel %d\n", __FUNCTION__,
+                                   SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN])));
+                        errcode = -1;
+                } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
+                        DHD_ERROR(("%s (superframe): got second descriptor?\n", __FUNCTION__));
+                        errcode = -1;
+                } else if ((doff < SDPCM_HDRLEN) ||
+                           (doff > (PKTLEN(osh, pfirst) - SDPCM_HDRLEN))) {
+                        DHD_ERROR(("%s (superframe): Bad data offset %d: HW %d pkt %d min %d\n",
+                                   __FUNCTION__, doff, sublen, PKTLEN(osh, pfirst), SDPCM_HDRLEN));
+                        errcode = -1;
+                }
+
+                /* Check sequence number of superframe SW header */
+                if (rxseq != seq) {
+                        DHD_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
+                                  __FUNCTION__, seq, rxseq));
+                        bus->rx_badseq++;
+                        rxseq = seq;
+                }
+
+                /* Check window for sanity */
+                if ((uint8)(txmax - bus->tx_seq) > 0x40) {
+                        DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                   __FUNCTION__, txmax, bus->tx_seq));
+                        txmax = bus->tx_seq;
+                }
+                bus->tx_max = txmax;
+
+                /* Remove superframe header, remember offset */
+                PKTPULL(osh, pfirst, doff);
+                sfdoff = doff;
+
+                /* Validate all the subframe headers */
+                for (num = 0, pnext = pfirst; pnext && !errcode;
+                     num++, pnext = PKTNEXT(osh, pnext)) {
+                        dptr = (uint8 *)PKTDATA(osh, pnext);
+                        dlen = (uint16)PKTLEN(osh, pnext);
+                        sublen = ltoh16_ua(dptr);
+                        check = ltoh16_ua(dptr + sizeof(uint16));
+                        chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                        doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+#ifdef DHD_DEBUG
+                        if (DHD_GLOM_ON()) {
+                                prhex("subframe", dptr, 32);
+                        }
+#endif
+
+                        if ((uint16)~(sublen^check)) {
+                                DHD_ERROR(("%s (subframe %d): HW hdr error: "
+                                           "len/check 0x%04x/0x%04x\n",
+                                           __FUNCTION__, num, sublen, check));
+                                errcode = -1;
+                        } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
+                                DHD_ERROR(("%s (subframe %d): length mismatch: "
+                                           "len 0x%04x, expect 0x%04x\n",
+                                           __FUNCTION__, num, sublen, dlen));
+                                errcode = -1;
+                        } else if ((chan != SDPCM_DATA_CHANNEL) &&
+                                   (chan != SDPCM_EVENT_CHANNEL)) {
+                                DHD_ERROR(("%s (subframe %d): bad channel %d\n",
+                                           __FUNCTION__, num, chan));
+                                errcode = -1;
+                        } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
+                                DHD_ERROR(("%s (subframe %d): Bad data offset %d: HW %d min %d\n",
+                                           __FUNCTION__, num, doff, sublen, SDPCM_HDRLEN));
+                                errcode = -1;
+                        }
+                }
+
+                if (errcode) {
+                        /* Terminate frame on error, request a couple retries */
+                        if (bus->glomerr++ < 3) {
+                                /* Restore superframe header space */
+                                PKTPUSH(osh, pfirst, sfdoff);
+                                dhdsdio_rxfail(bus, TRUE, TRUE);
+                        } else {
+                                bus->glomerr = 0;
+                                dhdsdio_rxfail(bus, TRUE, FALSE);
+                                dhd_os_sdlock_rxq(bus->dhd);
+                                PKTFREE(osh, bus->glom, FALSE);
+                                dhd_os_sdunlock_rxq(bus->dhd);
+                                bus->rxglomfail++;
+                                bus->glom = NULL;
+                        }
+                        bus->nextlen = 0;
+                        return 0;
+                }
+
+                /* Basic SD framing looks ok - process each packet (header) */
+                save_pfirst = pfirst;
+                bus->glom = NULL;
+                plast = NULL;
+
+                dhd_os_sdlock_rxq(bus->dhd);
+                for (num = 0; pfirst; rxseq++, pfirst = pnext) {
+                        pnext = PKTNEXT(osh, pfirst);
+                        PKTSETNEXT(osh, pfirst, NULL);
+
+                        dptr = (uint8 *)PKTDATA(osh, pfirst);
+                        sublen = ltoh16_ua(dptr);
+                        chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                        seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+                        doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+                        DHD_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
+                                  __FUNCTION__, num, pfirst, PKTDATA(osh, pfirst),
+                                  PKTLEN(osh, pfirst), sublen, chan, seq));
+
+                        ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL));
+
+                        if (rxseq != seq) {
+                                DHD_GLOM(("%s: rx_seq %d, expected %d\n",
+                                          __FUNCTION__, seq, rxseq));
+                                bus->rx_badseq++;
+                                rxseq = seq;
+                        }
+
+#ifdef DHD_DEBUG
+                        if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                                prhex("Rx Subframe Data", dptr, dlen);
+                        }
+#endif
+
+                        PKTSETLEN(osh, pfirst, sublen);
+                        PKTPULL(osh, pfirst, doff);
+
+                        if (PKTLEN(osh, pfirst) == 0) {
+                                PKTFREE(bus->dhd->osh, pfirst, FALSE);
+                                if (plast) {
+                                        PKTSETNEXT(osh, plast, pnext);
+                                } else {
+                                        ASSERT(save_pfirst == pfirst);
+                                        save_pfirst = pnext;
+                                }
+                                continue;
+                        } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pfirst) != 0) {
+                                DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
+                                bus->dhd->rx_errors++;
+                                PKTFREE(osh, pfirst, FALSE);
+                                if (plast) {
+                                        PKTSETNEXT(osh, plast, pnext);
+                                } else {
+                                        ASSERT(save_pfirst == pfirst);
+                                        save_pfirst = pnext;
+                                }
+                                continue;
+                        }
+
+                        /* this packet will go up, link back into chain and count it */
+                        PKTSETNEXT(osh, pfirst, pnext);
+                        plast = pfirst;
+                        num++;
+
+#ifdef DHD_DEBUG
+                        if (DHD_GLOM_ON()) {
+                                DHD_GLOM(("%s subframe %d to stack, %p(%p/%d) nxt/lnk %p/%p\n",
+                                          __FUNCTION__, num, pfirst,
+                                          PKTDATA(osh, pfirst), PKTLEN(osh, pfirst),
+                                          PKTNEXT(osh, pfirst), PKTLINK(pfirst)));
+                                prhex("", (uint8 *)PKTDATA(osh, pfirst),
+                                      MIN(PKTLEN(osh, pfirst), 32));
+                        }
+#endif /* DHD_DEBUG */
+                }
+                dhd_os_sdunlock_rxq(bus->dhd);
+                if (num) {
+                        dhd_os_sdunlock(bus->dhd);
+                        dhd_rx_frame(bus->dhd, ifidx, save_pfirst, num, 0);
+                        dhd_os_sdlock(bus->dhd);
+                }
+
+                bus->rxglomframes++;
+                bus->rxglompkts += num;
+        }
+        return num;
+}
+
+/* Return TRUE if there may be more frames to read */
+static uint
+dhdsdio_readframes(dhd_bus_t *bus, uint maxframes, bool *finished)
+{
+        osl_t *osh = bus->dhd->osh;
+        bcmsdh_info_t *sdh = bus->sdh;
+
+        uint16 len, check;      /* Extracted hardware header fields */
+        uint8 chan, seq, doff;  /* Extracted software header fields */
+        uint8 fcbits;           /* Extracted fcbits from software header */
+        uint8 delta;
+
+        void *pkt;      /* Packet for event or data frames */
+        uint16 pad;     /* Number of pad bytes to read */
+        uint16 rdlen;   /* Total number of bytes to read */
+        uint8 rxseq;    /* Next sequence number to expect */
+        uint rxleft = 0;        /* Remaining number of frames allowed */
+        int sdret;      /* Return code from bcmsdh calls */
+        uint8 txmax;    /* Maximum tx sequence offered */
+        bool len_consistent; /* Result of comparing readahead len and len from hw-hdr */
+        uint8 *rxbuf;
+        int ifidx = 0;
+        uint rxcount = 0; /* Total frames read */
+
+#if defined(DHD_DEBUG) || defined(SDTEST)
+        bool sdtest = FALSE;    /* To limit message spew from test mode */
+#endif
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        ASSERT(maxframes);
+
+#ifdef SDTEST
+        /* Allow pktgen to override maxframes */
+        if (bus->pktgen_count && (bus->pktgen_mode == DHD_PKTGEN_RECV)) {
+                maxframes = bus->pktgen_count;
+                sdtest = TRUE;
+        }
+#endif
+
+        /* Not finished unless we encounter no more frames indication */
+        *finished = FALSE;
+
+
+        for (rxseq = bus->rx_seq, rxleft = maxframes;
+             !bus->rxskip && rxleft && bus->dhd->busstate != DHD_BUS_DOWN;
+             rxseq++, rxleft--) {
+
+                /* Handle glomming separately */
+                if (bus->glom || bus->glomd) {
+                        uint8 cnt;
+                        DHD_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
+                                  __FUNCTION__, bus->glomd, bus->glom));
+                        cnt = dhdsdio_rxglom(bus, rxseq);
+                        DHD_GLOM(("%s: rxglom returned %d\n", __FUNCTION__, cnt));
+                        rxseq += cnt - 1;
+                        rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
+                        continue;
+                }
+
+                /* Try doing single read if we can */
+                if (dhd_readahead && bus->nextlen) {
+                        uint16 nextlen = bus->nextlen;
+                        bus->nextlen = 0;
+
+                        if (bus->bus == SPI_BUS) {
+                                rdlen = len = nextlen;
+                        }
+                        else {
+                                rdlen = len = nextlen << 4;
+
+                                /* Pad read to blocksize for efficiency */
+                                if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+                                        pad = bus->blocksize - (rdlen % bus->blocksize);
+                                        if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                                                ((rdlen + pad + firstread) < MAX_RX_DATASZ))
+                                                rdlen += pad;
+                                } else if (rdlen % DHD_SDALIGN) {
+                                        rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+                                }
+                        }
+
+                        /* We use bus->rxctl buffer in WinXP for initial control pkt receives.
+                         * Later we use buffer-poll for data as well as control packets.
+                         * This is required because dhd receives full frame in gSPI unlike SDIO.
+                         * After the frame is received we have to distinguish whether it is data
+                         * or non-data frame.
+                         */
+                        /* Allocate a packet buffer */
+                        dhd_os_sdlock_rxq(bus->dhd);
+                        if (!(pkt = PKTGET(osh, rdlen + DHD_SDALIGN, FALSE))) {
+                                if (bus->bus == SPI_BUS) {
+                                        bus->usebufpool = FALSE;
+                                        bus->rxctl = bus->rxbuf;
+                                        if (dhd_alignctl) {
+                                                bus->rxctl += firstread;
+                                                if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
+                                                        bus->rxctl += (DHD_SDALIGN - pad);
+                                                bus->rxctl -= firstread;
+                                        }
+                                        ASSERT(bus->rxctl >= bus->rxbuf);
+                                        rxbuf = bus->rxctl;
+                                        /* Read the entire frame */
+                                        sdret = dhd_bcmsdh_recv_buf(bus,
+                                                                    bcmsdh_cur_sbwad(sdh),
+                                                                    SDIO_FUNC_2,
+                                                                    F2SYNC, rxbuf, rdlen,
+                                                                    NULL, NULL, NULL);
+                                        bus->f2rxdata++;
+                                        ASSERT(sdret != BCME_PENDING);
+
+
+                                        /* Control frame failures need retransmission */
+                                        if (sdret < 0) {
+                                                DHD_ERROR(("%s: read %d control bytes failed: %d\n",
+                                                   __FUNCTION__, rdlen, sdret));
+                                                /* dhd.rx_ctlerrs is higher level */
+                                                bus->rxc_errors++;
+                                                dhd_os_sdunlock_rxq(bus->dhd);
+                                                dhdsdio_rxfail(bus, TRUE,
+                                                    (bus->bus == SPI_BUS) ? FALSE : TRUE);
+                                                continue;
+                                        }
+                                } else {
+                                        /* Give up on data, request rtx of events */
+                                        DHD_ERROR(("%s (nextlen): PKTGET failed: len %d rdlen %d "
+                                                   "expected rxseq %d\n",
+                                                   __FUNCTION__, len, rdlen, rxseq));
+                                        /* Just go try again w/normal header read */
+                                        dhd_os_sdunlock_rxq(bus->dhd);
+                                        continue;
+                                }
+                        } else {
+                                if (bus->bus == SPI_BUS)
+                                        bus->usebufpool = TRUE;
+
+                                ASSERT(!PKTLINK(pkt));
+                                PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
+                                rxbuf = (uint8 *)PKTDATA(osh, pkt);
+                                /* Read the entire frame */
+                                sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh),
+                                                            SDIO_FUNC_2,
+                                                            F2SYNC, rxbuf, rdlen,
+                                                            pkt, NULL, NULL);
+                                bus->f2rxdata++;
+                                ASSERT(sdret != BCME_PENDING);
+
+                                if (sdret < 0) {
+                                        DHD_ERROR(("%s (nextlen): read %d bytes failed: %d\n",
+                                           __FUNCTION__, rdlen, sdret));
+                                        PKTFREE(bus->dhd->osh, pkt, FALSE);
+                                        bus->dhd->rx_errors++;
+                                        dhd_os_sdunlock_rxq(bus->dhd);
+                                        /* Force retry w/normal header read.  Don't attempt NAK for
+                                         * gSPI
+                                         */
+                                        dhdsdio_rxfail(bus, TRUE,
+                                              (bus->bus == SPI_BUS) ? FALSE : TRUE);
+                                        continue;
+                                }
+                        }
+                        dhd_os_sdunlock_rxq(bus->dhd);
+
+                        /* Now check the header */
+                        bcopy(rxbuf, bus->rxhdr, SDPCM_HDRLEN);
+
+                        /* Extract hardware header fields */
+                        len = ltoh16_ua(bus->rxhdr);
+                        check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
+
+                        /* All zeros means readahead info was bad */
+                        if (!(len|check)) {
+                                DHD_INFO(("%s (nextlen): read zeros in HW header???\n",
+                                           __FUNCTION__));
+                                dhd_os_sdlock_rxq(bus->dhd);
+                                PKTFREE2();
+                                dhd_os_sdunlock_rxq(bus->dhd);
+                                GSPI_PR55150_BAILOUT;
+                                continue;
+                        }
+
+                        /* Validate check bytes */
+                        if ((uint16)~(len^check)) {
+                                DHD_ERROR(("%s (nextlen): HW hdr error: nextlen/len/check"
+                                           " 0x%04x/0x%04x/0x%04x\n", __FUNCTION__, nextlen,
+                                           len, check));
+                                dhd_os_sdlock_rxq(bus->dhd);
+                                PKTFREE2();
+                                dhd_os_sdunlock_rxq(bus->dhd);
+                                bus->rx_badhdr++;
+                                dhdsdio_rxfail(bus, FALSE, FALSE);
+                                GSPI_PR55150_BAILOUT;
+                                continue;
+                        }
+
+                        /* Validate frame length */
+                        if (len < SDPCM_HDRLEN) {
+                                DHD_ERROR(("%s (nextlen): HW hdr length invalid: %d\n",
+                                           __FUNCTION__, len));
+                                dhd_os_sdlock_rxq(bus->dhd);
+                                PKTFREE2();
+                                dhd_os_sdunlock_rxq(bus->dhd);
+                                GSPI_PR55150_BAILOUT;
+                                continue;
+                        }
+
+                        /* Check for consistency with readahead info */
+                                len_consistent = (nextlen != (ROUNDUP(len, 16) >> 4));
+                        if (len_consistent) {
+                                /* Mismatch, force retry w/normal header (may be >4K) */
+                                DHD_ERROR(("%s (nextlen): mismatch, nextlen %d len %d rnd %d; "
+                                           "expected rxseq %d\n",
+                                           __FUNCTION__, nextlen, len, ROUNDUP(len, 16), rxseq));
+                                dhd_os_sdlock_rxq(bus->dhd);
+                                PKTFREE2();
+                                dhd_os_sdunlock_rxq(bus->dhd);
+                                dhdsdio_rxfail(bus, TRUE, (bus->bus == SPI_BUS) ? FALSE : TRUE);
+                                GSPI_PR55150_BAILOUT;
+                                continue;
+                        }
+
+
+                        /* Extract software header fields */
+                        chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                        seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                        doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                        txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                                bus->nextlen =
+                                         bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+                                if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                                        DHD_INFO(("%s (nextlen): got frame w/nextlen too large"
+                                                  " (%d), seq %d\n", __FUNCTION__, bus->nextlen,
+                                                  seq));
+                                        bus->nextlen = 0;
+                                }
+
+                                bus->dhd->rx_readahead_cnt ++;
+                        /* Handle Flow Control */
+                        fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                        delta = 0;
+                        if (~bus->flowcontrol & fcbits) {
+                                bus->fc_xoff++;
+                                delta = 1;
+                        }
+                        if (bus->flowcontrol & ~fcbits) {
+                                bus->fc_xon++;
+                                delta = 1;
+                        }
+
+                        if (delta) {
+                                bus->fc_rcvd++;
+                                bus->flowcontrol = fcbits;
+                        }
+
+                        /* Check and update sequence number */
+                        if (rxseq != seq) {
+                                DHD_INFO(("%s (nextlen): rx_seq %d, expected %d\n",
+                                          __FUNCTION__, seq, rxseq));
+                                bus->rx_badseq++;
+                                rxseq = seq;
+                        }
+
+                        /* Check window for sanity */
+                        if ((uint8)(txmax - bus->tx_seq) > 0x40) {
+                                        DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                                __FUNCTION__, txmax, bus->tx_seq));
+                                        txmax = bus->tx_seq;
+                        }
+                        bus->tx_max = txmax;
+
+#ifdef DHD_DEBUG
+                        if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                                prhex("Rx Data", rxbuf, len);
+                        } else if (DHD_HDRS_ON()) {
+                                prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
+                        }
+#endif
+
+                        if (chan == SDPCM_CONTROL_CHANNEL) {
+                                if (bus->bus == SPI_BUS) {
+                                        dhdsdio_read_control(bus, rxbuf, len, doff);
+                                        if (bus->usebufpool) {
+                                                dhd_os_sdlock_rxq(bus->dhd);
+                                                PKTFREE(bus->dhd->osh, pkt, FALSE);
+                                                dhd_os_sdunlock_rxq(bus->dhd);
+                                        }
+                                        continue;
+                                } else {
+                                        DHD_ERROR(("%s (nextlen): readahead on control"
+                                                   " packet %d?\n", __FUNCTION__, seq));
+                                        /* Force retry w/normal header read */
+                                        bus->nextlen = 0;
+                                        dhdsdio_rxfail(bus, FALSE, TRUE);
+                                        dhd_os_sdlock_rxq(bus->dhd);
+                                        PKTFREE2();
+                                        dhd_os_sdunlock_rxq(bus->dhd);
+                                        continue;
+                                }
+                        }
+
+                        if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
+                                DHD_ERROR(("Received %d bytes on %d channel. Running out of "
+                                           "rx pktbuf's or not yet malloced.\n", len, chan));
+                                continue;
+                        }
+
+                        /* Validate data offset */
+                        if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+                                DHD_ERROR(("%s (nextlen): bad data offset %d: HW len %d min %d\n",
+                                           __FUNCTION__, doff, len, SDPCM_HDRLEN));
+                                dhd_os_sdlock_rxq(bus->dhd);
+                                PKTFREE2();
+                                dhd_os_sdunlock_rxq(bus->dhd);
+                                ASSERT(0);
+                                dhdsdio_rxfail(bus, FALSE, FALSE);
+                                continue;
+                        }
+
+                        /* All done with this one -- now deliver the packet */
+                        goto deliver;
+                }
+                /* gSPI frames should not be handled in fractions */
+                if (bus->bus == SPI_BUS) {
+                        break;
+                }
+
+                /* Read frame header (hardware and software) */
+                sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                            bus->rxhdr, firstread, NULL, NULL, NULL);
+                bus->f2rxhdrs++;
+                ASSERT(sdret != BCME_PENDING);
+
+                if (sdret < 0) {
+                        DHD_ERROR(("%s: RXHEADER FAILED: %d\n", __FUNCTION__, sdret));
+                        bus->rx_hdrfail++;
+                        dhdsdio_rxfail(bus, TRUE, TRUE);
+                        continue;
+                }
+
+#ifdef DHD_DEBUG
+                if (DHD_BYTES_ON() || DHD_HDRS_ON()) {
+                        prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
+                }
+#endif
+
+                /* Extract hardware header fields */
+                len = ltoh16_ua(bus->rxhdr);
+                check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
+
+                /* All zeros means no more frames */
+                if (!(len|check)) {
+                        *finished = TRUE;
+                        break;
+                }
+
+                /* Validate check bytes */
+                if ((uint16)~(len^check)) {
+                        DHD_ERROR(("%s: HW hdr error: len/check 0x%04x/0x%04x\n",
+                                   __FUNCTION__, len, check));
+                        bus->rx_badhdr++;
+                        dhdsdio_rxfail(bus, FALSE, FALSE);
+                        continue;
+                }
+
+                /* Validate frame length */
+                if (len < SDPCM_HDRLEN) {
+                        DHD_ERROR(("%s: HW hdr length invalid: %d\n", __FUNCTION__, len));
+                        continue;
+                }
+
+                /* Extract software header fields */
+                chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                /* Validate data offset */
+                if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+                        DHD_ERROR(("%s: Bad data offset %d: HW len %d, min %d seq %d\n",
+                                   __FUNCTION__, doff, len, SDPCM_HDRLEN, seq));
+                        bus->rx_badhdr++;
+                        ASSERT(0);
+                        dhdsdio_rxfail(bus, FALSE, FALSE);
+                        continue;
+                }
+
+                /* Save the readahead length if there is one */
+                bus->nextlen = bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+                if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                        DHD_INFO(("%s (nextlen): got frame w/nextlen too large (%d), seq %d\n",
+                                  __FUNCTION__, bus->nextlen, seq));
+                        bus->nextlen = 0;
+                }
+
+                /* Handle Flow Control */
+                fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                delta = 0;
+                if (~bus->flowcontrol & fcbits) {
+                        bus->fc_xoff++;
+                        delta = 1;
+                }
+                if (bus->flowcontrol & ~fcbits) {
+                        bus->fc_xon++;
+                        delta = 1;
+                }
+
+                if (delta) {
+                        bus->fc_rcvd++;
+                        bus->flowcontrol = fcbits;
+                }
+
+                /* Check and update sequence number */
+                if (rxseq != seq) {
+                        DHD_INFO(("%s: rx_seq %d, expected %d\n", __FUNCTION__, seq, rxseq));
+                        bus->rx_badseq++;
+                        rxseq = seq;
+                }
+
+                /* Check window for sanity */
+                if ((uint8)(txmax - bus->tx_seq) > 0x40) {
+                        DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                   __FUNCTION__, txmax, bus->tx_seq));
+                        txmax = bus->tx_seq;
+                }
+                bus->tx_max = txmax;
+
+                /* Call a separate function for control frames */
+                if (chan == SDPCM_CONTROL_CHANNEL) {
+                        dhdsdio_read_control(bus, bus->rxhdr, len, doff);
+                        continue;
+                }
+
+                ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL) ||
+                       (chan == SDPCM_TEST_CHANNEL) || (chan == SDPCM_GLOM_CHANNEL));
+
+                /* Length to read */
+                rdlen = (len > firstread) ? (len - firstread) : 0;
+
+                /* May pad read to blocksize for efficiency */
+                if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+                        pad = bus->blocksize - (rdlen % bus->blocksize);
+                        if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                            ((rdlen + pad + firstread) < MAX_RX_DATASZ))
+                                rdlen += pad;
+                } else if (rdlen % DHD_SDALIGN) {
+                        rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+                }
+
+                /* Satisfy length-alignment requirements */
+                if (forcealign && (rdlen & (ALIGNMENT - 1)))
+                        rdlen = ROUNDUP(rdlen, ALIGNMENT);
+
+                if ((rdlen + firstread) > MAX_RX_DATASZ) {
+                        /* Too long -- skip this frame */
+                        DHD_ERROR(("%s: too long: len %d rdlen %d\n", __FUNCTION__, len, rdlen));
+                        bus->dhd->rx_errors++; bus->rx_toolong++;
+                        dhdsdio_rxfail(bus, FALSE, FALSE);
+                        continue;
+                }
+
+                dhd_os_sdlock_rxq(bus->dhd);
+                if (!(pkt = PKTGET(osh, (rdlen + firstread + DHD_SDALIGN), FALSE))) {
+                        /* Give up on data, request rtx of events */
+                        DHD_ERROR(("%s: PKTGET failed: rdlen %d chan %d\n",
+                                   __FUNCTION__, rdlen, chan));
+                        bus->dhd->rx_dropped++;
+                        dhd_os_sdunlock_rxq(bus->dhd);
+                        dhdsdio_rxfail(bus, FALSE, RETRYCHAN(chan));
+                        continue;
+                }
+                dhd_os_sdunlock_rxq(bus->dhd);
+
+                ASSERT(!PKTLINK(pkt));
+
+                /* Leave room for what we already read, and align remainder */
+                ASSERT(firstread < (PKTLEN(osh, pkt)));
+                PKTPULL(osh, pkt, firstread);
+                PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
+
+                /* Read the remaining frame data */
+                sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                            ((uint8 *)PKTDATA(osh, pkt)), rdlen, pkt, NULL, NULL);
+                bus->f2rxdata++;
+                ASSERT(sdret != BCME_PENDING);
+
+                if (sdret < 0) {
+                        DHD_ERROR(("%s: read %d %s bytes failed: %d\n", __FUNCTION__, rdlen,
+                                   ((chan == SDPCM_EVENT_CHANNEL) ? "event" :
+                                    ((chan == SDPCM_DATA_CHANNEL) ? "data" : "test")), sdret));
+                        dhd_os_sdlock_rxq(bus->dhd);
+                        PKTFREE(bus->dhd->osh, pkt, FALSE);
+                        dhd_os_sdunlock_rxq(bus->dhd);
+                        bus->dhd->rx_errors++;
+                        dhdsdio_rxfail(bus, TRUE, RETRYCHAN(chan));
+                        continue;
+                }
+
+                /* Copy the already-read portion */
+                PKTPUSH(osh, pkt, firstread);
+                bcopy(bus->rxhdr, PKTDATA(osh, pkt), firstread);
+
+#ifdef DHD_DEBUG
+                if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                        prhex("Rx Data", PKTDATA(osh, pkt), len);
+                }
+#endif
+
+deliver:
+                /* Save superframe descriptor and allocate packet frame */
+                if (chan == SDPCM_GLOM_CHANNEL) {
+                        if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
+                                DHD_GLOM(("%s: got glom descriptor, %d bytes:\n",
+                                          __FUNCTION__, len));
+#ifdef DHD_DEBUG
+                                if (DHD_GLOM_ON()) {
+                                        prhex("Glom Data", PKTDATA(osh, pkt), len);
+                                }
+#endif
+                                PKTSETLEN(osh, pkt, len);
+                                ASSERT(doff == SDPCM_HDRLEN);
+                                PKTPULL(osh, pkt, SDPCM_HDRLEN);
+                                bus->glomd = pkt;
+                        } else {
+                                DHD_ERROR(("%s: glom superframe w/o descriptor!\n", __FUNCTION__));
+                                dhdsdio_rxfail(bus, FALSE, FALSE);
+                        }
+                        continue;
+                }
+
+                /* Fill in packet len and prio, deliver upward */
+                PKTSETLEN(osh, pkt, len);
+                PKTPULL(osh, pkt, doff);
+
+#ifdef SDTEST
+                /* Test channel packets are processed separately */
+                if (chan == SDPCM_TEST_CHANNEL) {
+                        dhdsdio_testrcv(bus, pkt, seq);
+                        continue;
+                }
+#endif /* SDTEST */
+
+                if (PKTLEN(osh, pkt) == 0) {
+                        dhd_os_sdlock_rxq(bus->dhd);
+                        PKTFREE(bus->dhd->osh, pkt, FALSE);
+                        dhd_os_sdunlock_rxq(bus->dhd);
+                        continue;
+                } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pkt) != 0) {
+                        DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
+                        dhd_os_sdlock_rxq(bus->dhd);
+                        PKTFREE(bus->dhd->osh, pkt, FALSE);
+                        dhd_os_sdunlock_rxq(bus->dhd);
+                        bus->dhd->rx_errors++;
+                        continue;
+                }
+
+
+                /* Unlock during rx call */
+                dhd_os_sdunlock(bus->dhd);
+                dhd_rx_frame(bus->dhd, ifidx, pkt, 1, chan);
+                dhd_os_sdlock(bus->dhd);
+        }
+        rxcount = maxframes - rxleft;
+#ifdef DHD_DEBUG
+        /* Message if we hit the limit */
+        if (!rxleft && !sdtest)
+                DHD_DATA(("%s: hit rx limit of %d frames\n", __FUNCTION__, maxframes));
+        else
+#endif /* DHD_DEBUG */
+        DHD_DATA(("%s: processed %d frames\n", __FUNCTION__, rxcount));
+        /* Back off rxseq if awaiting rtx, update rx_seq */
+        if (bus->rxskip)
+                rxseq--;
+        bus->rx_seq = rxseq;
+
+        return rxcount;
+}
+
+static uint32
+dhdsdio_hostmail(dhd_bus_t *bus)
+{
+        sdpcmd_regs_t *regs = bus->regs;
+        uint32 intstatus = 0;
+        uint32 hmb_data;
+        uint8 fcbits;
+        uint retries = 0;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        /* Read mailbox data and ack that we did so */
+        R_SDREG(hmb_data, &regs->tohostmailboxdata, retries);
+        if (retries <= retry_limit)
+                W_SDREG(SMB_INT_ACK, &regs->tosbmailbox, retries);
+        bus->f1regdata += 2;
+
+        /* Dongle recomposed rx frames, accept them again */
+        if (hmb_data & HMB_DATA_NAKHANDLED) {
+                DHD_INFO(("Dongle reports NAK handled, expect rtx of %d\n", bus->rx_seq));
+                if (!bus->rxskip) {
+                        DHD_ERROR(("%s: unexpected NAKHANDLED!\n", __FUNCTION__));
+                }
+                bus->rxskip = FALSE;
+                intstatus |= FRAME_AVAIL_MASK(bus);
+        }
+
+        /*
+         * DEVREADY does not occur with gSPI.
+         */
+        if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
+                bus->sdpcm_ver = (hmb_data & HMB_DATA_VERSION_MASK) >> HMB_DATA_VERSION_SHIFT;
+                if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
+                        DHD_ERROR(("Version mismatch, dongle reports %d, expecting %d\n",
+                                   bus->sdpcm_ver, SDPCM_PROT_VERSION));
+                else
+                        DHD_INFO(("Dongle ready, protocol version %d\n", bus->sdpcm_ver));
+                /* make sure for the SDIO_DEVICE_RXDATAINT_MODE_1 corecontrol is proper */
+                if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
+                    (bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1)) {
+                        uint32 val;
+
+                        val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
+                        val &= ~CC_XMTDATAAVAIL_MODE;
+                        val |= CC_XMTDATAAVAIL_CTRL;
+                        W_REG(bus->dhd->osh, &bus->regs->corecontrol, val);
+
+                        val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
+                }
+
+#ifdef DHD_DEBUG
+                /* Retrieve console state address now that firmware should have updated it */
+                {
+                        sdpcm_shared_t shared;
+                        if (dhdsdio_readshared(bus, &shared) == 0)
+                                bus->console_addr = shared.console_addr;
+                }
+#endif /* DHD_DEBUG */
+        }
+
+        /*
+         * Flow Control has been moved into the RX headers and this out of band
+         * method isn't used any more.  Leave this here for possibly remaining backward
+         * compatible with older dongles
+         */
+        if (hmb_data & HMB_DATA_FC) {
+                fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >> HMB_DATA_FCDATA_SHIFT;
+
+                if (fcbits & ~bus->flowcontrol)
+                        bus->fc_xoff++;
+                if (bus->flowcontrol & ~fcbits)
+                        bus->fc_xon++;
+
+                bus->fc_rcvd++;
+                bus->flowcontrol = fcbits;
+        }
+
+#ifdef DHD_DEBUG
+        /* At least print a message if FW halted */
+        if (hmb_data & HMB_DATA_FWHALT) {
+                DHD_ERROR(("INTERNAL ERROR: FIRMWARE HALTED\n"));
+                dhdsdio_checkdied(bus, NULL, 0);
+        }
+#endif /* DHD_DEBUG */
+
+        /* Shouldn't be any others */
+        if (hmb_data & ~(HMB_DATA_DEVREADY |
+                         HMB_DATA_FWHALT |
+                         HMB_DATA_NAKHANDLED |
+                         HMB_DATA_FC |
+                         HMB_DATA_FWREADY |
+                         HMB_DATA_FCDATA_MASK |
+                         HMB_DATA_VERSION_MASK)) {
+                DHD_ERROR(("Unknown mailbox data content: 0x%02x\n", hmb_data));
+        }
+
+        return intstatus;
+}
+
+static bool
+dhdsdio_dpc(dhd_bus_t *bus)
+{
+        bcmsdh_info_t *sdh = bus->sdh;
+        sdpcmd_regs_t *regs = bus->regs;
+        uint32 intstatus, newstatus = 0;
+        uint retries = 0;
+        uint rxlimit = dhd_rxbound; /* Rx frames to read before resched */
+        uint txlimit = dhd_txbound; /* Tx frames to send before resched */
+        uint framecnt = 0;                /* Temporary counter of tx/rx frames */
+        bool rxdone = TRUE;               /* Flag for no more read data */
+        bool resched = FALSE;     /* Flag indicating resched wanted */
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (bus->dhd->busstate == DHD_BUS_DOWN) {
+                DHD_ERROR(("%s: Bus down, ret\n", __FUNCTION__));
+                bus->intstatus = 0;
+                return 0;
+        }
+
+        /* Start with leftover status bits */
+        intstatus = bus->intstatus;
+
+        dhd_os_sdlock(bus->dhd);
+
+        /* If waiting for HTAVAIL, check status */
+        if (bus->clkstate == CLK_PENDING) {
+                int err;
+                uint8 clkctl, devctl = 0;
+
+#ifdef DHD_DEBUG
+                /* Check for inconsistent device control */
+                devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                if (err) {
+                        DHD_ERROR(("%s: error reading DEVCTL: %d\n", __FUNCTION__, err));
+                        bus->dhd->busstate = DHD_BUS_DOWN;
+                } else {
+                        ASSERT(devctl & SBSDIO_DEVCTL_CA_INT_ONLY);
+                }
+#endif /* DHD_DEBUG */
+
+                /* Read CSR, if clock on switch to AVAIL, else ignore */
+                clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+                if (err) {
+                        DHD_ERROR(("%s: error reading CSR: %d\n", __FUNCTION__, err));
+                        bus->dhd->busstate = DHD_BUS_DOWN;
+                }
+
+                DHD_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n", devctl, clkctl));
+
+                if (SBSDIO_HTAV(clkctl)) {
+                        devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                        if (err) {
+                                DHD_ERROR(("%s: error reading DEVCTL: %d\n",
+                                           __FUNCTION__, err));
+                                bus->dhd->busstate = DHD_BUS_DOWN;
+                        }
+                        devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                        bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                        if (err) {
+                                DHD_ERROR(("%s: error writing DEVCTL: %d\n",
+                                           __FUNCTION__, err));
+                                bus->dhd->busstate = DHD_BUS_DOWN;
+                        }
+                        bus->clkstate = CLK_AVAIL;
+                } else {
+                        goto clkwait;
+                }
+        }
+
+        BUS_WAKE(bus);
+
+        /* Make sure backplane clock is on */
+        dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
+        if (bus->clkstate != CLK_AVAIL)
+                goto clkwait;
+
+        /* Pending interrupt indicates new device status */
+        if (bus->ipend) {
+                bus->ipend = FALSE;
+                R_SDREG(newstatus, &regs->intstatus, retries);
+                bus->f1regdata++;
+                if (bcmsdh_regfail(bus->sdh))
+                        newstatus = 0;
+                newstatus &= bus->hostintmask;
+                bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
+                if (newstatus) {
+                        bus->f1regdata++;
+                        if ((bus->rxint_mode == SDIO_DEVICE_RXDATAINT_MODE_0) &&
+                                (newstatus == I_XMTDATA_AVAIL)) {
+                        }
+                        else
+                                W_SDREG(newstatus, &regs->intstatus, retries);
+                }
+        }
+
+        /* Merge new bits with previous */
+        intstatus |= newstatus;
+        bus->intstatus = 0;
+
+        /* Handle flow-control change: read new state in case our ack
+         * crossed another change interrupt.  If change still set, assume
+         * FC ON for safety, let next loop through do the debounce.
+         */
+        if (intstatus & I_HMB_FC_CHANGE) {
+                intstatus &= ~I_HMB_FC_CHANGE;
+                W_SDREG(I_HMB_FC_CHANGE, &regs->intstatus, retries);
+                R_SDREG(newstatus, &regs->intstatus, retries);
+                bus->f1regdata += 2;
+                bus->fcstate = !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
+                intstatus |= (newstatus & bus->hostintmask);
+        }
+
+        /* Just being here means nothing more to do for chipactive */
+        if (intstatus & I_CHIPACTIVE) {
+                /* ASSERT(bus->clkstate == CLK_AVAIL); */
+                intstatus &= ~I_CHIPACTIVE;
+        }
+
+        /* Handle host mailbox indication */
+        if (intstatus & I_HMB_HOST_INT) {
+                intstatus &= ~I_HMB_HOST_INT;
+                intstatus |= dhdsdio_hostmail(bus);
+        }
+
+        /* Generally don't ask for these, can get CRC errors... */
+        if (intstatus & I_WR_OOSYNC) {
+                DHD_ERROR(("Dongle reports WR_OOSYNC\n"));
+                intstatus &= ~I_WR_OOSYNC;
+        }
+
+        if (intstatus & I_RD_OOSYNC) {
+                DHD_ERROR(("Dongle reports RD_OOSYNC\n"));
+                intstatus &= ~I_RD_OOSYNC;
+        }
+
+        if (intstatus & I_SBINT) {
+                DHD_ERROR(("Dongle reports SBINT\n"));
+                intstatus &= ~I_SBINT;
+        }
+
+        /* Would be active due to wake-wlan in gSPI */
+        if (intstatus & I_CHIPACTIVE) {
+                DHD_INFO(("Dongle reports CHIPACTIVE\n"));
+                intstatus &= ~I_CHIPACTIVE;
+        }
+
+        /* Ignore frame indications if rxskip is set */
+        if (bus->rxskip) {
+                intstatus &= ~FRAME_AVAIL_MASK(bus);
+        }
+
+        /* On frame indication, read available frames */
+        if (PKT_AVAILABLE(bus, intstatus)) {
+                framecnt = dhdsdio_readframes(bus, rxlimit, &rxdone);
+                if (rxdone || bus->rxskip)
+                        intstatus  &= ~FRAME_AVAIL_MASK(bus);
+                rxlimit -= MIN(framecnt, rxlimit);
+        }
+
+        /* Keep still-pending events for next scheduling */
+        bus->intstatus = intstatus;
+
+clkwait:
+        /* Re-enable interrupts to detect new device events (mailbox, rx frame)
+         * or clock availability.  (Allows tx loop to check ipend if desired.)
+         * (Unless register access seems hosed, as we may not be able to ACK...)
+         */
+        if (bus->intr && bus->intdis && !bcmsdh_regfail(sdh)) {
+                DHD_INTR(("%s: enable SDIO interrupts, rxdone %d framecnt %d\n",
+                          __FUNCTION__, rxdone, framecnt));
+                bus->intdis = FALSE;
+#if defined(OOB_INTR_ONLY)
+        bcmsdh_oob_intr_set(1);
+#endif /* (OOB_INTR_ONLY) */
+                bcmsdh_intr_enable(sdh);
+        }
+
+        if (TXCTLOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL))  {
+                int ret, i;
+
+                ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                      (uint8 *)bus->ctrl_frame_buf, (uint32)bus->ctrl_frame_len,
+                        NULL, NULL, NULL);
+                ASSERT(ret != BCME_PENDING);
+
+                if (ret < 0) {
+                        /* On failure, abort the command and terminate the frame */
+                        DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
+                                  __FUNCTION__, ret));
+                        bus->tx_sderrs++;
+
+                        bcmsdh_abort(sdh, SDIO_FUNC_2);
+
+                        bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
+                                         SFC_WF_TERM, NULL);
+                        bus->f1regdata++;
+
+                        for (i = 0; i < 3; i++) {
+                                uint8 hi, lo;
+                                hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                     SBSDIO_FUNC1_WFRAMEBCHI, NULL);
+                                lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                     SBSDIO_FUNC1_WFRAMEBCLO, NULL);
+                                bus->f1regdata += 2;
+                                if ((hi == 0) && (lo == 0))
+                                        break;
+                        }
+                }
+                if (ret == 0) {
+                        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+                }
+
+                bus->ctrl_frame_stat = FALSE;
+                dhd_wait_event_wakeup(bus->dhd);
+        }
+        /* Send queued frames (limit 1 if rx may still be pending) */
+        else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
+            pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit && DATAOK(bus)) {
+                framecnt = rxdone ? txlimit : MIN(txlimit, dhd_txminmax);
+                framecnt = dhdsdio_sendfromq(bus, framecnt);
+                txlimit -= framecnt;
+        }
+        /* Resched the DPC if ctrl cmd is pending on bus credit */
+        if (bus->ctrl_frame_stat)
+                resched = TRUE;
+
+        /* Resched if events or tx frames are pending, else await next interrupt */
+        /* On failed register access, all bets are off: no resched or interrupts */
+        if ((bus->dhd->busstate == DHD_BUS_DOWN) || bcmsdh_regfail(sdh)) {
+                DHD_ERROR(("%s: failed backplane access over SDIO, halting operation %d \n",
+                           __FUNCTION__, bcmsdh_regfail(sdh)));
+                bus->dhd->busstate = DHD_BUS_DOWN;
+                bus->intstatus = 0;
+        } else if (bus->clkstate == CLK_PENDING) {
+                /* Awaiting I_CHIPACTIVE; don't resched */
+        } else if (bus->intstatus || bus->ipend ||
+                   (!bus->fcstate && pktq_mlen(&bus->txq, ~bus->flowcontrol) && DATAOK(bus)) ||
+                        PKT_AVAILABLE(bus, bus->intstatus)) {  /* Read multiple frames */
+                resched = TRUE;
+        }
+
+        bus->dpc_sched = resched;
+
+        /* If we're done for now, turn off clock request. */
+        if ((bus->idletime == DHD_IDLE_IMMEDIATE) && (bus->clkstate != CLK_PENDING)) {
+                bus->activity = FALSE;
+                dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+        }
+
+        dhd_os_sdunlock(bus->dhd);
+        return resched;
+}
+
+bool
+dhd_bus_dpc(struct dhd_bus *bus)
+{
+        bool resched;
+
+        /* Call the DPC directly. */
+        DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
+        resched = dhdsdio_dpc(bus);
+
+        return resched;
+}
+
+void
+dhdsdio_isr(void *arg)
+{
+        dhd_bus_t *bus = (dhd_bus_t*)arg;
+        bcmsdh_info_t *sdh;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (!bus) {
+                DHD_ERROR(("%s : bus is null pointer , exit \n", __FUNCTION__));
+                return;
+        }
+        sdh = bus->sdh;
+
+        if (bus->dhd->busstate == DHD_BUS_DOWN) {
+                DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+                return;
+        }
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        /* Count the interrupt call */
+        bus->intrcount++;
+        bus->ipend = TRUE;
+
+        /* Shouldn't get this interrupt if we're sleeping? */
+        if (bus->sleeping) {
+                DHD_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
+                return;
+        }
+
+        /* Disable additional interrupts (is this needed now)? */
+        if (bus->intr) {
+                DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+        } else {
+                DHD_ERROR(("dhdsdio_isr() w/o interrupt configured!\n"));
+        }
+
+        bcmsdh_intr_disable(sdh);
+        bus->intdis = TRUE;
+
+#if defined(SDIO_ISR_THREAD)
+        DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
+        DHD_OS_WAKE_LOCK(bus->dhd);
+        while (dhdsdio_dpc(bus));
+        DHD_OS_WAKE_UNLOCK(bus->dhd);
+#else
+        bus->dpc_sched = TRUE;
+        dhd_sched_dpc(bus->dhd);
+#endif 
+
+}
+
+#ifdef SDTEST
+static void
+dhdsdio_pktgen_init(dhd_bus_t *bus)
+{
+        /* Default to specified length, or full range */
+        if (dhd_pktgen_len) {
+                bus->pktgen_maxlen = MIN(dhd_pktgen_len, MAX_PKTGEN_LEN);
+                bus->pktgen_minlen = bus->pktgen_maxlen;
+        } else {
+                bus->pktgen_maxlen = MAX_PKTGEN_LEN;
+                bus->pktgen_minlen = 0;
+        }
+        bus->pktgen_len = (uint16)bus->pktgen_minlen;
+
+        /* Default to per-watchdog burst with 10s print time */
+        bus->pktgen_freq = 1;
+        bus->pktgen_print = 10000 / dhd_watchdog_ms;
+        bus->pktgen_count = (dhd_pktgen * dhd_watchdog_ms + 999) / 1000;
+
+        /* Default to echo mode */
+        bus->pktgen_mode = DHD_PKTGEN_ECHO;
+        bus->pktgen_stop = 1;
+}
+
+static void
+dhdsdio_pktgen(dhd_bus_t *bus)
+{
+        void *pkt;
+        uint8 *data;
+        uint pktcount;
+        uint fillbyte;
+        osl_t *osh = bus->dhd->osh;
+        uint16 len;
+
+        /* Display current count if appropriate */
+        if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
+                bus->pktgen_ptick = 0;
+                printf("%s: send attempts %d rcvd %d\n",
+                       __FUNCTION__, bus->pktgen_sent, bus->pktgen_rcvd);
+        }
+
+        /* For recv mode, just make sure dongle has started sending */
+        if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
+                if (bus->pktgen_rcv_state == PKTGEN_RCV_IDLE) {
+                        bus->pktgen_rcv_state = PKTGEN_RCV_ONGOING;
+                        dhdsdio_sdtest_set(bus, (uint8)bus->pktgen_total);
+                }
+                return;
+        }
+
+        /* Otherwise, generate or request the specified number of packets */
+        for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
+                /* Stop if total has been reached */
+                if (bus->pktgen_total && (bus->pktgen_sent >= bus->pktgen_total)) {
+                        bus->pktgen_count = 0;
+                        break;
+                }
+
+                /* Allocate an appropriate-sized packet */
+                len = bus->pktgen_len;
+                if (!(pkt = PKTGET(osh, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN),
+                                   TRUE))) {;
+                        DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
+                        break;
+                }
+                PKTALIGN(osh, pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
+                data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+
+                /* Write test header cmd and extra based on mode */
+                switch (bus->pktgen_mode) {
+                case DHD_PKTGEN_ECHO:
+                        *data++ = SDPCM_TEST_ECHOREQ;
+                        *data++ = (uint8)bus->pktgen_sent;
+                        break;
+
+                case DHD_PKTGEN_SEND:
+                        *data++ = SDPCM_TEST_DISCARD;
+                        *data++ = (uint8)bus->pktgen_sent;
+                        break;
+
+                case DHD_PKTGEN_RXBURST:
+                        *data++ = SDPCM_TEST_BURST;
+                        *data++ = (uint8)bus->pktgen_count;
+                        break;
+
+                default:
+                        DHD_ERROR(("Unrecognized pktgen mode %d\n", bus->pktgen_mode));
+                        PKTFREE(osh, pkt, TRUE);
+                        bus->pktgen_count = 0;
+                        return;
+                }
+
+                /* Write test header length field */
+                *data++ = (len >> 0);
+                *data++ = (len >> 8);
+
+                /* Then fill in the remainder -- N/A for burst, but who cares... */
+                for (fillbyte = 0; fillbyte < len; fillbyte++)
+                        *data++ = SDPCM_TEST_FILL(fillbyte, (uint8)bus->pktgen_sent);
+
+#ifdef DHD_DEBUG
+                if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                        data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+                        prhex("dhdsdio_pktgen: Tx Data", data, PKTLEN(osh, pkt) - SDPCM_HDRLEN);
+                }
+#endif
+
+                /* Send it */
+                if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE)) {
+                        bus->pktgen_fail++;
+                        if (bus->pktgen_stop && bus->pktgen_stop == bus->pktgen_fail)
+                                bus->pktgen_count = 0;
+                }
+                bus->pktgen_sent++;
+
+                /* Bump length if not fixed, wrap at max */
+                if (++bus->pktgen_len > bus->pktgen_maxlen)
+                        bus->pktgen_len = (uint16)bus->pktgen_minlen;
+
+                /* Special case for burst mode: just send one request! */
+                if (bus->pktgen_mode == DHD_PKTGEN_RXBURST)
+                        break;
+        }
+}
+
+static void
+dhdsdio_sdtest_set(dhd_bus_t *bus, uint8 count)
+{
+        void *pkt;
+        uint8 *data;
+        osl_t *osh = bus->dhd->osh;
+
+        /* Allocate the packet */
+        if (!(pkt = PKTGET(osh, SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN, TRUE))) {
+                DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
+                return;
+        }
+        PKTALIGN(osh, pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
+        data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+
+        /* Fill in the test header */
+        *data++ = SDPCM_TEST_SEND;
+        *data++ = count;
+        *data++ = (bus->pktgen_maxlen >> 0);
+        *data++ = (bus->pktgen_maxlen >> 8);
+
+        /* Send it */
+        if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE))
+                bus->pktgen_fail++;
+}
+
+
+static void
+dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq)
+{
+        osl_t *osh = bus->dhd->osh;
+        uint8 *data;
+        uint pktlen;
+
+        uint8 cmd;
+        uint8 extra;
+        uint16 len;
+        uint16 offset;
+
+        /* Check for min length */
+        if ((pktlen = PKTLEN(osh, pkt)) < SDPCM_TEST_HDRLEN) {
+                DHD_ERROR(("dhdsdio_restrcv: toss runt frame, pktlen %d\n", pktlen));
+                PKTFREE(osh, pkt, FALSE);
+                return;
+        }
+
+        /* Extract header fields */
+        data = PKTDATA(osh, pkt);
+        cmd = *data++;
+        extra = *data++;
+        len = *data++; len += *data++ << 8;
+        DHD_TRACE(("%s:cmd:%d, xtra:%d,len:%d\n", __FUNCTION__, cmd, extra, len));
+        /* Check length for relevant commands */
+        if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ || cmd == SDPCM_TEST_ECHORSP) {
+                if (pktlen != len + SDPCM_TEST_HDRLEN) {
+                        DHD_ERROR(("dhdsdio_testrcv: frame length mismatch, pktlen %d seq %d"
+                                   " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
+                        PKTFREE(osh, pkt, FALSE);
+                        return;
+                }
+        }
+
+        /* Process as per command */
+        switch (cmd) {
+        case SDPCM_TEST_ECHOREQ:
+                /* Rx->Tx turnaround ok (even on NDIS w/current implementation) */
+                *(uint8 *)(PKTDATA(osh, pkt)) = SDPCM_TEST_ECHORSP;
+                if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE) == 0) {
+                        bus->pktgen_sent++;
+                } else {
+                        bus->pktgen_fail++;
+                        PKTFREE(osh, pkt, FALSE);
+                }
+                bus->pktgen_rcvd++;
+                break;
+
+        case SDPCM_TEST_ECHORSP:
+                if (bus->ext_loop) {
+                        PKTFREE(osh, pkt, FALSE);
+                        bus->pktgen_rcvd++;
+                        break;
+                }
+
+                for (offset = 0; offset < len; offset++, data++) {
+                        if (*data != SDPCM_TEST_FILL(offset, extra)) {
+                                DHD_ERROR(("dhdsdio_testrcv: echo data mismatch: "
+                                           "offset %d (len %d) expect 0x%02x rcvd 0x%02x\n",
+                                           offset, len, SDPCM_TEST_FILL(offset, extra), *data));
+                                break;
+                        }
+                }
+                PKTFREE(osh, pkt, FALSE);
+                bus->pktgen_rcvd++;
+                break;
+
+        case SDPCM_TEST_DISCARD:
+                {
+                        int i = 0;
+                        uint8 *prn = data;
+                        uint8 testval = extra;
+                        for (i = 0; i < len; i++) {
+                                if (*prn != testval) {
+                                        DHD_ERROR(("DIErr@Pkt#:%d,Ix:%d, expected:0x%x, got:0x%x\n",
+                                                i, bus->pktgen_rcvd_rcvsession, testval, *prn));
+                                        prn++; testval++;
+                                }
+                        }
+                }
+                PKTFREE(osh, pkt, FALSE);
+                bus->pktgen_rcvd++;
+                break;
+
+        case SDPCM_TEST_BURST:
+        case SDPCM_TEST_SEND:
+        default:
+                DHD_INFO(("dhdsdio_testrcv: unsupported or unknown command, pktlen %d seq %d"
+                          " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
+                PKTFREE(osh, pkt, FALSE);
+                break;
+        }
+
+        /* For recv mode, stop at limit (and tell dongle to stop sending) */
+        if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
+                if (bus->pktgen_rcv_state != PKTGEN_RCV_IDLE) {
+                        bus->pktgen_rcvd_rcvsession++;
+
+                        if (bus->pktgen_total &&
+                                (bus->pktgen_rcvd_rcvsession >= bus->pktgen_total)) {
+                        bus->pktgen_count = 0;
+                    DHD_ERROR(("Pktgen:rcv test complete!\n"));
+                    bus->pktgen_rcv_state = PKTGEN_RCV_IDLE;
+                        dhdsdio_sdtest_set(bus, FALSE);
+                                bus->pktgen_rcvd_rcvsession = 0;
+                        }
+                }
+        }
+}
+#endif /* SDTEST */
+
+extern void
+dhd_disable_intr(dhd_pub_t *dhdp)
+{
+        dhd_bus_t *bus;
+        bus = dhdp->bus;
+        bcmsdh_intr_disable(bus->sdh);
+}
+
+extern bool
+dhd_bus_watchdog(dhd_pub_t *dhdp)
+{
+        dhd_bus_t *bus;
+
+        DHD_TIMER(("%s: Enter\n", __FUNCTION__));
+
+        bus = dhdp->bus;
+
+        if (bus->dhd->dongle_reset)
+                return FALSE;
+
+        /* Ignore the timer if simulating bus down */
+        if (bus->sleeping)
+                return FALSE;
+
+        if (dhdp->busstate == DHD_BUS_DOWN)
+                return FALSE;
+
+        /* Poll period: check device if appropriate. */
+        if (bus->poll && (++bus->polltick >= bus->pollrate)) {
+                uint32 intstatus = 0;
+
+                /* Reset poll tick */
+                bus->polltick = 0;
+
+                /* Check device if no interrupts */
+                if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
+
+                        if (!bus->dpc_sched) {
+                                uint8 devpend;
+                                devpend = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0,
+                                                          SDIOD_CCCR_INTPEND, NULL);
+                                intstatus = devpend & (INTR_STATUS_FUNC1 | INTR_STATUS_FUNC2);
+                        }
+
+                        /* If there is something, make like the ISR and schedule the DPC */
+                        if (intstatus) {
+                                bus->pollcnt++;
+                                bus->ipend = TRUE;
+                                if (bus->intr) {
+                                        bcmsdh_intr_disable(bus->sdh);
+                                }
+                                bus->dpc_sched = TRUE;
+                                dhd_sched_dpc(bus->dhd);
+
+                        }
+                }
+
+                /* Update interrupt tracking */
+                bus->lastintrs = bus->intrcount;
+        }
+
+#ifdef DHD_DEBUG
+        /* Poll for console output periodically */
+        if (dhdp->busstate == DHD_BUS_DATA && dhd_console_ms != 0) {
+                bus->console.count += dhd_watchdog_ms;
+                if (bus->console.count >= dhd_console_ms) {
+                        bus->console.count -= dhd_console_ms;
+                        /* Make sure backplane clock is on */
+                        dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+                        if (dhdsdio_readconsole(bus) < 0)
+                                dhd_console_ms = 0;     /* On error, stop trying */
+                }
+        }
+#endif /* DHD_DEBUG */
+
+#ifdef SDTEST
+        /* Generate packets if configured */
+        if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
+                /* Make sure backplane clock is on */
+                dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+                bus->pktgen_tick = 0;
+                dhdsdio_pktgen(bus);
+        }
+#endif
+
+        /* On idle timeout clear activity flag and/or turn off clock */
+        if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
+                if (++bus->idlecount >= bus->idletime) {
+                        bus->idlecount = 0;
+                        if (bus->activity) {
+                                bus->activity = FALSE;
+                                dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+                        }
+                }
+        }
+
+        return bus->ipend;
+}
+
+#ifdef DHD_DEBUG
+extern int
+dhd_bus_console_in(dhd_pub_t *dhdp, uchar *msg, uint msglen)
+{
+        dhd_bus_t *bus = dhdp->bus;
+        uint32 addr, val;
+        int rv;
+        void *pkt;
+
+        /* Address could be zero if CONSOLE := 0 in dongle Makefile */
+        if (bus->console_addr == 0)
+                return BCME_UNSUPPORTED;
+
+        /* Exclusive bus access */
+        dhd_os_sdlock(bus->dhd);
+
+        /* Don't allow input if dongle is in reset */
+        if (bus->dhd->dongle_reset) {
+                dhd_os_sdunlock(bus->dhd);
+                return BCME_NOTREADY;
+        }
+
+        /* Request clock to allow SDIO accesses */
+        BUS_WAKE(bus);
+        /* No pend allowed since txpkt is called later, ht clk has to be on */
+        dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+        /* Zero cbuf_index */
+        addr = bus->console_addr + OFFSETOF(hndrte_cons_t, cbuf_idx);
+        val = htol32(0);
+        if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+                goto done;
+
+        /* Write message into cbuf */
+        addr = bus->console_addr + OFFSETOF(hndrte_cons_t, cbuf);
+        if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
+                goto done;
+
+        /* Write length into vcons_in */
+        addr = bus->console_addr + OFFSETOF(hndrte_cons_t, vcons_in);
+        val = htol32(msglen);
+        if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+                goto done;
+
+        /* Bump dongle by sending an empty packet on the event channel.
+         * sdpcm_sendup (RX) checks for virtual console input.
+         */
+        if ((pkt = PKTGET(bus->dhd->osh, 4 + SDPCM_RESERVE, TRUE)) != NULL)
+                dhdsdio_txpkt(bus, pkt, SDPCM_EVENT_CHANNEL, TRUE);
+
+done:
+        if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                bus->activity = FALSE;
+                dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+        }
+
+        dhd_os_sdunlock(bus->dhd);
+
+        return rv;
+}
+#endif /* DHD_DEBUG */
+
+#ifdef DHD_DEBUG
+static void
+dhd_dump_cis(uint fn, uint8 *cis)
+{
+        uint byte, tag, tdata;
+        DHD_INFO(("Function %d CIS:\n", fn));
+
+        for (tdata = byte = 0; byte < SBSDIO_CIS_SIZE_LIMIT; byte++) {
+                if ((byte % 16) == 0)
+                        DHD_INFO(("    "));
+                DHD_INFO(("%02x ", cis[byte]));
+                if ((byte % 16) == 15)
+                        DHD_INFO(("\n"));
+                if (!tdata--) {
+                        tag = cis[byte];
+                        if (tag == 0xff)
+                                break;
+                        else if (!tag)
+                                tdata = 0;
+                        else if ((byte + 1) < SBSDIO_CIS_SIZE_LIMIT)
+                                tdata = cis[byte + 1] + 1;
+                        else
+                                DHD_INFO(("]"));
+                }
+        }
+        if ((byte % 16) != 15)
+                DHD_INFO(("\n"));
+}
+#endif /* DHD_DEBUG */
+
+static bool
+dhdsdio_chipmatch(uint16 chipid)
+{
+        if (chipid == BCM4325_CHIP_ID)
+                return TRUE;
+        if (chipid == BCM4329_CHIP_ID)
+                return TRUE;
+        if (chipid == BCM4315_CHIP_ID)
+                return TRUE;
+        if (chipid == BCM4319_CHIP_ID)
+                return TRUE;
+        if (chipid == BCM4336_CHIP_ID)
+                return TRUE;
+        if (chipid == BCM4330_CHIP_ID)
+                return TRUE;
+        if (chipid == BCM43237_CHIP_ID)
+                return TRUE;
+        if (chipid == BCM43362_CHIP_ID)
+                return TRUE;
+        if (chipid == BCM43239_CHIP_ID)
+                return TRUE;
+        return FALSE;
+}
+
+static void *
+dhdsdio_probe(uint16 venid, uint16 devid, uint16 bus_no, uint16 slot,
+        uint16 func, uint bustype, void *regsva, osl_t * osh, void *sdh, void *dev)
+{
+        int ret;
+        dhd_bus_t *bus;
+        dhd_cmn_t *cmn;
+#ifdef GET_CUSTOM_MAC_ENABLE
+        struct ether_addr ea_addr;
+#endif /* GET_CUSTOM_MAC_ENABLE */
+#ifdef PROP_TXSTATUS
+        uint up = 0;
+#endif
+
+        /* Init global variables at run-time, not as part of the declaration.
+         * This is required to support init/de-init of the driver. Initialization
+         * of globals as part of the declaration results in non-deterministic
+         * behavior since the value of the globals may be different on the
+         * first time that the driver is initialized vs subsequent initializations.
+         */
+        dhd_txbound = DHD_TXBOUND;
+        dhd_rxbound = DHD_RXBOUND;
+        dhd_alignctl = TRUE;
+        sd1idle = TRUE;
+        dhd_readahead = TRUE;
+        retrydata = FALSE;
+        dhd_doflow = FALSE;
+        dhd_dongle_memsize = 0;
+        dhd_txminmax = DHD_TXMINMAX;
+
+        forcealign = TRUE;
+
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+        DHD_INFO(("%s: venid 0x%04x devid 0x%04x\n", __FUNCTION__, venid, devid));
+
+        /* We make assumptions about address window mappings */
+        ASSERT((uintptr)regsva == SI_ENUM_BASE);
+
+        /* BCMSDH passes venid and devid based on CIS parsing -- but low-power start
+         * means early parse could fail, so here we should get either an ID
+         * we recognize OR (-1) indicating we must request power first.
+         */
+        /* Check the Vendor ID */
+        switch (venid) {
+                case 0x0000:
+                case VENDOR_BROADCOM:
+                        break;
+                default:
+                        DHD_ERROR(("%s: unknown vendor: 0x%04x\n",
+                                   __FUNCTION__, venid));
+                        return NULL;
+        }
+
+        /* Check the Device ID and make sure it's one that we support */
+        switch (devid) {
+                case BCM4325_D11DUAL_ID:                /* 4325 802.11a/g id */
+                case BCM4325_D11G_ID:                   /* 4325 802.11g 2.4Ghz band id */
+                case BCM4325_D11A_ID:                   /* 4325 802.11a 5Ghz band id */
+                        DHD_INFO(("%s: found 4325 Dongle\n", __FUNCTION__));
+                        break;
+                case BCM4329_D11N_ID:           /* 4329 802.11n dualband device */
+                case BCM4329_D11N2G_ID:         /* 4329 802.11n 2.4G device */
+                case BCM4329_D11N5G_ID:         /* 4329 802.11n 5G device */
+                case 0x4329:
+                        DHD_INFO(("%s: found 4329 Dongle\n", __FUNCTION__));
+                        break;
+                case BCM4315_D11DUAL_ID:                /* 4315 802.11a/g id */
+                case BCM4315_D11G_ID:                   /* 4315 802.11g id */
+                case BCM4315_D11A_ID:                   /* 4315 802.11a id */
+                        DHD_INFO(("%s: found 4315 Dongle\n", __FUNCTION__));
+                        break;
+                case BCM4319_D11N_ID:                   /* 4319 802.11n id */
+                case BCM4319_D11N2G_ID:                 /* 4319 802.11n2g id */
+                case BCM4319_D11N5G_ID:                 /* 4319 802.11n5g id */
+                        DHD_INFO(("%s: found 4319 Dongle\n", __FUNCTION__));
+                        break;
+                case 0:
+                        DHD_INFO(("%s: allow device id 0, will check chip internals\n",
+                                  __FUNCTION__));
+                        break;
+
+                default:
+                        DHD_ERROR(("%s: skipping 0x%04x/0x%04x, not a dongle\n",
+                                   __FUNCTION__, venid, devid));
+                        return NULL;
+        }
+
+        if (osh == NULL) {
+                /* Ask the OS interface part for an OSL handle */
+                if (!(osh = dhd_osl_attach(sdh, DHD_BUS))) {
+                        DHD_ERROR(("%s: osl_attach failed!\n", __FUNCTION__));
+                        return NULL;
+                }
+        }
+
+        /* Allocate private bus interface state */
+        if (!(bus = MALLOC(osh, sizeof(dhd_bus_t)))) {
+                DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+                goto fail;
+        }
+        bzero(bus, sizeof(dhd_bus_t));
+        bus->sdh = sdh;
+        bus->cl_devid = (uint16)devid;
+        bus->bus = DHD_BUS;
+        bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
+        bus->usebufpool = FALSE; /* Use bufpool if allocated, else use locally malloced rxbuf */
+
+        /* attach the common module */
+        if (!(cmn = dhd_common_init(bus->cl_devid, osh))) {
+                DHD_ERROR(("%s: dhd_common_init failed\n", __FUNCTION__));
+                goto fail;
+        }
+
+        /* attempt to attach to the dongle */
+        if (!(dhdsdio_probe_attach(bus, osh, sdh, regsva, devid))) {
+                DHD_ERROR(("%s: dhdsdio_probe_attach failed\n", __FUNCTION__));
+                dhd_common_deinit(NULL, cmn);
+                goto fail;
+        }
+
+        /* Attach to the dhd/OS/network interface */
+        if (!(bus->dhd = dhd_attach(osh, bus, SDPCM_RESERVE, dev))) {
+                DHD_ERROR(("%s: dhd_attach failed\n", __FUNCTION__));
+                goto fail;
+        }
+
+        bus->dhd->cmn = cmn;
+        cmn->dhd = bus->dhd;
+
+        /* Allocate buffers */
+        if (!(dhdsdio_probe_malloc(bus, osh, sdh))) {
+                DHD_ERROR(("%s: dhdsdio_probe_malloc failed\n", __FUNCTION__));
+                goto fail;
+        }
+
+        if (!(dhdsdio_probe_init(bus, osh, sdh))) {
+                DHD_ERROR(("%s: dhdsdio_probe_init failed\n", __FUNCTION__));
+                goto fail;
+        }
+
+        if (bus->intr) {
+                /* Register interrupt callback, but mask it (not operational yet). */
+                DHD_INTR(("%s: disable SDIO interrupts (not interested yet)\n", __FUNCTION__));
+                bcmsdh_intr_disable(sdh);
+                if ((ret = bcmsdh_intr_reg(sdh, dhdsdio_isr, bus)) != 0) {
+                        DHD_ERROR(("%s: FAILED: bcmsdh_intr_reg returned %d\n",
+                                   __FUNCTION__, ret));
+                        goto fail;
+                }
+                DHD_INTR(("%s: registered SDIO interrupt function ok\n", __FUNCTION__));
+        } else {
+                DHD_INFO(("%s: SDIO interrupt function is NOT registered due to polling mode\n",
+                           __FUNCTION__));
+        }
+
+        DHD_INFO(("%s: completed!!\n", __FUNCTION__));
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+        /* Read MAC address from external customer place        */
+        memset(&ea_addr, 0, sizeof(ea_addr));
+        ret = dhd_custom_get_mac_address(ea_addr.octet);
+        if (!ret) {
+                memcpy(bus->dhd->mac.octet, (void *)&ea_addr, ETHER_ADDR_LEN);
+        }
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+        /* if firmware path present try to download and bring up bus */
+        if (dhd_download_fw_on_driverload && (ret = dhd_bus_start(bus->dhd)) != 0) {
+                DHD_ERROR(("%s: dhd_bus_start failed\n", __FUNCTION__));
+                if (ret == BCME_NOTUP)
+                        goto fail;
+        }
+        /* Ok, have the per-port tell the stack we're open for business */
+        if (dhd_net_attach(bus->dhd, 0) != 0) {
+                DHD_ERROR(("%s: Net attach failed!!\n", __FUNCTION__));
+                goto fail;
+        }
+
+#ifdef PROP_TXSTATUS
+        if (dhd_download_fw_on_driverload)
+                dhd_wl_ioctl_cmd(bus->dhd, WLC_UP, (char *)&up, sizeof(up), TRUE, 0);
+#endif
+        return bus;
+
+fail:
+        dhdsdio_release(bus, osh);
+        return NULL;
+}
+
+static bool
+dhdsdio_probe_attach(struct dhd_bus *bus, osl_t *osh, void *sdh, void *regsva,
+                     uint16 devid)
+{
+        int err = 0;
+        uint8 clkctl = 0;
+
+        bus->alp_only = TRUE;
+
+        /* Return the window to backplane enumeration space for core access */
+        if (dhdsdio_set_siaddr_window(bus, SI_ENUM_BASE)) {
+                DHD_ERROR(("%s: FAILED to return to SI_ENUM_BASE\n", __FUNCTION__));
+        }
+
+#ifdef DHD_DEBUG
+        DHD_ERROR(("F1 signature read @0x18000000=0x%4x\n",
+               bcmsdh_reg_read(bus->sdh, SI_ENUM_BASE, 4)));
+
+#endif /* DHD_DEBUG */
+
+
+        /* Force PLL off until si_attach() programs PLL control regs */
+
+
+
+        bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, DHD_INIT_CLKCTL1, &err);
+        if (!err)
+                clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+
+        if (err || ((clkctl & ~SBSDIO_AVBITS) != DHD_INIT_CLKCTL1)) {
+                DHD_ERROR(("dhdsdio_probe: ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
+                           err, DHD_INIT_CLKCTL1, clkctl));
+                goto fail;
+        }
+
+
+#ifdef DHD_DEBUG
+        if (DHD_INFO_ON()) {
+                uint fn, numfn;
+                uint8 *cis[SDIOD_MAX_IOFUNCS];
+                int err = 0;
+
+                numfn = bcmsdh_query_iofnum(sdh);
+                ASSERT(numfn <= SDIOD_MAX_IOFUNCS);
+
+                /* Make sure ALP is available before trying to read CIS */
+                SPINWAIT(((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                    SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
+                          !SBSDIO_ALPAV(clkctl)), PMU_MAX_TRANSITION_DLY);
+
+                /* Now request ALP be put on the bus */
+                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                 DHD_INIT_CLKCTL2, &err);
+                OSL_DELAY(65);
+
+                for (fn = 0; fn <= numfn; fn++) {
+                        if (!(cis[fn] = MALLOC(osh, SBSDIO_CIS_SIZE_LIMIT))) {
+                                DHD_INFO(("dhdsdio_probe: fn %d cis malloc failed\n", fn));
+                                break;
+                        }
+                        bzero(cis[fn], SBSDIO_CIS_SIZE_LIMIT);
+
+                        if ((err = bcmsdh_cis_read(sdh, fn, cis[fn], SBSDIO_CIS_SIZE_LIMIT))) {
+                                DHD_INFO(("dhdsdio_probe: fn %d cis read err %d\n", fn, err));
+                                MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
+                                break;
+                        }
+                        dhd_dump_cis(fn, cis[fn]);
+                }
+
+                while (fn-- > 0) {
+                        ASSERT(cis[fn]);
+                        MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
+                }
+
+                if (err) {
+                        DHD_ERROR(("dhdsdio_probe: failure reading or parsing CIS\n"));
+                        goto fail;
+                }
+        }
+#endif /* DHD_DEBUG */
+
+        /* si_attach() will provide an SI handle and scan the backplane */
+        if (!(bus->sih = si_attach((uint)devid, osh, regsva, DHD_BUS, sdh,
+                                   &bus->vars, &bus->varsz))) {
+                DHD_ERROR(("%s: si_attach failed!\n", __FUNCTION__));
+                goto fail;
+        }
+
+        bcmsdh_chipinfo(sdh, bus->sih->chip, bus->sih->chiprev);
+
+        if (!dhdsdio_chipmatch((uint16)bus->sih->chip)) {
+                DHD_ERROR(("%s: unsupported chip: 0x%04x\n",
+                           __FUNCTION__, bus->sih->chip));
+                goto fail;
+        }
+
+
+        si_sdiod_drive_strength_init(bus->sih, osh, dhd_sdiod_drive_strength);
+
+
+        /* Get info on the ARM and SOCRAM cores... */
+        if (!DHD_NOPMU(bus)) {
+                if ((si_setcore(bus->sih, ARM7S_CORE_ID, 0)) ||
+                    (si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+                        bus->armrev = si_corerev(bus->sih);
+                } else {
+                        DHD_ERROR(("%s: failed to find ARM core!\n", __FUNCTION__));
+                        goto fail;
+                }
+                if (!(bus->orig_ramsize = si_socram_size(bus->sih))) {
+                        DHD_ERROR(("%s: failed to find SOCRAM memory!\n", __FUNCTION__));
+                        goto fail;
+                }
+                bus->ramsize = bus->orig_ramsize;
+                if (dhd_dongle_memsize)
+                        dhd_dongle_setmemsize(bus, dhd_dongle_memsize);
+
+                DHD_ERROR(("DHD: dongle ram size is set to %d(orig %d)\n",
+                        bus->ramsize, bus->orig_ramsize));
+        }
+
+        /* ...but normally deal with the SDPCMDEV core */
+        if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)) &&
+            !(bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0))) {
+                DHD_ERROR(("%s: failed to find SDIODEV core!\n", __FUNCTION__));
+                goto fail;
+        }
+        bus->sdpcmrev = si_corerev(bus->sih);
+
+        /* Set core control so an SDIO reset does a backplane reset */
+        OR_REG(osh, &bus->regs->corecontrol, CC_BPRESEN);
+        bus->rxint_mode = SDIO_DEVICE_HMB_RXINT;
+
+        if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
+                (bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1))
+        {
+                uint32 val;
+
+                val = R_REG(osh, &bus->regs->corecontrol);
+                val &= ~CC_XMTDATAAVAIL_MODE;
+                val |= CC_XMTDATAAVAIL_CTRL;
+                W_REG(osh, &bus->regs->corecontrol, val);
+        }
+
+
+        pktq_init(&bus->txq, (PRIOMASK + 1), QLEN);
+
+        /* Locate an appropriately-aligned portion of hdrbuf */
+        bus->rxhdr = (uint8 *)ROUNDUP((uintptr)&bus->hdrbuf[0], DHD_SDALIGN);
+
+        /* Set the poll and/or interrupt flags */
+        bus->intr = (bool)dhd_intr;
+        if ((bus->poll = (bool)dhd_poll))
+                bus->pollrate = 1;
+
+        return TRUE;
+
+fail:
+        if (bus->sih != NULL)
+                si_detach(bus->sih);
+        return FALSE;
+}
+
+static bool
+dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh)
+{
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (bus->dhd->maxctl) {
+                bus->rxblen = ROUNDUP((bus->dhd->maxctl + SDPCM_HDRLEN), ALIGNMENT) + DHD_SDALIGN;
+                if (!(bus->rxbuf = DHD_OS_PREALLOC(osh, DHD_PREALLOC_RXBUF, bus->rxblen))) {
+                        DHD_ERROR(("%s: MALLOC of %d-byte rxbuf failed\n",
+                                   __FUNCTION__, bus->rxblen));
+                        goto fail;
+                }
+        }
+        /* Allocate buffer to receive glomed packet */
+        if (!(bus->databuf = DHD_OS_PREALLOC(osh, DHD_PREALLOC_DATABUF, MAX_DATA_BUF))) {
+                DHD_ERROR(("%s: MALLOC of %d-byte databuf failed\n",
+                        __FUNCTION__, MAX_DATA_BUF));
+                /* release rxbuf which was already located as above */
+                if (!bus->rxblen)
+                        DHD_OS_PREFREE(osh, bus->rxbuf, bus->rxblen);
+                goto fail;
+        }
+
+        /* Align the buffer */
+        if ((uintptr)bus->databuf % DHD_SDALIGN)
+                bus->dataptr = bus->databuf + (DHD_SDALIGN - ((uintptr)bus->databuf % DHD_SDALIGN));
+        else
+                bus->dataptr = bus->databuf;
+
+        return TRUE;
+
+fail:
+        return FALSE;
+}
+
+static bool
+dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh)
+{
+        int32 fnum;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef SDTEST
+        dhdsdio_pktgen_init(bus);
+#endif /* SDTEST */
+
+        /* Disable F2 to clear any intermediate frame state on the dongle */
+        bcmsdh_cfg_write(sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
+
+        bus->dhd->busstate = DHD_BUS_DOWN;
+        bus->sleeping = FALSE;
+        bus->rxflow = FALSE;
+        bus->prev_rxlim_hit = 0;
+
+
+        /* Done with backplane-dependent accesses, can drop clock... */
+        bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+
+        /* ...and initialize clock/power states */
+        bus->clkstate = CLK_SDONLY;
+        bus->idletime = (int32)dhd_idletime;
+        bus->idleclock = DHD_IDLE_ACTIVE;
+
+        /* Query the SD clock speed */
+        if (bcmsdh_iovar_op(sdh, "sd_divisor", NULL, 0,
+                            &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
+                DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_divisor"));
+                bus->sd_divisor = -1;
+        } else {
+                DHD_INFO(("%s: Initial value for %s is %d\n",
+                          __FUNCTION__, "sd_divisor", bus->sd_divisor));
+        }
+
+        /* Query the SD bus mode */
+        if (bcmsdh_iovar_op(sdh, "sd_mode", NULL, 0,
+                            &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
+                DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_mode"));
+                bus->sd_mode = -1;
+        } else {
+                DHD_INFO(("%s: Initial value for %s is %d\n",
+                          __FUNCTION__, "sd_mode", bus->sd_mode));
+        }
+
+        /* Query the F2 block size, set roundup accordingly */
+        fnum = 2;
+        if (bcmsdh_iovar_op(sdh, "sd_blocksize", &fnum, sizeof(int32),
+                            &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
+                bus->blocksize = 0;
+                DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
+        } else {
+                DHD_INFO(("%s: Initial value for %s is %d\n",
+                          __FUNCTION__, "sd_blocksize", bus->blocksize));
+        }
+        bus->roundup = MIN(max_roundup, bus->blocksize);
+
+        /* Query if bus module supports packet chaining, default to use if supported */
+        if (bcmsdh_iovar_op(sdh, "sd_rxchain", NULL, 0,
+                            &bus->sd_rxchain, sizeof(int32), FALSE) != BCME_OK) {
+                bus->sd_rxchain = FALSE;
+        } else {
+                DHD_INFO(("%s: bus module (through bcmsdh API) %s chaining\n",
+                          __FUNCTION__, (bus->sd_rxchain ? "supports" : "does not support")));
+        }
+        bus->use_rxchain = (bool)bus->sd_rxchain;
+
+        return TRUE;
+}
+
+bool
+dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+                          char *pfw_path, char *pnv_path)
+{
+        bool ret;
+        bus->fw_path = pfw_path;
+        bus->nv_path = pnv_path;
+
+        ret = dhdsdio_download_firmware(bus, osh, bus->sdh);
+
+
+        return ret;
+}
+
+static bool
+dhdsdio_download_firmware(struct dhd_bus *bus, osl_t *osh, void *sdh)
+{
+        bool ret;
+
+        /* Download the firmware */
+        DHD_OS_WAKE_LOCK(bus->dhd);
+        dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+        ret = _dhdsdio_download_firmware(bus) == 0;
+
+        dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+        DHD_OS_WAKE_UNLOCK(bus->dhd);
+        return ret;
+}
+
+/* Detach and free everything */
+static void
+dhdsdio_release(dhd_bus_t *bus, osl_t *osh)
+{
+        bool dongle_isolation = FALSE;
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (bus) {
+                ASSERT(osh);
+
+                /* De-register interrupt handler */
+                bcmsdh_intr_disable(bus->sdh);
+                bcmsdh_intr_dereg(bus->sdh);
+
+                if (bus->dhd) {
+                        dhd_common_deinit(bus->dhd, NULL);
+                        dongle_isolation = bus->dhd->dongle_isolation;
+                        dhd_detach(bus->dhd);
+                        dhdsdio_release_dongle(bus, osh, dongle_isolation, TRUE);
+                        dhd_free(bus->dhd);
+                        bus->dhd = NULL;
+                }
+
+                dhdsdio_release_malloc(bus, osh);
+
+#ifdef DHD_DEBUG
+                if (bus->console.buf != NULL)
+                        MFREE(osh, bus->console.buf, bus->console.bufsize);
+#endif
+
+                MFREE(osh, bus, sizeof(dhd_bus_t));
+        }
+
+        if (osh)
+                dhd_osl_detach(osh);
+
+        DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static void
+dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh)
+{
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (bus->dhd && bus->dhd->dongle_reset)
+                return;
+
+        if (bus->rxbuf) {
+#ifndef DHD_USE_STATIC_BUF
+                MFREE(osh, bus->rxbuf, bus->rxblen);
+#endif
+                bus->rxctl = bus->rxbuf = NULL;
+                bus->rxlen = 0;
+        }
+
+        if (bus->databuf) {
+#ifndef DHD_USE_STATIC_BUF
+                MFREE(osh, bus->databuf, MAX_DATA_BUF);
+#endif
+                bus->databuf = NULL;
+        }
+
+        if (bus->vars && bus->varsz) {
+                MFREE(osh, bus->vars, bus->varsz);
+                bus->vars = NULL;
+        }
+
+}
+
+
+static void
+dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation, bool reset_flag)
+{
+        DHD_TRACE(("%s: Enter bus->dhd %p bus->dhd->dongle_reset %d \n", __FUNCTION__,
+                bus->dhd, bus->dhd->dongle_reset));
+
+        if ((bus->dhd && bus->dhd->dongle_reset) && reset_flag)
+                return;
+
+        if (bus->sih) {
+                if (bus->dhd) {
+                        dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+                }
+#if !defined(BCMLXSDMMC)
+                if (dongle_isolation == FALSE)
+                        si_watchdog(bus->sih, 4);
+#endif /* !defined(BCMLXSDMMC) */
+                if (bus->dhd) {
+                        dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+                }
+                si_detach(bus->sih);
+                if (bus->vars && bus->varsz)
+                        MFREE(osh, bus->vars, bus->varsz);
+                bus->vars = NULL;
+        }
+
+        DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static void
+dhdsdio_disconnect(void *ptr)
+{
+        dhd_bus_t *bus = (dhd_bus_t *)ptr;
+
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        if (bus) {
+                ASSERT(bus->dhd);
+                dhdsdio_release(bus, bus->dhd->osh);
+        }
+
+        DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+
+/* Register/Unregister functions are called by the main DHD entry
+ * point (e.g. module insertion) to link with the bus driver, in
+ * order to look for or await the device.
+ */
+
+static bcmsdh_driver_t dhd_sdio = {
+        dhdsdio_probe,
+        dhdsdio_disconnect
+};
+
+int
+dhd_bus_register(void)
+{
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        return bcmsdh_register(&dhd_sdio);
+}
+
+void
+dhd_bus_unregister(void)
+{
+        DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+        bcmsdh_unregister();
+}
+
+#ifdef BCMEMBEDIMAGE
+static int
+dhdsdio_download_code_array(struct dhd_bus *bus)
+{
+        int bcmerror = -1;
+        int offset = 0;
+        unsigned char *ularray = NULL;
+
+        DHD_INFO(("%s: download embedded firmware...\n", __FUNCTION__));
+
+        /* Download image */
+        while ((offset + MEMBLOCK) < sizeof(dlarray)) {
+                bcmerror = dhdsdio_membytes(bus, TRUE, offset,
+                        (uint8 *) (dlarray + offset), MEMBLOCK);
+                if (bcmerror) {
+                        DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                                __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                        goto err;
+                }
+
+                offset += MEMBLOCK;
+        }
+
+        if (offset < sizeof(dlarray)) {
+                bcmerror = dhdsdio_membytes(bus, TRUE, offset,
+                        (uint8 *) (dlarray + offset), sizeof(dlarray) - offset);
+                if (bcmerror) {
+                        DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                                __FUNCTION__, bcmerror, sizeof(dlarray) - offset, offset));
+                        goto err;
+                }
+        }
+
+#ifdef DHD_DEBUG
+        /* Upload and compare the downloaded code */
+        {
+                ularray = MALLOC(bus->dhd->osh, bus->ramsize);
+                /* Upload image to verify downloaded contents. */
+                offset = 0;
+                memset(ularray, 0xaa, bus->ramsize);
+                while ((offset + MEMBLOCK) < sizeof(dlarray)) {
+                        bcmerror = dhdsdio_membytes(bus, FALSE, offset, ularray + offset, MEMBLOCK);
+                        if (bcmerror) {
+                                DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+                                        __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                                goto err;
+                        }
+
+                        offset += MEMBLOCK;
+                }
+
+                if (offset < sizeof(dlarray)) {
+                        bcmerror = dhdsdio_membytes(bus, FALSE, offset,
+                                ularray + offset, sizeof(dlarray) - offset);
+                        if (bcmerror) {
+                                DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+                                        __FUNCTION__, bcmerror, sizeof(dlarray) - offset, offset));
+                                goto err;
+                        }
+                }
+
+                if (memcmp(dlarray, ularray, sizeof(dlarray))) {
+                        DHD_ERROR(("%s: Downloaded image is corrupted (%s, %s, %s).\n",
+                                   __FUNCTION__, dlimagename, dlimagever, dlimagedate));
+                        goto err;
+                } else
+                        DHD_ERROR(("%s: Download, Upload and compare succeeded (%s, %s, %s).\n",
+                                   __FUNCTION__, dlimagename, dlimagever, dlimagedate));
+
+        }
+#endif /* DHD_DEBUG */
+
+err:
+        if (ularray)
+                MFREE(bus->dhd->osh, ularray, bus->ramsize);
+        return bcmerror;
+}
+#endif /* BCMEMBEDIMAGE */
+
+static int
+dhdsdio_download_code_file(struct dhd_bus *bus, char *pfw_path)
+{
+        int bcmerror = -1;
+        int offset = 0;
+        uint len;
+        void *image = NULL;
+        uint8 *memblock = NULL, *memptr;
+
+        DHD_INFO(("%s: download firmware %s\n", __FUNCTION__, pfw_path));
+
+        image = dhd_os_open_image(pfw_path);
+        if (image == NULL)
+                goto err;
+
+        memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+        if (memblock == NULL) {
+                DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+                goto err;
+        }
+        if ((uint32)(uintptr)memblock % DHD_SDALIGN)
+                memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+
+        /* Download image */
+        while ((len = dhd_os_get_image_block((char*)memptr, MEMBLOCK, image))) {
+                bcmerror = dhdsdio_membytes(bus, TRUE, offset, memptr, len);
+                if (bcmerror) {
+                        DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                                __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                        goto err;
+                }
+
+                offset += MEMBLOCK;
+        }
+
+err:
+        if (memblock)
+                MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
+
+        if (image)
+                dhd_os_close_image(image);
+
+        return bcmerror;
+}
+
+/*
+        EXAMPLE: nvram_array
+        nvram_arry format:
+        name=value
+        Use carriage return at the end of each assignment, and an empty string with
+        carriage return at the end of array.
+
+        For example:
+        unsigned char  nvram_array[] = {"name1=value1\n", "name2=value2\n", "\n"};
+        Hex values start with 0x, and mac addr format: xx:xx:xx:xx:xx:xx.
+
+        Search "EXAMPLE: nvram_array" to see how the array is activated.
+*/
+
+void
+dhd_bus_set_nvram_params(struct dhd_bus * bus, const char *nvram_params)
+{
+        bus->nvram_params = nvram_params;
+}
+
+static int
+dhdsdio_download_nvram(struct dhd_bus *bus)
+{
+        int bcmerror = -1;
+        uint len;
+        void * image = NULL;
+        char * memblock = NULL;
+        char *bufp;
+        char *pnv_path;
+        bool nvram_file_exists;
+
+        pnv_path = bus->nv_path;
+
+        nvram_file_exists = ((pnv_path != NULL) && (pnv_path[0] != '\0'));
+        if (!nvram_file_exists && (bus->nvram_params == NULL))
+                return (0);
+
+        if (nvram_file_exists) {
+                image = dhd_os_open_image(pnv_path);
+                if (image == NULL)
+                        goto err;
+        }
+
+        memblock = MALLOC(bus->dhd->osh, MAX_NVRAMBUF_SIZE);
+        if (memblock == NULL) {
+                DHD_ERROR(("%s: Failed to allocate memory %d bytes\n",
+                           __FUNCTION__, MAX_NVRAMBUF_SIZE));
+                goto err;
+        }
+
+        /* Download variables */
+        if (nvram_file_exists) {
+                len = dhd_os_get_image_block(memblock, MAX_NVRAMBUF_SIZE, image);
+        }
+        else {
+                len = strlen(bus->nvram_params);
+                ASSERT(len <= MAX_NVRAMBUF_SIZE);
+                memcpy(memblock, bus->nvram_params, len);
+        }
+        if (len > 0 && len < MAX_NVRAMBUF_SIZE) {
+                bufp = (char *)memblock;
+                bufp[len] = 0;
+                len = process_nvram_vars(bufp, len);
+                if (len % 4) {
+                        len += 4 - (len % 4);
+                }
+                bufp += len;
+                *bufp++ = 0;
+                if (len)
+                        bcmerror = dhdsdio_downloadvars(bus, memblock, len + 1);
+                if (bcmerror) {
+                        DHD_ERROR(("%s: error downloading vars: %d\n",
+                                   __FUNCTION__, bcmerror));
+                }
+        }
+        else {
+                DHD_ERROR(("%s: error reading nvram file: %d\n",
+                           __FUNCTION__, len));
+                bcmerror = BCME_SDIO_ERROR;
+        }
+
+err:
+        if (memblock)
+                MFREE(bus->dhd->osh, memblock, MAX_NVRAMBUF_SIZE);
+
+        if (image)
+                dhd_os_close_image(image);
+
+        return bcmerror;
+}
+
+static int
+_dhdsdio_download_firmware(struct dhd_bus *bus)
+{
+        int bcmerror = -1;
+        char *p;
+
+        bool embed = FALSE;     /* download embedded firmware */
+        bool dlok = FALSE;      /* download firmware succeeded */
+
+        /* Out immediately if no image to download */
+        if ((bus->fw_path == NULL) || (bus->fw_path[0] == '\0')) {
+#ifdef BCMEMBEDIMAGE
+                embed = TRUE;
+#else
+                return 0;
+#endif
+        }
+
+        /* Keep arm in reset */
+        if (dhdsdio_download_state(bus, TRUE)) {
+                DHD_ERROR(("%s: error placing ARM core in reset\n", __FUNCTION__));
+                goto err;
+        }
+
+        /* External image takes precedence if specified */
+        if ((bus->fw_path != NULL) && (bus->fw_path[0] != '\0')) {
+
+                /* replace bcm43xx with bcm4330 or bcm4329 */
+                if ((p = strstr(bus->fw_path, "bcm43xx"))) {
+                        if (bus->cl_devid == 0x4329) {
+                                *(p + 5)='2';
+                                *(p + 6)='9';
+                        }
+                        if (bus->cl_devid == 0x4330) {
+                                *(p + 5)='3';
+                                *(p + 6)='0';
+                        }
+                }
+
+                if (dhdsdio_download_code_file(bus, bus->fw_path)) {
+                        DHD_ERROR(("%s: dongle image file download failed\n", __FUNCTION__));
+#ifdef BCMEMBEDIMAGE
+                        embed = TRUE;
+#else
+                        goto err;
+#endif
+                }
+                else {
+                        embed = FALSE;
+                        dlok = TRUE;
+                }
+        }
+#ifdef BCMEMBEDIMAGE
+        if (embed) {
+                if (dhdsdio_download_code_array(bus)) {
+                        DHD_ERROR(("%s: dongle image array download failed\n", __FUNCTION__));
+                        goto err;
+                }
+                else {
+                        dlok = TRUE;
+                }
+        }
+#endif
+        if (!dlok) {
+                DHD_ERROR(("%s: dongle image download failed\n", __FUNCTION__));
+                goto err;
+        }
+
+        /* EXAMPLE: nvram_array */
+        /* If a valid nvram_arry is specified as above, it can be passed down to dongle */
+        /* dhd_bus_set_nvram_params(bus, (char *)&nvram_array); */
+
+        /* External nvram takes precedence if specified */
+        if (dhdsdio_download_nvram(bus)) {
+                DHD_ERROR(("%s: dongle nvram file download failed\n", __FUNCTION__));
+                goto err;
+        }
+
+        /* Take arm out of reset */
+        if (dhdsdio_download_state(bus, FALSE)) {
+                DHD_ERROR(("%s: error getting out of ARM core reset\n", __FUNCTION__));
+                goto err;
+        }
+
+        bcmerror = 0;
+
+err:
+        return bcmerror;
+}
+
+static int
+dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
+        void *pkt, bcmsdh_cmplt_fn_t complete, void *handle)
+{
+        int status;
+
+        status = bcmsdh_recv_buf(bus->sdh, addr, fn, flags, buf, nbytes, pkt, complete, handle);
+
+        return status;
+}
+
+static int
+dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
+        void *pkt, bcmsdh_cmplt_fn_t complete, void *handle)
+{
+        return (bcmsdh_send_buf(bus->sdh, addr, fn, flags, buf, nbytes, pkt, complete, handle));
+}
+
+uint
+dhd_bus_chip(struct dhd_bus *bus)
+{
+        ASSERT(bus->sih != NULL);
+        return bus->sih->chip;
+}
+
+void *
+dhd_bus_pub(struct dhd_bus *bus)
+{
+        return bus->dhd;
+}
+
+void *
+dhd_bus_txq(struct dhd_bus *bus)
+{
+        return &bus->txq;
+}
+
+uint
+dhd_bus_hdrlen(struct dhd_bus *bus)
+{
+        return SDPCM_HDRLEN;
+}
+
+int
+dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag)
+{
+        int bcmerror = 0;
+        dhd_bus_t *bus;
+
+        bus = dhdp->bus;
+
+        if (flag == TRUE) {
+                if (!bus->dhd->dongle_reset) {
+                        dhd_os_sdlock(dhdp);
+                        dhd_os_wd_timer(dhdp, 0);
+#if !defined(IGNORE_ETH0_DOWN)
+                        /* Force flow control as protection when stop come before ifconfig_down */
+                        dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+#endif /* !defined(IGNORE_ETH0_DOWN) */
+                        /* Expect app to have torn down any connection before calling */
+                        /* Stop the bus, disable F2 */
+                        dhd_bus_stop(bus, FALSE);
+
+#if defined(OOB_INTR_ONLY)
+                        /* Clean up any pending IRQ */
+                        bcmsdh_set_irq(FALSE);
+#endif /* defined(OOB_INTR_ONLY) */
+
+                        /* Clean tx/rx buffer pointers, detach from the dongle */
+                        dhdsdio_release_dongle(bus, bus->dhd->osh, TRUE, TRUE);
+
+                        bus->dhd->dongle_reset = TRUE;
+                        bus->dhd->up = FALSE;
+                        dhd_os_sdunlock(dhdp);
+
+                        DHD_TRACE(("%s:  WLAN OFF DONE\n", __FUNCTION__));
+                        /* App can now remove power from device */
+                } else
+                        bcmerror = BCME_SDIO_ERROR;
+        } else {
+                /* App must have restored power to device before calling */
+
+                DHD_TRACE(("\n\n%s: == WLAN ON ==\n", __FUNCTION__));
+
+                if (bus->dhd->dongle_reset) {
+                        /* Turn on WLAN */
+#ifdef DHDTHREAD
+                        dhd_os_sdlock(dhdp);
+#endif /* DHDTHREAD */
+                        /* Reset SD client */
+                        bcmsdh_reset(bus->sdh);
+
+                        /* Attempt to re-attach & download */
+                        if (dhdsdio_probe_attach(bus, bus->dhd->osh, bus->sdh,
+                                                (uint32 *)SI_ENUM_BASE,
+                                                bus->cl_devid)) {
+                                /* Attempt to download binary to the dongle */
+                                if (dhdsdio_probe_init(bus, bus->dhd->osh, bus->sdh) &&
+                                        dhdsdio_download_firmware(bus, bus->dhd->osh, bus->sdh)) {
+
+                                        /* Re-init bus, enable F2 transfer */
+                                        bcmerror = dhd_bus_init((dhd_pub_t *) bus->dhd, FALSE);
+                                        if (bcmerror == BCME_OK) {
+#if defined(OOB_INTR_ONLY)
+                                                bcmsdh_set_irq(TRUE);
+                                                dhd_enable_oob_intr(bus, TRUE);
+#endif /* defined(OOB_INTR_ONLY) */
+
+                                                bus->dhd->dongle_reset = FALSE;
+                                                bus->dhd->up = TRUE;
+
+#if !defined(IGNORE_ETH0_DOWN)
+                                                /* Restore flow control  */
+                                                dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+#endif 
+                                                dhd_os_wd_timer(dhdp, dhd_watchdog_ms);
+
+                                                DHD_TRACE(("%s: WLAN ON DONE\n", __FUNCTION__));
+                                        } else {
+                                                dhd_bus_stop(bus, FALSE);
+                                                dhdsdio_release_dongle(bus, bus->dhd->osh,
+                                                        TRUE, FALSE);
+                                        }
+                                } else
+                                        bcmerror = BCME_SDIO_ERROR;
+                        } else
+                                bcmerror = BCME_SDIO_ERROR;
+
+#ifdef DHDTHREAD
+                        dhd_os_sdunlock(dhdp);
+#endif /* DHDTHREAD */
+                } else {
+                        bcmerror = BCME_SDIO_ERROR;
+                        DHD_INFO(("%s called when dongle is not in reset\n",
+                                __FUNCTION__));
+                        DHD_INFO(("Will call dhd_bus_start instead\n"));
+                        sdioh_start(NULL, 1);
+                        if ((bcmerror = dhd_bus_start(dhdp)) != 0)
+                                DHD_ERROR(("%s: dhd_bus_start fail with %d\n",
+                                        __FUNCTION__, bcmerror));
+                }
+        }
+        return bcmerror;
+}
+
+int
+dhd_bus_membytes(dhd_pub_t *dhdp, bool set, uint32 address, uint8 *data, uint size)
+{
+        dhd_bus_t *bus;
+
+        bus = dhdp->bus;
+        return dhdsdio_membytes(bus, set, address, data, size);
+}
diff --git a/drivers/net/wireless/bcmdhd/dhd_wlfc.h b/drivers/net/wireless/bcmdhd/dhd_wlfc.h
new file mode 100644
index 00000000000..59d018b64c6
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dhd_wlfc.h
@@ -0,0 +1,266 @@
+/*
+* Copyright (C) 1999-2011, Broadcom Corporation
+* 
+*         Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2 (the "GPL"),
+* available at http://www.broadcom.com/licenses/GPLv2.php, with the
+* following added to such license:
+* 
+*      As a special exception, the copyright holders of this software give you
+* permission to link this software with independent modules, and to copy and
+* distribute the resulting executable under terms of your choice, provided that
+* you also meet, for each linked independent module, the terms and conditions of
+* the license of that module.  An independent module is a module which is not
+* derived from this software.  The special exception does not apply to any
+* modifications of the software.
+* 
+*      Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a license
+* other than the GPL, without Broadcom's express prior written consent.
+* $Id: dhd_wlfc.h,v 1.1.8.1 2010-09-09 22:41:08 Exp $
+*
+*/
+#ifndef __wlfc_host_driver_definitions_h__
+#define __wlfc_host_driver_definitions_h__
+
+/* 16 bits will provide an absolute max of 65536 slots */
+#define WLFC_HANGER_MAXITEMS 1024
+
+#define WLFC_HANGER_ITEM_STATE_FREE             1
+#define WLFC_HANGER_ITEM_STATE_INUSE    2
+
+#define WLFC_PKTID_HSLOT_MASK                   0xffff /* allow 16 bits only */
+#define WLFC_PKTID_HSLOT_SHIFT                  8
+
+/* x -> TXSTATUS TAG to/from firmware */
+#define WLFC_PKTID_HSLOT_GET(x)                 \
+        (((x) >> WLFC_PKTID_HSLOT_SHIFT) & WLFC_PKTID_HSLOT_MASK)
+#define WLFC_PKTID_HSLOT_SET(var, slot) \
+        ((var) = ((var) & ~(WLFC_PKTID_HSLOT_MASK << WLFC_PKTID_HSLOT_SHIFT)) | \
+        (((slot) & WLFC_PKTID_HSLOT_MASK) << WLFC_PKTID_HSLOT_SHIFT))
+
+#define WLFC_PKTID_FREERUNCTR_MASK      0xff
+
+#define WLFC_PKTID_FREERUNCTR_GET(x)    ((x) & WLFC_PKTID_FREERUNCTR_MASK)
+#define WLFC_PKTID_FREERUNCTR_SET(var, ctr)     \
+        ((var) = (((var) & ~WLFC_PKTID_FREERUNCTR_MASK) | \
+        (((ctr) & WLFC_PKTID_FREERUNCTR_MASK))))
+
+#define WLFC_PKTQ_PENQ(pq, prec, p) ((pktq_full((pq)) || pktq_pfull((pq), (prec)))? \
+        NULL : pktq_penq((pq), (prec), (p)))
+#define WLFC_PKTQ_PENQ_HEAD(pq, prec, p) ((pktq_full((pq)) || pktq_pfull((pq), (prec))) ? \
+        NULL : pktq_penq_head((pq), (prec), (p)))
+
+typedef enum ewlfc_packet_state {
+        eWLFC_PKTTYPE_NEW,
+        eWLFC_PKTTYPE_DELAYED,
+        eWLFC_PKTTYPE_SUPPRESSED,
+        eWLFC_PKTTYPE_MAX
+} ewlfc_packet_state_t;
+
+typedef enum ewlfc_mac_entry_action {
+        eWLFC_MAC_ENTRY_ACTION_ADD,
+        eWLFC_MAC_ENTRY_ACTION_DEL,
+        eWLFC_MAC_ENTRY_ACTION_MAX
+} ewlfc_mac_entry_action_t;
+
+typedef struct wlfc_hanger_item {
+        uint8   state;
+        uint8   pad[3];
+        uint32  identifier;
+        void*   pkt;
+#ifdef PROP_TXSTATUS_DEBUG
+        uint32  push_time;
+#endif
+} wlfc_hanger_item_t;
+
+typedef struct wlfc_hanger {
+        int max_items;
+        uint32 pushed;
+        uint32 popped;
+        uint32 failed_to_push;
+        uint32 failed_to_pop;
+        uint32 failed_slotfind;
+        wlfc_hanger_item_t items[1];
+} wlfc_hanger_t;
+
+#define WLFC_HANGER_SIZE(n)     ((sizeof(wlfc_hanger_t) - \
+        sizeof(wlfc_hanger_item_t)) + ((n)*sizeof(wlfc_hanger_item_t)))
+
+#define WLFC_STATE_OPEN         1
+#define WLFC_STATE_CLOSE        2
+
+#define WLFC_PSQ_PREC_COUNT             ((AC_COUNT + 1) * 2) /* 2 for each AC traffic and bc/mc */
+#define WLFC_PSQ_LEN                    64
+#define WLFC_SENDQ_LEN                  256
+
+#define WLFC_FLOWCONTROL_DELTA          8
+#define WLFC_FLOWCONTROL_HIWATER        (WLFC_PSQ_LEN - WLFC_FLOWCONTROL_DELTA)
+#define WLFC_FLOWCONTROL_LOWATER        (WLFC_FLOWCONTROL_HIWATER - WLFC_FLOWCONTROL_DELTA)
+
+typedef struct wlfc_mac_descriptor {
+        uint8 occupied;
+        uint8 interface_id;
+        uint8 iftype;
+        uint8 state;
+        uint8 ac_bitmap; /* for APSD */
+        uint8 requested_credit;
+        uint8 requested_packet;
+        uint8 ea[ETHER_ADDR_LEN];
+        /*
+        maintain (MAC,AC) based seq count for
+        packets going to the device. As well as bc/mc.
+        */
+        uint8 seq[AC_COUNT + 1];
+        uint8 generation;
+        struct pktq     psq;
+        /* The AC pending bitmap that was reported to the fw at last change */
+        uint8 traffic_lastreported_bmp;
+        /* The new AC pending bitmap */
+        uint8 traffic_pending_bmp;
+        /* 1= send on next opportunity */
+        uint8 send_tim_signal;
+        uint8 mac_handle;
+#ifdef PROP_TXSTATUS_DEBUG
+        uint32 dstncredit_sent_packets;
+        uint32 dstncredit_acks;
+        uint32 opened_ct;
+        uint32 closed_ct;
+#endif
+} wlfc_mac_descriptor_t;
+
+#define WLFC_DECR_SEQCOUNT(entry, prec) do { if (entry->seq[(prec)] == 0) {\
+        entry->seq[prec] = 0xff; } else entry->seq[prec]--;} while (0)
+
+#define WLFC_INCR_SEQCOUNT(entry, prec) entry->seq[(prec)]++
+#define WLFC_SEQCOUNT(entry, prec) entry->seq[(prec)]
+
+typedef struct athost_wl_stat_counters {
+        uint32  pktin;
+        uint32  pkt2bus;
+        uint32  pktdropped;
+        uint32  tlv_parse_failed;
+        uint32  rollback;
+        uint32  rollback_failed;
+        uint32  sendq_full_error;
+        uint32  delayq_full_error;
+        uint32  credit_request_failed;
+        uint32  packet_request_failed;
+        uint32  mac_update_failed;
+        uint32  psmode_update_failed;
+        uint32  interface_update_failed;
+        uint32  wlfc_header_only_pkt;
+        uint32  txstatus_in;
+        uint32  d11_suppress;
+        uint32  wl_suppress;
+        uint32  bad_suppress;
+        uint32  pkt_freed;
+        uint32  pkt_free_err;
+        uint32  psq_wlsup_retx;
+        uint32  psq_wlsup_enq;
+        uint32  psq_d11sup_retx;
+        uint32  psq_d11sup_enq;
+        uint32  psq_hostq_retx;
+        uint32  psq_hostq_enq;
+        uint32  mac_handle_notfound;
+        uint32  wlc_tossed_pkts;
+        uint32  dhd_hdrpulls;
+        uint32  generic_error;
+        /* an extra one for bc/mc traffic */
+        uint32  sendq_pkts[AC_COUNT + 1];
+#ifdef PROP_TXSTATUS_DEBUG
+        /* all pkt2bus -> txstatus latency accumulated */
+        uint32  latency_sample_count;
+        uint32  total_status_latency;
+        uint32  latency_most_recent;
+        int             idx_delta;
+        uint32  deltas[10];
+        uint32  fifo_credits_sent[6];
+        uint32  fifo_credits_back[6];
+        uint32  dropped_qfull[6];
+        uint32  signal_only_pkts_sent;
+        uint32  signal_only_pkts_freed;
+#endif
+} athost_wl_stat_counters_t;
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac) do { \
+        (ctx)->stats.fifo_credits_sent[(ac)]++;} while (0)
+#define WLFC_HOST_FIFO_CREDIT_INC_BACKCTRS(ctx, ac) do { \
+        (ctx)->stats.fifo_credits_back[(ac)]++;} while (0)
+#define WLFC_HOST_FIFO_DROPPEDCTR_INC(ctx, ac) do { \
+        (ctx)->stats.dropped_qfull[(ac)]++;} while (0)
+#else
+#define WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac) do {} while (0)
+#define WLFC_HOST_FIFO_CREDIT_INC_BACKCTRS(ctx, ac) do {} while (0)
+#define WLFC_HOST_FIFO_DROPPEDCTR_INC(ctx, ac) do {} while (0)
+#endif
+
+#define WLFC_FCMODE_NONE                                0
+#define WLFC_FCMODE_IMPLIED_CREDIT              1
+#define WLFC_FCMODE_EXPLICIT_CREDIT             2
+
+#define WLFC_BORROW_DEFER_PERIOD_MS 100
+
+/* Mask to represent available ACs (note: BC/MC is ignored */
+#define WLFC_AC_MASK 0xF
+
+/* Mask to check for only on-going AC_BE traffic */
+#define WLFC_AC_BE_TRAFFIC_ONLY 0xD
+
+typedef struct athost_wl_status_info {
+        uint8   last_seqid_to_wlc;
+
+        /* OSL handle */
+        osl_t*  osh;
+        /* dhd pub */
+        void*   dhdp;
+
+        /* stats */
+        athost_wl_stat_counters_t stats;
+
+        /* the additional ones are for bc/mc and ATIM FIFO */
+        int             FIFO_credit[AC_COUNT + 2];
+
+        /* Credit borrow counts for each FIFO from each of the other FIFOs */
+        int             credits_borrowed[AC_COUNT + 2][AC_COUNT + 2];
+
+        struct  pktq SENDQ;
+
+        /* packet hanger and MAC->handle lookup table */
+        void*   hanger;
+        struct {
+                /* table for individual nodes */
+                wlfc_mac_descriptor_t   nodes[WLFC_MAC_DESC_TABLE_SIZE];
+                /* table for interfaces */
+                wlfc_mac_descriptor_t   interfaces[WLFC_MAX_IFNUM];
+                /* OS may send packets to unknown (unassociated) destinations */
+                /* A place holder for bc/mc and packets to unknown destinations */
+                wlfc_mac_descriptor_t   other;
+        } destination_entries;
+        /* token position for different priority packets */
+        uint8   token_pos[AC_COUNT+1];
+        /* ON/OFF state for flow control to the host network interface */
+        uint8   hostif_flow_state[WLFC_MAX_IFNUM];
+        uint8   host_ifidx;
+        /* to flow control an OS interface */
+        uint8   toggle_host_if;
+
+        /*
+        Mode in which the dhd flow control shall operate. Must be set before
+        traffic starts to the device.
+        0 - Do not do any proptxtstatus flow control
+        1 - Use implied credit from a packet status
+        2 - Use explicit credit
+        */
+        uint8   proptxstatus_mode;
+
+        /* To borrow credits */
+        uint8   allow_credit_borrow;
+
+        /* Timestamp to compute how long to defer borrowing for */
+        uint32  borrow_defer_timestamp;
+} athost_wl_status_info_t;
+
+#endif /* __wlfc_host_driver_definitions_h__ */
diff --git a/drivers/net/wireless/bcmdhd/dngl_stats.h b/drivers/net/wireless/bcmdhd/dngl_stats.h
new file mode 100644
index 00000000000..9cdf718b399
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dngl_stats.h
@@ -0,0 +1,43 @@
+/*
+ * Common stats definitions for clients of dongle
+ * ports
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dngl_stats.h,v 1.5 2008-06-02 16:56:20 Exp $
+ */
+
+#ifndef _dngl_stats_h_
+#define _dngl_stats_h_
+
+typedef struct {
+        unsigned long   rx_packets;             /* total packets received */
+        unsigned long   tx_packets;             /* total packets transmitted */
+        unsigned long   rx_bytes;               /* total bytes received */
+        unsigned long   tx_bytes;               /* total bytes transmitted */
+        unsigned long   rx_errors;              /* bad packets received */
+        unsigned long   tx_errors;              /* packet transmit problems */
+        unsigned long   rx_dropped;             /* packets dropped by dongle */
+        unsigned long   tx_dropped;             /* packets dropped by dongle */
+        unsigned long   multicast;      /* multicast packets received */
+} dngl_stats_t;
+
+#endif /* _dngl_stats_h_ */
diff --git a/drivers/net/wireless/bcmdhd/dngl_wlhdr.h b/drivers/net/wireless/bcmdhd/dngl_wlhdr.h
new file mode 100644
index 00000000000..8b39b9ecb58
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/dngl_wlhdr.h
@@ -0,0 +1,40 @@
+/*
+ * Dongle WL Header definitions
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dngl_wlhdr.h,v 1.1 2009-01-08 01:21:12 Exp $
+ */
+
+#ifndef _dngl_wlhdr_h_
+#define _dngl_wlhdr_h_
+
+typedef struct wl_header {
+    uint8   type;           /* Header type */
+    uint8   version;        /* Header version */
+        int8    rssi;                   /* RSSI */
+        uint8   pad;                    /* Unused */
+} wl_header_t;
+
+#define WL_HEADER_LEN   sizeof(wl_header_t)
+#define WL_HEADER_TYPE  0
+#define WL_HEADER_VER   1
+#endif /* _dngl_wlhdr_h_ */
diff --git a/drivers/net/wireless/bcmdhd/hndpmu.c b/drivers/net/wireless/bcmdhd/hndpmu.c
new file mode 100644
index 00000000000..b9586e40d0c
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/hndpmu.c
@@ -0,0 +1,222 @@
+/*
+ * Misc utility routines for accessing PMU corerev specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: hndpmu.c,v 1.228.2.56 2011-02-11 22:49:07 Exp $
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <hndpmu.h>
+
+#define PMU_ERROR(args)
+
+#define PMU_MSG(args)
+
+/* To check in verbose debugging messages not intended
+ * to be on except on private builds.
+ */
+#define PMU_NONE(args)
+
+
+/* SDIO Pad drive strength to select value mappings.
+ * The last strength value in each table must be 0 (the tri-state value).
+ */
+typedef struct {
+        uint8 strength;                 /* Pad Drive Strength in mA */
+        uint8 sel;                      /* Chip-specific select value */
+} sdiod_drive_str_t;
+
+/* SDIO Drive Strength to sel value table for PMU Rev 1 */
+static const sdiod_drive_str_t sdiod_drive_strength_tab1[] = {
+        {4, 0x2},
+        {2, 0x3},
+        {1, 0x0},
+        {0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 2, 3 */
+static const sdiod_drive_str_t sdiod_drive_strength_tab2[] = {
+        {12, 0x7},
+        {10, 0x6},
+        {8, 0x5},
+        {6, 0x4},
+        {4, 0x2},
+        {2, 0x1},
+        {0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 8 (1.8V) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab3[] = {
+        {32, 0x7},
+        {26, 0x6},
+        {22, 0x5},
+        {16, 0x4},
+        {12, 0x3},
+        {8, 0x2},
+        {4, 0x1},
+        {0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 11 (1.8v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab4_1v8[] = {
+        {32, 0x6},
+        {26, 0x7},
+        {22, 0x4},
+        {16, 0x5},
+        {12, 0x2},
+        {8, 0x3},
+        {4, 0x0},
+        {0, 0x1} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 11 (1.2v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab4_1v2[] = {
+        {16, 0x3},
+        {13, 0x2},
+        {11, 0x1},
+        {8, 0x0},
+        {6, 0x7},
+        {4, 0x6},
+        {2, 0x5},
+        {0, 0x4} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 11 (2.5v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab4_2v5[] = {
+        {80, 0x5},
+        {65, 0x4},
+        {55, 0x7},
+        {40, 0x6},
+        {30, 0x1},
+        {20, 0x0},
+        {10, 0x3},
+        {0, 0x2} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 13 (1.8v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab5_1v8[] = {
+        {6, 0x7},
+        {5, 0x6},
+        {4, 0x5},
+        {3, 0x4},
+        {2, 0x2},
+        {1, 0x1},
+        {0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 13 (3.3v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab5_3v3[] = {
+        {12, 0x7},
+        {10, 0x6},
+        {8, 0x5},
+        {6, 0x4},
+        {4, 0x2},
+        {2, 0x1},
+        {0, 0x0} };
+
+
+#define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
+
+void
+si_sdiod_drive_strength_init(si_t *sih, osl_t *osh, uint32 drivestrength)
+{
+        chipcregs_t *cc;
+        uint origidx, intr_val = 0;
+        sdiod_drive_str_t *str_tab = NULL;
+        uint32 str_mask = 0;
+        uint32 str_shift = 0;
+
+        if (!(sih->cccaps & CC_CAP_PMU)) {
+                return;
+        }
+
+        /* Remember original core before switch to chipc */
+        cc = (chipcregs_t *) si_switch_core(sih, CC_CORE_ID, &origidx, &intr_val);
+
+        switch (SDIOD_DRVSTR_KEY(sih->chip, sih->pmurev)) {
+        case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 1):
+                str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab1;
+                str_mask = 0x30000000;
+                str_shift = 28;
+                break;
+        case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 2):
+        case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 3):
+        case SDIOD_DRVSTR_KEY(BCM4315_CHIP_ID, 4):
+                str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab2;
+                str_mask = 0x00003800;
+                str_shift = 11;
+                break;
+        case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 8):
+        case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 11):
+                if (sih->pmurev == 8) {
+                        str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab3;
+                }
+                else if (sih->pmurev == 11) {
+                        str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab4_1v8;
+                }
+                str_mask = 0x00003800;
+                str_shift = 11;
+                break;
+        case SDIOD_DRVSTR_KEY(BCM4330_CHIP_ID, 12):
+                str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab4_1v8;
+                str_mask = 0x00003800;
+                str_shift = 11;
+                break;
+        case SDIOD_DRVSTR_KEY(BCM43362_CHIP_ID, 13):
+                str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab5_1v8;
+                str_mask = 0x00003800;
+                str_shift = 11;
+                break;
+        default:
+                PMU_MSG(("No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
+                         bcm_chipname(sih->chip, chn, 8), sih->chiprev, sih->pmurev));
+
+                break;
+        }
+
+        if (str_tab != NULL) {
+                uint32 cc_data_temp;
+                int i;
+
+                /* Pick the lowest available drive strength equal or greater than the
+                 * requested strength.  Drive strength of 0 requests tri-state.
+                 */
+                for (i = 0; drivestrength < str_tab[i].strength; i++)
+                        ;
+
+                if (i > 0 && drivestrength > str_tab[i].strength)
+                        i--;
+
+                W_REG(osh, &cc->chipcontrol_addr, 1);
+                cc_data_temp = R_REG(osh, &cc->chipcontrol_data);
+                cc_data_temp &= ~str_mask;
+                cc_data_temp |= str_tab[i].sel << str_shift;
+                W_REG(osh, &cc->chipcontrol_data, cc_data_temp);
+
+                PMU_MSG(("SDIO: %dmA drive strength requested; set to %dmA\n",
+                         drivestrength, str_tab[i].strength));
+        }
+
+        /* Return to original core */
+        si_restore_core(sih, origidx, intr_val);
+}
diff --git a/drivers/net/wireless/bcmdhd/include/Makefile b/drivers/net/wireless/bcmdhd/include/Makefile
new file mode 100644
index 00000000000..c07266fd6fd
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/Makefile
@@ -0,0 +1,53 @@
+#!/bin/bash
+#
+# This script serves following purpose:
+#
+# 1. It generates native version information by querying
+#    automerger maintained database to see where src/include
+#    came from
+# 2. For select components, as listed in compvers.sh
+#    it generates component version files
+#
+# Copyright 2005, Broadcom, Inc.
+#
+# $Id: Makefile 241702 2011-02-19 00:41:03Z automrgr $
+#
+
+SRCBASE := ..
+
+TARGETS := epivers.h
+
+ifdef VERBOSE
+export VERBOSE
+endif
+
+all release: epivers compvers
+
+# Generate epivers.h for native branch version
+epivers:
+        bash epivers.sh
+
+# Generate epivers.h for native branch version
+compvers:
+        @if [ -s "compvers.sh" ]; then \
+                echo "Generating component versions, if any"; \
+                bash compvers.sh; \
+        else \
+                echo "Skipping component version generation"; \
+        fi
+
+# Generate epivers.h for native branch version
+clean_compvers:
+        @if [ -s "compvers.sh" ]; then \
+                echo "bash compvers.sh clean"; \
+                bash compvers.sh clean; \
+        else \
+                echo "Skipping component version clean"; \
+        fi
+
+clean:
+        rm -f $(TARGETS) *.prev
+
+clean_all: clean clean_compvers
+
+.PHONY: all release clean epivers compvers clean_compvers
diff --git a/drivers/net/wireless/bcmdhd/include/aidmp.h b/drivers/net/wireless/bcmdhd/include/aidmp.h
new file mode 100644
index 00000000000..375df443a29
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/aidmp.h
@@ -0,0 +1,377 @@
+/*
+ * Broadcom AMBA Interconnect definitions.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: aidmp.h,v 13.4.14.1 2010-03-09 18:40:06 Exp $
+ */
+
+
+#ifndef _AIDMP_H
+#define _AIDMP_H
+
+
+#define MFGID_ARM               0x43b
+#define MFGID_BRCM              0x4bf
+#define MFGID_MIPS              0x4a7
+
+
+#define CC_SIM                  0
+#define CC_EROM                 1
+#define CC_CORESIGHT            9
+#define CC_VERIF                0xb
+#define CC_OPTIMO               0xd
+#define CC_GEN                  0xe
+#define CC_PRIMECELL            0xf
+
+
+#define ER_EROMENTRY            0x000
+#define ER_REMAPCONTROL         0xe00
+#define ER_REMAPSELECT          0xe04
+#define ER_MASTERSELECT         0xe10
+#define ER_ITCR                 0xf00
+#define ER_ITIP                 0xf04
+
+
+#define ER_TAG                  0xe
+#define ER_TAG1                 0x6
+#define ER_VALID                1
+#define ER_CI                   0
+#define ER_MP                   2
+#define ER_ADD                  4
+#define ER_END                  0xe
+#define ER_BAD                  0xffffffff
+
+
+#define CIA_MFG_MASK            0xfff00000
+#define CIA_MFG_SHIFT           20
+#define CIA_CID_MASK            0x000fff00
+#define CIA_CID_SHIFT           8
+#define CIA_CCL_MASK            0x000000f0
+#define CIA_CCL_SHIFT           4
+
+
+#define CIB_REV_MASK            0xff000000
+#define CIB_REV_SHIFT           24
+#define CIB_NSW_MASK            0x00f80000
+#define CIB_NSW_SHIFT           19
+#define CIB_NMW_MASK            0x0007c000
+#define CIB_NMW_SHIFT           14
+#define CIB_NSP_MASK            0x00003e00
+#define CIB_NSP_SHIFT           9
+#define CIB_NMP_MASK            0x000001f0
+#define CIB_NMP_SHIFT           4
+
+
+#define MPD_MUI_MASK            0x0000ff00
+#define MPD_MUI_SHIFT           8
+#define MPD_MP_MASK             0x000000f0
+#define MPD_MP_SHIFT            4
+
+
+#define AD_ADDR_MASK            0xfffff000
+#define AD_SP_MASK              0x00000f00
+#define AD_SP_SHIFT             8
+#define AD_ST_MASK              0x000000c0
+#define AD_ST_SHIFT             6
+#define AD_ST_SLAVE             0x00000000
+#define AD_ST_BRIDGE            0x00000040
+#define AD_ST_SWRAP             0x00000080
+#define AD_ST_MWRAP             0x000000c0
+#define AD_SZ_MASK              0x00000030
+#define AD_SZ_SHIFT             4
+#define AD_SZ_4K                0x00000000
+#define AD_SZ_8K                0x00000010
+#define AD_SZ_16K               0x00000020
+#define AD_SZ_SZD               0x00000030
+#define AD_AG32                 0x00000008
+#define AD_ADDR_ALIGN           0x00000fff
+#define AD_SZ_BASE              0x00001000      
+
+
+#define SD_SZ_MASK              0xfffff000
+#define SD_SG32                 0x00000008
+#define SD_SZ_ALIGN             0x00000fff
+
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+typedef volatile struct _aidmp {
+        uint32  oobselina30;    
+        uint32  oobselina74;    
+        uint32  PAD[6];
+        uint32  oobselinb30;    
+        uint32  oobselinb74;    
+        uint32  PAD[6];
+        uint32  oobselinc30;    
+        uint32  oobselinc74;    
+        uint32  PAD[6];
+        uint32  oobselind30;    
+        uint32  oobselind74;    
+        uint32  PAD[38];
+        uint32  oobselouta30;   
+        uint32  oobselouta74;   
+        uint32  PAD[6];
+        uint32  oobseloutb30;   
+        uint32  oobseloutb74;   
+        uint32  PAD[6];
+        uint32  oobseloutc30;   
+        uint32  oobseloutc74;   
+        uint32  PAD[6];
+        uint32  oobseloutd30;   
+        uint32  oobseloutd74;   
+        uint32  PAD[38];
+        uint32  oobsynca;       
+        uint32  oobseloutaen;   
+        uint32  PAD[6];
+        uint32  oobsyncb;       
+        uint32  oobseloutben;   
+        uint32  PAD[6];
+        uint32  oobsyncc;       
+        uint32  oobseloutcen;   
+        uint32  PAD[6];
+        uint32  oobsyncd;       
+        uint32  oobseloutden;   
+        uint32  PAD[38];
+        uint32  oobaextwidth;   
+        uint32  oobainwidth;    
+        uint32  oobaoutwidth;   
+        uint32  PAD[5];
+        uint32  oobbextwidth;   
+        uint32  oobbinwidth;    
+        uint32  oobboutwidth;   
+        uint32  PAD[5];
+        uint32  oobcextwidth;   
+        uint32  oobcinwidth;    
+        uint32  oobcoutwidth;   
+        uint32  PAD[5];
+        uint32  oobdextwidth;   
+        uint32  oobdinwidth;    
+        uint32  oobdoutwidth;   
+        uint32  PAD[37];
+        uint32  ioctrlset;      
+        uint32  ioctrlclear;    
+        uint32  ioctrl;         
+        uint32  PAD[61];
+        uint32  iostatus;       
+        uint32  PAD[127];
+        uint32  ioctrlwidth;    
+        uint32  iostatuswidth;  
+        uint32  PAD[62];
+        uint32  resetctrl;      
+        uint32  resetstatus;    
+        uint32  resetreadid;    
+        uint32  resetwriteid;   
+        uint32  PAD[60];
+        uint32  errlogctrl;     
+        uint32  errlogdone;     
+        uint32  errlogstatus;   
+        uint32  errlogaddrlo;   
+        uint32  errlogaddrhi;   
+        uint32  errlogid;       
+        uint32  errloguser;     
+        uint32  errlogflags;    
+        uint32  PAD[56];
+        uint32  intstatus;      
+        uint32  PAD[127];
+        uint32  config;         
+        uint32  PAD[63];
+        uint32  itcr;           
+        uint32  PAD[3];
+        uint32  itipooba;       
+        uint32  itipoobb;       
+        uint32  itipoobc;       
+        uint32  itipoobd;       
+        uint32  PAD[4];
+        uint32  itipoobaout;    
+        uint32  itipoobbout;    
+        uint32  itipoobcout;    
+        uint32  itipoobdout;    
+        uint32  PAD[4];
+        uint32  itopooba;       
+        uint32  itopoobb;       
+        uint32  itopoobc;       
+        uint32  itopoobd;       
+        uint32  PAD[4];
+        uint32  itopoobain;     
+        uint32  itopoobbin;     
+        uint32  itopoobcin;     
+        uint32  itopoobdin;     
+        uint32  PAD[4];
+        uint32  itopreset;      
+        uint32  PAD[15];
+        uint32  peripherialid4; 
+        uint32  peripherialid5; 
+        uint32  peripherialid6; 
+        uint32  peripherialid7; 
+        uint32  peripherialid0; 
+        uint32  peripherialid1; 
+        uint32  peripherialid2; 
+        uint32  peripherialid3; 
+        uint32  componentid0;   
+        uint32  componentid1;   
+        uint32  componentid2;   
+        uint32  componentid3;   
+} aidmp_t;
+
+#endif 
+
+
+#define OOB_BUSCONFIG           0x020
+#define OOB_STATUSA             0x100
+#define OOB_STATUSB             0x104
+#define OOB_STATUSC             0x108
+#define OOB_STATUSD             0x10c
+#define OOB_ENABLEA0            0x200
+#define OOB_ENABLEA1            0x204
+#define OOB_ENABLEA2            0x208
+#define OOB_ENABLEA3            0x20c
+#define OOB_ENABLEB0            0x280
+#define OOB_ENABLEB1            0x284
+#define OOB_ENABLEB2            0x288
+#define OOB_ENABLEB3            0x28c
+#define OOB_ENABLEC0            0x300
+#define OOB_ENABLEC1            0x304
+#define OOB_ENABLEC2            0x308
+#define OOB_ENABLEC3            0x30c
+#define OOB_ENABLED0            0x380
+#define OOB_ENABLED1            0x384
+#define OOB_ENABLED2            0x388
+#define OOB_ENABLED3            0x38c
+#define OOB_ITCR                0xf00
+#define OOB_ITIPOOBA            0xf10
+#define OOB_ITIPOOBB            0xf14
+#define OOB_ITIPOOBC            0xf18
+#define OOB_ITIPOOBD            0xf1c
+#define OOB_ITOPOOBA            0xf30
+#define OOB_ITOPOOBB            0xf34
+#define OOB_ITOPOOBC            0xf38
+#define OOB_ITOPOOBD            0xf3c
+
+
+#define AI_OOBSELINA30          0x000
+#define AI_OOBSELINA74          0x004
+#define AI_OOBSELINB30          0x020
+#define AI_OOBSELINB74          0x024
+#define AI_OOBSELINC30          0x040
+#define AI_OOBSELINC74          0x044
+#define AI_OOBSELIND30          0x060
+#define AI_OOBSELIND74          0x064
+#define AI_OOBSELOUTA30         0x100
+#define AI_OOBSELOUTA74         0x104
+#define AI_OOBSELOUTB30         0x120
+#define AI_OOBSELOUTB74         0x124
+#define AI_OOBSELOUTC30         0x140
+#define AI_OOBSELOUTC74         0x144
+#define AI_OOBSELOUTD30         0x160
+#define AI_OOBSELOUTD74         0x164
+#define AI_OOBSYNCA             0x200
+#define AI_OOBSELOUTAEN         0x204
+#define AI_OOBSYNCB             0x220
+#define AI_OOBSELOUTBEN         0x224
+#define AI_OOBSYNCC             0x240
+#define AI_OOBSELOUTCEN         0x244
+#define AI_OOBSYNCD             0x260
+#define AI_OOBSELOUTDEN         0x264
+#define AI_OOBAEXTWIDTH         0x300
+#define AI_OOBAINWIDTH          0x304
+#define AI_OOBAOUTWIDTH         0x308
+#define AI_OOBBEXTWIDTH         0x320
+#define AI_OOBBINWIDTH          0x324
+#define AI_OOBBOUTWIDTH         0x328
+#define AI_OOBCEXTWIDTH         0x340
+#define AI_OOBCINWIDTH          0x344
+#define AI_OOBCOUTWIDTH         0x348
+#define AI_OOBDEXTWIDTH         0x360
+#define AI_OOBDINWIDTH          0x364
+#define AI_OOBDOUTWIDTH         0x368
+
+
+#define AI_IOCTRLSET            0x400
+#define AI_IOCTRLCLEAR          0x404
+#define AI_IOCTRL               0x408
+#define AI_IOSTATUS             0x500
+#define AI_RESETCTRL            0x800
+#define AI_RESETSTATUS          0x804
+
+
+#define AI_IOCTRLWIDTH          0x700
+#define AI_IOSTATUSWIDTH        0x704
+
+#define AI_RESETREADID          0x808
+#define AI_RESETWRITEID         0x80c
+#define AI_ERRLOGCTRL           0xa00
+#define AI_ERRLOGDONE           0xa04
+#define AI_ERRLOGSTATUS         0xa08
+#define AI_ERRLOGADDRLO         0xa0c
+#define AI_ERRLOGADDRHI         0xa10
+#define AI_ERRLOGID             0xa14
+#define AI_ERRLOGUSER           0xa18
+#define AI_ERRLOGFLAGS          0xa1c
+#define AI_INTSTATUS            0xa00
+#define AI_CONFIG               0xe00
+#define AI_ITCR                 0xf00
+#define AI_ITIPOOBA             0xf10
+#define AI_ITIPOOBB             0xf14
+#define AI_ITIPOOBC             0xf18
+#define AI_ITIPOOBD             0xf1c
+#define AI_ITIPOOBAOUT          0xf30
+#define AI_ITIPOOBBOUT          0xf34
+#define AI_ITIPOOBCOUT          0xf38
+#define AI_ITIPOOBDOUT          0xf3c
+#define AI_ITOPOOBA             0xf50
+#define AI_ITOPOOBB             0xf54
+#define AI_ITOPOOBC             0xf58
+#define AI_ITOPOOBD             0xf5c
+#define AI_ITOPOOBAIN           0xf70
+#define AI_ITOPOOBBIN           0xf74
+#define AI_ITOPOOBCIN           0xf78
+#define AI_ITOPOOBDIN           0xf7c
+#define AI_ITOPRESET            0xf90
+#define AI_PERIPHERIALID4       0xfd0
+#define AI_PERIPHERIALID5       0xfd4
+#define AI_PERIPHERIALID6       0xfd8
+#define AI_PERIPHERIALID7       0xfdc
+#define AI_PERIPHERIALID0       0xfe0
+#define AI_PERIPHERIALID1       0xfe4
+#define AI_PERIPHERIALID2       0xfe8
+#define AI_PERIPHERIALID3       0xfec
+#define AI_COMPONENTID0         0xff0
+#define AI_COMPONENTID1         0xff4
+#define AI_COMPONENTID2         0xff8
+#define AI_COMPONENTID3         0xffc
+
+
+#define AIRC_RESET              1
+
+
+#define AICFG_OOB               0x00000020
+#define AICFG_IOS               0x00000010
+#define AICFG_IOC               0x00000008
+#define AICFG_TO                0x00000004
+#define AICFG_ERRL              0x00000002
+#define AICFG_RST               0x00000001
+
+
+#define OOB_SEL_OUTEN_B_5       15
+#define OOB_SEL_OUTEN_B_6       23
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/bcmcdc.h b/drivers/net/wireless/bcmdhd/include/bcmcdc.h
new file mode 100644
index 00000000000..ce45c50d964
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmcdc.h
@@ -0,0 +1,121 @@
+/*
+ * CDC network driver ioctl/indication encoding
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmcdc.h,v 13.25.10.3 2010-12-22 23:47:26 Exp $
+ */
+
+#ifndef _bcmcdc_h_
+#define _bcmcdc_h_
+#include <proto/ethernet.h>
+
+typedef struct cdc_ioctl {
+        uint32 cmd;      
+        uint32 len;      
+        uint32 flags;    
+        uint32 status;   
+} cdc_ioctl_t;
+
+
+#define CDC_MAX_MSG_SIZE   ETHER_MAX_LEN
+
+
+#define CDCL_IOC_OUTLEN_MASK   0x0000FFFF  
+                                           
+#define CDCL_IOC_OUTLEN_SHIFT  0
+#define CDCL_IOC_INLEN_MASK    0xFFFF0000   
+#define CDCL_IOC_INLEN_SHIFT   16
+
+
+#define CDCF_IOC_ERROR          0x01    
+#define CDCF_IOC_SET            0x02    
+#define CDCF_IOC_OVL_IDX_MASK   0x3c    
+#define CDCF_IOC_OVL_RSV        0x40    
+#define CDCF_IOC_OVL            0x80    
+#define CDCF_IOC_ACTION_MASK    0xfe    
+#define CDCF_IOC_ACTION_SHIFT   1       
+#define CDCF_IOC_IF_MASK        0xF000  
+#define CDCF_IOC_IF_SHIFT       12
+#define CDCF_IOC_ID_MASK        0xFFFF0000      
+#define CDCF_IOC_ID_SHIFT       16              
+
+#define CDC_IOC_IF_IDX(flags)   (((flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT)
+#define CDC_IOC_ID(flags)       (((flags) & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT)
+
+#define CDC_GET_IF_IDX(hdr) \
+        ((int)((((hdr)->flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT))
+#define CDC_SET_IF_IDX(hdr, idx) \
+        ((hdr)->flags = (((hdr)->flags & ~CDCF_IOC_IF_MASK) | ((idx) << CDCF_IOC_IF_SHIFT)))
+
+
+
+#define BDC_HEADER_LEN          4
+
+#define BDC_PROTO_VER_1         1       
+#define BDC_PROTO_VER           2       
+
+#define BDC_FLAG_VER_MASK       0xf0    
+#define BDC_FLAG_VER_SHIFT      4       
+
+#define BDC_FLAG__UNUSED        0x03    
+#define BDC_FLAG_SUM_GOOD       0x04    
+#define BDC_FLAG_SUM_NEEDED     0x08    
+
+#define BDC_PRIORITY_MASK       0x7
+
+#define BDC_FLAG2_FC_FLAG       0x10    
+                                                                        
+#define BDC_PRIORITY_FC_SHIFT   4               
+
+#define BDC_FLAG2_IF_MASK       0x0f    
+#define BDC_FLAG2_IF_SHIFT      0
+#define BDC_FLAG2_PAD_MASK              0xf0
+#define BDC_FLAG_PAD_MASK               0x03
+#define BDC_FLAG2_PAD_SHIFT             2
+#define BDC_FLAG_PAD_SHIFT              0
+#define BDC_FLAG2_PAD_IDX               0x3c
+#define BDC_FLAG_PAD_IDX                0x03
+#define BDC_GET_PAD_LEN(hdr) \
+        ((int)(((((hdr)->flags2) & BDC_FLAG2_PAD_MASK) >> BDC_FLAG2_PAD_SHIFT) | \
+        ((((hdr)->flags) & BDC_FLAG_PAD_MASK) >> BDC_FLAG_PAD_SHIFT)))
+#define BDC_SET_PAD_LEN(hdr, idx) \
+        ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_PAD_MASK) | \
+        (((idx) & BDC_FLAG2_PAD_IDX) << BDC_FLAG2_PAD_SHIFT))); \
+        ((hdr)->flags = (((hdr)->flags & ~BDC_FLAG_PAD_MASK) | \
+        (((idx) & BDC_FLAG_PAD_IDX) << BDC_FLAG_PAD_SHIFT)))
+
+#define BDC_GET_IF_IDX(hdr) \
+        ((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
+#define BDC_SET_IF_IDX(hdr, idx) \
+        ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | ((idx) << BDC_FLAG2_IF_SHIFT)))
+
+struct bdc_header {
+        uint8   flags;                  
+        uint8   priority;               
+        uint8   flags2;
+        uint8   dataOffset;
+};
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/bcmdefs.h b/drivers/net/wireless/bcmdhd/include/bcmdefs.h
new file mode 100644
index 00000000000..da1fd5e4eac
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmdefs.h
@@ -0,0 +1,196 @@
+/*
+ * Misc system wide definitions
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmdefs.h,v 13.68.2.8 2011-01-08 04:04:19 Exp $
+ */
+
+
+#ifndef _bcmdefs_h_
+#define _bcmdefs_h_
+
+
+
+#define bcmreclaimed            0
+#define _data   _data
+#define _fn     _fn
+#define _data   _data
+#define _fn             _fn
+#define _fn     _fn
+#define CONST   const
+#define BCMFASTPATH
+
+
+
+
+#define _data   _data
+#define _fn             _fn
+#define _fn     _fn
+#define STATIC  static
+
+
+#define SI_BUS                  0       
+#define PCI_BUS                 1       
+#define PCMCIA_BUS              2       
+#define SDIO_BUS                3       
+#define JTAG_BUS                4       
+#define USB_BUS                 5       
+#define SPI_BUS                 6       
+#define RPC_BUS                 7       
+
+
+#ifdef BCMBUSTYPE
+#define BUSTYPE(bus)    (BCMBUSTYPE)
+#else
+#define BUSTYPE(bus)    (bus)
+#endif
+
+
+#ifdef BCMCHIPTYPE
+#define CHIPTYPE(bus)   (BCMCHIPTYPE)
+#else
+#define CHIPTYPE(bus)   (bus)
+#endif
+
+
+
+#if defined(BCMSPROMBUS)
+#define SPROMBUS        (BCMSPROMBUS)
+#elif defined(SI_PCMCIA_SROM)
+#define SPROMBUS        (PCMCIA_BUS)
+#else
+#define SPROMBUS        (PCI_BUS)
+#endif
+
+
+#ifdef BCMCHIPID
+#define CHIPID(chip)    (BCMCHIPID)
+#else
+#define CHIPID(chip)    (chip)
+#endif
+
+#ifdef BCMCHIPREV
+#define CHIPREV(rev)    (BCMCHIPREV)
+#else
+#define CHIPREV(rev)    (rev)
+#endif
+
+
+#define DMADDR_MASK_32 0x0              
+#define DMADDR_MASK_30 0xc0000000       
+#define DMADDR_MASK_0  0xffffffff       
+
+#define DMADDRWIDTH_30  30 
+#define DMADDRWIDTH_32  32 
+#define DMADDRWIDTH_63  63 
+#define DMADDRWIDTH_64  64 
+
+#ifdef BCMDMA64OSL
+typedef struct {
+        uint32 loaddr;
+        uint32 hiaddr;
+} dma64addr_t;
+
+typedef dma64addr_t dmaaddr_t;
+#define PHYSADDRHI(_pa) ((_pa).hiaddr)
+#define PHYSADDRHISET(_pa, _val) \
+        do { \
+                (_pa).hiaddr = (_val);          \
+        } while (0)
+#define PHYSADDRLO(_pa) ((_pa).loaddr)
+#define PHYSADDRLOSET(_pa, _val) \
+        do { \
+                (_pa).loaddr = (_val);          \
+        } while (0)
+
+#else
+typedef unsigned long dmaaddr_t;
+#define PHYSADDRHI(_pa) (0)
+#define PHYSADDRHISET(_pa, _val)
+#define PHYSADDRLO(_pa) ((_pa))
+#define PHYSADDRLOSET(_pa, _val) \
+        do { \
+                (_pa) = (_val);                 \
+        } while (0)
+#endif 
+
+
+typedef struct  {
+        dmaaddr_t addr;
+        uint32    length;
+} hnddma_seg_t;
+
+#define MAX_DMA_SEGS 4
+
+
+typedef struct {
+        void *oshdmah; 
+        uint origsize; 
+        uint nsegs;
+        hnddma_seg_t segs[MAX_DMA_SEGS];
+} hnddma_seg_map_t;
+
+
+
+
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RCP_TXNOCOPY)
+
+#define BCMEXTRAHDROOM 220
+#else
+#define BCMEXTRAHDROOM 172
+#endif
+
+
+#define BCMDONGLEHDRSZ 12
+#define BCMDONGLEPADSZ 16
+
+#define BCMDONGLEOVERHEAD       (BCMDONGLEHDRSZ + BCMDONGLEPADSZ)
+
+
+#if defined(BCMASSERT_LOG)
+#define BCMASSERT_SUPPORT
+#endif 
+
+
+#define BITFIELD_MASK(width) \
+                (((unsigned)1 << (width)) - 1)
+#define GFIELD(val, field) \
+                (((val) >> field ## _S) & field ## _M)
+#define SFIELD(val, field, bits) \
+                (((val) & (~(field ## _M << field ## _S))) | \
+                 ((unsigned)(bits) << field ## _S))
+
+
+#ifdef BCMSMALL
+#undef  BCMSPACE
+#define bcmspace        FALSE   
+#else
+#define BCMSPACE
+#define bcmspace        TRUE    
+#endif
+
+
+#define MAXSZ_NVRAM_VARS        4096
+
+#define LOCATOR_EXTERN static
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/bcmdevs.h b/drivers/net/wireless/bcmdhd/include/bcmdevs.h
new file mode 100644
index 00000000000..4f707c0c692
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmdevs.h
@@ -0,0 +1,182 @@
+/*
+ * Broadcom device-specific manifest constants.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmdevs.h,v 13.285.2.39 2011-02-04 05:03:16 Exp $
+ */
+
+
+#ifndef _BCMDEVS_H
+#define _BCMDEVS_H
+
+
+#define VENDOR_EPIGRAM          0xfeda
+#define VENDOR_BROADCOM         0x14e4
+#define VENDOR_SI_IMAGE         0x1095          
+#define VENDOR_TI               0x104c          
+#define VENDOR_RICOH            0x1180          
+#define VENDOR_JMICRON          0x197b
+
+
+
+#define VENDOR_BROADCOM_PCMCIA  0x02d0
+
+
+#define VENDOR_BROADCOM_SDIO    0x00BF
+
+
+#define BCM_DNGL_VID            0x0a5c
+#define BCM_DNGL_BL_PID_4328    0xbd12
+#define BCM_DNGL_BL_PID_4322    0xbd13
+#define BCM_DNGL_BL_PID_4319    0xbd16
+#define BCM_DNGL_BL_PID_43236   0xbd17
+#define BCM_DNGL_BL_PID_4332    0xbd18
+#define BCM_DNGL_BL_PID_4330    0xbd19
+#define BCM_DNGL_BL_PID_43239   0xbd1b
+#define BCM_DNGL_BDC_PID        0x0bdc
+#define BCM_DNGL_JTAG_PID       0x4a44
+#define BCM4325_D11DUAL_ID      0x431b          
+#define BCM4325_D11G_ID         0x431c          
+#define BCM4325_D11A_ID         0x431d          
+#define BCM4321_D11N_ID         0x4328          
+#define BCM4321_D11N2G_ID       0x4329          
+#define BCM4321_D11N5G_ID       0x432a          
+#define BCM4322_D11N_ID         0x432b          
+#define BCM4322_D11N2G_ID       0x432c          
+#define BCM4322_D11N5G_ID       0x432d          
+#define BCM4329_D11N_ID         0x432e          
+#define BCM4329_D11N2G_ID       0x432f          
+#define BCM4329_D11N5G_ID       0x4330          
+#define BCM4315_D11DUAL_ID      0x4334          
+#define BCM4315_D11G_ID         0x4335          
+#define BCM4315_D11A_ID         0x4336          
+#define BCM4319_D11N_ID         0x4337          
+#define BCM4319_D11N2G_ID       0x4338          
+#define BCM4319_D11N5G_ID       0x4339          
+#define BCM43231_D11N2G_ID      0x4340          
+#define BCM43221_D11N2G_ID      0x4341          
+#define BCM43222_D11N_ID        0x4350          
+#define BCM43222_D11N2G_ID      0x4351          
+#define BCM43222_D11N5G_ID      0x4352          
+#define BCM43224_D11N_ID        0x4353          
+#define BCM43224_D11N_ID_VEN1   0x0576          
+#define BCM43226_D11N_ID        0x4354          
+#define BCM43236_D11N_ID        0x4346          
+#define BCM43236_D11N2G_ID      0x4347          
+#define BCM43236_D11N5G_ID      0x4348          
+#define BCM43225_D11N2G_ID      0x4357          
+#define BCM43421_D11N_ID        0xA99D          
+#define BCM4313_D11N2G_ID       0x4727          
+#define BCM4330_D11N_ID         0x4360          
+#define BCM4330_D11N2G_ID       0x4361          
+#define BCM4330_D11N5G_ID       0x4362          
+#define BCM4336_D11N_ID         0x4343          
+#define BCM6362_D11N_ID         0x435f          
+#define BCM4331_D11N_ID         0x4331          
+#define BCM4331_D11N2G_ID       0x4332          
+#define BCM4331_D11N5G_ID       0x4333          
+#define BCM43237_D11N_ID        0x4355          
+#define BCM43237_D11N5G_ID      0x4356          
+#define BCM43227_D11N2G_ID      0x4358          
+#define BCM43228_D11N_ID                0x4359          
+#define BCM43228_D11N5G_ID      0x435a           
+#define BCM43362_D11N_ID        0x4363          
+#define BCM43239_D11N_ID        0x4370          
+
+
+#define SDIOH_FPGA_ID           0x43f2          
+#define SPIH_FPGA_ID            0x43f5          
+#define BCM4710_DEVICE_ID       0x4710          
+#define BCM27XX_SDIOH_ID        0x2702          
+#define PCIXX21_FLASHMEDIA0_ID  0x8033          
+#define PCIXX21_SDIOH0_ID       0x8034          
+#define PCIXX21_FLASHMEDIA_ID   0x803b          
+#define PCIXX21_SDIOH_ID        0x803c          
+#define R5C822_SDIOH_ID         0x0822          
+#define JMICRON_SDIOH_ID        0x2381          
+
+
+#define BCM4306_CHIP_ID         0x4306          
+#define BCM4311_CHIP_ID         0x4311          
+#define BCM43111_CHIP_ID        43111           
+#define BCM43112_CHIP_ID        43112           
+#define BCM4312_CHIP_ID         0x4312          
+#define BCM4313_CHIP_ID         0x4313          
+#define BCM4315_CHIP_ID         0x4315          
+#define BCM4318_CHIP_ID         0x4318          
+#define BCM4319_CHIP_ID         0x4319          
+#define BCM4320_CHIP_ID         0x4320          
+#define BCM4321_CHIP_ID         0x4321          
+#define BCM4322_CHIP_ID         0x4322          
+#define BCM43221_CHIP_ID        43221           
+#define BCM43222_CHIP_ID        43222           
+#define BCM43224_CHIP_ID        43224           
+#define BCM43225_CHIP_ID        43225           
+#define BCM43227_CHIP_ID        43227           
+#define BCM43228_CHIP_ID        43228           
+#define BCM43226_CHIP_ID        43226           
+#define BCM43231_CHIP_ID        43231           
+#define BCM43234_CHIP_ID        43234           
+#define BCM43235_CHIP_ID        43235           
+#define BCM43236_CHIP_ID        43236           
+#define BCM43237_CHIP_ID        43237           
+#define BCM43238_CHIP_ID        43238           
+#define BCM43239_CHIP_ID        43239           
+#define BCM43420_CHIP_ID        43420           
+#define BCM43421_CHIP_ID        43421           
+#define BCM43428_CHIP_ID        43428           
+#define BCM43431_CHIP_ID        43431           
+#define BCM4325_CHIP_ID         0x4325          
+#define BCM4328_CHIP_ID         0x4328          
+#define BCM4329_CHIP_ID         0x4329          
+#define BCM4331_CHIP_ID         0x4331          
+#define BCM4336_CHIP_ID         0x4336          
+#define BCM43362_CHIP_ID        43362           
+#define BCM4330_CHIP_ID         0x4330          
+#define BCM4402_CHIP_ID         0x4402          
+#define BCM4704_CHIP_ID         0x4704          
+#define BCM4710_CHIP_ID         0x4710          
+#define BCM4712_CHIP_ID         0x4712          
+#define BCM4785_CHIP_ID         0x4785          
+#define BCM5350_CHIP_ID         0x5350          
+#define BCM5352_CHIP_ID         0x5352          
+#define BCM5354_CHIP_ID         0x5354          
+#define BCM5365_CHIP_ID         0x5365          
+
+
+#define BCM4303_PKG_ID          2               
+#define BCM4309_PKG_ID          1               
+#define BCM4712LARGE_PKG_ID     0               
+#define BCM4712SMALL_PKG_ID     1               
+#define BCM4712MID_PKG_ID       2               
+#define BCM4328USBD11G_PKG_ID   2               
+#define BCM4328USBDUAL_PKG_ID   3               
+#define BCM4328SDIOD11G_PKG_ID  4               
+#define BCM4328SDIODUAL_PKG_ID  5               
+#define BCM4329_289PIN_PKG_ID   0               
+#define BCM4329_182PIN_PKG_ID   1               
+#define BCM5354E_PKG_ID         1               
+#define HDLSIM5350_PKG_ID       1               
+#define HDLSIM_PKG_ID           14              
+#define HWSIM_PKG_ID            15              
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/bcmendian.h b/drivers/net/wireless/bcmdhd/include/bcmendian.h
new file mode 100644
index 00000000000..04b07ecb804
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmendian.h
@@ -0,0 +1,279 @@
+/*
+ * Byte order utilities
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *  $Id: bcmendian.h,v 1.36 2009-11-09 05:29:43 Exp $
+ *
+ * This file by default provides proper behavior on little-endian architectures.
+ * On big-endian architectures, IL_BIGENDIAN should be defined.
+ */
+
+
+#ifndef _BCMENDIAN_H_
+#define _BCMENDIAN_H_
+
+#include <typedefs.h>
+
+
+#define BCMSWAP16(val) \
+        ((uint16)((((uint16)(val) & (uint16)0x00ffU) << 8) | \
+                  (((uint16)(val) & (uint16)0xff00U) >> 8)))
+
+
+#define BCMSWAP32(val) \
+        ((uint32)((((uint32)(val) & (uint32)0x000000ffU) << 24) | \
+                  (((uint32)(val) & (uint32)0x0000ff00U) <<  8) | \
+                  (((uint32)(val) & (uint32)0x00ff0000U) >>  8) | \
+                  (((uint32)(val) & (uint32)0xff000000U) >> 24)))
+
+
+#define BCMSWAP32BY16(val) \
+        ((uint32)((((uint32)(val) & (uint32)0x0000ffffU) << 16) | \
+                  (((uint32)(val) & (uint32)0xffff0000U) >> 16)))
+
+
+#ifndef hton16
+#define HTON16(i) BCMSWAP16(i)
+#define hton16(i) bcmswap16(i)
+#define HTON32(i) BCMSWAP32(i)
+#define hton32(i) bcmswap32(i)
+#define NTOH16(i) BCMSWAP16(i)
+#define ntoh16(i) bcmswap16(i)
+#define NTOH32(i) BCMSWAP32(i)
+#define ntoh32(i) bcmswap32(i)
+#define LTOH16(i) (i)
+#define ltoh16(i) (i)
+#define LTOH32(i) (i)
+#define ltoh32(i) (i)
+#define HTOL16(i) (i)
+#define htol16(i) (i)
+#define HTOL32(i) (i)
+#define htol32(i) (i)
+#endif 
+
+#define ltoh16_buf(buf, i)
+#define htol16_buf(buf, i)
+
+
+#define load32_ua(a)            ltoh32_ua(a)
+#define store32_ua(a, v)        htol32_ua_store(v, a)
+#define load16_ua(a)            ltoh16_ua(a)
+#define store16_ua(a, v)        htol16_ua_store(v, a)
+
+#define _LTOH16_UA(cp)  ((cp)[0] | ((cp)[1] << 8))
+#define _LTOH32_UA(cp)  ((cp)[0] | ((cp)[1] << 8) | ((cp)[2] << 16) | ((cp)[3] << 24))
+#define _NTOH16_UA(cp)  (((cp)[0] << 8) | (cp)[1])
+#define _NTOH32_UA(cp)  (((cp)[0] << 24) | ((cp)[1] << 16) | ((cp)[2] << 8) | (cp)[3])
+
+#define ltoh_ua(ptr) \
+        (sizeof(*(ptr)) == sizeof(uint8) ? *(const uint8 *)(ptr) : \
+         sizeof(*(ptr)) == sizeof(uint16) ? _LTOH16_UA((const uint8 *)(ptr)) : \
+         sizeof(*(ptr)) == sizeof(uint32) ? _LTOH32_UA((const uint8 *)(ptr)) : \
+         *(uint8 *)0)
+
+#define ntoh_ua(ptr) \
+        (sizeof(*(ptr)) == sizeof(uint8) ? *(const uint8 *)(ptr) : \
+         sizeof(*(ptr)) == sizeof(uint16) ? _NTOH16_UA((const uint8 *)(ptr)) : \
+         sizeof(*(ptr)) == sizeof(uint32) ? _NTOH32_UA((const uint8 *)(ptr)) : \
+         *(uint8 *)0)
+
+#ifdef __GNUC__
+
+
+
+#define bcmswap16(val) ({ \
+        uint16 _val = (val); \
+        BCMSWAP16(_val); \
+})
+
+#define bcmswap32(val) ({ \
+        uint32 _val = (val); \
+        BCMSWAP32(_val); \
+})
+
+#define bcmswap32by16(val) ({ \
+        uint32 _val = (val); \
+        BCMSWAP32BY16(_val); \
+})
+
+#define bcmswap16_buf(buf, len) ({ \
+        uint16 *_buf = (uint16 *)(buf); \
+        uint _wds = (len) / 2; \
+        while (_wds--) { \
+                *_buf = bcmswap16(*_buf); \
+                _buf++; \
+        } \
+})
+
+#define htol16_ua_store(val, bytes) ({ \
+        uint16 _val = (val); \
+        uint8 *_bytes = (uint8 *)(bytes); \
+        _bytes[0] = _val & 0xff; \
+        _bytes[1] = _val >> 8; \
+})
+
+#define htol32_ua_store(val, bytes) ({ \
+        uint32 _val = (val); \
+        uint8 *_bytes = (uint8 *)(bytes); \
+        _bytes[0] = _val & 0xff; \
+        _bytes[1] = (_val >> 8) & 0xff; \
+        _bytes[2] = (_val >> 16) & 0xff; \
+        _bytes[3] = _val >> 24; \
+})
+
+#define hton16_ua_store(val, bytes) ({ \
+        uint16 _val = (val); \
+        uint8 *_bytes = (uint8 *)(bytes); \
+        _bytes[0] = _val >> 8; \
+        _bytes[1] = _val & 0xff; \
+})
+
+#define hton32_ua_store(val, bytes) ({ \
+        uint32 _val = (val); \
+        uint8 *_bytes = (uint8 *)(bytes); \
+        _bytes[0] = _val >> 24; \
+        _bytes[1] = (_val >> 16) & 0xff; \
+        _bytes[2] = (_val >> 8) & 0xff; \
+        _bytes[3] = _val & 0xff; \
+})
+
+#define ltoh16_ua(bytes) ({ \
+        const uint8 *_bytes = (const uint8 *)(bytes); \
+        _LTOH16_UA(_bytes); \
+})
+
+#define ltoh32_ua(bytes) ({ \
+        const uint8 *_bytes = (const uint8 *)(bytes); \
+        _LTOH32_UA(_bytes); \
+})
+
+#define ntoh16_ua(bytes) ({ \
+        const uint8 *_bytes = (const uint8 *)(bytes); \
+        _NTOH16_UA(_bytes); \
+})
+
+#define ntoh32_ua(bytes) ({ \
+        const uint8 *_bytes = (const uint8 *)(bytes); \
+        _NTOH32_UA(_bytes); \
+})
+
+#else 
+
+
+static INLINE uint16
+bcmswap16(uint16 val)
+{
+        return BCMSWAP16(val);
+}
+
+static INLINE uint32
+bcmswap32(uint32 val)
+{
+        return BCMSWAP32(val);
+}
+
+static INLINE uint32
+bcmswap32by16(uint32 val)
+{
+        return BCMSWAP32BY16(val);
+}
+
+
+
+
+static INLINE void
+bcmswap16_buf(uint16 *buf, uint len)
+{
+        len = len / 2;
+
+        while (len--) {
+                *buf = bcmswap16(*buf);
+                buf++;
+        }
+}
+
+
+static INLINE void
+htol16_ua_store(uint16 val, uint8 *bytes)
+{
+        bytes[0] = val & 0xff;
+        bytes[1] = val >> 8;
+}
+
+
+static INLINE void
+htol32_ua_store(uint32 val, uint8 *bytes)
+{
+        bytes[0] = val & 0xff;
+        bytes[1] = (val >> 8) & 0xff;
+        bytes[2] = (val >> 16) & 0xff;
+        bytes[3] = val >> 24;
+}
+
+
+static INLINE void
+hton16_ua_store(uint16 val, uint8 *bytes)
+{
+        bytes[0] = val >> 8;
+        bytes[1] = val & 0xff;
+}
+
+
+static INLINE void
+hton32_ua_store(uint32 val, uint8 *bytes)
+{
+        bytes[0] = val >> 24;
+        bytes[1] = (val >> 16) & 0xff;
+        bytes[2] = (val >> 8) & 0xff;
+        bytes[3] = val & 0xff;
+}
+
+
+static INLINE uint16
+ltoh16_ua(const void *bytes)
+{
+        return _LTOH16_UA((const uint8 *)bytes);
+}
+
+
+static INLINE uint32
+ltoh32_ua(const void *bytes)
+{
+        return _LTOH32_UA((const uint8 *)bytes);
+}
+
+
+static INLINE uint16
+ntoh16_ua(const void *bytes)
+{
+        return _NTOH16_UA((const uint8 *)bytes);
+}
+
+
+static INLINE uint32
+ntoh32_ua(const void *bytes)
+{
+        return _NTOH32_UA((const uint8 *)bytes);
+}
+
+#endif 
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/bcmpcispi.h b/drivers/net/wireless/bcmdhd/include/bcmpcispi.h
new file mode 100644
index 00000000000..fd148c591d8
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmpcispi.h
@@ -0,0 +1,181 @@
+/*
+ * Broadcom PCI-SPI Host Controller Register Definitions
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmpcispi.h,v 13.15.112.1 2010-11-15 18:22:12 Exp $
+ */
+#ifndef _BCM_PCI_SPI_H
+#define _BCM_PCI_SPI_H
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define _PADLINE(line)  pad ## line
+#define _XSTR(line)     _PADLINE(line)
+#define PAD             _XSTR(__LINE__)
+#endif  /* PAD */
+
+
+typedef volatile struct {
+        uint32 spih_ctrl;               /* 0x00 SPI Control Register */
+        uint32 spih_stat;               /* 0x04 SPI Status Register */
+        uint32 spih_data;               /* 0x08 SPI Data Register, 32-bits wide */
+        uint32 spih_ext;                /* 0x0C SPI Extension Register */
+        uint32 PAD[4];                  /* 0x10-0x1F PADDING */
+
+        uint32 spih_gpio_ctrl;          /* 0x20 SPI GPIO Control Register */
+        uint32 spih_gpio_data;          /* 0x24 SPI GPIO Data Register */
+        uint32 PAD[6];                  /* 0x28-0x3F PADDING */
+
+        uint32 spih_int_edge;           /* 0x40 SPI Interrupt Edge Register (0=Level, 1=Edge) */
+        uint32 spih_int_pol;            /* 0x44 SPI Interrupt Polarity Register (0=Active Low, */
+                                                        /* 1=Active High) */
+        uint32 spih_int_mask;           /* 0x48 SPI Interrupt Mask */
+        uint32 spih_int_status;         /* 0x4C SPI Interrupt Status */
+        uint32 PAD[4];                  /* 0x50-0x5F PADDING */
+
+        uint32 spih_hex_disp;           /* 0x60 SPI 4-digit hex display value */
+        uint32 spih_current_ma;         /* 0x64 SPI SD card current consumption in mA */
+        uint32 PAD[1];                  /* 0x68 PADDING */
+        uint32 spih_disp_sel;           /* 0x6c SPI 4-digit hex display mode select (1=current) */
+        uint32 PAD[4];                  /* 0x70-0x7F PADDING */
+        uint32 PAD[8];                  /* 0x80-0x9F PADDING */
+        uint32 PAD[8];                  /* 0xA0-0xBF PADDING */
+        uint32 spih_pll_ctrl;   /* 0xC0 PLL Control Register */
+        uint32 spih_pll_status; /* 0xC4 PLL Status Register */
+        uint32 spih_xtal_freq;  /* 0xC8 External Clock Frequency in units of 10000Hz */
+        uint32 spih_clk_count;  /* 0xCC External Clock Count Register */
+
+} spih_regs_t;
+
+typedef volatile struct {
+        uint32 cfg_space[0x40];         /* 0x000-0x0FF PCI Configuration Space (Read Only) */
+        uint32 P_IMG_CTRL0;             /* 0x100 PCI Image0 Control Register */
+
+        uint32 P_BA0;                   /* 0x104 32 R/W PCI Image0 Base Address register */
+        uint32 P_AM0;                   /* 0x108 32 R/W PCI Image0 Address Mask register */
+        uint32 P_TA0;                   /* 0x10C 32 R/W PCI Image0 Translation Address register */
+        uint32 P_IMG_CTRL1;             /* 0x110 32 R/W PCI Image1 Control register */
+        uint32 P_BA1;                   /* 0x114 32 R/W PCI Image1 Base Address register */
+        uint32 P_AM1;                   /* 0x118 32 R/W PCI Image1 Address Mask register */
+        uint32 P_TA1;                   /* 0x11C 32 R/W PCI Image1 Translation Address register */
+        uint32 P_IMG_CTRL2;             /* 0x120 32 R/W PCI Image2 Control register */
+        uint32 P_BA2;                   /* 0x124 32 R/W PCI Image2 Base Address register */
+        uint32 P_AM2;                   /* 0x128 32 R/W PCI Image2 Address Mask register */
+        uint32 P_TA2;                   /* 0x12C 32 R/W PCI Image2 Translation Address register */
+        uint32 P_IMG_CTRL3;             /* 0x130 32 R/W PCI Image3 Control register */
+        uint32 P_BA3;                   /* 0x134 32 R/W PCI Image3 Base Address register */
+        uint32 P_AM3;                   /* 0x138 32 R/W PCI Image3 Address Mask register */
+        uint32 P_TA3;                   /* 0x13C 32 R/W PCI Image3 Translation Address register */
+        uint32 P_IMG_CTRL4;             /* 0x140 32 R/W PCI Image4 Control register */
+        uint32 P_BA4;                   /* 0x144 32 R/W PCI Image4 Base Address register */
+        uint32 P_AM4;                   /* 0x148 32 R/W PCI Image4 Address Mask register */
+        uint32 P_TA4;                   /* 0x14C 32 R/W PCI Image4 Translation Address register */
+        uint32 P_IMG_CTRL5;             /* 0x150 32 R/W PCI Image5 Control register */
+        uint32 P_BA5;                   /* 0x154 32 R/W PCI Image5 Base Address register */
+        uint32 P_AM5;                   /* 0x158 32 R/W PCI Image5 Address Mask register */
+        uint32 P_TA5;                   /* 0x15C 32 R/W PCI Image5 Translation Address register */
+        uint32 P_ERR_CS;                /* 0x160 32 R/W PCI Error Control and Status register */
+        uint32 P_ERR_ADDR;              /* 0x164 32 R PCI Erroneous Address register */
+        uint32 P_ERR_DATA;              /* 0x168 32 R PCI Erroneous Data register */
+
+        uint32 PAD[5];                  /* 0x16C-0x17F PADDING */
+
+        uint32 WB_CONF_SPC_BAR;         /* 0x180 32 R WISHBONE Configuration Space Base Address */
+        uint32 W_IMG_CTRL1;             /* 0x184 32 R/W WISHBONE Image1 Control register */
+        uint32 W_BA1;                   /* 0x188 32 R/W WISHBONE Image1 Base Address register */
+        uint32 W_AM1;                   /* 0x18C 32 R/W WISHBONE Image1 Address Mask register */
+        uint32 W_TA1;                   /* 0x190 32 R/W WISHBONE Image1 Translation Address reg */
+        uint32 W_IMG_CTRL2;             /* 0x194 32 R/W WISHBONE Image2 Control register */
+        uint32 W_BA2;                   /* 0x198 32 R/W WISHBONE Image2 Base Address register */
+        uint32 W_AM2;                   /* 0x19C 32 R/W WISHBONE Image2 Address Mask register */
+        uint32 W_TA2;                   /* 0x1A0 32 R/W WISHBONE Image2 Translation Address reg */
+        uint32 W_IMG_CTRL3;             /* 0x1A4 32 R/W WISHBONE Image3 Control register */
+        uint32 W_BA3;                   /* 0x1A8 32 R/W WISHBONE Image3 Base Address register */
+        uint32 W_AM3;                   /* 0x1AC 32 R/W WISHBONE Image3 Address Mask register */
+        uint32 W_TA3;                   /* 0x1B0 32 R/W WISHBONE Image3 Translation Address reg */
+        uint32 W_IMG_CTRL4;             /* 0x1B4 32 R/W WISHBONE Image4 Control register */
+        uint32 W_BA4;                   /* 0x1B8 32 R/W WISHBONE Image4 Base Address register */
+        uint32 W_AM4;                   /* 0x1BC 32 R/W WISHBONE Image4 Address Mask register */
+        uint32 W_TA4;                   /* 0x1C0 32 R/W WISHBONE Image4 Translation Address reg */
+        uint32 W_IMG_CTRL5;             /* 0x1C4 32 R/W WISHBONE Image5 Control register */
+        uint32 W_BA5;                   /* 0x1C8 32 R/W WISHBONE Image5 Base Address register */
+        uint32 W_AM5;                   /* 0x1CC 32 R/W WISHBONE Image5 Address Mask register */
+        uint32 W_TA5;                   /* 0x1D0 32 R/W WISHBONE Image5 Translation Address reg */
+        uint32 W_ERR_CS;                /* 0x1D4 32 R/W WISHBONE Error Control and Status reg */
+        uint32 W_ERR_ADDR;              /* 0x1D8 32 R WISHBONE Erroneous Address register */
+        uint32 W_ERR_DATA;              /* 0x1DC 32 R WISHBONE Erroneous Data register */
+        uint32 CNF_ADDR;                /* 0x1E0 32 R/W Configuration Cycle register */
+        uint32 CNF_DATA;                /* 0x1E4 32 R/W Configuration Cycle Generation Data reg */
+
+        uint32 INT_ACK;                 /* 0x1E8 32 R Interrupt Acknowledge register */
+        uint32 ICR;                     /* 0x1EC 32 R/W Interrupt Control register */
+        uint32 ISR;                     /* 0x1F0 32 R/W Interrupt Status register */
+} spih_pciregs_t;
+
+/*
+ * PCI Core interrupt enable and status bit definitions.
+ */
+
+/* PCI Core ICR Register bit definitions */
+#define PCI_INT_PROP_EN         (1 << 0)        /* Interrupt Propagation Enable */
+#define PCI_WB_ERR_INT_EN       (1 << 1)        /* Wishbone Error Interrupt Enable */
+#define PCI_PCI_ERR_INT_EN      (1 << 2)        /* PCI Error Interrupt Enable */
+#define PCI_PAR_ERR_INT_EN      (1 << 3)        /* Parity Error Interrupt Enable */
+#define PCI_SYS_ERR_INT_EN      (1 << 4)        /* System Error Interrupt Enable */
+#define PCI_SOFTWARE_RESET      (1U << 31)      /* Software reset of the PCI Core. */
+
+
+/* PCI Core ISR Register bit definitions */
+#define PCI_INT_PROP_ST         (1 << 0)        /* Interrupt Propagation Status */
+#define PCI_WB_ERR_INT_ST       (1 << 1)        /* Wishbone Error Interrupt Status */
+#define PCI_PCI_ERR_INT_ST      (1 << 2)        /* PCI Error Interrupt Status */
+#define PCI_PAR_ERR_INT_ST      (1 << 3)        /* Parity Error Interrupt Status */
+#define PCI_SYS_ERR_INT_ST      (1 << 4)        /* System Error Interrupt Status */
+
+
+/* Registers on the Wishbone bus */
+#define SPIH_CTLR_INTR          (1 << 0)        /* SPI Host Controller Core Interrupt */
+#define SPIH_DEV_INTR           (1 << 1)        /* SPI Device Interrupt */
+#define SPIH_WFIFO_INTR         (1 << 2)        /* SPI Tx FIFO Empty Intr (FPGA Rev >= 8) */
+
+/* GPIO Bit definitions */
+#define SPIH_CS                 (1 << 0)        /* SPI Chip Select (active low) */
+#define SPIH_SLOT_POWER         (1 << 1)        /* SD Card Slot Power Enable */
+#define SPIH_CARD_DETECT        (1 << 2)        /* SD Card Detect */
+
+/* SPI Status Register Bit definitions */
+#define SPIH_STATE_MASK         0x30            /* SPI Transfer State Machine state mask */
+#define SPIH_STATE_SHIFT        4               /* SPI Transfer State Machine state shift */
+#define SPIH_WFFULL             (1 << 3)        /* SPI Write FIFO Full */
+#define SPIH_WFEMPTY            (1 << 2)        /* SPI Write FIFO Empty */
+#define SPIH_RFFULL             (1 << 1)        /* SPI Read FIFO Full */
+#define SPIH_RFEMPTY            (1 << 0)        /* SPI Read FIFO Empty */
+
+#define SPIH_EXT_CLK            (1U << 31)      /* Use External Clock as PLL Clock source. */
+
+#define SPIH_PLL_NO_CLK         (1 << 1)        /* Set to 1 if the PLL's input clock is lost. */
+#define SPIH_PLL_LOCKED         (1 << 3)        /* Set to 1 when the PLL is locked. */
+
+/* Spin bit loop bound check */
+#define SPI_SPIN_BOUND          0xf4240         /* 1 million */
+
+#endif /* _BCM_PCI_SPI_H */
diff --git a/drivers/net/wireless/bcmdhd/include/bcmperf.h b/drivers/net/wireless/bcmdhd/include/bcmperf.h
new file mode 100644
index 00000000000..a3985cf2937
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmperf.h
@@ -0,0 +1,36 @@
+/*
+ * Performance counters software interface.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmperf.h,v 13.5 2007-09-14 22:00:59 Exp $
+ */
+/* essai */
+#ifndef _BCMPERF_H_
+#define _BCMPERF_H_
+/* get cache hits and misses */
+#define BCMPERF_ENABLE_INSTRCOUNT()
+#define BCMPERF_ENABLE_ICACHE_MISS()
+#define BCMPERF_ENABLE_ICACHE_HIT()
+#define BCMPERF_GETICACHE_MISS(x)       ((x) = 0)
+#define BCMPERF_GETICACHE_HIT(x)        ((x) = 0)
+#define BCMPERF_GETINSTRCOUNT(x)        ((x) = 0)
+#endif /* _BCMPERF_H_ */
diff --git a/drivers/net/wireless/bcmdhd/include/bcmsdbus.h b/drivers/net/wireless/bcmdhd/include/bcmsdbus.h
new file mode 100644
index 00000000000..5fda5e9b5df
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmsdbus.h
@@ -0,0 +1,120 @@
+/*
+ * Definitions for API from sdio common code (bcmsdh) to individual
+ * host controller drivers.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdbus.h,v 13.17.86.2 2010-12-23 01:13:20 Exp $
+ */
+
+#ifndef _sdio_api_h_
+#define _sdio_api_h_
+
+
+#define SDIOH_API_RC_SUCCESS                          (0x00)
+#define SDIOH_API_RC_FAIL                             (0x01)
+#define SDIOH_API_SUCCESS(status) (status == 0)
+
+#define SDIOH_READ              0       /* Read request */
+#define SDIOH_WRITE             1       /* Write request */
+
+#define SDIOH_DATA_FIX          0       /* Fixed addressing */
+#define SDIOH_DATA_INC          1       /* Incremental addressing */
+
+#define SDIOH_CMD_TYPE_NORMAL   0       /* Normal command */
+#define SDIOH_CMD_TYPE_APPEND   1       /* Append command */
+#define SDIOH_CMD_TYPE_CUTTHRU  2       /* Cut-through command */
+
+#define SDIOH_DATA_PIO          0       /* PIO mode */
+#define SDIOH_DATA_DMA          1       /* DMA mode */
+
+
+typedef int SDIOH_API_RC;
+
+/* SDio Host structure */
+typedef struct sdioh_info sdioh_info_t;
+
+/* callback function, taking one arg */
+typedef void (*sdioh_cb_fn_t)(void *);
+
+/* attach, return handler on success, NULL if failed.
+ *  The handler shall be provided by all subsequent calls. No local cache
+ *  cfghdl points to the starting address of pci device mapped memory
+ */
+extern sdioh_info_t * sdioh_attach(osl_t *osh, void *cfghdl, uint irq);
+extern SDIOH_API_RC sdioh_detach(osl_t *osh, sdioh_info_t *si);
+extern SDIOH_API_RC sdioh_interrupt_register(sdioh_info_t *si, sdioh_cb_fn_t fn, void *argh);
+extern SDIOH_API_RC sdioh_interrupt_deregister(sdioh_info_t *si);
+
+/* query whether SD interrupt is enabled or not */
+extern SDIOH_API_RC sdioh_interrupt_query(sdioh_info_t *si, bool *onoff);
+
+/* enable or disable SD interrupt */
+extern SDIOH_API_RC sdioh_interrupt_set(sdioh_info_t *si, bool enable_disable);
+
+#if defined(DHD_DEBUG)
+extern bool sdioh_interrupt_pending(sdioh_info_t *si);
+#endif
+
+/* read or write one byte using cmd52 */
+extern SDIOH_API_RC sdioh_request_byte(sdioh_info_t *si, uint rw, uint fnc, uint addr, uint8 *byte);
+
+/* read or write 2/4 bytes using cmd53 */
+extern SDIOH_API_RC sdioh_request_word(sdioh_info_t *si, uint cmd_type, uint rw, uint fnc,
+        uint addr, uint32 *word, uint nbyte);
+
+/* read or write any buffer using cmd53 */
+extern SDIOH_API_RC sdioh_request_buffer(sdioh_info_t *si, uint pio_dma, uint fix_inc,
+        uint rw, uint fnc_num, uint32 addr, uint regwidth, uint32 buflen, uint8 *buffer,
+        void *pkt);
+
+/* get cis data */
+extern SDIOH_API_RC sdioh_cis_read(sdioh_info_t *si, uint fuc, uint8 *cis, uint32 length);
+
+extern SDIOH_API_RC sdioh_cfg_read(sdioh_info_t *si, uint fuc, uint32 addr, uint8 *data);
+extern SDIOH_API_RC sdioh_cfg_write(sdioh_info_t *si, uint fuc, uint32 addr, uint8 *data);
+
+/* query number of io functions */
+extern uint sdioh_query_iofnum(sdioh_info_t *si);
+
+/* handle iovars */
+extern int sdioh_iovar_op(sdioh_info_t *si, const char *name,
+                          void *params, int plen, void *arg, int len, bool set);
+
+/* Issue abort to the specified function and clear controller as needed */
+extern int sdioh_abort(sdioh_info_t *si, uint fnc);
+
+/* Start and Stop SDIO without re-enumerating the SD card. */
+extern int sdioh_start(sdioh_info_t *si, int stage);
+extern int sdioh_stop(sdioh_info_t *si);
+
+/* Wait system lock free */
+extern int sdioh_waitlockfree(sdioh_info_t *si);
+
+/* Reset and re-initialize the device */
+extern int sdioh_sdio_reset(sdioh_info_t *si);
+
+/* Helper function */
+void *bcmsdh_get_sdioh(bcmsdh_info_t *sdh);
+
+
+
+#endif /* _sdio_api_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/bcmsdh.h b/drivers/net/wireless/bcmdhd/include/bcmsdh.h
new file mode 100644
index 00000000000..4e3affde6b0
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmsdh.h
@@ -0,0 +1,211 @@
+/*
+ * SDIO host client driver interface of Broadcom HNBU
+ *     export functions to client drivers
+ *     abstract OS and BUS specific details of SDIO
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdh.h,v 13.46.52.3 2010-10-19 00:41:44 Exp $
+ */
+
+#ifndef _bcmsdh_h_
+#define _bcmsdh_h_
+
+#define BCMSDH_ERROR_VAL        0x0001 /* Error */
+#define BCMSDH_INFO_VAL         0x0002 /* Info */
+extern const uint bcmsdh_msglevel;
+
+#define BCMSDH_ERROR(x)
+#define BCMSDH_INFO(x)
+
+/* forward declarations */
+typedef struct bcmsdh_info bcmsdh_info_t;
+typedef void (*bcmsdh_cb_fn_t)(void *);
+
+/* Attach and build an interface to the underlying SD host driver.
+ *  - Allocates resources (structs, arrays, mem, OS handles, etc) needed by bcmsdh.
+ *  - Returns the bcmsdh handle and virtual address base for register access.
+ *    The returned handle should be used in all subsequent calls, but the bcmsh
+ *    implementation may maintain a single "default" handle (e.g. the first or
+ *    most recent one) to enable single-instance implementations to pass NULL.
+ */
+extern bcmsdh_info_t *bcmsdh_attach(osl_t *osh, void *cfghdl, void **regsva, uint irq);
+
+/* Detach - freeup resources allocated in attach */
+extern int bcmsdh_detach(osl_t *osh, void *sdh);
+
+/* Query if SD device interrupts are enabled */
+extern bool bcmsdh_intr_query(void *sdh);
+
+/* Enable/disable SD interrupt */
+extern int bcmsdh_intr_enable(void *sdh);
+extern int bcmsdh_intr_disable(void *sdh);
+
+/* Register/deregister device interrupt handler. */
+extern int bcmsdh_intr_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh);
+extern int bcmsdh_intr_dereg(void *sdh);
+
+#if defined(DHD_DEBUG)
+/* Query pending interrupt status from the host controller */
+extern bool bcmsdh_intr_pending(void *sdh);
+#endif
+
+#ifdef BCMLXSDMMC
+extern int bcmsdh_claim_host_and_lock(void *sdh);
+extern int bcmsdh_release_host_and_unlock(void *sdh);
+#endif /* BCMLXSDMMC */
+
+/* Register a callback to be called if and when bcmsdh detects
+ * device removal. No-op in the case of non-removable/hardwired devices.
+ */
+extern int bcmsdh_devremove_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh);
+
+/* Access SDIO address space (e.g. CCCR) using CMD52 (single-byte interface).
+ *   fn:   function number
+ *   addr: unmodified SDIO-space address
+ *   data: data byte to write
+ *   err:  pointer to error code (or NULL)
+ */
+extern uint8 bcmsdh_cfg_read(void *sdh, uint func, uint32 addr, int *err);
+extern void bcmsdh_cfg_write(void *sdh, uint func, uint32 addr, uint8 data, int *err);
+
+/* Read/Write 4bytes from/to cfg space */
+extern uint32 bcmsdh_cfg_read_word(void *sdh, uint fnc_num, uint32 addr, int *err);
+extern void bcmsdh_cfg_write_word(void *sdh, uint fnc_num, uint32 addr, uint32 data, int *err);
+
+/* Read CIS content for specified function.
+ *   fn:     function whose CIS is being requested (0 is common CIS)
+ *   cis:    pointer to memory location to place results
+ *   length: number of bytes to read
+ * Internally, this routine uses the values from the cis base regs (0x9-0xB)
+ * to form an SDIO-space address to read the data from.
+ */
+extern int bcmsdh_cis_read(void *sdh, uint func, uint8 *cis, uint length);
+
+/* Synchronous access to device (client) core registers via CMD53 to F1.
+ *   addr: backplane address (i.e. >= regsva from attach)
+ *   size: register width in bytes (2 or 4)
+ *   data: data for register write
+ */
+extern uint32 bcmsdh_reg_read(void *sdh, uint32 addr, uint size);
+extern uint32 bcmsdh_reg_write(void *sdh, uint32 addr, uint size, uint32 data);
+
+/* Indicate if last reg read/write failed */
+extern bool bcmsdh_regfail(void *sdh);
+
+/* Buffer transfer to/from device (client) core via cmd53.
+ *   fn:       function number
+ *   addr:     backplane address (i.e. >= regsva from attach)
+ *   flags:    backplane width, address increment, sync/async
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ *   pkt:      pointer to packet associated with buf (if any)
+ *   complete: callback function for command completion (async only)
+ *   handle:   handle for completion callback (first arg in callback)
+ * Returns 0 or error code.
+ * NOTE: Async operation is not currently supported.
+ */
+typedef void (*bcmsdh_cmplt_fn_t)(void *handle, int status, bool sync_waiting);
+extern int bcmsdh_send_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                           uint8 *buf, uint nbytes, void *pkt,
+                           bcmsdh_cmplt_fn_t complete, void *handle);
+extern int bcmsdh_recv_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                           uint8 *buf, uint nbytes, void *pkt,
+                           bcmsdh_cmplt_fn_t complete, void *handle);
+
+/* Flags bits */
+#define SDIO_REQ_4BYTE  0x1     /* Four-byte target (backplane) width (vs. two-byte) */
+#define SDIO_REQ_FIXED  0x2     /* Fixed address (FIFO) (vs. incrementing address) */
+#define SDIO_REQ_ASYNC  0x4     /* Async request (vs. sync request) */
+
+/* Pending (non-error) return code */
+#define BCME_PENDING    1
+
+/* Read/write to memory block (F1, no FIFO) via CMD53 (sync only).
+ *   rw:       read or write (0/1)
+ *   addr:     direct SDIO address
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ * Returns 0 or error code.
+ */
+extern int bcmsdh_rwdata(void *sdh, uint rw, uint32 addr, uint8 *buf, uint nbytes);
+
+/* Issue an abort to the specified function */
+extern int bcmsdh_abort(void *sdh, uint fn);
+
+/* Start SDIO Host Controller communication */
+extern int bcmsdh_start(void *sdh, int stage);
+
+/* Stop SDIO Host Controller communication */
+extern int bcmsdh_stop(void *sdh);
+
+/* Wait system lock free */
+extern int bcmsdh_waitlockfree(void *sdh);
+
+/* Returns the "Device ID" of target device on the SDIO bus. */
+extern int bcmsdh_query_device(void *sdh);
+
+/* Returns the number of IO functions reported by the device */
+extern uint bcmsdh_query_iofnum(void *sdh);
+
+/* Miscellaneous knob tweaker. */
+extern int bcmsdh_iovar_op(void *sdh, const char *name,
+                           void *params, int plen, void *arg, int len, bool set);
+
+/* Reset and reinitialize the device */
+extern int bcmsdh_reset(bcmsdh_info_t *sdh);
+
+/* helper functions */
+
+extern void *bcmsdh_get_sdioh(bcmsdh_info_t *sdh);
+
+/* callback functions */
+typedef struct {
+        /* attach to device */
+        void *(*attach)(uint16 vend_id, uint16 dev_id, uint16 bus, uint16 slot,
+                        uint16 func, uint bustype, void * regsva, osl_t * osh,
+                        void * param, void *dev);
+        /* detach from device */
+        void (*detach)(void *ch);
+} bcmsdh_driver_t;
+
+/* platform specific/high level functions */
+extern int bcmsdh_register(bcmsdh_driver_t *driver);
+extern void bcmsdh_unregister(void);
+extern bool bcmsdh_chipmatch(uint16 vendor, uint16 device);
+extern void bcmsdh_device_remove(void * sdh);
+
+#if defined(OOB_INTR_ONLY)
+extern int bcmsdh_register_oob_intr(void * dhdp);
+extern void bcmsdh_unregister_oob_intr(void);
+extern void bcmsdh_oob_intr_set(bool enable);
+#endif /* defined(OOB_INTR_ONLY) */
+/* Function to pass device-status bits to DHD. */
+extern uint32 bcmsdh_get_dstatus(void *sdh);
+
+/* Function to return current window addr */
+extern uint32 bcmsdh_cur_sbwad(void *sdh);
+
+/* Function to pass chipid and rev to lower layers for controlling pr's */
+extern void bcmsdh_chipinfo(void *sdh, uint32 chip, uint32 chiprev);
+
+
+#endif  /* _bcmsdh_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/bcmsdh_sdmmc.h b/drivers/net/wireless/bcmdhd/include/bcmsdh_sdmmc.h
new file mode 100644
index 00000000000..d188c4ec7d5
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmsdh_sdmmc.h
@@ -0,0 +1,122 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdh_sdmmc.h,v 13.5.88.1 2010-12-23 01:13:20 Exp $
+ */
+
+#ifndef __BCMSDH_SDMMC_H__
+#define __BCMSDH_SDMMC_H__
+
+#define sd_err(x)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+
+#define sd_sync_dma(sd, read, nbytes)
+#define sd_init_dma(sd)
+#define sd_ack_intr(sd)
+#define sd_wakeup(sd);
+
+/* Allocate/init/free per-OS private data */
+extern int sdioh_sdmmc_osinit(sdioh_info_t *sd);
+extern void sdioh_sdmmc_osfree(sdioh_info_t *sd);
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+        do { if (!(exp)) \
+                printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+        } while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS 0
+#define ERROR   1
+
+/* private bus modes */
+#define SDIOH_MODE_SD4          2
+#define CLIENT_INTR             0x100   /* Get rid of this! */
+
+struct sdioh_info {
+        osl_t           *osh;                   /* osh handler */
+        bool            client_intr_enabled;    /* interrupt connnected flag */
+        bool            intr_handler_valid;     /* client driver interrupt handler valid */
+        sdioh_cb_fn_t   intr_handler;           /* registered interrupt handler */
+        void            *intr_handler_arg;      /* argument to call interrupt handler */
+        uint16          intmask;                /* Current active interrupts */
+        void            *sdos_info;             /* Pointer to per-OS private data */
+
+        uint            irq;                    /* Client irq */
+        int             intrcount;              /* Client interrupts */
+
+        bool            sd_use_dma;             /* DMA on CMD53 */
+        bool            sd_blockmode;           /* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+                                                /*  Must be on for sd_multiblock to be effective */
+        bool            use_client_ints;        /* If this is false, make sure to restore */
+        int             sd_mode;                /* SD1/SD4/SPI */
+        int             client_block_size[SDIOD_MAX_IOFUNCS];           /* Blocksize */
+        uint8           num_funcs;              /* Supported funcs on client */
+        uint32          com_cis_ptr;
+        uint32          func_cis_ptr[SDIOD_MAX_IOFUNCS];
+        uint            max_dma_len;
+        uint            max_dma_descriptors;    /* DMA Descriptors supported by this controller. */
+//      SDDMA_DESCRIPTOR        SGList[32];     /* Scatter/Gather DMA List */
+};
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdh_sdmmc.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/* OS-independent interrupt handler */
+extern bool check_client_intr(sdioh_info_t *sd);
+
+/* Core interrupt enable/disable of device interrupts */
+extern void sdioh_sdmmc_devintr_on(sdioh_info_t *sd);
+extern void sdioh_sdmmc_devintr_off(sdioh_info_t *sd);
+
+
+/**************************************************************
+ * Internal interfaces: bcmsdh_sdmmc.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *sdioh_sdmmc_reg_map(osl_t *osh, int32 addr, int size);
+extern void sdioh_sdmmc_reg_unmap(osl_t *osh, int32 addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int sdioh_sdmmc_register_irq(sdioh_info_t *sd, uint irq);
+extern void sdioh_sdmmc_free_irq(uint irq, sdioh_info_t *sd);
+
+typedef struct _BCMSDH_SDMMC_INSTANCE {
+        sdioh_info_t    *sd;
+        struct sdio_func *func[SDIOD_MAX_IOFUNCS];
+} BCMSDH_SDMMC_INSTANCE, *PBCMSDH_SDMMC_INSTANCE;
+
+#endif /* __BCMSDH_SDMMC_H__ */
diff --git a/drivers/net/wireless/bcmdhd/include/bcmsdpcm.h b/drivers/net/wireless/bcmdhd/include/bcmsdpcm.h
new file mode 100644
index 00000000000..ee29b5c08a5
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmsdpcm.h
@@ -0,0 +1,274 @@
+/*
+ * Broadcom SDIO/PCMCIA
+ * Software-specific definitions shared between device and host side
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdpcm.h,v 13.4.90.2 2010-05-12 04:14:25 Exp $
+ */
+
+#ifndef _bcmsdpcm_h_
+#define _bcmsdpcm_h_
+
+/*
+ * Software allocation of To SB Mailbox resources
+ */
+
+/* intstatus bits */
+#define I_SMB_NAK       I_SMB_SW0       /* To SB Mailbox Frame NAK */
+#define I_SMB_INT_ACK   I_SMB_SW1       /* To SB Mailbox Host Interrupt ACK */
+#define I_SMB_USE_OOB   I_SMB_SW2       /* To SB Mailbox Use OOB Wakeup */
+#define I_SMB_DEV_INT   I_SMB_SW3       /* To SB Mailbox Miscellaneous Interrupt */
+
+#define I_TOSBMAIL      (I_SMB_NAK | I_SMB_INT_ACK | I_SMB_USE_OOB | I_SMB_DEV_INT)
+
+/* tosbmailbox bits corresponding to intstatus bits */
+#define SMB_NAK         (1 << 0)        /* To SB Mailbox Frame NAK */
+#define SMB_INT_ACK     (1 << 1)        /* To SB Mailbox Host Interrupt ACK */
+#define SMB_USE_OOB     (1 << 2)        /* To SB Mailbox Use OOB Wakeup */
+#define SMB_DEV_INT     (1 << 3)        /* To SB Mailbox Miscellaneous Interrupt */
+#define SMB_MASK        0x0000000f      /* To SB Mailbox Mask */
+
+/* tosbmailboxdata */
+#define SMB_DATA_VERSION_MASK   0x00ff0000      /* host protocol version (sent with F2 enable) */
+#define SMB_DATA_VERSION_SHIFT  16              /* host protocol version (sent with F2 enable) */
+
+/*
+ * Software allocation of To Host Mailbox resources
+ */
+
+/* intstatus bits */
+#define I_HMB_FC_STATE  I_HMB_SW0       /* To Host Mailbox Flow Control State */
+#define I_HMB_FC_CHANGE I_HMB_SW1       /* To Host Mailbox Flow Control State Changed */
+#define I_HMB_FRAME_IND I_HMB_SW2       /* To Host Mailbox Frame Indication */
+#define I_HMB_HOST_INT  I_HMB_SW3       /* To Host Mailbox Miscellaneous Interrupt */
+
+#define I_TOHOSTMAIL    (I_HMB_FC_CHANGE | I_HMB_FRAME_IND | I_HMB_HOST_INT)
+
+/* tohostmailbox bits corresponding to intstatus bits */
+#define HMB_FC_ON       (1 << 0)        /* To Host Mailbox Flow Control State */
+#define HMB_FC_CHANGE   (1 << 1)        /* To Host Mailbox Flow Control State Changed */
+#define HMB_FRAME_IND   (1 << 2)        /* To Host Mailbox Frame Indication */
+#define HMB_HOST_INT    (1 << 3)        /* To Host Mailbox Miscellaneous Interrupt */
+#define HMB_MASK        0x0000000f      /* To Host Mailbox Mask */
+
+/* tohostmailboxdata */
+#define HMB_DATA_NAKHANDLED     0x01    /* we're ready to retransmit NAK'd frame to host */
+#define HMB_DATA_DEVREADY       0x02    /* we're ready to to talk to host after enable */
+#define HMB_DATA_FC             0x04    /* per prio flowcontrol update flag to host */
+#define HMB_DATA_FWREADY        0x08    /* firmware is ready for protocol activity */
+#define HMB_DATA_FWHALT         0x10    /* firmware has halted operation */
+
+#define HMB_DATA_FCDATA_MASK    0xff000000      /* per prio flowcontrol data */
+#define HMB_DATA_FCDATA_SHIFT   24              /* per prio flowcontrol data */
+
+#define HMB_DATA_VERSION_MASK   0x00ff0000      /* device protocol version (with devready) */
+#define HMB_DATA_VERSION_SHIFT  16              /* device protocol version (with devready) */
+
+/*
+ * Software-defined protocol header
+ */
+
+/* Current protocol version */
+#define SDPCM_PROT_VERSION      4
+
+/* SW frame header */
+#define SDPCM_SEQUENCE_MASK             0x000000ff      /* Sequence Number Mask */
+#define SDPCM_PACKET_SEQUENCE(p) (((uint8 *)p)[0] & 0xff) /* p starts w/SW Header */
+
+#define SDPCM_CHANNEL_MASK              0x00000f00      /* Channel Number Mask */
+#define SDPCM_CHANNEL_SHIFT             8               /* Channel Number Shift */
+#define SDPCM_PACKET_CHANNEL(p) (((uint8 *)p)[1] & 0x0f) /* p starts w/SW Header */
+
+#define SDPCM_FLAGS_MASK                0x0000f000      /* Mask of flag bits */
+#define SDPCM_FLAGS_SHIFT               12              /* Flag bits shift */
+#define SDPCM_PACKET_FLAGS(p) ((((uint8 *)p)[1] & 0xf0) >> 4) /* p starts w/SW Header */
+
+/* Next Read Len: lookahead length of next frame, in 16-byte units (rounded up) */
+#define SDPCM_NEXTLEN_MASK              0x00ff0000      /* Next Read Len Mask */
+#define SDPCM_NEXTLEN_SHIFT             16              /* Next Read Len Shift */
+#define SDPCM_NEXTLEN_VALUE(p) ((((uint8 *)p)[2] & 0xff) << 4) /* p starts w/SW Header */
+#define SDPCM_NEXTLEN_OFFSET            2
+
+/* Data Offset from SOF (HW Tag, SW Tag, Pad) */
+#define SDPCM_DOFFSET_OFFSET            3               /* Data Offset */
+#define SDPCM_DOFFSET_VALUE(p)          (((uint8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
+#define SDPCM_DOFFSET_MASK              0xff000000
+#define SDPCM_DOFFSET_SHIFT             24
+
+#define SDPCM_FCMASK_OFFSET             4               /* Flow control */
+#define SDPCM_FCMASK_VALUE(p)           (((uint8 *)p)[SDPCM_FCMASK_OFFSET ] & 0xff)
+#define SDPCM_WINDOW_OFFSET             5               /* Credit based fc */
+#define SDPCM_WINDOW_VALUE(p)           (((uint8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
+#define SDPCM_VERSION_OFFSET            6               /* Version # */
+#define SDPCM_VERSION_VALUE(p)          (((uint8 *)p)[SDPCM_VERSION_OFFSET] & 0xff)
+#define SDPCM_UNUSED_OFFSET             7               /* Spare */
+#define SDPCM_UNUSED_VALUE(p)           (((uint8 *)p)[SDPCM_UNUSED_OFFSET] & 0xff)
+
+#define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
+
+/* logical channel numbers */
+#define SDPCM_CONTROL_CHANNEL   0       /* Control Request/Response Channel Id */
+#define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
+#define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
+#define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets (superframes) */
+#define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
+#define SDPCM_MAX_CHANNEL       15
+
+#define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for eight-bit frame seq number */
+
+#define SDPCM_FLAG_RESVD0       0x01
+#define SDPCM_FLAG_RESVD1       0x02
+#define SDPCM_FLAG_GSPI_TXENAB  0x04
+#define SDPCM_FLAG_GLOMDESC     0x08    /* Superframe descriptor mask */
+
+/* For GLOM_CHANNEL frames, use a flag to indicate descriptor frame */
+#define SDPCM_GLOMDESC_FLAG     (SDPCM_FLAG_GLOMDESC << SDPCM_FLAGS_SHIFT)
+
+#define SDPCM_GLOMDESC(p)       (((uint8 *)p)[1] & 0x80)
+
+/* For TEST_CHANNEL packets, define another 4-byte header */
+#define SDPCM_TEST_HDRLEN       4       /* Generally: Cmd(1), Ext(1), Len(2);
+                                         * Semantics of Ext byte depend on command.
+                                         * Len is current or requested frame length, not
+                                         * including test header; sent little-endian.
+                                         */
+#define SDPCM_TEST_DISCARD      0x01    /* Receiver discards. Ext is a pattern id. */
+#define SDPCM_TEST_ECHOREQ      0x02    /* Echo request. Ext is a pattern id. */
+#define SDPCM_TEST_ECHORSP      0x03    /* Echo response. Ext is a pattern id. */
+#define SDPCM_TEST_BURST        0x04    /* Receiver to send a burst. Ext is a frame count */
+#define SDPCM_TEST_SEND         0x05    /* Receiver sets send mode. Ext is boolean on/off */
+
+/* Handy macro for filling in datagen packets with a pattern */
+#define SDPCM_TEST_FILL(byteno, id)     ((uint8)(id + byteno))
+
+/*
+ * Software counters (first part matches hardware counters)
+ */
+
+typedef volatile struct {
+        uint32 cmd52rd;         /* Cmd52RdCount, SDIO: cmd52 reads */
+        uint32 cmd52wr;         /* Cmd52WrCount, SDIO: cmd52 writes */
+        uint32 cmd53rd;         /* Cmd53RdCount, SDIO: cmd53 reads */
+        uint32 cmd53wr;         /* Cmd53WrCount, SDIO: cmd53 writes */
+        uint32 abort;           /* AbortCount, SDIO: aborts */
+        uint32 datacrcerror;    /* DataCrcErrorCount, SDIO: frames w/CRC error */
+        uint32 rdoutofsync;     /* RdOutOfSyncCount, SDIO/PCMCIA: Rd Frm out of sync */
+        uint32 wroutofsync;     /* RdOutOfSyncCount, SDIO/PCMCIA: Wr Frm out of sync */
+        uint32 writebusy;       /* WriteBusyCount, SDIO: device asserted "busy" */
+        uint32 readwait;        /* ReadWaitCount, SDIO: no data ready for a read cmd */
+        uint32 readterm;        /* ReadTermCount, SDIO: read frame termination cmds */
+        uint32 writeterm;       /* WriteTermCount, SDIO: write frames termination cmds */
+        uint32 rxdescuflo;      /* receive descriptor underflows */
+        uint32 rxfifooflo;      /* receive fifo overflows */
+        uint32 txfifouflo;      /* transmit fifo underflows */
+        uint32 runt;            /* runt (too short) frames recv'd from bus */
+        uint32 badlen;          /* frame's rxh len does not match its hw tag len */
+        uint32 badcksum;        /* frame's hw tag chksum doesn't agree with len value */
+        uint32 seqbreak;        /* break in sequence # space from one rx frame to the next */
+        uint32 rxfcrc;          /* frame rx header indicates crc error */
+        uint32 rxfwoos;         /* frame rx header indicates write out of sync */
+        uint32 rxfwft;          /* frame rx header indicates write frame termination */
+        uint32 rxfabort;        /* frame rx header indicates frame aborted */
+        uint32 woosint;         /* write out of sync interrupt */
+        uint32 roosint;         /* read out of sync interrupt */
+        uint32 rftermint;       /* read frame terminate interrupt */
+        uint32 wftermint;       /* write frame terminate interrupt */
+} sdpcmd_cnt_t;
+
+/*
+ * Register Access Macros
+ */
+
+#define SDIODREV_IS(var, val)   ((var) == (val))
+#define SDIODREV_GE(var, val)   ((var) >= (val))
+#define SDIODREV_GT(var, val)   ((var) > (val))
+#define SDIODREV_LT(var, val)   ((var) < (val))
+#define SDIODREV_LE(var, val)   ((var) <= (val))
+
+#define SDIODDMAREG32(h, dir, chnl) \
+        ((dir) == DMA_TX ? \
+         (void *)(uintptr)&((h)->regs->dma.sdiod32.dma32regs[chnl].xmt) : \
+         (void *)(uintptr)&((h)->regs->dma.sdiod32.dma32regs[chnl].rcv))
+
+#define SDIODDMAREG64(h, dir, chnl) \
+        ((dir) == DMA_TX ? \
+         (void *)(uintptr)&((h)->regs->dma.sdiod64.dma64regs[chnl].xmt) : \
+         (void *)(uintptr)&((h)->regs->dma.sdiod64.dma64regs[chnl].rcv))
+
+#define SDIODDMAREG(h, dir, chnl) \
+        (SDIODREV_LT((h)->corerev, 1) ? \
+         SDIODDMAREG32((h), (dir), (chnl)) : \
+         SDIODDMAREG64((h), (dir), (chnl)))
+
+#define PCMDDMAREG(h, dir, chnl) \
+        ((dir) == DMA_TX ? \
+         (void *)(uintptr)&((h)->regs->dma.pcm32.dmaregs.xmt) : \
+         (void *)(uintptr)&((h)->regs->dma.pcm32.dmaregs.rcv))
+
+#define SDPCMDMAREG(h, dir, chnl, coreid) \
+        ((coreid) == SDIOD_CORE_ID ? \
+         SDIODDMAREG(h, dir, chnl) : \
+         PCMDDMAREG(h, dir, chnl))
+
+#define SDIODFIFOREG(h, corerev) \
+        (SDIODREV_LT((corerev), 1) ? \
+         ((dma32diag_t *)(uintptr)&((h)->regs->dma.sdiod32.dmafifo)) : \
+         ((dma32diag_t *)(uintptr)&((h)->regs->dma.sdiod64.dmafifo)))
+
+#define PCMDFIFOREG(h) \
+        ((dma32diag_t *)(uintptr)&((h)->regs->dma.pcm32.dmafifo))
+
+#define SDPCMFIFOREG(h, coreid, corerev) \
+        ((coreid) == SDIOD_CORE_ID ? \
+         SDIODFIFOREG(h, corerev) : \
+         PCMDFIFOREG(h))
+
+/*
+ * Shared structure between dongle and the host.
+ * The structure contains pointers to trap or assert information.
+ */
+#define SDPCM_SHARED_VERSION       0x0001
+#define SDPCM_SHARED_VERSION_MASK  0x00FF
+#define SDPCM_SHARED_ASSERT_BUILT  0x0100
+#define SDPCM_SHARED_ASSERT        0x0200
+#define SDPCM_SHARED_TRAP          0x0400
+#define SDPCM_SHARED_IN_BRPT       0x0800
+#define SDPCM_SHARED_SET_BRPT      0x1000
+#define SDPCM_SHARED_PENDING_BRPT  0x2000
+
+typedef struct {
+        uint32  flags;
+        uint32  trap_addr;
+        uint32  assert_exp_addr;
+        uint32  assert_file_addr;
+        uint32  assert_line;
+        uint32  console_addr;           /* Address of hndrte_cons_t */
+        uint32  msgtrace_addr;
+        uint32  brpt_addr;
+} sdpcm_shared_t;
+
+extern sdpcm_shared_t sdpcm_shared;
+
+/* Function can be used to notify host of FW halt */
+extern void sdpcmd_fwhalt(void);
+
+#endif  /* _bcmsdpcm_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/bcmsdspi.h b/drivers/net/wireless/bcmdhd/include/bcmsdspi.h
new file mode 100644
index 00000000000..0bff355f8ff
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmsdspi.h
@@ -0,0 +1,135 @@
+/*
+ * SD-SPI Protocol Conversion - BCMSDH->SPI Translation Layer
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdspi.h,v 13.11.86.1 2010-11-15 18:14:56 Exp $
+ */
+#ifndef _BCM_SD_SPI_H
+#define _BCM_SD_SPI_H
+
+/* global msglevel for debug messages - bitvals come from sdiovar.h */
+
+#define sd_err(x)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+        do { if (!(exp)) \
+                printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+        } while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS 0
+#undef ERROR
+#define ERROR   1
+
+/* private bus modes */
+#define SDIOH_MODE_SPI          0
+
+#define USE_BLOCKMODE           0x2     /* Block mode can be single block or multi */
+#define USE_MULTIBLOCK          0x4
+
+struct sdioh_info {
+        uint cfg_bar;                           /* pci cfg address for bar */
+        uint32 caps;                            /* cached value of capabilities reg */
+        uint            bar0;                   /* BAR0 for PCI Device */
+        osl_t           *osh;                   /* osh handler */
+        void            *controller;    /* Pointer to SPI Controller's private data struct */
+
+        uint            lockcount;              /* nest count of sdspi_lock() calls */
+        bool            client_intr_enabled;    /* interrupt connnected flag */
+        bool            intr_handler_valid;     /* client driver interrupt handler valid */
+        sdioh_cb_fn_t   intr_handler;           /* registered interrupt handler */
+        void            *intr_handler_arg;      /* argument to call interrupt handler */
+        bool            initialized;            /* card initialized */
+        uint32          target_dev;             /* Target device ID */
+        uint32          intmask;                /* Current active interrupts */
+        void            *sdos_info;             /* Pointer to per-OS private data */
+
+        uint32          controller_type;        /* Host controller type */
+        uint8           version;                /* Host Controller Spec Compliance Version */
+        uint            irq;                    /* Client irq */
+        uint32          intrcount;              /* Client interrupts */
+        uint32          local_intrcount;        /* Controller interrupts */
+        bool            host_init_done;         /* Controller initted */
+        bool            card_init_done;         /* Client SDIO interface initted */
+        bool            polled_mode;            /* polling for command completion */
+
+        bool            sd_use_dma;             /* DMA on CMD53 */
+        bool            sd_blockmode;           /* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+                                                /*  Must be on for sd_multiblock to be effective */
+        bool            use_client_ints;        /* If this is false, make sure to restore */
+        bool            got_hcint;              /* Host Controller interrupt. */
+                                                /*  polling hack in wl_linux.c:wl_timer() */
+        int             adapter_slot;           /* Maybe dealing with multiple slots/controllers */
+        int             sd_mode;                /* SD1/SD4/SPI */
+        int             client_block_size[SDIOD_MAX_IOFUNCS];           /* Blocksize */
+        uint32          data_xfer_count;        /* Current register transfer size */
+        uint32          cmd53_wr_data;          /* Used to pass CMD53 write data */
+        uint32          card_response;          /* Used to pass back response status byte */
+        uint32          card_rsp_data;          /* Used to pass back response data word */
+        uint16          card_rca;               /* Current Address */
+        uint8           num_funcs;              /* Supported funcs on client */
+        uint32          com_cis_ptr;
+        uint32          func_cis_ptr[SDIOD_MAX_IOFUNCS];
+        void            *dma_buf;
+        ulong           dma_phys;
+        int             r_cnt;                  /* rx count */
+        int             t_cnt;                  /* tx_count */
+};
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdspi.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/**************************************************************
+ * Internal interfaces: bcmsdspi.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *spi_reg_map(osl_t *osh, uintptr addr, int size);
+extern void spi_reg_unmap(osl_t *osh, uintptr addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int spi_register_irq(sdioh_info_t *sd, uint irq);
+extern void spi_free_irq(uint irq, sdioh_info_t *sd);
+
+/* OS-specific interrupt wrappers (atomic interrupt enable/disable) */
+extern void spi_lock(sdioh_info_t *sd);
+extern void spi_unlock(sdioh_info_t *sd);
+
+/* Allocate/init/free per-OS private data */
+extern int spi_osinit(sdioh_info_t *sd);
+extern void spi_osfree(sdioh_info_t *sd);
+
+#endif /* _BCM_SD_SPI_H */
diff --git a/drivers/net/wireless/bcmdhd/include/bcmsdstd.h b/drivers/net/wireless/bcmdhd/include/bcmsdstd.h
new file mode 100644
index 00000000000..0f4c0267dbc
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmsdstd.h
@@ -0,0 +1,267 @@
+/*
+ *  'Standard' SDIO HOST CONTROLLER driver
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdstd.h,v 13.21.2.6 2010-11-15 18:14:01 Exp $
+ */
+#ifndef _BCM_SD_STD_H
+#define _BCM_SD_STD_H
+
+/* global msglevel for debug messages - bitvals come from sdiovar.h */
+#define sd_err(x)       do { if (sd_msglevel & SDH_ERROR_VAL) printf x; } while (0)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+#define sd_dma(x)
+
+#define sd_sync_dma(sd, read, nbytes)
+#define sd_init_dma(sd)
+#define sd_ack_intr(sd)
+#define sd_wakeup(sd);
+/* Allocate/init/free per-OS private data */
+extern int sdstd_osinit(sdioh_info_t *sd);
+extern void sdstd_osfree(sdioh_info_t *sd);
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+        do { if (!(exp)) \
+                printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+        } while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS 0
+#define ERROR   1
+
+/* private bus modes */
+#define SDIOH_MODE_SPI          0
+#define SDIOH_MODE_SD1          1
+#define SDIOH_MODE_SD4          2
+
+#define MAX_SLOTS 6     /* For PCI: Only 6 BAR entries => 6 slots */
+#define SDIOH_REG_WINSZ 0x100 /* Number of registers in Standard Host Controller */
+
+#define SDIOH_TYPE_ARASAN_HDK   1
+#define SDIOH_TYPE_BCM27XX      2
+#define SDIOH_TYPE_TI_PCIXX21   4       /* TI PCIxx21 Standard Host Controller */
+#define SDIOH_TYPE_RICOH_R5C822 5       /* Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host Adapter */
+#define SDIOH_TYPE_JMICRON      6       /* JMicron Standard SDIO Host Controller */
+
+/* For linux, allow yielding for dongle */
+#define BCMSDYIELD
+
+/* Expected card status value for CMD7 */
+#define SDIOH_CMD7_EXP_STATUS   0x00001E00
+
+#define RETRIES_LARGE 100000
+#define RETRIES_SMALL 100
+
+
+#define USE_BLOCKMODE           0x2     /* Block mode can be single block or multi */
+#define USE_MULTIBLOCK          0x4
+
+#define USE_FIFO                0x8     /* Fifo vs non-fifo */
+
+#define CLIENT_INTR             0x100   /* Get rid of this! */
+
+#define HC_INTR_RETUNING        0x1000
+
+
+struct sdioh_info {
+        uint cfg_bar;                           /* pci cfg address for bar */
+        uint32 caps;                            /* cached value of capabilities reg */
+        uint32 curr_caps;                       /* max current capabilities reg */
+
+        osl_t           *osh;                   /* osh handler */
+        volatile char   *mem_space;             /* pci device memory va */
+        uint            lockcount;              /* nest count of sdstd_lock() calls */
+        bool            client_intr_enabled;    /* interrupt connnected flag */
+        bool            intr_handler_valid;     /* client driver interrupt handler valid */
+        sdioh_cb_fn_t   intr_handler;           /* registered interrupt handler */
+        void            *intr_handler_arg;      /* argument to call interrupt handler */
+        bool            initialized;            /* card initialized */
+        uint            target_dev;             /* Target device ID */
+        uint16          intmask;                /* Current active interrupts */
+        void            *sdos_info;             /* Pointer to per-OS private data */
+
+        uint32          controller_type;        /* Host controller type */
+        uint8           version;                /* Host Controller Spec Compliance Version */
+        uint            irq;                    /* Client irq */
+        int             intrcount;              /* Client interrupts */
+        int             local_intrcount;        /* Controller interrupts */
+        bool            host_init_done;         /* Controller initted */
+        bool            card_init_done;         /* Client SDIO interface initted */
+        bool            polled_mode;            /* polling for command completion */
+
+        bool            sd_blockmode;           /* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+                                                /*  Must be on for sd_multiblock to be effective */
+        bool            use_client_ints;        /* If this is false, make sure to restore */
+                                                /*  polling hack in wl_linux.c:wl_timer() */
+        int             adapter_slot;           /* Maybe dealing with multiple slots/controllers */
+        int             sd_mode;                /* SD1/SD4/SPI */
+        int             client_block_size[SDIOD_MAX_IOFUNCS];           /* Blocksize */
+        uint32          data_xfer_count;        /* Current transfer */
+        uint16          card_rca;               /* Current Address */
+        int8            sd_dma_mode;            /* DMA Mode (PIO, SDMA, ... ADMA2) on CMD53 */
+        uint8           num_funcs;              /* Supported funcs on client */
+        uint32          com_cis_ptr;
+        uint32          func_cis_ptr[SDIOD_MAX_IOFUNCS];
+        void            *dma_buf;               /* DMA Buffer virtual address */
+        ulong           dma_phys;               /* DMA Buffer physical address */
+        void            *adma2_dscr_buf;        /* ADMA2 Descriptor Buffer virtual address */
+        ulong           adma2_dscr_phys;        /* ADMA2 Descriptor Buffer physical address */
+
+        /* adjustments needed to make the dma align properly */
+        void            *dma_start_buf;
+        ulong           dma_start_phys;
+        uint            alloced_dma_size;
+        void            *adma2_dscr_start_buf;
+        ulong           adma2_dscr_start_phys;
+        uint            alloced_adma2_dscr_size;
+
+        int             r_cnt;                  /* rx count */
+        int             t_cnt;                  /* tx_count */
+        bool            got_hcint;              /* local interrupt flag */
+        uint16          last_intrstatus;        /* to cache intrstatus */
+        int     host_UHSISupported;             /* whether UHSI is supported for HC. */
+        int     card_UHSI_voltage_Supported;    /* whether UHSI is supported for 
+                                                 * Card in terms of Voltage [1.8 or 3.3]. 
+                                                 */
+        int     global_UHSI_Supp;       /* type of UHSI support in both host and card.
+                                         * HOST_SDR_UNSUPP: capabilities not supported/matched
+                                         * HOST_SDR_12_25: SDR12 and SDR25 supported
+                                         * HOST_SDR_50_104_DDR: one of SDR50/SDR104 or DDR50 supptd
+                                         */
+        int     sd3_dat_state;          /* data transfer state used for retuning check */
+        int     sd3_tun_state;          /* tuning state used for retuning check */
+        bool    sd3_tuning_reqd;        /* tuning requirement parameter */
+        uint32  caps3;                  /* cached value of 32 MSbits capabilities reg (SDIO 3.0) */
+};
+
+#define DMA_MODE_NONE   0
+#define DMA_MODE_SDMA   1
+#define DMA_MODE_ADMA1  2
+#define DMA_MODE_ADMA2  3
+#define DMA_MODE_ADMA2_64 4
+#define DMA_MODE_AUTO   -1
+
+#define USE_DMA(sd)             ((bool)((sd->sd_dma_mode > 0) ? TRUE : FALSE))
+
+/* SDIO Host Control Register DMA Mode Definitions */
+#define SDIOH_SDMA_MODE                 0
+#define SDIOH_ADMA1_MODE                1
+#define SDIOH_ADMA2_MODE                2
+#define SDIOH_ADMA2_64_MODE             3
+
+#define ADMA2_ATTRIBUTE_VALID           (1 << 0)        /* ADMA Descriptor line valid */
+#define ADMA2_ATTRIBUTE_END                     (1 << 1)        /* End of Descriptor */
+#define ADMA2_ATTRIBUTE_INT                     (1 << 2)        /* Interrupt when line is done */
+#define ADMA2_ATTRIBUTE_ACT_NOP         (0 << 4)        /* Skip current line, go to next. */
+#define ADMA2_ATTRIBUTE_ACT_RSV         (1 << 4)        /* Same as NOP */
+#define ADMA1_ATTRIBUTE_ACT_SET         (1 << 4)        /* ADMA1 Only - set transfer length */
+#define ADMA2_ATTRIBUTE_ACT_TRAN        (2 << 4)        /* Transfer Data of one descriptor line. */
+#define ADMA2_ATTRIBUTE_ACT_LINK        (3 << 4)        /* Link Descriptor */
+
+/* States for Tuning and corr data */
+#define TUNING_IDLE                     0
+#define TUNING_START                    1
+#define TUNING_START_AFTER_DAT  2
+#define TUNING_ONGOING                  3
+
+#define DATA_TRANSFER_IDLE              0
+#define DATA_TRANSFER_ONGOING   1
+
+/* ADMA2 Descriptor Table Entry for 32-bit Address */
+typedef struct adma2_dscr_32b {
+        uint32 len_attr;
+        uint32 phys_addr;
+} adma2_dscr_32b_t;
+
+/* ADMA1 Descriptor Table Entry */
+typedef struct adma1_dscr {
+        uint32 phys_addr_attr;
+} adma1_dscr_t;
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdstd.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/* OS-independent interrupt handler */
+extern bool check_client_intr(sdioh_info_t *sd);
+
+/* Core interrupt enable/disable of device interrupts */
+extern void sdstd_devintr_on(sdioh_info_t *sd);
+extern void sdstd_devintr_off(sdioh_info_t *sd);
+
+/* Enable/disable interrupts for local controller events */
+extern void sdstd_intrs_on(sdioh_info_t *sd, uint16 norm, uint16 err);
+extern void sdstd_intrs_off(sdioh_info_t *sd, uint16 norm, uint16 err);
+
+/* Wait for specified interrupt and error bits to be set */
+extern void sdstd_spinbits(sdioh_info_t *sd, uint16 norm, uint16 err);
+
+
+/**************************************************************
+ * Internal interfaces: bcmsdstd.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *sdstd_reg_map(osl_t *osh, int32 addr, int size);
+extern void sdstd_reg_unmap(osl_t *osh, int32 addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int sdstd_register_irq(sdioh_info_t *sd, uint irq);
+extern void sdstd_free_irq(uint irq, sdioh_info_t *sd);
+
+/* OS-specific interrupt wrappers (atomic interrupt enable/disable) */
+extern void sdstd_lock(sdioh_info_t *sd);
+extern void sdstd_unlock(sdioh_info_t *sd);
+extern void sdstd_waitlockfree(sdioh_info_t *sd);
+
+/* OS-specific wait-for-interrupt-or-status */
+extern int sdstd_waitbits(sdioh_info_t *sd, uint16 norm, uint16 err, bool yield, uint16 *bits);
+
+/* used by bcmsdstd_linux [implemented in sdstd] */
+extern void sdstd_3_enable_retuning_int(sdioh_info_t *sd);
+extern void sdstd_3_disable_retuning_int(sdioh_info_t *sd);
+extern bool sdstd_3_is_retuning_int_set(sdioh_info_t *sd);
+extern bool sdstd_3_check_and_set_retuning(sdioh_info_t *sd);
+extern int sdstd_3_get_tune_state(sdioh_info_t *sd);
+extern void sdstd_3_set_tune_state(sdioh_info_t *sd, int state);
+extern uint8 sdstd_3_get_tuning_exp(sdioh_info_t *sd);
+extern uint32 sdstd_3_get_uhsi_clkmode(sdioh_info_t *sd);
+extern int sdstd_3_clk_tuning(sdioh_info_t *sd, uint32 sd3ClkMode);
+
+/* used by sdstd [implemented in bcmsdstd_linux/ndis] */
+extern void sdstd_3_start_tuning(sdioh_info_t *sd);
+extern void sdstd_3_osinit_tuning(sdioh_info_t *sd);
+extern void sdstd_3_osclean_tuning(sdioh_info_t *sd);
+
+#endif /* _BCM_SD_STD_H */
diff --git a/drivers/net/wireless/bcmdhd/include/bcmspi.h b/drivers/net/wireless/bcmdhd/include/bcmspi.h
new file mode 100644
index 00000000000..0eb2a30c9a8
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmspi.h
@@ -0,0 +1,40 @@
+/*
+ * Broadcom SPI Low-Level Hardware Driver API
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmspi.h,v 13.5.112.1 2010-11-15 18:13:09 Exp $
+ */
+#ifndef _BCM_SPI_H
+#define _BCM_SPI_H
+
+extern void spi_devintr_off(sdioh_info_t *sd);
+extern void spi_devintr_on(sdioh_info_t *sd);
+extern bool spi_start_clock(sdioh_info_t *sd, uint16 new_sd_divisor);
+extern bool spi_controller_highspeed_mode(sdioh_info_t *sd, bool hsmode);
+extern bool spi_check_client_intr(sdioh_info_t *sd, int *is_dev_intr);
+extern bool spi_hw_attach(sdioh_info_t *sd);
+extern bool spi_hw_detach(sdioh_info_t *sd);
+extern void spi_sendrecv(sdioh_info_t *sd, uint8 *msg_out, uint8 *msg_in, int msglen);
+extern void spi_spinbits(sdioh_info_t *sd);
+extern void spi_waitbits(sdioh_info_t *sd, bool yield);
+
+#endif /* _BCM_SPI_H */
diff --git a/drivers/net/wireless/bcmdhd/include/bcmutils.h b/drivers/net/wireless/bcmdhd/include/bcmutils.h
new file mode 100644
index 00000000000..530036f0ba7
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmutils.h
@@ -0,0 +1,708 @@
+/*
+ * Misc useful os-independent macros and functions.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmutils.h,v 13.236.2.16 2011-01-26 00:45:06 Exp $
+ */
+
+
+#ifndef _bcmutils_h_
+#define _bcmutils_h_
+
+#define bcm_strcpy_s(dst, noOfElements, src)            strcpy((dst), (src))
+#define bcm_strncpy_s(dst, noOfElements, src, count)    strncpy((dst), (src), (count))
+#define bcm_strcat_s(dst, noOfElements, src)            strcat((dst), (src))
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+#define _BCM_U  0x01    
+#define _BCM_L  0x02    
+#define _BCM_D  0x04    
+#define _BCM_C  0x08    
+#define _BCM_P  0x10    
+#define _BCM_S  0x20    
+#define _BCM_X  0x40    
+#define _BCM_SP 0x80    
+
+extern const unsigned char bcm_ctype[];
+#define bcm_ismask(x)   (bcm_ctype[(int)(unsigned char)(x)])
+
+#define bcm_isalnum(c)  ((bcm_ismask(c)&(_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_isalpha(c)  ((bcm_ismask(c)&(_BCM_U|_BCM_L)) != 0)
+#define bcm_iscntrl(c)  ((bcm_ismask(c)&(_BCM_C)) != 0)
+#define bcm_isdigit(c)  ((bcm_ismask(c)&(_BCM_D)) != 0)
+#define bcm_isgraph(c)  ((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_islower(c)  ((bcm_ismask(c)&(_BCM_L)) != 0)
+#define bcm_isprint(c)  ((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D|_BCM_SP)) != 0)
+#define bcm_ispunct(c)  ((bcm_ismask(c)&(_BCM_P)) != 0)
+#define bcm_isspace(c)  ((bcm_ismask(c)&(_BCM_S)) != 0)
+#define bcm_isupper(c)  ((bcm_ismask(c)&(_BCM_U)) != 0)
+#define bcm_isxdigit(c) ((bcm_ismask(c)&(_BCM_D|_BCM_X)) != 0)
+#define bcm_tolower(c)  (bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#define bcm_toupper(c)  (bcm_islower((c)) ? ((c) + 'A' - 'a') : (c))
+
+
+
+struct bcmstrbuf {
+        char *buf;      
+        unsigned int size;      
+        char *origbuf;  
+        unsigned int origsize;  
+};
+
+
+#ifdef BCMDRIVER
+#include <osl.h>
+
+#define GPIO_PIN_NOTDEFINED     0x20    
+
+
+#define SPINWAIT(exp, us) { \
+        uint countdown = (us) + 9; \
+        while ((exp) && (countdown >= 10)) {\
+                OSL_DELAY(10); \
+                countdown -= 10; \
+        } \
+}
+
+
+#ifndef PKTQ_LEN_DEFAULT
+#define PKTQ_LEN_DEFAULT        128     
+#endif
+#ifndef PKTQ_MAX_PREC
+#define PKTQ_MAX_PREC           16      
+#endif
+
+typedef struct pktq_prec {
+        void *head;     
+        void *tail;     
+        uint16 len;     
+        uint16 max;     
+} pktq_prec_t;
+
+
+
+struct pktq {
+        uint16 num_prec;        
+        uint16 hi_prec;         
+        uint16 max;             
+        uint16 len;             
+        
+        struct pktq_prec q[PKTQ_MAX_PREC];
+};
+
+
+struct spktq {
+        uint16 num_prec;        
+        uint16 hi_prec;         
+        uint16 max;             
+        uint16 len;             
+        
+        struct pktq_prec q[1];
+};
+
+#define PKTQ_PREC_ITER(pq, prec)        for (prec = (pq)->num_prec - 1; prec >= 0; prec--)
+
+
+typedef bool (*ifpkt_cb_t)(void*, int);
+
+#ifdef BCMPKTPOOL
+#define POOL_ENAB(pool)         ((pool) && (pool)->inited)
+#if defined(BCM4329C0)
+#define SHARED_POOL             (pktpool_shared_ptr)
+#else
+#define SHARED_POOL             (pktpool_shared)
+#endif 
+#else 
+#define POOL_ENAB(bus)          0
+#define SHARED_POOL             ((struct pktpool *)NULL)
+#endif 
+
+#ifndef PKTPOOL_LEN_MAX
+#define PKTPOOL_LEN_MAX         40
+#endif
+#define PKTPOOL_CB_MAX          3
+
+struct pktpool;
+typedef void (*pktpool_cb_t)(struct pktpool *pool, void *arg);
+typedef struct {
+        pktpool_cb_t cb;
+        void *arg;
+} pktpool_cbinfo_t;
+
+#ifdef BCMDBG_POOL
+
+#define POOL_IDLE       0
+#define POOL_RXFILL     1
+#define POOL_RXDH       2
+#define POOL_RXD11      3
+#define POOL_TXDH       4
+#define POOL_TXD11      5
+#define POOL_AMPDU      6
+#define POOL_TXENQ      7
+
+typedef struct {
+        void *p;
+        uint32 cycles;
+        uint32 dur;
+} pktpool_dbg_t;
+
+typedef struct {
+        uint8 txdh;     
+        uint8 txd11;    
+        uint8 enq;      
+        uint8 rxdh;     
+        uint8 rxd11;    
+        uint8 rxfill;   
+        uint8 idle;     
+} pktpool_stats_t;
+#endif 
+
+typedef struct pktpool {
+        bool inited;
+        uint16 r;
+        uint16 w;
+        uint16 len;
+        uint16 maxlen;
+        uint16 plen;
+        bool istx;
+        bool empty;
+        uint8 cbtoggle;
+        uint8 cbcnt;
+        uint8 ecbcnt;
+        bool emptycb_disable;
+        pktpool_cbinfo_t cbs[PKTPOOL_CB_MAX];
+        pktpool_cbinfo_t ecbs[PKTPOOL_CB_MAX];
+        void *q[PKTPOOL_LEN_MAX + 1];
+
+#ifdef BCMDBG_POOL
+        uint8 dbg_cbcnt;
+        pktpool_cbinfo_t dbg_cbs[PKTPOOL_CB_MAX];
+        uint16 dbg_qlen;
+        pktpool_dbg_t dbg_q[PKTPOOL_LEN_MAX + 1];
+#endif
+} pktpool_t;
+
+#if defined(BCM4329C0)
+extern pktpool_t *pktpool_shared_ptr;
+#else
+extern pktpool_t *pktpool_shared;
+#endif 
+
+extern int pktpool_init(osl_t *osh, pktpool_t *pktp, int *pktplen, int plen, bool istx);
+extern int pktpool_deinit(osl_t *osh, pktpool_t *pktp);
+extern int pktpool_fill(osl_t *osh, pktpool_t *pktp, bool minimal);
+extern void* pktpool_get(pktpool_t *pktp);
+extern void pktpool_free(pktpool_t *pktp, void *p);
+extern int pktpool_add(pktpool_t *pktp, void *p);
+extern uint16 pktpool_avail(pktpool_t *pktp);
+extern int pktpool_avail_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_empty_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_setmaxlen(pktpool_t *pktp, uint16 maxlen);
+extern void pktpool_emptycb_disable(pktpool_t *pktp, bool disable);
+
+#define POOLPTR(pp)                     ((pktpool_t *)(pp))
+#define pktpool_len(pp)                 (POOLPTR(pp)->len - 1)
+#define pktpool_plen(pp)                (POOLPTR(pp)->plen)
+#define pktpool_maxlen(pp)              (POOLPTR(pp)->maxlen)
+
+#ifdef BCMDBG_POOL
+extern int pktpool_dbg_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_start_trigger(pktpool_t *pktp, void *p);
+extern int pktpool_dbg_dump(pktpool_t *pktp);
+extern int pktpool_dbg_notify(pktpool_t *pktp);
+extern int pktpool_stats_dump(pktpool_t *pktp, pktpool_stats_t *stats);
+#endif 
+
+
+
+struct ether_addr;
+
+extern int ether_isbcast(const void *ea);
+extern int ether_isnulladdr(const void *ea);
+
+
+
+#define pktq_psetmax(pq, prec, _max)    ((pq)->q[prec].max = (_max))
+#define pktq_plen(pq, prec)             ((pq)->q[prec].len)
+#define pktq_pavail(pq, prec)           ((pq)->q[prec].max - (pq)->q[prec].len)
+#define pktq_pfull(pq, prec)            ((pq)->q[prec].len >= (pq)->q[prec].max)
+#define pktq_pempty(pq, prec)           ((pq)->q[prec].len == 0)
+
+#define pktq_ppeek(pq, prec)            ((pq)->q[prec].head)
+#define pktq_ppeek_tail(pq, prec)       ((pq)->q[prec].tail)
+
+extern void *pktq_penq(struct pktq *pq, int prec, void *p);
+extern void *pktq_penq_head(struct pktq *pq, int prec, void *p);
+extern void *pktq_pdeq(struct pktq *pq, int prec);
+extern void *pktq_pdeq_tail(struct pktq *pq, int prec);
+
+extern void pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir,
+        ifpkt_cb_t fn, int arg);
+
+extern bool pktq_pdel(struct pktq *pq, void *p, int prec);
+
+
+
+extern int pktq_mlen(struct pktq *pq, uint prec_bmp);
+extern void *pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out);
+
+
+
+#define pktq_len(pq)                    ((int)(pq)->len)
+#define pktq_max(pq)                    ((int)(pq)->max)
+#define pktq_avail(pq)                  ((int)((pq)->max - (pq)->len))
+#define pktq_full(pq)                   ((pq)->len >= (pq)->max)
+#define pktq_empty(pq)                  ((pq)->len == 0)
+
+
+#define pktenq(pq, p)           pktq_penq(((struct pktq *)pq), 0, (p))
+#define pktenq_head(pq, p)      pktq_penq_head(((struct pktq *)pq), 0, (p))
+#define pktdeq(pq)              pktq_pdeq(((struct pktq *)pq), 0)
+#define pktdeq_tail(pq)         pktq_pdeq_tail(((struct pktq *)pq), 0)
+#define pktqinit(pq, len) pktq_init(((struct pktq *)pq), 1, len)
+
+extern void pktq_init(struct pktq *pq, int num_prec, int max_len);
+
+extern void *pktq_deq(struct pktq *pq, int *prec_out);
+extern void *pktq_deq_tail(struct pktq *pq, int *prec_out);
+extern void *pktq_peek(struct pktq *pq, int *prec_out);
+extern void *pktq_peek_tail(struct pktq *pq, int *prec_out);
+extern void pktq_flush(osl_t *osh, struct pktq *pq, bool dir, ifpkt_cb_t fn, int arg);
+
+
+
+extern uint pktcopy(osl_t *osh, void *p, uint offset, int len, uchar *buf);
+extern uint pktfrombuf(osl_t *osh, void *p, uint offset, int len, uchar *buf);
+extern uint pkttotlen(osl_t *osh, void *p);
+extern void *pktlast(osl_t *osh, void *p);
+extern uint pktsegcnt(osl_t *osh, void *p);
+
+
+extern uint pktsetprio(void *pkt, bool update_vtag);
+#define PKTPRIO_VDSCP   0x100           
+#define PKTPRIO_VLAN    0x200           
+#define PKTPRIO_UPD     0x400           
+#define PKTPRIO_DSCP    0x800           
+
+
+extern int bcm_atoi(char *s);
+extern ulong bcm_strtoul(char *cp, char **endp, uint base);
+extern char *bcmstrstr(char *haystack, char *needle);
+extern char *bcmstrcat(char *dest, const char *src);
+extern char *bcmstrncat(char *dest, const char *src, uint size);
+extern ulong wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen);
+char* bcmstrtok(char **string, const char *delimiters, char *tokdelim);
+int bcmstricmp(const char *s1, const char *s2);
+int bcmstrnicmp(const char* s1, const char* s2, int cnt);
+
+
+
+extern char *bcm_ether_ntoa(const struct ether_addr *ea, char *buf);
+extern int bcm_ether_atoe(char *p, struct ether_addr *ea);
+
+
+struct ipv4_addr;
+extern char *bcm_ip_ntoa(struct ipv4_addr *ia, char *buf);
+
+
+extern void bcm_mdelay(uint ms);
+
+extern char *getvar(char *vars, const char *name);
+extern int getintvar(char *vars, const char *name);
+extern int getintvararray(char *vars, const char *name, int index);
+extern int getintvararraysize(char *vars, const char *name);
+extern uint getgpiopin(char *vars, char *pin_name, uint def_pin);
+#define bcm_perf_enable()
+#define bcmstats(fmt)
+#define bcmlog(fmt, a1, a2)
+#define bcmdumplog(buf, size)   *buf = '\0'
+#define bcmdumplogent(buf, idx) -1
+
+#define bcmtslog(tstamp, fmt, a1, a2)
+#define bcmprinttslogs()
+#define bcmprinttstamp(us)
+
+extern char *bcm_nvram_vars(uint *length);
+extern int bcm_nvram_cache(void *sih);
+
+
+
+
+typedef struct bcm_iovar {
+        const char *name;       
+        uint16 varid;           
+        uint16 flags;           
+        uint16 type;            
+        uint16 minlen;          
+} bcm_iovar_t;
+
+
+
+
+#define IOV_GET 0 
+#define IOV_SET 1 
+
+
+#define IOV_GVAL(id)            ((id)*2)
+#define IOV_SVAL(id)            (((id)*2)+IOV_SET)
+#define IOV_ISSET(actionid)     ((actionid & IOV_SET) == IOV_SET)
+#define IOV_ID(actionid)        (actionid >> 1)
+
+
+
+extern const bcm_iovar_t *bcm_iovar_lookup(const bcm_iovar_t *table, const char *name);
+extern int bcm_iovar_lencheck(const bcm_iovar_t *table, void *arg, int len, bool set);
+#if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
+        defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
+extern int bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len);
+#endif 
+#endif  
+
+
+#define IOVT_VOID       0       
+#define IOVT_BOOL       1       
+#define IOVT_INT8       2       
+#define IOVT_UINT8      3       
+#define IOVT_INT16      4       
+#define IOVT_UINT16     5       
+#define IOVT_INT32      6       
+#define IOVT_UINT32     7       
+#define IOVT_BUFFER     8       
+#define BCM_IOVT_VALID(type) (((unsigned int)(type)) <= IOVT_BUFFER)
+
+
+#define BCM_IOV_TYPE_INIT { \
+        "void", \
+        "bool", \
+        "int8", \
+        "uint8", \
+        "int16", \
+        "uint16", \
+        "int32", \
+        "uint32", \
+        "buffer", \
+        "" }
+
+#define BCM_IOVT_IS_INT(type) (\
+        (type == IOVT_BOOL) || \
+        (type == IOVT_INT8) || \
+        (type == IOVT_UINT8) || \
+        (type == IOVT_INT16) || \
+        (type == IOVT_UINT16) || \
+        (type == IOVT_INT32) || \
+        (type == IOVT_UINT32))
+
+
+
+#define BCME_STRLEN             64      
+#define VALID_BCMERROR(e)  ((e <= 0) && (e >= BCME_LAST))
+
+
+
+
+#define BCME_OK                         0       
+#define BCME_ERROR                      -1      
+#define BCME_BADARG                     -2      
+#define BCME_BADOPTION                  -3      
+#define BCME_NOTUP                      -4      
+#define BCME_NOTDOWN                    -5      
+#define BCME_NOTAP                      -6      
+#define BCME_NOTSTA                     -7      
+#define BCME_BADKEYIDX                  -8      
+#define BCME_RADIOOFF                   -9      
+#define BCME_NOTBANDLOCKED              -10     
+#define BCME_NOCLK                      -11     
+#define BCME_BADRATESET                 -12     
+#define BCME_BADBAND                    -13     
+#define BCME_BUFTOOSHORT                -14     
+#define BCME_BUFTOOLONG                 -15     
+#define BCME_BUSY                       -16     
+#define BCME_NOTASSOCIATED              -17     
+#define BCME_BADSSIDLEN                 -18     
+#define BCME_OUTOFRANGECHAN             -19     
+#define BCME_BADCHAN                    -20     
+#define BCME_BADADDR                    -21     
+#define BCME_NORESOURCE                 -22     
+#define BCME_UNSUPPORTED                -23     
+#define BCME_BADLEN                     -24     
+#define BCME_NOTREADY                   -25     
+#define BCME_EPERM                      -26     
+#define BCME_NOMEM                      -27     
+#define BCME_ASSOCIATED                 -28     
+#define BCME_RANGE                      -29     
+#define BCME_NOTFOUND                   -30     
+#define BCME_WME_NOT_ENABLED            -31     
+#define BCME_TSPEC_NOTFOUND             -32     
+#define BCME_ACM_NOTSUPPORTED           -33     
+#define BCME_NOT_WME_ASSOCIATION        -34     
+#define BCME_SDIO_ERROR                 -35     
+#define BCME_DONGLE_DOWN                -36     
+#define BCME_VERSION                    -37     
+#define BCME_TXFAIL                     -38     
+#define BCME_RXFAIL                     -39     
+#define BCME_NODEVICE                   -40     
+#define BCME_NMODE_DISABLED             -41     
+#define BCME_NONRESIDENT                -42 
+#define BCME_LAST                       BCME_NONRESIDENT
+
+
+#define BCMERRSTRINGTABLE {             \
+        "OK",                           \
+        "Undefined error",              \
+        "Bad Argument",                 \
+        "Bad Option",                   \
+        "Not up",                       \
+        "Not down",                     \
+        "Not AP",                       \
+        "Not STA",                      \
+        "Bad Key Index",                \
+        "Radio Off",                    \
+        "Not band locked",              \
+        "No clock",                     \
+        "Bad Rate valueset",            \
+        "Bad Band",                     \
+        "Buffer too short",             \
+        "Buffer too long",              \
+        "Busy",                         \
+        "Not Associated",               \
+        "Bad SSID len",                 \
+        "Out of Range Channel",         \
+        "Bad Channel",                  \
+        "Bad Address",                  \
+        "Not Enough Resources",         \
+        "Unsupported",                  \
+        "Bad length",                   \
+        "Not Ready",                    \
+        "Not Permitted",                \
+        "No Memory",                    \
+        "Associated",                   \
+        "Not In Range",                 \
+        "Not Found",                    \
+        "WME Not Enabled",              \
+        "TSPEC Not Found",              \
+        "ACM Not Supported",            \
+        "Not WME Association",          \
+        "SDIO Bus Error",               \
+        "Dongle Not Accessible",        \
+        "Incorrect version",            \
+        "TX Failure",                   \
+        "RX Failure",                   \
+        "Device Not Present",           \
+        "NMODE Disabled",               \
+        "Nonresident overlay access", \
+}
+
+#ifndef ABS
+#define ABS(a)                  (((a) < 0)?-(a):(a))
+#endif 
+
+#ifndef MIN
+#define MIN(a, b)               (((a) < (b))?(a):(b))
+#endif 
+
+#ifndef MAX
+#define MAX(a, b)               (((a) > (b))?(a):(b))
+#endif 
+
+#define CEIL(x, y)              (((x) + ((y)-1)) / (y))
+#define ROUNDUP(x, y)           ((((x)+((y)-1))/(y))*(y))
+#define ISALIGNED(a, x)         (((uintptr)(a) & ((x)-1)) == 0)
+#define ALIGN_ADDR(addr, boundary) (void *)(((uintptr)(addr) + (boundary) - 1) \
+                                                 & ~((boundary) - 1))
+#define ISPOWEROF2(x)           ((((x)-1)&(x)) == 0)
+#define VALID_MASK(mask)        !((mask) & ((mask) + 1))
+#ifndef OFFSETOF
+#define OFFSETOF(type, member)  ((uint)(uintptr)&((type *)0)->member)
+#endif 
+#ifndef ARRAYSIZE
+#define ARRAYSIZE(a)            (sizeof(a)/sizeof(a[0]))
+#endif
+
+
+extern void *_bcmutils_dummy_fn;
+#define REFERENCE_FUNCTION(f)   (_bcmutils_dummy_fn = (void *)(f))
+
+
+#ifndef setbit
+#ifndef NBBY                  
+#define NBBY    8       
+#endif 
+#define setbit(a, i)    (((uint8 *)a)[(i)/NBBY] |= 1<<((i)%NBBY))
+#define clrbit(a, i)    (((uint8 *)a)[(i)/NBBY] &= ~(1<<((i)%NBBY)))
+#define isset(a, i)     (((const uint8 *)a)[(i)/NBBY] & (1<<((i)%NBBY)))
+#define isclr(a, i)     ((((const uint8 *)a)[(i)/NBBY] & (1<<((i)%NBBY))) == 0)
+#endif 
+
+#define NBITS(type)     (sizeof(type) * 8)
+#define NBITVAL(nbits)  (1 << (nbits))
+#define MAXBITVAL(nbits)        ((1 << (nbits)) - 1)
+#define NBITMASK(nbits) MAXBITVAL(nbits)
+#define MAXNBVAL(nbyte) MAXBITVAL((nbyte) * 8)
+
+
+#define MUX(pred, true, false) ((pred) ? (true) : (false))
+
+
+#define MODDEC(x, bound) MUX((x) == 0, (bound) - 1, (x) - 1)
+#define MODINC(x, bound) MUX((x) == (bound) - 1, 0, (x) + 1)
+
+
+#define MODDEC_POW2(x, bound) (((x) - 1) & ((bound) - 1))
+#define MODINC_POW2(x, bound) (((x) + 1) & ((bound) - 1))
+
+
+#define MODADD(x, y, bound) \
+    MUX((x) + (y) >= (bound), (x) + (y) - (bound), (x) + (y))
+#define MODSUB(x, y, bound) \
+    MUX(((int)(x)) - ((int)(y)) < 0, (x) - (y) + (bound), (x) - (y))
+
+
+#define MODADD_POW2(x, y, bound) (((x) + (y)) & ((bound) - 1))
+#define MODSUB_POW2(x, y, bound) (((x) - (y)) & ((bound) - 1))
+
+
+#define CRC8_INIT_VALUE  0xff           
+#define CRC8_GOOD_VALUE  0x9f           
+#define CRC16_INIT_VALUE 0xffff         
+#define CRC16_GOOD_VALUE 0xf0b8         
+#define CRC32_INIT_VALUE 0xffffffff     
+#define CRC32_GOOD_VALUE 0xdebb20e3     
+
+
+typedef struct bcm_bit_desc {
+        uint32  bit;
+        const char* name;
+} bcm_bit_desc_t;
+
+
+typedef struct bcm_tlv {
+        uint8   id;
+        uint8   len;
+        uint8   data[1];
+} bcm_tlv_t;
+
+
+#define bcm_valid_tlv(elt, buflen) ((buflen) >= 2 && (int)(buflen) >= (int)(2 + (elt)->len))
+
+
+#define ETHER_ADDR_STR_LEN      18      
+
+
+
+static INLINE void
+xor_128bit_block(const uint8 *src1, const uint8 *src2, uint8 *dst)
+{
+        if (
+#ifdef __i386__
+            1 ||
+#endif
+            (((uintptr)src1 | (uintptr)src2 | (uintptr)dst) & 3) == 0) {
+                
+                
+                ((uint32 *)dst)[0] = ((const uint32 *)src1)[0] ^ ((const uint32 *)src2)[0];
+                ((uint32 *)dst)[1] = ((const uint32 *)src1)[1] ^ ((const uint32 *)src2)[1];
+                ((uint32 *)dst)[2] = ((const uint32 *)src1)[2] ^ ((const uint32 *)src2)[2];
+                ((uint32 *)dst)[3] = ((const uint32 *)src1)[3] ^ ((const uint32 *)src2)[3];
+        } else {
+                
+                int k;
+                for (k = 0; k < 16; k++)
+                        dst[k] = src1[k] ^ src2[k];
+        }
+}
+
+
+
+extern uint8 hndcrc8(uint8 *p, uint nbytes, uint8 crc);
+extern uint16 hndcrc16(uint8 *p, uint nbytes, uint16 crc);
+extern uint32 hndcrc32(uint8 *p, uint nbytes, uint32 crc);
+
+#if defined(DHD_DEBUG) || defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || \
+        defined(WLMSG_ASSOC)
+extern int bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len);
+#endif
+
+#if defined(DHD_DEBUG) || defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || \
+        defined(WLMSG_ASSOC) || defined(WLMEDIA_PEAKRATE)
+extern int bcm_format_hex(char *str, const void *bytes, int len);
+#endif
+
+extern const char *bcm_crypto_algo_name(uint algo);
+extern char *bcm_chipname(uint chipid, char *buf, uint len);
+extern char *bcm_brev_str(uint32 brev, char *buf);
+extern void printbig(char *buf);
+extern void prhex(const char *msg, uchar *buf, uint len);
+
+
+extern bcm_tlv_t *bcm_next_tlv(bcm_tlv_t *elt, int *buflen);
+extern bcm_tlv_t *bcm_parse_tlvs(void *buf, int buflen, uint key);
+extern bcm_tlv_t *bcm_parse_ordered_tlvs(void *buf, int buflen, uint key);
+
+
+extern const char *bcmerrorstr(int bcmerror);
+
+
+typedef uint32 mbool;
+#define mboolset(mb, bit)               ((mb) |= (bit))         
+#define mboolclr(mb, bit)               ((mb) &= ~(bit))        
+#define mboolisset(mb, bit)             (((mb) & (bit)) != 0)   
+#define mboolmaskset(mb, mask, val)     ((mb) = (((mb) & ~(mask)) | (val)))
+
+
+extern uint16 bcm_qdbm_to_mw(uint8 qdbm);
+extern uint8 bcm_mw_to_qdbm(uint16 mw);
+
+
+struct fielddesc {
+        const char *nameandfmt;
+        uint32  offset;
+        uint32  len;
+};
+
+extern void bcm_binit(struct bcmstrbuf *b, char *buf, uint size);
+extern int bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...);
+extern void bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount);
+extern int bcm_cmp_bytes(uchar *arg1, uchar *arg2, uint8 nbytes);
+extern void bcm_print_bytes(char *name, const uchar *cdata, int len);
+
+typedef  uint32 (*bcmutl_rdreg_rtn)(void *arg0, uint arg1, uint32 offset);
+extern uint bcmdumpfields(bcmutl_rdreg_rtn func_ptr, void *arg0, uint arg1, struct fielddesc *str,
+                          char *buf, uint32 bufsize);
+
+extern uint bcm_mkiovar(char *name, char *data, uint datalen, char *buf, uint len);
+extern uint bcm_bitcount(uint8 *bitmap, uint bytelength);
+
+
+
+#define SSID_FMT_BUF_LEN        ((4 * DOT11_MAX_SSID_LEN) + 1)
+
+unsigned int process_nvram_vars(char *varbuf, unsigned int len);
+
+#ifdef __cplusplus
+        }
+#endif
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/bcmwifi.h b/drivers/net/wireless/bcmdhd/include/bcmwifi.h
new file mode 100644
index 00000000000..45f3c0312dc
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/bcmwifi.h
@@ -0,0 +1,165 @@
+/*
+ * Misc utility routines for WL and Apps
+ * This header file housing the define and function prototype use by
+ * both the wl driver, tools & Apps.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmwifi.h,v 1.29.6.3 2010-08-03 17:47:04 Exp $
+ */
+
+
+#ifndef _bcmwifi_h_
+#define _bcmwifi_h_
+
+
+
+typedef uint16 chanspec_t;
+
+
+#define CH_UPPER_SB                     0x01
+#define CH_LOWER_SB                     0x02
+#define CH_EWA_VALID                    0x04
+#define CH_20MHZ_APART                  4
+#define CH_10MHZ_APART                  2
+#define CH_5MHZ_APART                   1       
+#define CH_MAX_2G_CHANNEL               14      
+#define WLC_MAX_2G_CHANNEL              CH_MAX_2G_CHANNEL 
+#define MAXCHANNEL              224     
+
+#define WL_CHANSPEC_CHAN_MASK           0x00ff
+#define WL_CHANSPEC_CHAN_SHIFT          0
+
+#define WL_CHANSPEC_CTL_SB_MASK         0x0300
+#define WL_CHANSPEC_CTL_SB_SHIFT             8
+#define WL_CHANSPEC_CTL_SB_LOWER        0x0100
+#define WL_CHANSPEC_CTL_SB_UPPER        0x0200
+#define WL_CHANSPEC_CTL_SB_NONE         0x0300
+
+#define WL_CHANSPEC_BW_MASK             0x0C00
+#define WL_CHANSPEC_BW_SHIFT                10
+#define WL_CHANSPEC_BW_10               0x0400
+#define WL_CHANSPEC_BW_20               0x0800
+#define WL_CHANSPEC_BW_40               0x0C00
+
+#define WL_CHANSPEC_BAND_MASK           0xf000
+#define WL_CHANSPEC_BAND_SHIFT          12
+#define WL_CHANSPEC_BAND_5G             0x1000
+#define WL_CHANSPEC_BAND_2G             0x2000
+#define INVCHANSPEC                     255
+
+
+#define WF_CHAN_FACTOR_2_4_G            4814    
+#define WF_CHAN_FACTOR_5_G              10000   
+#define WF_CHAN_FACTOR_4_G              8000    
+
+
+#define LOWER_20_SB(channel)    (((channel) > CH_10MHZ_APART) ? ((channel) - CH_10MHZ_APART) : 0)
+#define UPPER_20_SB(channel)    (((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \
+                                ((channel) + CH_10MHZ_APART) : 0)
+#define CHSPEC_WLCBANDUNIT(chspec)      (CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX)
+#define CH20MHZ_CHSPEC(channel) (chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \
+                                WL_CHANSPEC_CTL_SB_NONE | (((channel) <= CH_MAX_2G_CHANNEL) ? \
+                                WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
+#define NEXT_20MHZ_CHAN(channel)        (((channel) < (MAXCHANNEL - CH_20MHZ_APART)) ? \
+                                        ((channel) + CH_20MHZ_APART) : 0)
+#define CH40MHZ_CHSPEC(channel, ctlsb)  (chanspec_t) \
+                                        ((channel) | (ctlsb) | WL_CHANSPEC_BW_40 | \
+                                        ((channel) <= CH_MAX_2G_CHANNEL ? WL_CHANSPEC_BAND_2G : \
+                                        WL_CHANSPEC_BAND_5G))
+#define CHSPEC_CHANNEL(chspec)  ((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK))
+#define CHSPEC_BAND(chspec)     ((chspec) & WL_CHANSPEC_BAND_MASK)
+
+
+#define CHSPEC_CTL_SB(chspec)  (chspec & WL_CHANSPEC_CTL_SB_MASK)
+#define CHSPEC_BW(chspec)      (chspec & WL_CHANSPEC_BW_MASK)
+
+#ifdef WL11N_20MHZONLY
+
+#define CHSPEC_IS10(chspec)     0
+#define CHSPEC_IS20(chspec)     1
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)     0
+#endif
+
+#else 
+
+#define CHSPEC_IS10(chspec)     (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10)
+#define CHSPEC_IS20(chspec)     (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)     (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)
+#endif
+
+#endif 
+
+#define CHSPEC_IS20_UNCOND(chspec)      (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
+
+#define CHSPEC_IS5G(chspec)     (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
+#define CHSPEC_IS2G(chspec)     (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G)
+#define CHSPEC_SB_NONE(chspec)  (((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_NONE)
+#define CHSPEC_SB_UPPER(chspec) (((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_UPPER)
+#define CHSPEC_SB_LOWER(chspec) (((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_LOWER)
+#define CHSPEC_CTL_CHAN(chspec)  ((CHSPEC_SB_LOWER(chspec)) ? \
+                                  (LOWER_20_SB(((chspec) & WL_CHANSPEC_CHAN_MASK))) : \
+                                  (UPPER_20_SB(((chspec) & WL_CHANSPEC_CHAN_MASK))))
+#define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS5G(chspec) ? WLC_BAND_5G : WLC_BAND_2G)
+
+#define CHANSPEC_STR_LEN    8
+
+
+#define WLC_MAXRATE     108     
+#define WLC_RATE_1M     2       
+#define WLC_RATE_2M     4       
+#define WLC_RATE_5M5    11      
+#define WLC_RATE_11M    22      
+#define WLC_RATE_6M     12      
+#define WLC_RATE_9M     18      
+#define WLC_RATE_12M    24      
+#define WLC_RATE_18M    36      
+#define WLC_RATE_24M    48      
+#define WLC_RATE_36M    72      
+#define WLC_RATE_48M    96      
+#define WLC_RATE_54M    108     
+
+#define WLC_2G_25MHZ_OFFSET             5       
+
+
+extern char * wf_chspec_ntoa(chanspec_t chspec, char *buf);
+
+
+extern chanspec_t wf_chspec_aton(char *a);
+
+
+extern bool wf_chspec_malformed(chanspec_t chanspec);
+
+
+extern uint8 wf_chspec_ctlchan(chanspec_t chspec);
+
+
+extern chanspec_t wf_chspec_ctlchspec(chanspec_t chspec);
+
+
+extern int wf_mhz2channel(uint freq, uint start_factor);
+
+
+extern int wf_channel2mhz(uint channel, uint start_factor);
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/dhdioctl.h b/drivers/net/wireless/bcmdhd/include/dhdioctl.h
new file mode 100644
index 00000000000..9661dac2603
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/dhdioctl.h
@@ -0,0 +1,129 @@
+/*
+ * Definitions for ioctls to access DHD iovars.
+ * Based on wlioctl.h (for Broadcom 802.11abg driver).
+ * (Moves towards generic ioctls for BCM drivers/iovars.)
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhdioctl.h,v 13.11.10.1 2010-12-22 23:47:26 Exp $
+ */
+
+#ifndef _dhdioctl_h_
+#define _dhdioctl_h_
+
+#include <typedefs.h>
+
+
+/* require default structure packing */
+#define BWL_DEFAULT_PACKING
+#include <packed_section_start.h>
+
+
+/* Linux network driver ioctl encoding */
+typedef struct dhd_ioctl {
+        uint cmd;       /* common ioctl definition */
+        void *buf;      /* pointer to user buffer */
+        uint len;       /* length of user buffer */
+        bool set;       /* get or set request (optional) */
+        uint used;      /* bytes read or written (optional) */
+        uint needed;    /* bytes needed (optional) */
+        uint driver;    /* to identify target driver */
+} dhd_ioctl_t;
+
+/* Underlying BUS definition */
+enum {
+        BUS_TYPE_USB = 0, /* for USB dongles */
+        BUS_TYPE_SDIO /* for SDIO dongles */
+};
+
+/* per-driver magic numbers */
+#define DHD_IOCTL_MAGIC         0x00444944
+
+/* bump this number if you change the ioctl interface */
+#define DHD_IOCTL_VERSION       1
+
+#define DHD_IOCTL_MAXLEN        8192            /* max length ioctl buffer required */
+#define DHD_IOCTL_SMLEN         256             /* "small" length ioctl buffer required */
+
+/* common ioctl definitions */
+#define DHD_GET_MAGIC                           0
+#define DHD_GET_VERSION                         1
+#define DHD_GET_VAR                             2
+#define DHD_SET_VAR                             3
+
+/* message levels */
+#define DHD_ERROR_VAL   0x0001
+#define DHD_TRACE_VAL   0x0002
+#define DHD_INFO_VAL    0x0004
+#define DHD_DATA_VAL    0x0008
+#define DHD_CTL_VAL     0x0010
+#define DHD_TIMER_VAL   0x0020
+#define DHD_HDRS_VAL    0x0040
+#define DHD_BYTES_VAL   0x0080
+#define DHD_INTR_VAL    0x0100
+#define DHD_LOG_VAL     0x0200
+#define DHD_GLOM_VAL    0x0400
+#define DHD_EVENT_VAL   0x0800
+#define DHD_BTA_VAL     0x1000
+#define DHD_ISCAN_VAL   0x2000
+#define DHD_ARPOE_VAL   0x4000
+
+#ifdef SDTEST
+/* For pktgen iovar */
+typedef struct dhd_pktgen {
+        uint version;           /* To allow structure change tracking */
+        uint freq;              /* Max ticks between tx/rx attempts */
+        uint count;             /* Test packets to send/rcv each attempt */
+        uint print;             /* Print counts every <print> attempts */
+        uint total;             /* Total packets (or bursts) */
+        uint minlen;            /* Minimum length of packets to send */
+        uint maxlen;            /* Maximum length of packets to send */
+        uint numsent;           /* Count of test packets sent */
+        uint numrcvd;           /* Count of test packets received */
+        uint numfail;           /* Count of test send failures */
+        uint mode;              /* Test mode (type of test packets) */
+        uint stop;              /* Stop after this many tx failures */
+} dhd_pktgen_t;
+
+/* Version in case structure changes */
+#define DHD_PKTGEN_VERSION 2
+
+/* Type of test packets to use */
+#define DHD_PKTGEN_ECHO         1 /* Send echo requests */
+#define DHD_PKTGEN_SEND         2 /* Send discard packets */
+#define DHD_PKTGEN_RXBURST      3 /* Request dongle send N packets */
+#define DHD_PKTGEN_RECV         4 /* Continuous rx from continuous tx dongle */
+#endif /* SDTEST */
+
+/* Enter idle immediately (no timeout) */
+#define DHD_IDLE_IMMEDIATE      (-1)
+
+/* Values for idleclock iovar: other values are the sd_divisor to use when idle */
+#define DHD_IDLE_ACTIVE 0       /* Do not request any SD clock change when idle */
+#define DHD_IDLE_STOP   (-1)    /* Request SD clock be stopped (and use SD1 mode) */
+
+
+/* require default structure packing */
+#include <packed_section_end.h>
+
+#endif /* _dhdioctl_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/epivers.h b/drivers/net/wireless/bcmdhd/include/epivers.h
new file mode 100644
index 00000000000..ae1f975bdb6
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/epivers.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: epivers.h.in,v 13.32.4.1 2010-09-17 00:39:18 $
+ *
+*/
+
+
+#ifndef _epivers_h_
+#define _epivers_h_
+
+#define EPI_MAJOR_VERSION       5
+
+#define EPI_MINOR_VERSION       90
+
+#define EPI_RC_NUMBER           125
+
+#define EPI_INCREMENTAL_NUMBER  94
+
+#define EPI_BUILD_NUMBER        0
+
+#define EPI_VERSION             5, 90, 125, 94
+
+#define EPI_VERSION_NUM         0x055a7d5e
+
+#define EPI_VERSION_DEV         5.90.125
+
+
+#define EPI_VERSION_STR         "5.90.125.94"
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/hndpmu.h b/drivers/net/wireless/bcmdhd/include/hndpmu.h
new file mode 100644
index 00000000000..51c51b9734a
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/hndpmu.h
@@ -0,0 +1,34 @@
+/*
+ * HND SiliconBackplane PMU support.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: hndpmu.h,v 13.35.8.5 2011-02-11 00:56:32 Exp $
+ */
+
+#ifndef _hndpmu_h_
+#define _hndpmu_h_
+
+
+extern void si_pmu_otp_power(si_t *sih, osl_t *osh, bool on);
+extern void si_sdiod_drive_strength_init(si_t *sih, osl_t *osh, uint32 drivestrength);
+
+#endif /* _hndpmu_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/hndrte_armtrap.h b/drivers/net/wireless/bcmdhd/include/hndrte_armtrap.h
new file mode 100644
index 00000000000..8b9615c35f3
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/hndrte_armtrap.h
@@ -0,0 +1,88 @@
+/*
+ * HNDRTE arm trap handling.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: hndrte_armtrap.h,v 13.4.14.1 2011-02-05 00:04:30 Exp $
+ */
+
+#ifndef _hndrte_armtrap_h
+#define _hndrte_armtrap_h
+
+
+/* ARM trap handling */
+
+/* Trap types defined by ARM (see arminc.h) */
+
+/* Trap locations in lo memory */
+#define TRAP_STRIDE     4
+#define FIRST_TRAP      TR_RST
+#define LAST_TRAP       (TR_FIQ * TRAP_STRIDE)
+
+#if defined(__ARM_ARCH_4T__)
+#define MAX_TRAP_TYPE   (TR_FIQ + 1)
+#elif defined(__ARM_ARCH_7M__)
+#define MAX_TRAP_TYPE   (TR_ISR + ARMCM3_NUMINTS)
+#endif  /* __ARM_ARCH_7M__ */
+
+/* The trap structure is defined here as offsets for assembly */
+#define TR_TYPE         0x00
+#define TR_EPC          0x04
+#define TR_CPSR         0x08
+#define TR_SPSR         0x0c
+#define TR_REGS         0x10
+#define TR_REG(n)       (TR_REGS + (n) * 4)
+#define TR_SP           TR_REG(13)
+#define TR_LR           TR_REG(14)
+#define TR_PC           TR_REG(15)
+
+#define TRAP_T_SIZE     80
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+#include <typedefs.h>
+
+typedef struct _trap_struct {
+        uint32          type;
+        uint32          epc;
+        uint32          cpsr;
+        uint32          spsr;
+        uint32          r0;
+        uint32          r1;
+        uint32          r2;
+        uint32          r3;
+        uint32          r4;
+        uint32          r5;
+        uint32          r6;
+        uint32          r7;
+        uint32          r8;
+        uint32          r9;
+        uint32          r10;
+        uint32          r11;
+        uint32          r12;
+        uint32          r13;
+        uint32          r14;
+        uint32          pc;
+} trap_t;
+
+#endif  /* !_LANGUAGE_ASSEMBLY */
+
+#endif  /* _hndrte_armtrap_h */
diff --git a/drivers/net/wireless/bcmdhd/include/hndrte_cons.h b/drivers/net/wireless/bcmdhd/include/hndrte_cons.h
new file mode 100644
index 00000000000..b9ede53af70
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/hndrte_cons.h
@@ -0,0 +1,68 @@
+/*
+ * Console support for hndrte.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: hndrte_cons.h,v 13.4.10.4 2011-02-05 00:08:20 Exp $
+ */
+
+#ifndef _HNDRTE_CONS_H
+#define _HNDRTE_CONS_H
+
+#include <typedefs.h>
+
+#define CBUF_LEN        (128)
+
+#define LOG_BUF_LEN     1024
+
+typedef struct {
+        uint32          buf;            /* Can't be pointer on (64-bit) hosts */
+        uint            buf_size;
+        uint            idx;
+        char            *_buf_compat;   /* redundant pointer for backward compat. */
+} hndrte_log_t;
+
+typedef struct {
+        /* Virtual UART
+         *   When there is no UART (e.g. Quickturn), the host should write a complete
+         *   input line directly into cbuf and then write the length into vcons_in.
+         *   This may also be used when there is a real UART (at risk of conflicting with
+         *   the real UART).  vcons_out is currently unused.
+         */
+        volatile uint   vcons_in;
+        volatile uint   vcons_out;
+
+        /* Output (logging) buffer
+         *   Console output is written to a ring buffer log_buf at index log_idx.
+         *   The host may read the output when it sees log_idx advance.
+         *   Output will be lost if the output wraps around faster than the host polls.
+         */
+        hndrte_log_t    log;
+
+        /* Console input line buffer
+         *   Characters are read one at a time into cbuf until <CR> is received, then
+         *   the buffer is processed as a command line.  Also used for virtual UART.
+         */
+        uint            cbuf_idx;
+        char            cbuf[CBUF_LEN];
+} hndrte_cons_t;
+
+#endif /* _HNDRTE_CONS_H */
diff --git a/drivers/net/wireless/bcmdhd/include/hndsoc.h b/drivers/net/wireless/bcmdhd/include/hndsoc.h
new file mode 100644
index 00000000000..4e26121c388
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/hndsoc.h
@@ -0,0 +1,207 @@
+/*
+ * Broadcom HND chip & on-chip-interconnect-related definitions.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: hndsoc.h,v 13.11 2009-12-03 23:52:31 Exp $
+ */
+
+#ifndef _HNDSOC_H
+#define _HNDSOC_H
+
+/* Include the soci specific files */
+#include <sbconfig.h>
+#include <aidmp.h>
+
+/*
+ * SOC Interconnect Address Map.
+ * All regions may not exist on all chips.
+ */
+#define SI_SDRAM_BASE           0x00000000      /* Physical SDRAM */
+#define SI_PCI_MEM              0x08000000      /* Host Mode sb2pcitranslation0 (64 MB) */
+#define SI_PCI_MEM_SZ           (64 * 1024 * 1024)
+#define SI_PCI_CFG              0x0c000000      /* Host Mode sb2pcitranslation1 (64 MB) */
+#define SI_SDRAM_SWAPPED        0x10000000      /* Byteswapped Physical SDRAM */
+#define SI_SDRAM_R2             0x80000000      /* Region 2 for sdram (512 MB) */
+
+#define SI_ENUM_BASE            0x18000000      /* Enumeration space base */
+
+#define SI_WRAP_BASE            0x18100000      /* Wrapper space base */
+#define SI_CORE_SIZE            0x1000          /* each core gets 4Kbytes for registers */
+#define SI_MAXCORES             16              /* Max cores (this is arbitrary, for software
+                                                 * convenience and could be changed if we
+                                                 * make any larger chips
+                                                 */
+
+#define SI_FASTRAM              0x19000000      /* On-chip RAM on chips that also have DDR */
+#define SI_FASTRAM_SWAPPED      0x19800000
+
+#define SI_FLASH2               0x1c000000      /* Flash Region 2 (region 1 shadowed here) */
+#define SI_FLASH2_SZ            0x02000000      /* Size of Flash Region 2 */
+#define SI_ARMCM3_ROM           0x1e000000      /* ARM Cortex-M3 ROM */
+#define SI_FLASH1               0x1fc00000      /* MIPS Flash Region 1 */
+#define SI_FLASH1_SZ            0x00400000      /* MIPS Size of Flash Region 1 */
+#define SI_ARM7S_ROM            0x20000000      /* ARM7TDMI-S ROM */
+#define SI_ARMCM3_SRAM2         0x60000000      /* ARM Cortex-M3 SRAM Region 2 */
+#define SI_ARM7S_SRAM2          0x80000000      /* ARM7TDMI-S SRAM Region 2 */
+#define SI_ARM_FLASH1           0xffff0000      /* ARM Flash Region 1 */
+#define SI_ARM_FLASH1_SZ        0x00010000      /* ARM Size of Flash Region 1 */
+
+#define SI_PCI_DMA              0x40000000      /* Client Mode sb2pcitranslation2 (1 GB) */
+#define SI_PCI_DMA2             0x80000000      /* Client Mode sb2pcitranslation2 (1 GB) */
+#define SI_PCI_DMA_SZ           0x40000000      /* Client Mode sb2pcitranslation2 size in bytes */
+#define SI_PCIE_DMA_L32         0x00000000      /* PCIE Client Mode sb2pcitranslation2
+                                                 * (2 ZettaBytes), low 32 bits
+                                                 */
+#define SI_PCIE_DMA_H32         0x80000000      /* PCIE Client Mode sb2pcitranslation2
+                                                 * (2 ZettaBytes), high 32 bits
+                                                 */
+
+/* core codes */
+#define NODEV_CORE_ID           0x700           /* Invalid coreid */
+#define CC_CORE_ID              0x800           /* chipcommon core */
+#define ILINE20_CORE_ID         0x801           /* iline20 core */
+#define SRAM_CORE_ID            0x802           /* sram core */
+#define SDRAM_CORE_ID           0x803           /* sdram core */
+#define PCI_CORE_ID             0x804           /* pci core */
+#define MIPS_CORE_ID            0x805           /* mips core */
+#define ENET_CORE_ID            0x806           /* enet mac core */
+#define CODEC_CORE_ID           0x807           /* v90 codec core */
+#define USB_CORE_ID             0x808           /* usb 1.1 host/device core */
+#define ADSL_CORE_ID            0x809           /* ADSL core */
+#define ILINE100_CORE_ID        0x80a           /* iline100 core */
+#define IPSEC_CORE_ID           0x80b           /* ipsec core */
+#define UTOPIA_CORE_ID          0x80c           /* utopia core */
+#define PCMCIA_CORE_ID          0x80d           /* pcmcia core */
+#define SOCRAM_CORE_ID          0x80e           /* internal memory core */
+#define MEMC_CORE_ID            0x80f           /* memc sdram core */
+#define OFDM_CORE_ID            0x810           /* OFDM phy core */
+#define EXTIF_CORE_ID           0x811           /* external interface core */
+#define D11_CORE_ID             0x812           /* 802.11 MAC core */
+#define APHY_CORE_ID            0x813           /* 802.11a phy core */
+#define BPHY_CORE_ID            0x814           /* 802.11b phy core */
+#define GPHY_CORE_ID            0x815           /* 802.11g phy core */
+#define MIPS33_CORE_ID          0x816           /* mips3302 core */
+#define USB11H_CORE_ID          0x817           /* usb 1.1 host core */
+#define USB11D_CORE_ID          0x818           /* usb 1.1 device core */
+#define USB20H_CORE_ID          0x819           /* usb 2.0 host core */
+#define USB20D_CORE_ID          0x81a           /* usb 2.0 device core */
+#define SDIOH_CORE_ID           0x81b           /* sdio host core */
+#define ROBO_CORE_ID            0x81c           /* roboswitch core */
+#define ATA100_CORE_ID          0x81d           /* parallel ATA core */
+#define SATAXOR_CORE_ID         0x81e           /* serial ATA & XOR DMA core */
+#define GIGETH_CORE_ID          0x81f           /* gigabit ethernet core */
+#define PCIE_CORE_ID            0x820           /* pci express core */
+#define NPHY_CORE_ID            0x821           /* 802.11n 2x2 phy core */
+#define SRAMC_CORE_ID           0x822           /* SRAM controller core */
+#define MINIMAC_CORE_ID         0x823           /* MINI MAC/phy core */
+#define ARM11_CORE_ID           0x824           /* ARM 1176 core */
+#define ARM7S_CORE_ID           0x825           /* ARM7tdmi-s core */
+#define LPPHY_CORE_ID           0x826           /* 802.11a/b/g phy core */
+#define PMU_CORE_ID             0x827           /* PMU core */
+#define SSNPHY_CORE_ID          0x828           /* 802.11n single-stream phy core */
+#define SDIOD_CORE_ID           0x829           /* SDIO device core */
+#define ARMCM3_CORE_ID          0x82a           /* ARM Cortex M3 core */
+#define HTPHY_CORE_ID           0x82b           /* 802.11n 4x4 phy core */
+#define MIPS74K_CORE_ID         0x82c           /* mips 74k core */
+#define GMAC_CORE_ID            0x82d           /* Gigabit MAC core */
+#define DMEMC_CORE_ID           0x82e           /* DDR1/2 memory controller core */
+#define PCIERC_CORE_ID          0x82f           /* PCIE Root Complex core */
+#define OCP_CORE_ID             0x830           /* OCP2OCP bridge core */
+#define SC_CORE_ID              0x831           /* shared common core */
+#define AHB_CORE_ID             0x832           /* OCP2AHB bridge core */
+#define SPIH_CORE_ID            0x833           /* SPI host core */
+#define I2S_CORE_ID             0x834           /* I2S core */
+#define DMEMS_CORE_ID           0x835           /* SDR/DDR1 memory controller core */
+#define DEF_SHIM_COMP           0x837           /* SHIM component in ubus/6362 */
+#define OOB_ROUTER_CORE_ID      0x367           /* OOB router core ID */
+#define DEF_AI_COMP             0xfff           /* Default component, in ai chips it maps all
+                                                 * unused address ranges
+                                                 */
+
+/* There are TWO constants on all HND chips: SI_ENUM_BASE above,
+ * and chipcommon being the first core:
+ */
+#define SI_CC_IDX               0
+
+/* SOC Interconnect types (aka chip types) */
+#define SOCI_SB                 0
+#define SOCI_AI                 1
+#define SOCI_UBUS               2
+
+/* Common core control flags */
+#define SICF_BIST_EN            0x8000
+#define SICF_PME_EN             0x4000
+#define SICF_CORE_BITS          0x3ffc
+#define SICF_FGC                0x0002
+#define SICF_CLOCK_EN           0x0001
+
+/* Common core status flags */
+#define SISF_BIST_DONE          0x8000
+#define SISF_BIST_ERROR         0x4000
+#define SISF_GATED_CLK          0x2000
+#define SISF_DMA64              0x1000
+#define SISF_CORE_BITS          0x0fff
+
+/* A register that is common to all cores to
+ * communicate w/PMU regarding clock control.
+ */
+#define SI_CLK_CTL_ST           0x1e0           /* clock control and status */
+
+/* clk_ctl_st register */
+#define CCS_FORCEALP            0x00000001      /* force ALP request */
+#define CCS_FORCEHT             0x00000002      /* force HT request */
+#define CCS_FORCEILP            0x00000004      /* force ILP request */
+#define CCS_ALPAREQ             0x00000008      /* ALP Avail Request */
+#define CCS_HTAREQ              0x00000010      /* HT Avail Request */
+#define CCS_FORCEHWREQOFF       0x00000020      /* Force HW Clock Request Off */
+#define CCS_ERSRC_REQ_MASK      0x00000700      /* external resource requests */
+#define CCS_ERSRC_REQ_SHIFT     8
+#define CCS_ALPAVAIL            0x00010000      /* ALP is available */
+#define CCS_HTAVAIL             0x00020000      /* HT is available */
+#define CCS_BP_ON_APL           0x00040000      /* RO: Backplane is running on ALP clock */
+#define CCS_BP_ON_HT            0x00080000      /* RO: Backplane is running on HT clock */
+#define CCS_ERSRC_STS_MASK      0x07000000      /* external resource status */
+#define CCS_ERSRC_STS_SHIFT     24
+
+#define CCS0_HTAVAIL            0x00010000      /* HT avail in chipc and pcmcia on 4328a0 */
+#define CCS0_ALPAVAIL           0x00020000      /* ALP avail in chipc and pcmcia on 4328a0 */
+
+/* Not really related to SOC Interconnect, but a couple of software
+ * conventions for the use the flash space:
+ */
+
+/* Minumum amount of flash we support */
+#define FLASH_MIN               0x00020000      /* Minimum flash size */
+
+/* A boot/binary may have an embedded block that describes its size  */
+#define BISZ_OFFSET             0x3e0           /* At this offset into the binary */
+#define BISZ_MAGIC              0x4249535a      /* Marked with this value: 'BISZ' */
+#define BISZ_MAGIC_IDX          0               /* Word 0: magic */
+#define BISZ_TXTST_IDX          1               /*      1: text start */
+#define BISZ_TXTEND_IDX         2               /*      2: text end */
+#define BISZ_DATAST_IDX         3               /*      3: data start */
+#define BISZ_DATAEND_IDX        4               /*      4: data end */
+#define BISZ_BSSST_IDX          5               /*      5: bss start */
+#define BISZ_BSSEND_IDX         6               /*      6: bss end */
+#define BISZ_SIZE               7               /* descriptor size in 32-bit integers */
+
+#endif /* _HNDSOC_H */
diff --git a/drivers/net/wireless/bcmdhd/include/htsf.h b/drivers/net/wireless/bcmdhd/include/htsf.h
new file mode 100644
index 00000000000..379fbbe37db
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/htsf.h
@@ -0,0 +1,74 @@
+/*
+ * Time stamps for latency measurements 
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: htsf.h,v 1.1.2.4 2011-01-21 08:27:03 Exp $
+ */
+#ifndef _HTSF_H_
+#define _HTSF_H_
+
+#define HTSFMAGIC               0xCDCDABAB  /* in network order for tcpdump  */
+#define HTSFENDMAGIC            0xEFEFABAB  /* to distinguish from RT2 magic */
+#define HTSF_HOSTOFFSET         102
+#define HTSF_DNGLOFFSET         HTSF_HOSTOFFSET - 4
+#define HTSF_DNGLOFFSET2        HTSF_HOSTOFFSET + 106
+#define HTSF_MIN_PKTLEN         200
+#define ETHER_TYPE_BRCM_PKTDLYSTATS     0x886d
+
+typedef enum htsfts_type {
+        T10,
+        T20,
+        T30,
+        T40,
+        T50,
+        T60,
+        T70,
+        T80,
+        T90,
+        TA0,
+        TE0
+} htsf_timestamp_t;
+
+typedef struct {
+        uint32 magic;
+        uint32 prio;
+        uint32 seqnum;
+        uint32 misc;
+        uint32 c10;
+        uint32 t10;
+        uint32 c20;
+        uint32 t20;
+        uint32 t30;
+        uint32 t40;
+        uint32 t50;
+        uint32 t60;
+        uint32 t70;
+        uint32 t80;
+        uint32 t90;
+        uint32 cA0;
+        uint32 tA0;
+        uint32 cE0;
+        uint32 tE0;
+        uint32 endmagic;
+} htsfts_t;
+
+#endif /* _HTSF_H_ */
diff --git a/drivers/net/wireless/bcmdhd/include/linux_osl.h b/drivers/net/wireless/bcmdhd/include/linux_osl.h
new file mode 100644
index 00000000000..1ec136eb70d
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/linux_osl.h
@@ -0,0 +1,431 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: linux_osl.h,v 13.158.6.3 2010-12-22 23:47:26 Exp $
+ */
+
+
+#ifndef _linux_osl_h_
+#define _linux_osl_h_
+
+#include <typedefs.h>
+
+
+extern void * osl_os_open_image(char * filename);
+extern int osl_os_get_image_block(char * buf, int len, void * image);
+extern void osl_os_close_image(void * image);
+
+
+#ifdef BCMDRIVER
+
+
+extern osl_t *osl_attach(void *pdev, uint bustype, bool pkttag);
+extern void osl_detach(osl_t *osh);
+
+
+extern uint32 g_assert_type;
+
+
+#if defined(BCMASSERT_LOG)
+        #define ASSERT(exp) \
+          do { if (!(exp)) osl_assert(#exp, __FILE__, __LINE__); } while (0)
+extern void osl_assert(char *exp, char *file, int line);
+#else
+        #ifdef __GNUC__
+                #define GCC_VERSION \
+                        (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+                #if GCC_VERSION > 30100
+                        #define ASSERT(exp)     do {} while (0)
+                #else
+                        
+                        #define ASSERT(exp)
+                #endif 
+        #endif 
+#endif 
+
+
+#define OSL_DELAY(usec)         osl_delay(usec)
+extern void osl_delay(uint usec);
+
+#define OSL_PCMCIA_READ_ATTR(osh, offset, buf, size) \
+        osl_pcmcia_read_attr((osh), (offset), (buf), (size))
+#define OSL_PCMCIA_WRITE_ATTR(osh, offset, buf, size) \
+        osl_pcmcia_write_attr((osh), (offset), (buf), (size))
+extern void osl_pcmcia_read_attr(osl_t *osh, uint offset, void *buf, int size);
+extern void osl_pcmcia_write_attr(osl_t *osh, uint offset, void *buf, int size);
+
+
+#define OSL_PCI_READ_CONFIG(osh, offset, size) \
+        osl_pci_read_config((osh), (offset), (size))
+#define OSL_PCI_WRITE_CONFIG(osh, offset, size, val) \
+        osl_pci_write_config((osh), (offset), (size), (val))
+extern uint32 osl_pci_read_config(osl_t *osh, uint offset, uint size);
+extern void osl_pci_write_config(osl_t *osh, uint offset, uint size, uint val);
+
+
+#define OSL_PCI_BUS(osh)        osl_pci_bus(osh)
+#define OSL_PCI_SLOT(osh)       osl_pci_slot(osh)
+extern uint osl_pci_bus(osl_t *osh);
+extern uint osl_pci_slot(osl_t *osh);
+
+
+typedef struct {
+        bool pkttag;
+        uint pktalloced;        
+        bool mmbus;             
+        pktfree_cb_fn_t tx_fn;  
+        void *tx_ctx;           
+} osl_pubinfo_t;
+
+#define PKTFREESETCB(osh, _tx_fn, _tx_ctx)              \
+        do {                                            \
+           ((osl_pubinfo_t*)osh)->tx_fn = _tx_fn;       \
+           ((osl_pubinfo_t*)osh)->tx_ctx = _tx_ctx;     \
+        } while (0)
+
+
+
+#define BUS_SWAP32(v)           (v)
+
+        #define MALLOC(osh, size)       osl_malloc((osh), (size))
+        #define MFREE(osh, addr, size)  osl_mfree((osh), (addr), (size))
+        #define MALLOCED(osh)           osl_malloced((osh))
+        extern void *osl_malloc(osl_t *osh, uint size);
+        extern void osl_mfree(osl_t *osh, void *addr, uint size);
+        extern uint osl_malloced(osl_t *osh);
+
+#define NATIVE_MALLOC(osh, size)                kmalloc(size, GFP_ATOMIC)
+#define NATIVE_MFREE(osh, addr, size)   kfree(addr)
+
+#define MALLOC_FAILED(osh)      osl_malloc_failed((osh))
+extern uint osl_malloc_failed(osl_t *osh);
+
+
+#define DMA_CONSISTENT_ALIGN    osl_dma_consistent_align()
+#define DMA_ALLOC_CONSISTENT(osh, size, align, tot, pap, dmah) \
+        osl_dma_alloc_consistent((osh), (size), (align), (tot), (pap))
+#define DMA_FREE_CONSISTENT(osh, va, size, pa, dmah) \
+        osl_dma_free_consistent((osh), (void*)(va), (size), (pa))
+extern uint osl_dma_consistent_align(void);
+extern void *osl_dma_alloc_consistent(osl_t *osh, uint size, uint16 align, uint *tot, ulong *pap);
+extern void osl_dma_free_consistent(osl_t *osh, void *va, uint size, ulong pa);
+
+
+#define DMA_TX  1       
+#define DMA_RX  2       
+
+
+#define DMA_MAP(osh, va, size, direction, p, dmah) \
+        osl_dma_map((osh), (va), (size), (direction))
+#define DMA_UNMAP(osh, pa, size, direction, p, dmah) \
+        osl_dma_unmap((osh), (pa), (size), (direction))
+extern uint osl_dma_map(osl_t *osh, void *va, uint size, int direction);
+extern void osl_dma_unmap(osl_t *osh, uint pa, uint size, int direction);
+
+
+#define OSL_DMADDRWIDTH(osh, addrwidth) do {} while (0)
+
+
+        #include <bcmsdh.h>
+        #define OSL_WRITE_REG(osh, r, v) (bcmsdh_reg_write(NULL, (uintptr)(r), sizeof(*(r)), (v)))
+        #define OSL_READ_REG(osh, r) (bcmsdh_reg_read(NULL, (uintptr)(r), sizeof(*(r))))
+
+        #define SELECT_BUS_WRITE(osh, mmap_op, bus_op) if (((osl_pubinfo_t*)(osh))->mmbus) \
+                mmap_op else bus_op
+        #define SELECT_BUS_READ(osh, mmap_op, bus_op) (((osl_pubinfo_t*)(osh))->mmbus) ? \
+                mmap_op : bus_op
+
+#define OSL_ERROR(bcmerror)     osl_error(bcmerror)
+extern int osl_error(int bcmerror);
+
+
+#define PKTBUFSZ        2048   
+
+
+
+#define OSL_SYSUPTIME()         ((uint32)jiffies * (1000 / HZ))
+#define printf(fmt, args...)    printk(fmt , ## args)
+#include <linux/kernel.h>       
+#include <linux/string.h>       
+
+#define bcopy(src, dst, len)    memcpy((dst), (src), (len))
+#define bcmp(b1, b2, len)       memcmp((b1), (b2), (len))
+#define bzero(b, len)           memset((b), '\0', (len))
+
+
+
+#ifndef __mips__
+#define R_REG(osh, r) (\
+        SELECT_BUS_READ(osh, sizeof(*(r)) == sizeof(uint8) ? readb((volatile uint8*)(r)) : \
+        sizeof(*(r)) == sizeof(uint16) ? readw((volatile uint16*)(r)) : \
+        readl((volatile uint32*)(r)), OSL_READ_REG(osh, r)) \
+)
+#else 
+#define R_REG(osh, r) (\
+        SELECT_BUS_READ(osh, \
+                ({ \
+                        __typeof(*(r)) __osl_v; \
+                        __asm__ __volatile__("sync"); \
+                        switch (sizeof(*(r))) { \
+                                case sizeof(uint8):     __osl_v = \
+                                        readb((volatile uint8*)(r)); break; \
+                                case sizeof(uint16):    __osl_v = \
+                                        readw((volatile uint16*)(r)); break; \
+                                case sizeof(uint32):    __osl_v = \
+                                        readl((volatile uint32*)(r)); break; \
+                        } \
+                        __asm__ __volatile__("sync"); \
+                        __osl_v; \
+                }), \
+                ({ \
+                        __typeof(*(r)) __osl_v; \
+                        __asm__ __volatile__("sync"); \
+                        __osl_v = OSL_READ_REG(osh, r); \
+                        __asm__ __volatile__("sync"); \
+                        __osl_v; \
+                })) \
+)
+#endif 
+
+#define W_REG(osh, r, v) do { \
+        SELECT_BUS_WRITE(osh,  \
+                switch (sizeof(*(r))) { \
+                        case sizeof(uint8):     writeb((uint8)(v), (volatile uint8*)(r)); break; \
+                        case sizeof(uint16):    writew((uint16)(v), (volatile uint16*)(r)); break; \
+                        case sizeof(uint32):    writel((uint32)(v), (volatile uint32*)(r)); break; \
+                }, \
+                (OSL_WRITE_REG(osh, r, v))); \
+        } while (0)
+
+
+#define AND_REG(osh, r, v)              W_REG(osh, (r), R_REG(osh, r) & (v))
+#define OR_REG(osh, r, v)               W_REG(osh, (r), R_REG(osh, r) | (v))
+
+
+#define bcopy(src, dst, len)    memcpy((dst), (src), (len))
+#define bcmp(b1, b2, len)       memcmp((b1), (b2), (len))
+#define bzero(b, len)           memset((b), '\0', (len))
+
+
+#ifdef __mips__
+#include <asm/addrspace.h>
+#define OSL_UNCACHED(va)        ((void *)KSEG1ADDR((va)))
+#define OSL_CACHED(va)          ((void *)KSEG0ADDR((va)))
+#else
+#define OSL_UNCACHED(va)        ((void *)va)
+#define OSL_CACHED(va)          ((void *)va)
+#endif 
+
+
+#if defined(__i386__)
+#define OSL_GETCYCLES(x)        rdtscl((x))
+#else
+#define OSL_GETCYCLES(x)        ((x) = 0)
+#endif 
+
+
+#define BUSPROBE(val, addr)     ({ (val) = R_REG(NULL, (addr)); 0; })
+
+
+#if !defined(CONFIG_MMC_MSM7X00A)
+#define REG_MAP(pa, size)       ioremap_nocache((unsigned long)(pa), (unsigned long)(size))
+#else
+#define REG_MAP(pa, size)       (void *)(0)
+#endif 
+#define REG_UNMAP(va)           iounmap((va))
+
+
+#define R_SM(r)                 *(r)
+#define W_SM(r, v)              (*(r) = (v))
+#define BZERO_SM(r, len)        memset((r), '\0', (len))
+
+
+#include <linuxver.h>           
+
+
+#define PKTGET(osh, len, send)          osl_pktget((osh), (len))
+#define PKTDUP(osh, skb)                osl_pktdup((osh), (skb))
+#define PKTLIST_DUMP(osh, buf)
+#define PKTDBG_TRACE(osh, pkt, bit)
+#define PKTFREE(osh, skb, send)         osl_pktfree((osh), (skb), (send))
+#ifdef DHD_USE_STATIC_BUF
+#define PKTGET_STATIC(osh, len, send)           osl_pktget_static((osh), (len))
+#define PKTFREE_STATIC(osh, skb, send)          osl_pktfree_static((osh), (skb), (send))
+#endif
+#define PKTDATA(osh, skb)               (((struct sk_buff*)(skb))->data)
+#define PKTLEN(osh, skb)                (((struct sk_buff*)(skb))->len)
+#define PKTHEADROOM(osh, skb)           (PKTDATA(osh, skb)-(((struct sk_buff*)(skb))->head))
+#define PKTTAILROOM(osh, skb) ((((struct sk_buff*)(skb))->end)-(((struct sk_buff*)(skb))->tail))
+#define PKTNEXT(osh, skb)               (((struct sk_buff*)(skb))->next)
+#define PKTSETNEXT(osh, skb, x)         (((struct sk_buff*)(skb))->next = (struct sk_buff*)(x))
+#define PKTSETLEN(osh, skb, len)        __skb_trim((struct sk_buff*)(skb), (len))
+#define PKTPUSH(osh, skb, bytes)        skb_push((struct sk_buff*)(skb), (bytes))
+#define PKTPULL(osh, skb, bytes)        skb_pull((struct sk_buff*)(skb), (bytes))
+#define PKTTAG(skb)                     ((void*)(((struct sk_buff*)(skb))->cb))
+#define PKTALLOCED(osh)                 ((osl_pubinfo_t *)(osh))->pktalloced
+#define PKTSETPOOL(osh, skb, x, y)      do {} while (0)
+#define PKTPOOL(osh, skb)               FALSE
+#define PKTSHRINK(osh, m)               (m)
+
+#ifdef CTFPOOL
+#define CTFPOOL_REFILL_THRESH   3
+typedef struct ctfpool {
+        void            *head;
+        spinlock_t      lock;
+        uint            max_obj;
+        uint            curr_obj;
+        uint            obj_size;
+        uint            refills;
+        uint            fast_allocs;
+        uint            fast_frees;
+        uint            slow_allocs;
+} ctfpool_t;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+#define FASTBUF (1 << 4)
+#define CTFBUF  (1 << 5)
+#define PKTSETFAST(osh, skb)    ((((struct sk_buff*)(skb))->mac_len) |= FASTBUF)
+#define PKTCLRFAST(osh, skb)    ((((struct sk_buff*)(skb))->mac_len) &= (~FASTBUF))
+#define PKTSETCTF(osh, skb)     ((((struct sk_buff*)(skb))->mac_len) |= CTFBUF)
+#define PKTCLRCTF(osh, skb)     ((((struct sk_buff*)(skb))->mac_len) &= (~CTFBUF))
+#define PKTISFAST(osh, skb)     ((((struct sk_buff*)(skb))->mac_len) & FASTBUF)
+#define PKTISCTF(osh, skb)      ((((struct sk_buff*)(skb))->mac_len) & CTFBUF)
+#define PKTFAST(osh, skb)       (((struct sk_buff*)(skb))->mac_len)
+#else
+#define FASTBUF (1 << 0)
+#define CTFBUF  (1 << 1)
+#define PKTSETFAST(osh, skb)    ((((struct sk_buff*)(skb))->__unused) |= FASTBUF)
+#define PKTCLRFAST(osh, skb)    ((((struct sk_buff*)(skb))->__unused) &= (~FASTBUF))
+#define PKTSETCTF(osh, skb)     ((((struct sk_buff*)(skb))->__unused) |= CTFBUF)
+#define PKTCLRCTF(osh, skb)     ((((struct sk_buff*)(skb))->__unused) &= (~CTFBUF))
+#define PKTISFAST(osh, skb)     ((((struct sk_buff*)(skb))->__unused) & FASTBUF)
+#define PKTISCTF(osh, skb)      ((((struct sk_buff*)(skb))->__unused) & CTFBUF)
+#define PKTFAST(osh, skb)       (((struct sk_buff*)(skb))->__unused)
+#endif 
+
+#define CTFPOOLPTR(osh, skb)    (((struct sk_buff*)(skb))->sk)
+#define CTFPOOLHEAD(osh, skb)   (((ctfpool_t *)((struct sk_buff*)(skb))->sk)->head)
+
+extern void *osl_ctfpool_add(osl_t *osh);
+extern void osl_ctfpool_replenish(osl_t *osh, uint thresh);
+extern int32 osl_ctfpool_init(osl_t *osh, uint numobj, uint size);
+extern void osl_ctfpool_cleanup(osl_t *osh);
+extern void osl_ctfpool_stats(osl_t *osh, void *b);
+#endif 
+
+#ifdef HNDCTF
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+#define SKIPCT  (1 << 6)
+#define PKTSETSKIPCT(osh, skb)  (((struct sk_buff*)(skb))->mac_len |= SKIPCT)
+#define PKTCLRSKIPCT(osh, skb)  (((struct sk_buff*)(skb))->mac_len &= (~SKIPCT))
+#define PKTSKIPCT(osh, skb)     (((struct sk_buff*)(skb))->mac_len & SKIPCT)
+#else 
+#define SKIPCT  (1 << 2)
+#define PKTSETSKIPCT(osh, skb)  (((struct sk_buff*)(skb))->__unused |= SKIPCT)
+#define PKTCLRSKIPCT(osh, skb)  (((struct sk_buff*)(skb))->__unused &= (~SKIPCT))
+#define PKTSKIPCT(osh, skb)     (((struct sk_buff*)(skb))->__unused & SKIPCT)
+#endif 
+#else 
+#define PKTSETSKIPCT(osh, skb)
+#define PKTCLRSKIPCT(osh, skb)
+#define PKTSKIPCT(osh, skb)
+#endif 
+
+extern void osl_pktfree(osl_t *osh, void *skb, bool send);
+extern void *osl_pktget_static(osl_t *osh, uint len);
+extern void osl_pktfree_static(osl_t *osh, void *skb, bool send);
+
+extern void *osl_pktget(osl_t *osh, uint len);
+extern void *osl_pktdup(osl_t *osh, void *skb);
+
+
+static INLINE void *
+osl_pkt_frmnative(osl_pubinfo_t *osh, void *pkt)
+{
+        struct sk_buff *nskb;
+
+        if (osh->pkttag)
+                bzero((void*)((struct sk_buff*)pkt)->cb, OSL_PKTTAG_SZ);
+
+        
+        for (nskb = (struct sk_buff *)pkt; nskb; nskb = nskb->next) {
+                osh->pktalloced++;
+        }
+
+        return (void *)pkt;
+}
+#define PKTFRMNATIVE(osh, skb)  osl_pkt_frmnative(((osl_pubinfo_t *)osh), (struct sk_buff*)(skb))
+
+
+static INLINE struct sk_buff *
+osl_pkt_tonative(osl_pubinfo_t *osh, void *pkt)
+{
+        struct sk_buff *nskb;
+
+        if (osh->pkttag)
+                bzero(((struct sk_buff*)pkt)->cb, OSL_PKTTAG_SZ);
+
+        
+        for (nskb = (struct sk_buff *)pkt; nskb; nskb = nskb->next) {
+                osh->pktalloced--;
+        }
+
+        return (struct sk_buff *)pkt;
+}
+#define PKTTONATIVE(osh, pkt)           osl_pkt_tonative((osl_pubinfo_t *)(osh), (pkt))
+
+#define PKTLINK(skb)                    (((struct sk_buff*)(skb))->prev)
+#define PKTSETLINK(skb, x)              (((struct sk_buff*)(skb))->prev = (struct sk_buff*)(x))
+#define PKTPRIO(skb)                    (((struct sk_buff*)(skb))->priority)
+#define PKTSETPRIO(skb, x)              (((struct sk_buff*)(skb))->priority = (x))
+#define PKTSUMNEEDED(skb)               (((struct sk_buff*)(skb))->ip_summed == CHECKSUM_HW)
+#define PKTSETSUMGOOD(skb, x)           (((struct sk_buff*)(skb))->ip_summed = \
+                                                ((x) ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE))
+
+#define PKTSHARED(skb)                  (((struct sk_buff*)(skb))->cloned)
+
+
+
+#else 
+
+
+
+        #define ASSERT(exp)     do {} while (0)
+
+
+#define MALLOC(o, l) malloc(l)
+#define MFREE(o, p, l) free(p)
+#include <stdlib.h>
+
+
+#include <string.h>
+
+
+#include <stdio.h>
+
+
+extern void bcopy(const void *src, void *dst, size_t len);
+extern int bcmp(const void *b1, const void *b2, size_t len);
+extern void bzero(void *b, size_t len);
+#endif 
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/linuxver.h b/drivers/net/wireless/bcmdhd/include/linuxver.h
new file mode 100644
index 00000000000..96844db2f05
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/linuxver.h
@@ -0,0 +1,593 @@
+/*
+ * Linux-specific abstractions to gain some independence from linux kernel versions.
+ * Pave over some 2.2 versus 2.4 versus 2.6 kernel differences.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: linuxver.h,v 13.53.2.2 2010-12-22 23:47:26 Exp $
+ */
+
+
+#ifndef _linuxver_h_
+#define _linuxver_h_
+
+#include <linux/version.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+#include <linux/config.h>
+#else
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 33))
+#include <generated/autoconf.h>
+#else
+#include <linux/autoconf.h>
+#endif
+#endif 
+#include <linux/module.h>
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 0))
+
+#ifdef __UNDEF_NO_VERSION__
+#undef __NO_VERSION__
+#else
+#define __NO_VERSION__
+#endif
+#endif  
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
+#define module_param(_name_, _type_, _perm_)    MODULE_PARM(_name_, "i")
+#define module_param_string(_name_, _string_, _size_, _perm_) \
+                MODULE_PARM(_string_, "c" __MODULE_STRING(_size_))
+#endif
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 9))
+#include <linux/malloc.h>
+#else
+#include <linux/slab.h>
+#endif
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/netdevice.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+#include <linux/semaphore.h>
+#endif 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28))
+#undef IP_TOS
+#endif 
+#include <asm/io.h>
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 41))
+#include <linux/workqueue.h>
+#else
+#include <linux/tqueue.h>
+#ifndef work_struct
+#define work_struct tq_struct
+#endif
+#ifndef INIT_WORK
+#define INIT_WORK(_work, _func, _data) INIT_TQUEUE((_work), (_func), (_data))
+#endif
+#ifndef schedule_work
+#define schedule_work(_work) schedule_task((_work))
+#endif
+#ifndef flush_scheduled_work
+#define flush_scheduled_work() flush_scheduled_tasks()
+#endif
+#endif  
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+#define MY_INIT_WORK(_work, _func)      INIT_WORK(_work, _func)
+#else
+#define MY_INIT_WORK(_work, _func)      INIT_WORK(_work, _func, _work)
+typedef void (*work_func_t)(void *work);
+#endif  
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+
+#ifndef IRQ_NONE
+typedef void irqreturn_t;
+#define IRQ_NONE
+#define IRQ_HANDLED
+#define IRQ_RETVAL(x)
+#endif
+#else
+typedef irqreturn_t(*FN_ISR) (int irq, void *dev_id, struct pt_regs *ptregs);
+#endif  
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#define IRQF_SHARED     SA_SHIRQ
+#endif 
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 17)
+#ifdef  CONFIG_NET_RADIO
+#define CONFIG_WIRELESS_EXT
+#endif
+#endif  
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 67)
+#define MOD_INC_USE_COUNT
+#define MOD_DEC_USE_COUNT
+#endif 
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
+#include <linux/sched.h>
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+#include <net/lib80211.h>
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+#include <linux/ieee80211.h>
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+#include <net/ieee80211.h>
+#endif
+#endif 
+
+
+#ifndef __exit
+#define __exit
+#endif
+#ifndef __devexit
+#define __devexit
+#endif
+#ifndef __devinit
+#define __devinit       __init
+#endif
+#ifndef __devinitdata
+#define __devinitdata
+#endif
+#ifndef __devexit_p
+#define __devexit_p(x)  x
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 0))
+
+#define pci_get_drvdata(dev)            (dev)->sysdata
+#define pci_set_drvdata(dev, value)     (dev)->sysdata = (value)
+
+
+
+struct pci_device_id {
+        unsigned int vendor, device;            
+        unsigned int subvendor, subdevice;      
+        unsigned int class, class_mask;         
+        unsigned long driver_data;              
+};
+
+struct pci_driver {
+        struct list_head node;
+        char *name;
+        const struct pci_device_id *id_table;   
+        int (*probe)(struct pci_dev *dev,
+                     const struct pci_device_id *id); 
+        void (*remove)(struct pci_dev *dev);    
+        void (*suspend)(struct pci_dev *dev);   
+        void (*resume)(struct pci_dev *dev);    
+};
+
+#define MODULE_DEVICE_TABLE(type, name)
+#define PCI_ANY_ID (~0)
+
+
+#define pci_module_init pci_register_driver
+extern int pci_register_driver(struct pci_driver *drv);
+extern void pci_unregister_driver(struct pci_driver *drv);
+
+#endif 
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18))
+#define pci_module_init pci_register_driver
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18))
+#ifdef MODULE
+#define module_init(x) int init_module(void) { return x(); }
+#define module_exit(x) void cleanup_module(void) { x(); }
+#else
+#define module_init(x)  __initcall(x);
+#define module_exit(x)  __exitcall(x);
+#endif
+#endif  
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)
+#define WL_USE_NETDEV_OPS
+#else
+#undef WL_USE_NETDEV_OPS
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)) && defined(CONFIG_RFKILL_INPUT)
+#define WL_CONFIG_RFKILL_INPUT
+#else
+#undef WL_CONFIG_RFKILL_INPUT
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 48))
+#define list_for_each(pos, head) \
+        for (pos = (head)->next; pos != (head); pos = pos->next)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 13))
+#define pci_resource_start(dev, bar)    ((dev)->base_address[(bar)])
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 44))
+#define pci_resource_start(dev, bar)    ((dev)->resource[(bar)].start)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 23))
+#define pci_enable_device(dev) do { } while (0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 14))
+#define net_device device
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 42))
+
+
+
+#ifndef PCI_DMA_TODEVICE
+#define PCI_DMA_TODEVICE        1
+#define PCI_DMA_FROMDEVICE      2
+#endif
+
+typedef u32 dma_addr_t;
+
+
+static inline int get_order(unsigned long size)
+{
+        int order;
+
+        size = (size-1) >> (PAGE_SHIFT-1);
+        order = -1;
+        do {
+                size >>= 1;
+                order++;
+        } while (size);
+        return order;
+}
+
+static inline void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size,
+                                         dma_addr_t *dma_handle)
+{
+        void *ret;
+        int gfp = GFP_ATOMIC | GFP_DMA;
+
+        ret = (void *)__get_free_pages(gfp, get_order(size));
+
+        if (ret != NULL) {
+                memset(ret, 0, size);
+                *dma_handle = virt_to_bus(ret);
+        }
+        return ret;
+}
+static inline void pci_free_consistent(struct pci_dev *hwdev, size_t size,
+                                       void *vaddr, dma_addr_t dma_handle)
+{
+        free_pages((unsigned long)vaddr, get_order(size));
+}
+#define pci_map_single(cookie, address, size, dir)      virt_to_bus(address)
+#define pci_unmap_single(cookie, address, size, dir)
+
+#endif 
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 43))
+
+#define dev_kfree_skb_any(a)            dev_kfree_skb(a)
+#define netif_down(dev)                 do { (dev)->start = 0; } while (0)
+
+
+#ifndef _COMPAT_NETDEVICE_H
+
+
+
+#define dev_kfree_skb_irq(a)    dev_kfree_skb(a)
+#define netif_wake_queue(dev) \
+                do { clear_bit(0, &(dev)->tbusy); mark_bh(NET_BH); } while (0)
+#define netif_stop_queue(dev)   set_bit(0, &(dev)->tbusy)
+
+static inline void netif_start_queue(struct net_device *dev)
+{
+        dev->tbusy = 0;
+        dev->interrupt = 0;
+        dev->start = 1;
+}
+
+#define netif_queue_stopped(dev)        (dev)->tbusy
+#define netif_running(dev)              (dev)->start
+
+#endif 
+
+#define netif_device_attach(dev)        netif_start_queue(dev)
+#define netif_device_detach(dev)        netif_stop_queue(dev)
+
+
+#define tasklet_struct                          tq_struct
+static inline void tasklet_schedule(struct tasklet_struct *tasklet)
+{
+        queue_task(tasklet, &tq_immediate);
+        mark_bh(IMMEDIATE_BH);
+}
+
+static inline void tasklet_init(struct tasklet_struct *tasklet,
+                                void (*func)(unsigned long),
+                                unsigned long data)
+{
+        tasklet->next = NULL;
+        tasklet->sync = 0;
+        tasklet->routine = (void (*)(void *))func;
+        tasklet->data = (void *)data;
+}
+#define tasklet_kill(tasklet)   { do {} while (0); }
+
+
+#define del_timer_sync(timer) del_timer(timer)
+
+#else
+
+#define netif_down(dev)
+
+#endif 
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 3))
+
+
+#define PREPARE_TQUEUE(_tq, _routine, _data)                    \
+        do {                                                    \
+                (_tq)->routine = _routine;                      \
+                (_tq)->data = _data;                            \
+        } while (0)
+
+
+#define INIT_TQUEUE(_tq, _routine, _data)                       \
+        do {                                                    \
+                INIT_LIST_HEAD(&(_tq)->list);                   \
+                (_tq)->sync = 0;                                \
+                PREPARE_TQUEUE((_tq), (_routine), (_data));     \
+        } while (0)
+
+#endif  
+
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 9)
+#define PCI_SAVE_STATE(a, b)    pci_save_state(a)
+#define PCI_RESTORE_STATE(a, b) pci_restore_state(a)
+#else
+#define PCI_SAVE_STATE(a, b)    pci_save_state(a, b)
+#define PCI_RESTORE_STATE(a, b) pci_restore_state(a, b)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 6))
+static inline int
+pci_save_state(struct pci_dev *dev, u32 *buffer)
+{
+        int i;
+        if (buffer) {
+                for (i = 0; i < 16; i++)
+                        pci_read_config_dword(dev, i * 4, &buffer[i]);
+        }
+        return 0;
+}
+
+static inline int
+pci_restore_state(struct pci_dev *dev, u32 *buffer)
+{
+        int i;
+
+        if (buffer) {
+                for (i = 0; i < 16; i++)
+                        pci_write_config_dword(dev, i * 4, buffer[i]);
+        }
+        
+        else {
+                for (i = 0; i < 6; i ++)
+                        pci_write_config_dword(dev,
+                                               PCI_BASE_ADDRESS_0 + (i * 4),
+                                               pci_resource_start(dev, i));
+                pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
+        }
+        return 0;
+}
+#endif 
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 19))
+#define read_c0_count() read_32bit_cp0_register(CP0_COUNT)
+#endif
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24))
+#ifndef SET_MODULE_OWNER
+#define SET_MODULE_OWNER(dev)           do {} while (0)
+#define OLD_MOD_INC_USE_COUNT           MOD_INC_USE_COUNT
+#define OLD_MOD_DEC_USE_COUNT           MOD_DEC_USE_COUNT
+#else
+#define OLD_MOD_INC_USE_COUNT           do {} while (0)
+#define OLD_MOD_DEC_USE_COUNT           do {} while (0)
+#endif
+#else 
+#ifndef SET_MODULE_OWNER
+#define SET_MODULE_OWNER(dev)           do {} while (0)
+#endif
+#ifndef MOD_INC_USE_COUNT
+#define MOD_INC_USE_COUNT                       do {} while (0)
+#endif
+#ifndef MOD_DEC_USE_COUNT
+#define MOD_DEC_USE_COUNT                       do {} while (0)
+#endif
+#define OLD_MOD_INC_USE_COUNT           MOD_INC_USE_COUNT
+#define OLD_MOD_DEC_USE_COUNT           MOD_DEC_USE_COUNT
+#endif 
+
+#ifndef SET_NETDEV_DEV
+#define SET_NETDEV_DEV(net, pdev)       do {} while (0)
+#endif
+
+#ifndef HAVE_FREE_NETDEV
+#define free_netdev(dev)                kfree(dev)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+
+#define af_packet_priv                  data
+#endif
+
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11)
+#define DRV_SUSPEND_STATE_TYPE pm_message_t
+#else
+#define DRV_SUSPEND_STATE_TYPE uint32
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+#define CHECKSUM_HW     CHECKSUM_PARTIAL
+#endif
+
+typedef struct {
+        void    *parent;  
+        struct  task_struct *p_task;
+        long    thr_pid;
+        int     prio; 
+        struct  semaphore sema;
+        bool    terminated;
+        struct  completion completed;
+} tsk_ctl_t;
+
+
+
+
+#ifdef DHD_DEBUG
+#define DBG_THR(x) printk x
+#else
+#define DBG_THR(x)
+#endif
+
+#define SMP_RD_BARRIER_DEPENDS(x) smp_rmb(x)
+
+
+#define PROC_START(thread_func, owner, tsk_ctl, flags) \
+{ \
+        sema_init(&((tsk_ctl)->sema), 0); \
+        init_completion(&((tsk_ctl)->completed)); \
+        (tsk_ctl)->parent = owner; \
+        (tsk_ctl)->terminated = FALSE; \
+        (tsk_ctl)->thr_pid = kernel_thread(thread_func, tsk_ctl, flags); \
+        if ((tsk_ctl)->thr_pid > 0) \
+                wait_for_completion(&((tsk_ctl)->completed)); \
+        DBG_THR(("%s thr:%lx started\n", __FUNCTION__, (tsk_ctl)->thr_pid)); \
+}
+
+#define PROC_STOP(tsk_ctl) \
+{ \
+        (tsk_ctl)->terminated = TRUE; \
+        smp_wmb(); \
+        up(&((tsk_ctl)->sema)); \
+        wait_for_completion(&((tsk_ctl)->completed)); \
+        DBG_THR(("%s thr:%lx terminated OK\n", __FUNCTION__, (tsk_ctl)->thr_pid)); \
+        (tsk_ctl)->thr_pid = -1; \
+}
+
+
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+#define KILL_PROC(nr, sig) \
+{ \
+struct task_struct *tsk; \
+struct pid *pid;    \
+pid = find_get_pid((pid_t)nr);    \
+tsk = pid_task(pid, PIDTYPE_PID);    \
+if (tsk) send_sig(sig, tsk, 1); \
+}
+#else
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && (LINUX_VERSION_CODE <= \
+        KERNEL_VERSION(2, 6, 30))
+#define KILL_PROC(pid, sig) \
+{ \
+        struct task_struct *tsk; \
+        tsk = find_task_by_vpid(pid); \
+        if (tsk) send_sig(sig, tsk, 1); \
+}
+#else
+#define KILL_PROC(pid, sig) \
+{ \
+        kill_proc(pid, sig, 1); \
+}
+#endif
+#endif 
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#include <linux/time.h>
+#include <linux/wait.h>
+#else
+#include <linux/sched.h>
+
+#define __wait_event_interruptible_timeout(wq, condition, ret)          \
+do {                                                                    \
+        wait_queue_t __wait;                                            \
+        init_waitqueue_entry(&__wait, current);                         \
+                                                                        \
+        add_wait_queue(&wq, &__wait);                                   \
+        for (;;) {                                                      \
+                set_current_state(TASK_INTERRUPTIBLE);                  \
+                if (condition)                                          \
+                        break;                                          \
+                if (!signal_pending(current)) {                         \
+                        ret = schedule_timeout(ret);                    \
+                        if (!ret)                                       \
+                                break;                                  \
+                        continue;                                       \
+                }                                                       \
+                ret = -ERESTARTSYS;                                     \
+                break;                                                  \
+        }                                                               \
+        current->state = TASK_RUNNING;                                  \
+        remove_wait_queue(&wq, &__wait);                                \
+} while (0)
+
+#define wait_event_interruptible_timeout(wq, condition, timeout)        \
+({                                                                      \
+        long __ret = timeout;                                           \
+        if (!(condition))                                               \
+                __wait_event_interruptible_timeout(wq, condition, __ret); \
+        __ret;                                                          \
+})
+
+#endif 
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+#define WL_DEV_IF(dev)          ((wl_if_t*)netdev_priv(dev))
+#else
+#define WL_DEV_IF(dev)          ((wl_if_t*)(dev)->priv)
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20)
+#define WL_ISR(i, d, p)         wl_isr((i), (d))
+#else
+#define WL_ISR(i, d, p)         wl_isr((i), (d), (p))
+#endif  
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+#define netdev_priv(dev) dev->priv
+#endif 
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/miniopt.h b/drivers/net/wireless/bcmdhd/include/miniopt.h
new file mode 100644
index 00000000000..f468420f534
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/miniopt.h
@@ -0,0 +1,77 @@
+/*
+ * Command line options parser.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ * $Id: miniopt.h,v 1.3 2009-01-15 00:06:54 Exp $
+ */
+
+
+#ifndef MINI_OPT_H
+#define MINI_OPT_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ---- Include Files ---------------------------------------------------- */
+/* ---- Constants and Types ---------------------------------------------- */
+
+#define MINIOPT_MAXKEY  128     /* Max options */
+typedef struct miniopt {
+
+        /* These are persistent after miniopt_init() */
+        const char* name;               /* name for prompt in error strings */
+        const char* flags;              /* option chars that take no args */
+        bool longflags;         /* long options may be flags */
+        bool opt_end;           /* at end of options (passed a "--") */
+
+        /* These are per-call to miniopt() */
+
+        int consumed;           /* number of argv entries cosumed in
+                                 * the most recent call to miniopt()
+                                 */
+        bool positional;
+        bool good_int;          /* 'val' member is the result of a sucessful
+                                 * strtol conversion of the option value
+                                 */
+        char opt;
+        char key[MINIOPT_MAXKEY];
+        char* valstr;           /* positional param, or value for the option,
+                                 * or null if the option had
+                                 * no accompanying value
+                                 */
+        uint uval;              /* strtol translation of valstr */
+        int  val;               /* strtol translation of valstr */
+} miniopt_t;
+
+void miniopt_init(miniopt_t *t, const char* name, const char* flags, bool longflags);
+int miniopt(miniopt_t *t, char **argv);
+
+
+/* ---- Variable Externs ------------------------------------------------- */
+/* ---- Function Prototypes ---------------------------------------------- */
+
+
+#ifdef __cplusplus
+        }
+#endif
+
+#endif  /* MINI_OPT_H  */
diff --git a/drivers/net/wireless/bcmdhd/include/msgtrace.h b/drivers/net/wireless/bcmdhd/include/msgtrace.h
new file mode 100644
index 00000000000..721d42100f2
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/msgtrace.h
@@ -0,0 +1,74 @@
+/*
+ * Trace messages sent over HBUS
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: msgtrace.h,v 1.4 2009-04-10 04:15:32 Exp $
+ */
+
+#ifndef _MSGTRACE_H
+#define _MSGTRACE_H
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define MSGTRACE_VERSION 1
+
+/* Message trace header */
+typedef BWL_PRE_PACKED_STRUCT struct msgtrace_hdr {
+        uint8   version;
+        uint8   spare;
+        uint16  len;    /* Len of the trace */
+        uint32  seqnum; /* Sequence number of message. Useful if the messsage has been lost
+                         * because of DMA error or a bus reset (ex: SDIO Func2)
+                         */
+        uint32  discarded_bytes;  /* Number of discarded bytes because of trace overflow  */
+        uint32  discarded_printf; /* Number of discarded printf because of trace overflow */
+} BWL_POST_PACKED_STRUCT msgtrace_hdr_t;
+
+#define MSGTRACE_HDRLEN         sizeof(msgtrace_hdr_t)
+
+/* The hbus driver generates traces when sending a trace message. This causes endless traces. 
+ * This flag must be set to TRUE in any hbus traces. The flag is reset in the function msgtrace_put.
+ * This prevents endless traces but generates hasardous lost of traces only in bus device code.
+ * It is recommendat to set this flag in macro SD_TRACE but not in SD_ERROR for avoiding missing
+ * hbus error traces. hbus error trace should not generates endless traces.
+ */
+extern bool msgtrace_hbus_trace;
+
+typedef void (*msgtrace_func_send_t)(void *hdl1, void *hdl2, uint8 *hdr,
+                                     uint16 hdrlen, uint8 *buf, uint16 buflen);
+extern void msgtrace_start(void);
+extern void msgtrace_stop(void);
+extern void msgtrace_sent(void);
+extern void msgtrace_put(char *buf, int count);
+extern void msgtrace_init(void *hdl1, void *hdl2, msgtrace_func_send_t func_send);
+extern bool msgtrace_event_enabled(void);
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif  /* _MSGTRACE_H */
diff --git a/drivers/net/wireless/bcmdhd/include/osl.h b/drivers/net/wireless/bcmdhd/include/osl.h
new file mode 100644
index 00000000000..80248ee7604
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/osl.h
@@ -0,0 +1,66 @@
+/*
+ * OS Abstraction Layer
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: osl.h,v 13.44.96.1 2010-05-20 11:09:18 Exp $
+ */
+
+
+#ifndef _osl_h_
+#define _osl_h_
+
+
+typedef struct osl_info osl_t;
+typedef struct osl_dmainfo osldma_t;
+
+#define OSL_PKTTAG_SZ   32 
+
+
+typedef void (*pktfree_cb_fn_t)(void *ctx, void *pkt, unsigned int status);
+
+
+#include <linux_osl.h>
+
+#ifndef PKTDBG_TRACE
+#define PKTDBG_TRACE(osh, pkt, bit)
+#endif
+
+
+
+#define SET_REG(osh, r, mask, val)      W_REG((osh), (r), ((R_REG((osh), r) & ~(mask)) | (val)))
+
+#ifndef AND_REG
+#define AND_REG(osh, r, v)              W_REG(osh, (r), R_REG(osh, r) & (v))
+#endif   
+
+#ifndef OR_REG
+#define OR_REG(osh, r, v)               W_REG(osh, (r), R_REG(osh, r) | (v))
+#endif   
+
+#if !defined(OSL_SYSUPTIME)
+#define OSL_SYSUPTIME() (0)
+#define OSL_SYSUPTIME_SUPPORT FALSE
+#else
+#define OSL_SYSUPTIME_SUPPORT TRUE
+#endif 
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/packed_section_end.h b/drivers/net/wireless/bcmdhd/include/packed_section_end.h
new file mode 100644
index 00000000000..5d4a8767807
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/packed_section_end.h
@@ -0,0 +1,54 @@
+/*
+ * Declare directives for structure packing. No padding will be provided
+ * between the members of packed structures, and therefore, there is no
+ * guarantee that structure members will be aligned.
+ *
+ * Declaring packed structures is compiler specific. In order to handle all
+ * cases, packed structures should be delared as:
+ *
+ * #include <packed_section_start.h>
+ *
+ * typedef BWL_PRE_PACKED_STRUCT struct foobar_t {
+ *    some_struct_members;
+ * } BWL_POST_PACKED_STRUCT foobar_t;
+ *
+ * #include <packed_section_end.h>
+ *
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ * $Id: packed_section_end.h,v 1.4 2008-12-09 23:43:22 Exp $
+ */
+
+
+
+
+#ifdef BWL_PACKED_SECTION
+        #undef BWL_PACKED_SECTION
+#else
+        #error "BWL_PACKED_SECTION is NOT defined!"
+#endif
+
+
+
+
+
+#undef  BWL_PRE_PACKED_STRUCT
+#undef  BWL_POST_PACKED_STRUCT
diff --git a/drivers/net/wireless/bcmdhd/include/packed_section_start.h b/drivers/net/wireless/bcmdhd/include/packed_section_start.h
new file mode 100644
index 00000000000..da2fed68afa
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/packed_section_start.h
@@ -0,0 +1,61 @@
+/*
+ * Declare directives for structure packing. No padding will be provided
+ * between the members of packed structures, and therefore, there is no
+ * guarantee that structure members will be aligned.
+ *
+ * Declaring packed structures is compiler specific. In order to handle all
+ * cases, packed structures should be delared as:
+ *
+ * #include <packed_section_start.h>
+ *
+ * typedef BWL_PRE_PACKED_STRUCT struct foobar_t {
+ *    some_struct_members;
+ * } BWL_POST_PACKED_STRUCT foobar_t;
+ *
+ * #include <packed_section_end.h>
+ *
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ * $Id: packed_section_start.h,v 1.4.124.1 2010-09-17 00:47:03 Exp $
+ */
+
+
+
+
+#ifdef BWL_PACKED_SECTION
+        #error "BWL_PACKED_SECTION is already defined!"
+#else
+        #define BWL_PACKED_SECTION
+#endif
+
+
+
+
+
+#if defined(__GNUC__)
+        #define BWL_PRE_PACKED_STRUCT
+        #define BWL_POST_PACKED_STRUCT  __attribute__ ((packed))
+#elif defined(__CC_ARM)
+        #define BWL_PRE_PACKED_STRUCT   __packed
+        #define BWL_POST_PACKED_STRUCT
+#else
+        #error "Unknown compiler!"
+#endif
diff --git a/drivers/net/wireless/bcmdhd/include/pcicfg.h b/drivers/net/wireless/bcmdhd/include/pcicfg.h
new file mode 100644
index 00000000000..fae063a72f1
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/pcicfg.h
@@ -0,0 +1,52 @@
+/*
+ * pcicfg.h: PCI configuration constants and structures.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: pcicfg.h,v 1.50 2009-12-07 21:56:06 Exp $
+ */
+
+
+#ifndef _h_pcicfg_
+#define _h_pcicfg_
+
+
+#define PCI_CFG_VID             0
+#define PCI_CFG_CMD             4
+#define PCI_CFG_REV             8
+#define PCI_CFG_BAR0            0x10
+#define PCI_CFG_BAR1            0x14
+#define PCI_BAR0_WIN            0x80    
+#define PCI_INT_STATUS          0x90    
+#define PCI_INT_MASK            0x94    
+
+#define PCIE_EXTCFG_OFFSET      0x100
+#define PCI_BAR0_PCIREGS_OFFSET (6 * 1024)      
+#define PCI_BAR0_PCISBR_OFFSET  (4 * 1024)      
+
+#define PCI_BAR0_WINSZ          (16 * 1024)     
+
+
+#define PCI_16KB0_PCIREGS_OFFSET (8 * 1024)     
+#define PCI_16KB0_CCREGS_OFFSET (12 * 1024)     
+#define PCI_16KBB0_WINSZ        (16 * 1024)     
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/proto/802.11.h b/drivers/net/wireless/bcmdhd/include/proto/802.11.h
new file mode 100644
index 00000000000..2342cb38314
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/802.11.h
@@ -0,0 +1,1731 @@
+/*
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * Fundamental types and constants relating to 802.11
+ *
+ * $Id: 802.11.h,v 9.260.2.6 2010-12-15 21:41:14 Exp $
+ */
+
+
+#ifndef _802_11_H_
+#define _802_11_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+#ifndef _NET_ETHERNET_H_
+#include <proto/ethernet.h>
+#endif
+
+#include <proto/wpa.h>
+
+
+#include <packed_section_start.h>
+
+
+#define DOT11_TU_TO_US          1024    
+
+
+#define DOT11_A3_HDR_LEN        24  
+#define DOT11_A4_HDR_LEN        30  
+#define DOT11_MAC_HDR_LEN       DOT11_A3_HDR_LEN    
+#define DOT11_FCS_LEN           4   
+#define DOT11_ICV_LEN           4   
+#define DOT11_ICV_AES_LEN       8   
+#define DOT11_QOS_LEN           2   
+#define DOT11_HTC_LEN           4   
+
+#define DOT11_KEY_INDEX_SHIFT       6   
+#define DOT11_IV_LEN            4   
+#define DOT11_IV_TKIP_LEN       8   
+#define DOT11_IV_AES_OCB_LEN        4   
+#define DOT11_IV_AES_CCM_LEN        8   
+#define DOT11_IV_MAX_LEN        8   
+
+
+#define DOT11_MAX_MPDU_BODY_LEN     2304    
+
+#define DOT11_MAX_MPDU_LEN      (DOT11_A4_HDR_LEN + \
+                                         DOT11_QOS_LEN + \
+                                         DOT11_IV_AES_CCM_LEN + \
+                                         DOT11_MAX_MPDU_BODY_LEN + \
+                                         DOT11_ICV_LEN + \
+                                         DOT11_FCS_LEN) 
+
+#define DOT11_MAX_SSID_LEN      32  
+
+
+#define DOT11_DEFAULT_RTS_LEN       2347    
+#define DOT11_MAX_RTS_LEN       2347    
+
+
+#define DOT11_MIN_FRAG_LEN      256 
+#define DOT11_MAX_FRAG_LEN      2346    
+#define DOT11_DEFAULT_FRAG_LEN      2346    
+
+
+#define DOT11_MIN_BEACON_PERIOD     1   
+#define DOT11_MAX_BEACON_PERIOD     0xFFFF  
+
+
+#define DOT11_MIN_DTIM_PERIOD       1   
+#define DOT11_MAX_DTIM_PERIOD       0xFF    
+
+
+#define DOT11_LLC_SNAP_HDR_LEN      8   
+#define DOT11_OUI_LEN           3   
+BWL_PRE_PACKED_STRUCT struct dot11_llc_snap_header {
+        uint8   dsap;               
+        uint8   ssap;               
+        uint8   ctl;                
+        uint8   oui[DOT11_OUI_LEN];     
+        uint16  type;               
+} BWL_POST_PACKED_STRUCT;
+
+
+#define RFC1042_HDR_LEN (ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)    
+
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_header {
+        uint16          fc;     
+        uint16          durid;      
+        struct ether_addr   a1;     
+        struct ether_addr   a2;     
+        struct ether_addr   a3;     
+        uint16          seq;        
+        struct ether_addr   a4;     
+} BWL_POST_PACKED_STRUCT;
+
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_rts_frame {
+        uint16          fc;     
+        uint16          durid;      
+        struct ether_addr   ra;     
+        struct ether_addr   ta;     
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_RTS_LEN       16      
+
+BWL_PRE_PACKED_STRUCT struct dot11_cts_frame {
+        uint16          fc;     
+        uint16          durid;      
+        struct ether_addr   ra;     
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_CTS_LEN       10      
+
+BWL_PRE_PACKED_STRUCT struct dot11_ack_frame {
+        uint16          fc;     
+        uint16          durid;      
+        struct ether_addr   ra;     
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ACK_LEN       10      
+
+BWL_PRE_PACKED_STRUCT struct dot11_ps_poll_frame {
+        uint16          fc;     
+        uint16          durid;      
+        struct ether_addr   bssid;      
+        struct ether_addr   ta;     
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_PS_POLL_LEN   16      
+
+BWL_PRE_PACKED_STRUCT struct dot11_cf_end_frame {
+        uint16          fc;     
+        uint16          durid;      
+        struct ether_addr   ra;     
+        struct ether_addr   bssid;      
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_CS_END_LEN    16      
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_wifi_vendor_specific {
+        uint8   category;
+        uint8   OUI[3];
+        uint8   type;
+        uint8   subtype;
+        uint8   data[1040];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_wifi_vendor_specific dot11_action_wifi_vendor_specific_t;
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_vs_frmhdr {
+        uint8   category;
+        uint8   OUI[3];
+        uint8   type;
+        uint8   subtype;
+        uint8   data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_vs_frmhdr dot11_action_vs_frmhdr_t;
+#define DOT11_ACTION_VS_HDR_LEN 6
+
+#define BCM_ACTION_OUI_BYTE0    0x00
+#define BCM_ACTION_OUI_BYTE1    0x90
+#define BCM_ACTION_OUI_BYTE2    0x4c
+
+
+#define DOT11_BA_CTL_POLICY_NORMAL  0x0000  
+#define DOT11_BA_CTL_POLICY_NOACK   0x0001  
+#define DOT11_BA_CTL_POLICY_MASK    0x0001  
+
+#define DOT11_BA_CTL_MTID       0x0002  
+#define DOT11_BA_CTL_COMPRESSED     0x0004  
+
+#define DOT11_BA_CTL_NUMMSDU_MASK   0x0FC0  
+#define DOT11_BA_CTL_NUMMSDU_SHIFT  6   
+
+#define DOT11_BA_CTL_TID_MASK       0xF000  
+#define DOT11_BA_CTL_TID_SHIFT      12  
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_ctl_header {
+        uint16          fc;     
+        uint16          durid;      
+        struct ether_addr   ra;     
+        struct ether_addr   ta;     
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_CTL_HDR_LEN   16      
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_bar {
+        uint16          bar_control;    
+        uint16          seqnum;     
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_BAR_LEN       4       
+
+#define DOT11_BA_BITMAP_LEN 128     
+#define DOT11_BA_CMP_BITMAP_LEN 8       
+
+BWL_PRE_PACKED_STRUCT struct dot11_ba {
+        uint16          ba_control; 
+        uint16          seqnum;     
+        uint8           bitmap[DOT11_BA_BITMAP_LEN];    
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_BA_LEN        4       
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_management_header {
+        uint16          fc;     
+        uint16          durid;      
+        struct ether_addr   da;     
+        struct ether_addr   sa;     
+        struct ether_addr   bssid;      
+        uint16          seq;        
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_MGMT_HDR_LEN  24      
+
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_bcn_prb {
+        uint32          timestamp[2];
+        uint16          beacon_interval;
+        uint16          capability;
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_BCN_PRB_LEN   12      
+#define DOT11_BCN_PRB_FIXED_LEN 12      
+
+BWL_PRE_PACKED_STRUCT struct dot11_auth {
+        uint16          alg;        
+        uint16          seq;        
+        uint16          status;     
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_AUTH_FIXED_LEN    6       
+
+BWL_PRE_PACKED_STRUCT struct dot11_assoc_req {
+        uint16          capability; 
+        uint16          listen;     
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ASSOC_REQ_FIXED_LEN   4   
+
+BWL_PRE_PACKED_STRUCT struct dot11_reassoc_req {
+        uint16          capability; 
+        uint16          listen;     
+        struct ether_addr   ap;     
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_REASSOC_REQ_FIXED_LEN 10  
+
+BWL_PRE_PACKED_STRUCT struct dot11_assoc_resp {
+        uint16          capability; 
+        uint16          status;     
+        uint16          aid;        
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ASSOC_RESP_FIXED_LEN  6   
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_measure {
+        uint8   category;
+        uint8   action;
+        uint8   token;
+        uint8   data[1];
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ACTION_MEASURE_LEN    3   
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ht_ch_width {
+        uint8   category;
+        uint8   action;
+        uint8   ch_width;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ht_mimops {
+        uint8   category;
+        uint8   action;
+        uint8   control;
+} BWL_POST_PACKED_STRUCT;
+
+#define SM_PWRSAVE_ENABLE   1
+#define SM_PWRSAVE_MODE     2
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_power_cnst {
+        uint8 id;
+        uint8 len;
+        uint8 power;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_power_cnst dot11_power_cnst_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_power_cap {
+        uint8 min;
+        uint8 max;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_power_cap dot11_power_cap_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_tpc_rep {
+        uint8 id;
+        uint8 len;
+        uint8 tx_pwr;
+        uint8 margin;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tpc_rep dot11_tpc_rep_t;
+#define DOT11_MNG_IE_TPC_REPORT_LEN 2   
+
+BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
+        uint8 id;
+        uint8 len;
+        uint8 first_channel;
+        uint8 num_channels;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_supp_channels dot11_supp_channels_t;
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_extch {
+        uint8   id;     
+        uint8   len;        
+        uint8   extch;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extch dot11_extch_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_brcm_extch {
+        uint8   id;     
+        uint8   len;        
+        uint8   oui[3];     
+        uint8   type;           
+        uint8   extch;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_brcm_extch dot11_brcm_extch_ie_t;
+
+#define BRCM_EXTCH_IE_LEN   5
+#define BRCM_EXTCH_IE_TYPE  53  
+#define DOT11_EXTCH_IE_LEN  1
+#define DOT11_EXT_CH_MASK   0x03    
+#define DOT11_EXT_CH_UPPER  0x01    
+#define DOT11_EXT_CH_LOWER  0x03    
+#define DOT11_EXT_CH_NONE   0x00    
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_frmhdr {
+        uint8   category;
+        uint8   action;
+        uint8   data[1];
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ACTION_FRMHDR_LEN 2
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_channel_switch {
+        uint8 id;   
+        uint8 len;  
+        uint8 mode; 
+        uint8 channel;  
+        uint8 count;    
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_channel_switch dot11_chan_switch_ie_t;
+
+#define DOT11_SWITCH_IE_LEN 3   
+
+#define DOT11_CSA_MODE_ADVISORY     0   
+#define DOT11_CSA_MODE_NO_TX        1   
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_switch_channel {
+        uint8   category;
+        uint8   action;
+        dot11_chan_switch_ie_t chan_switch_ie;  
+        dot11_brcm_extch_ie_t extch_ie;     
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_csa_body {
+        uint8 mode; 
+        uint8 reg;  
+        uint8 channel;  
+        uint8 count;    
+} BWL_POST_PACKED_STRUCT;
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_ext_csa {
+        uint8 id;   
+        uint8 len;  
+        struct dot11_csa_body b;    
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ext_csa dot11_ext_csa_ie_t;
+#define DOT11_EXT_CSA_IE_LEN    4   
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ext_csa {
+        uint8   category;
+        uint8   action;
+        dot11_ext_csa_ie_t chan_switch_ie;  
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11y_action_ext_csa {
+        uint8   category;
+        uint8   action;
+        struct dot11_csa_body b;    
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_coex {
+        uint8   id;
+        uint8   len;
+        uint8   info;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_coex dot11_obss_coex_t;
+#define DOT11_OBSS_COEXINFO_LEN 1   
+
+#define DOT11_OBSS_COEX_INFO_REQ        0x01
+#define DOT11_OBSS_COEX_40MHZ_INTOLERANT    0x02
+#define DOT11_OBSS_COEX_20MHZ_WIDTH_REQ 0x04
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_chanlist {
+        uint8   id;
+        uint8   len;
+        uint8   regclass;
+        uint8   chanlist[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_chanlist dot11_obss_chanlist_t;
+#define DOT11_OBSS_CHANLIST_FIXED_LEN   1   
+
+BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
+        uint8 id;
+        uint8 len;
+        uint8 cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extcap_ie dot11_extcap_ie_t;
+#define DOT11_EXTCAP_LEN    1
+
+
+
+#define DOT11_MEASURE_TYPE_BASIC    0   
+#define DOT11_MEASURE_TYPE_CCA      1   
+#define DOT11_MEASURE_TYPE_RPI      2   
+#define DOT11_MEASURE_TYPE_CHLOAD       3   
+#define DOT11_MEASURE_TYPE_NOISE        4   
+#define DOT11_MEASURE_TYPE_BEACON       5   
+#define DOT11_MEASURE_TYPE_FRAME    6   
+#define DOT11_MEASURE_TYPE_STATS        7   
+#define DOT11_MEASURE_TYPE_LCI      8   
+#define DOT11_MEASURE_TYPE_TXSTREAM     9   
+#define DOT11_MEASURE_TYPE_PAUSE        255 
+
+
+#define DOT11_MEASURE_MODE_PARALLEL     (1<<0)  
+#define DOT11_MEASURE_MODE_ENABLE   (1<<1)  
+#define DOT11_MEASURE_MODE_REQUEST  (1<<2)  
+#define DOT11_MEASURE_MODE_REPORT   (1<<3)  
+#define DOT11_MEASURE_MODE_DUR  (1<<4)  
+
+#define DOT11_MEASURE_MODE_LATE     (1<<0)  
+#define DOT11_MEASURE_MODE_INCAPABLE    (1<<1)  
+#define DOT11_MEASURE_MODE_REFUSED  (1<<2)  
+
+#define DOT11_MEASURE_BASIC_MAP_BSS ((uint8)(1<<0)) 
+#define DOT11_MEASURE_BASIC_MAP_OFDM    ((uint8)(1<<1)) 
+#define DOT11_MEASURE_BASIC_MAP_UKNOWN  ((uint8)(1<<2)) 
+#define DOT11_MEASURE_BASIC_MAP_RADAR   ((uint8)(1<<3)) 
+#define DOT11_MEASURE_BASIC_MAP_UNMEAS  ((uint8)(1<<4)) 
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_req {
+        uint8 id;
+        uint8 len;
+        uint8 token;
+        uint8 mode;
+        uint8 type;
+        uint8 channel;
+        uint8 start_time[8];
+        uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_req dot11_meas_req_t;
+#define DOT11_MNG_IE_MREQ_LEN 14    
+
+#define DOT11_MNG_IE_MREQ_FIXED_LEN 3   
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_rep {
+        uint8 id;
+        uint8 len;
+        uint8 token;
+        uint8 mode;
+        uint8 type;
+        BWL_PRE_PACKED_STRUCT union
+        {
+                BWL_PRE_PACKED_STRUCT struct {
+                        uint8 channel;
+                        uint8 start_time[8];
+                        uint16 duration;
+                        uint8 map;
+                } BWL_POST_PACKED_STRUCT basic;
+                uint8 data[1];
+        } BWL_POST_PACKED_STRUCT rep;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_rep dot11_meas_rep_t;
+
+
+#define DOT11_MNG_IE_MREP_FIXED_LEN 3   
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_rep_basic {
+        uint8 channel;
+        uint8 start_time[8];
+        uint16 duration;
+        uint8 map;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
+#define DOT11_MEASURE_BASIC_REP_LEN 12  
+
+BWL_PRE_PACKED_STRUCT struct dot11_quiet {
+        uint8 id;
+        uint8 len;
+        uint8 count;    
+        uint8 period;   
+        uint16 duration;    
+        uint16 offset;  
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_quiet dot11_quiet_t;
+
+BWL_PRE_PACKED_STRUCT struct chan_map_tuple {
+        uint8 channel;
+        uint8 map;
+} BWL_POST_PACKED_STRUCT;
+typedef struct chan_map_tuple chan_map_tuple_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ibss_dfs {
+        uint8 id;
+        uint8 len;
+        uint8 eaddr[ETHER_ADDR_LEN];
+        uint8 interval;
+        chan_map_tuple_t map[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ibss_dfs dot11_ibss_dfs_t;
+
+
+#define WME_OUI         "\x00\x50\xf2"  
+#define WME_OUI_LEN     3
+#define WME_OUI_TYPE        2   
+#define WME_VER         1   
+#define WME_TYPE        2   
+#define WME_SUBTYPE_IE      0   
+#define WME_SUBTYPE_PARAM_IE    1   
+#define WME_SUBTYPE_TSPEC   2   
+
+
+#define AC_BE           0   
+#define AC_BK           1   
+#define AC_VI           2   
+#define AC_VO           3   
+#define AC_COUNT        4   
+
+typedef uint8 ac_bitmap_t;  
+
+#define AC_BITMAP_NONE      0x0 
+#define AC_BITMAP_ALL       0xf 
+#define AC_BITMAP_TST(ab, ac)   (((ab) & (1 << (ac))) != 0)
+#define AC_BITMAP_SET(ab, ac)   (((ab) |= (1 << (ac))))
+#define AC_BITMAP_RESET(ab, ac) (((ab) &= ~(1 << (ac))))
+
+
+BWL_PRE_PACKED_STRUCT struct wme_ie {
+        uint8 oui[3];
+        uint8 type;
+        uint8 subtype;
+        uint8 version;
+        uint8 qosinfo;
+} BWL_POST_PACKED_STRUCT;
+typedef struct wme_ie wme_ie_t;
+#define WME_IE_LEN 7    
+
+BWL_PRE_PACKED_STRUCT struct edcf_acparam {
+        uint8   ACI;
+        uint8   ECW;
+        uint16  TXOP;       
+} BWL_POST_PACKED_STRUCT;
+typedef struct edcf_acparam edcf_acparam_t;
+
+
+BWL_PRE_PACKED_STRUCT struct wme_param_ie {
+        uint8 oui[3];
+        uint8 type;
+        uint8 subtype;
+        uint8 version;
+        uint8 qosinfo;
+        uint8 rsvd;
+        edcf_acparam_t acparam[AC_COUNT];
+} BWL_POST_PACKED_STRUCT;
+typedef struct wme_param_ie wme_param_ie_t;
+#define WME_PARAM_IE_LEN            24          
+
+
+#define WME_QI_AP_APSD_MASK         0x80        
+#define WME_QI_AP_APSD_SHIFT        7           
+#define WME_QI_AP_COUNT_MASK        0x0f        
+#define WME_QI_AP_COUNT_SHIFT       0           
+
+
+#define WME_QI_STA_MAXSPLEN_MASK    0x60        
+#define WME_QI_STA_MAXSPLEN_SHIFT   5           
+#define WME_QI_STA_APSD_ALL_MASK    0xf         
+#define WME_QI_STA_APSD_ALL_SHIFT   0           
+#define WME_QI_STA_APSD_BE_MASK     0x8         
+#define WME_QI_STA_APSD_BE_SHIFT    3           
+#define WME_QI_STA_APSD_BK_MASK     0x4         
+#define WME_QI_STA_APSD_BK_SHIFT    2           
+#define WME_QI_STA_APSD_VI_MASK     0x2         
+#define WME_QI_STA_APSD_VI_SHIFT    1           
+#define WME_QI_STA_APSD_VO_MASK     0x1         
+#define WME_QI_STA_APSD_VO_SHIFT    0           
+
+
+#define EDCF_AIFSN_MIN               1           
+#define EDCF_AIFSN_MAX               15          
+#define EDCF_AIFSN_MASK              0x0f        
+#define EDCF_ACM_MASK                0x10        
+#define EDCF_ACI_MASK                0x60        
+#define EDCF_ACI_SHIFT               5           
+#define EDCF_AIFSN_SHIFT             12          
+
+
+#define EDCF_ECW_MIN                 0           
+#define EDCF_ECW_MAX                 15          
+#define EDCF_ECW2CW(exp)             ((1 << (exp)) - 1)
+#define EDCF_ECWMIN_MASK             0x0f        
+#define EDCF_ECWMAX_MASK             0xf0        
+#define EDCF_ECWMAX_SHIFT            4           
+
+
+#define EDCF_TXOP_MIN                0           
+#define EDCF_TXOP_MAX                65535       
+#define EDCF_TXOP2USEC(txop)         ((txop) << 5)
+
+
+#define NON_EDCF_AC_BE_ACI_STA          0x02
+
+
+#define EDCF_AC_BE_ACI_STA           0x03   
+#define EDCF_AC_BE_ECW_STA           0xA4   
+#define EDCF_AC_BE_TXOP_STA          0x0000 
+#define EDCF_AC_BK_ACI_STA           0x27   
+#define EDCF_AC_BK_ECW_STA           0xA4   
+#define EDCF_AC_BK_TXOP_STA          0x0000 
+#define EDCF_AC_VI_ACI_STA           0x42   
+#define EDCF_AC_VI_ECW_STA           0x43   
+#define EDCF_AC_VI_TXOP_STA          0x005e 
+#define EDCF_AC_VO_ACI_STA           0x62   
+#define EDCF_AC_VO_ECW_STA           0x32   
+#define EDCF_AC_VO_TXOP_STA          0x002f 
+
+
+#define EDCF_AC_BE_ACI_AP            0x03   
+#define EDCF_AC_BE_ECW_AP            0x64   
+#define EDCF_AC_BE_TXOP_AP           0x0000 
+#define EDCF_AC_BK_ACI_AP            0x27   
+#define EDCF_AC_BK_ECW_AP            0xA4   
+#define EDCF_AC_BK_TXOP_AP           0x0000 
+#define EDCF_AC_VI_ACI_AP            0x41   
+#define EDCF_AC_VI_ECW_AP            0x43   
+#define EDCF_AC_VI_TXOP_AP           0x005e 
+#define EDCF_AC_VO_ACI_AP            0x61   
+#define EDCF_AC_VO_ECW_AP            0x32   
+#define EDCF_AC_VO_TXOP_AP           0x002f 
+
+
+BWL_PRE_PACKED_STRUCT struct edca_param_ie {
+        uint8 qosinfo;
+        uint8 rsvd;
+        edcf_acparam_t acparam[AC_COUNT];
+} BWL_POST_PACKED_STRUCT;
+typedef struct edca_param_ie edca_param_ie_t;
+#define EDCA_PARAM_IE_LEN            18          
+
+
+BWL_PRE_PACKED_STRUCT struct qos_cap_ie {
+        uint8 qosinfo;
+} BWL_POST_PACKED_STRUCT;
+typedef struct qos_cap_ie qos_cap_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_qbss_load_ie {
+        uint8 id;           
+        uint8 length;
+        uint16 station_count;       
+        uint8 channel_utilization;  
+        uint16 aac;             
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_qbss_load_ie dot11_qbss_load_ie_t;
+
+
+#define FIXED_MSDU_SIZE 0x8000      
+#define MSDU_SIZE_MASK  0x7fff      
+
+
+
+#define INTEGER_SHIFT   13  
+#define FRACTION_MASK   0x1FFF  
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
+        uint8 category;         
+        uint8 action;
+        uint8 token;
+        uint8 status;
+        uint8 data[1];          
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_MGMT_NOTIFICATION_LEN 4   
+
+
+#define WME_ADDTS_REQUEST   0   
+#define WME_ADDTS_RESPONSE  1   
+#define WME_DELTS_REQUEST   2   
+
+
+#define WME_ADMISSION_ACCEPTED      0   
+#define WME_INVALID_PARAMETERS      1   
+#define WME_ADMISSION_REFUSED       3   
+
+
+#define BCN_PRB_SSID(body) ((char*)(body) + DOT11_BCN_PRB_LEN)
+
+
+#define DOT11_OPEN_SYSTEM   0   
+#define DOT11_SHARED_KEY    1   
+#define DOT11_OPEN_SHARED   2   
+#define DOT11_FAST_BSS      3   
+#define DOT11_CHALLENGE_LEN 128 
+
+
+#define FC_PVER_MASK        0x3 
+#define FC_PVER_SHIFT       0   
+#define FC_TYPE_MASK        0xC 
+#define FC_TYPE_SHIFT       2   
+#define FC_SUBTYPE_MASK     0xF0    
+#define FC_SUBTYPE_SHIFT    4   
+#define FC_TODS         0x100   
+#define FC_TODS_SHIFT       8   
+#define FC_FROMDS       0x200   
+#define FC_FROMDS_SHIFT     9   
+#define FC_MOREFRAG     0x400   
+#define FC_MOREFRAG_SHIFT   10  
+#define FC_RETRY        0x800   
+#define FC_RETRY_SHIFT      11  
+#define FC_PM           0x1000  
+#define FC_PM_SHIFT     12  
+#define FC_MOREDATA     0x2000  
+#define FC_MOREDATA_SHIFT   13  
+#define FC_WEP          0x4000  
+#define FC_WEP_SHIFT        14  
+#define FC_ORDER        0x8000  
+#define FC_ORDER_SHIFT      15  
+
+
+#define SEQNUM_SHIFT        4   
+#define SEQNUM_MAX      0x1000  
+#define FRAGNUM_MASK        0xF 
+
+
+
+
+#define FC_TYPE_MNG     0   
+#define FC_TYPE_CTL     1   
+#define FC_TYPE_DATA        2   
+
+
+#define FC_SUBTYPE_ASSOC_REQ        0   
+#define FC_SUBTYPE_ASSOC_RESP       1   
+#define FC_SUBTYPE_REASSOC_REQ      2   
+#define FC_SUBTYPE_REASSOC_RESP     3   
+#define FC_SUBTYPE_PROBE_REQ        4   
+#define FC_SUBTYPE_PROBE_RESP       5   
+#define FC_SUBTYPE_BEACON       8   
+#define FC_SUBTYPE_ATIM         9   
+#define FC_SUBTYPE_DISASSOC     10  
+#define FC_SUBTYPE_AUTH         11  
+#define FC_SUBTYPE_DEAUTH       12  
+#define FC_SUBTYPE_ACTION       13  
+#define FC_SUBTYPE_ACTION_NOACK     14  
+
+
+#define FC_SUBTYPE_CTL_WRAPPER      7   
+#define FC_SUBTYPE_BLOCKACK_REQ     8   
+#define FC_SUBTYPE_BLOCKACK     9   
+#define FC_SUBTYPE_PS_POLL      10  
+#define FC_SUBTYPE_RTS          11  
+#define FC_SUBTYPE_CTS          12  
+#define FC_SUBTYPE_ACK          13  
+#define FC_SUBTYPE_CF_END       14  
+#define FC_SUBTYPE_CF_END_ACK       15  
+
+
+#define FC_SUBTYPE_DATA         0   
+#define FC_SUBTYPE_DATA_CF_ACK      1   
+#define FC_SUBTYPE_DATA_CF_POLL     2   
+#define FC_SUBTYPE_DATA_CF_ACK_POLL 3   
+#define FC_SUBTYPE_NULL         4   
+#define FC_SUBTYPE_CF_ACK       5   
+#define FC_SUBTYPE_CF_POLL      6   
+#define FC_SUBTYPE_CF_ACK_POLL      7   
+#define FC_SUBTYPE_QOS_DATA     8   
+#define FC_SUBTYPE_QOS_DATA_CF_ACK  9   
+#define FC_SUBTYPE_QOS_DATA_CF_POLL 10  
+#define FC_SUBTYPE_QOS_DATA_CF_ACK_POLL 11  
+#define FC_SUBTYPE_QOS_NULL     12  
+#define FC_SUBTYPE_QOS_CF_POLL      14  
+#define FC_SUBTYPE_QOS_CF_ACK_POLL  15  
+
+
+#define FC_SUBTYPE_ANY_QOS(s)       (((s) & 8) != 0)
+#define FC_SUBTYPE_ANY_NULL(s)      (((s) & 4) != 0)
+#define FC_SUBTYPE_ANY_CF_POLL(s)   (((s) & 2) != 0)
+#define FC_SUBTYPE_ANY_CF_ACK(s)    (((s) & 1) != 0)
+
+
+#define FC_KIND_MASK        (FC_TYPE_MASK | FC_SUBTYPE_MASK)    
+
+#define FC_KIND(t, s)   (((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))    
+
+#define FC_SUBTYPE(fc)  (((fc) & FC_SUBTYPE_MASK) >> FC_SUBTYPE_SHIFT)  
+#define FC_TYPE(fc) (((fc) & FC_TYPE_MASK) >> FC_TYPE_SHIFT)    
+
+#define FC_ASSOC_REQ    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)  
+#define FC_ASSOC_RESP   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP) 
+#define FC_REASSOC_REQ  FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)    
+#define FC_REASSOC_RESP FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)   
+#define FC_PROBE_REQ    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)  
+#define FC_PROBE_RESP   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP) 
+#define FC_BEACON   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)     
+#define FC_DISASSOC FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)   
+#define FC_AUTH     FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)       
+#define FC_DEAUTH   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)     
+#define FC_ACTION   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)     
+#define FC_ACTION_NOACK FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION_NOACK)   
+
+#define FC_CTL_WRAPPER  FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTL_WRAPPER)    
+#define FC_BLOCKACK_REQ FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK_REQ)   
+#define FC_BLOCKACK FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK)   
+#define FC_PS_POLL  FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)    
+#define FC_RTS      FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)        
+#define FC_CTS      FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)        
+#define FC_ACK      FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)        
+#define FC_CF_END   FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)     
+#define FC_CF_END_ACK   FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK) 
+
+#define FC_DATA     FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)      
+#define FC_NULL_DATA    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)      
+#define FC_DATA_CF_ACK  FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)   
+#define FC_QOS_DATA FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA)  
+#define FC_QOS_NULL FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL)  
+
+
+
+
+#define QOS_PRIO_SHIFT      0   
+#define QOS_PRIO_MASK       0x0007  
+#define QOS_PRIO(qos)       (((qos) & QOS_PRIO_MASK) >> QOS_PRIO_SHIFT) 
+
+
+#define QOS_TID_SHIFT       0   
+#define QOS_TID_MASK        0x000f  
+#define QOS_TID(qos)        (((qos) & QOS_TID_MASK) >> QOS_TID_SHIFT)   
+
+
+#define QOS_EOSP_SHIFT      4   
+#define QOS_EOSP_MASK       0x0010  
+#define QOS_EOSP(qos)       (((qos) & QOS_EOSP_MASK) >> QOS_EOSP_SHIFT) 
+
+
+#define QOS_ACK_NORMAL_ACK  0   
+#define QOS_ACK_NO_ACK      1   
+#define QOS_ACK_NO_EXP_ACK  2   
+#define QOS_ACK_BLOCK_ACK   3   
+#define QOS_ACK_SHIFT       5   
+#define QOS_ACK_MASK        0x0060  
+#define QOS_ACK(qos)        (((qos) & QOS_ACK_MASK) >> QOS_ACK_SHIFT)   
+
+
+#define QOS_AMSDU_SHIFT     7   
+#define QOS_AMSDU_MASK      0x0080  
+
+
+
+
+
+
+#define DOT11_MNG_AUTH_ALGO_LEN     2   
+#define DOT11_MNG_AUTH_SEQ_LEN      2   
+#define DOT11_MNG_BEACON_INT_LEN    2   
+#define DOT11_MNG_CAP_LEN       2   
+#define DOT11_MNG_AP_ADDR_LEN       6   
+#define DOT11_MNG_LISTEN_INT_LEN    2   
+#define DOT11_MNG_REASON_LEN        2   
+#define DOT11_MNG_AID_LEN       2   
+#define DOT11_MNG_STATUS_LEN        2   
+#define DOT11_MNG_TIMESTAMP_LEN     8   
+
+
+#define DOT11_AID_MASK          0x3fff  
+
+
+#define DOT11_RC_RESERVED       0   
+#define DOT11_RC_UNSPECIFIED        1   
+#define DOT11_RC_AUTH_INVAL     2   
+#define DOT11_RC_DEAUTH_LEAVING     3   
+#define DOT11_RC_INACTIVITY     4   
+#define DOT11_RC_BUSY           5   
+#define DOT11_RC_INVAL_CLASS_2      6   
+#define DOT11_RC_INVAL_CLASS_3      7   
+#define DOT11_RC_DISASSOC_LEAVING   8   
+#define DOT11_RC_NOT_AUTH       9   
+#define DOT11_RC_BAD_PC         10  
+#define DOT11_RC_BAD_CHANNELS       11  
+
+
+
+#define DOT11_RC_UNSPECIFIED_QOS    32  
+#define DOT11_RC_INSUFFCIENT_BW     33  
+#define DOT11_RC_EXCESSIVE_FRAMES   34  
+#define DOT11_RC_TX_OUTSIDE_TXOP    35  
+#define DOT11_RC_LEAVING_QBSS       36  
+#define DOT11_RC_BAD_MECHANISM      37  
+#define DOT11_RC_SETUP_NEEDED       38  
+#define DOT11_RC_TIMEOUT        39  
+
+#define DOT11_RC_MAX            23  
+
+
+#define DOT11_SC_SUCCESS        0   
+#define DOT11_SC_FAILURE        1   
+#define DOT11_SC_CAP_MISMATCH       10  
+#define DOT11_SC_REASSOC_FAIL       11  
+#define DOT11_SC_ASSOC_FAIL     12  
+#define DOT11_SC_AUTH_MISMATCH      13  
+#define DOT11_SC_AUTH_SEQ       14  
+#define DOT11_SC_AUTH_CHALLENGE_FAIL    15  
+#define DOT11_SC_AUTH_TIMEOUT       16  
+#define DOT11_SC_ASSOC_BUSY_FAIL    17  
+#define DOT11_SC_ASSOC_RATE_MISMATCH    18  
+#define DOT11_SC_ASSOC_SHORT_REQUIRED   19  
+#define DOT11_SC_ASSOC_PBCC_REQUIRED    20  
+#define DOT11_SC_ASSOC_AGILITY_REQUIRED 21  
+#define DOT11_SC_ASSOC_SPECTRUM_REQUIRED    22  
+#define DOT11_SC_ASSOC_BAD_POWER_CAP    23  
+#define DOT11_SC_ASSOC_BAD_SUP_CHANNELS 24  
+#define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED   25  
+#define DOT11_SC_ASSOC_ERPBCC_REQUIRED  26  
+#define DOT11_SC_ASSOC_DSSOFDM_REQUIRED 27  
+
+#define DOT11_SC_DECLINED       37  
+#define DOT11_SC_INVALID_PARAMS     38  
+#define DOT11_SC_INVALID_AKMP       43  
+#define DOT11_SC_INVALID_MDID       54  
+#define DOT11_SC_INVALID_FTIE       55  
+
+
+#define DOT11_MNG_DS_PARAM_LEN          1   
+#define DOT11_MNG_IBSS_PARAM_LEN        2   
+
+
+#define DOT11_MNG_TIM_FIXED_LEN         3   
+#define DOT11_MNG_TIM_DTIM_COUNT        0   
+#define DOT11_MNG_TIM_DTIM_PERIOD       1   
+#define DOT11_MNG_TIM_BITMAP_CTL        2   
+#define DOT11_MNG_TIM_PVB           3   
+
+
+#define TLV_TAG_OFF     0   
+#define TLV_LEN_OFF     1   
+#define TLV_HDR_LEN     2   
+#define TLV_BODY_OFF        2   
+
+
+#define DOT11_MNG_SSID_ID           0   
+#define DOT11_MNG_RATES_ID          1   
+#define DOT11_MNG_FH_PARMS_ID           2   
+#define DOT11_MNG_DS_PARMS_ID           3   
+#define DOT11_MNG_CF_PARMS_ID           4   
+#define DOT11_MNG_TIM_ID            5   
+#define DOT11_MNG_IBSS_PARMS_ID         6   
+#define DOT11_MNG_COUNTRY_ID            7   
+#define DOT11_MNG_HOPPING_PARMS_ID      8   
+#define DOT11_MNG_HOPPING_TABLE_ID      9   
+#define DOT11_MNG_REQUEST_ID            10  
+#define DOT11_MNG_QBSS_LOAD_ID          11  
+#define DOT11_MNG_EDCA_PARAM_ID         12  
+#define DOT11_MNG_CHALLENGE_ID          16  
+#define DOT11_MNG_PWR_CONSTRAINT_ID     32  
+#define DOT11_MNG_PWR_CAP_ID            33  
+#define DOT11_MNG_TPC_REQUEST_ID        34  
+#define DOT11_MNG_TPC_REPORT_ID         35  
+#define DOT11_MNG_SUPP_CHANNELS_ID      36  
+#define DOT11_MNG_CHANNEL_SWITCH_ID     37  
+#define DOT11_MNG_MEASURE_REQUEST_ID        38  
+#define DOT11_MNG_MEASURE_REPORT_ID     39  
+#define DOT11_MNG_QUIET_ID          40  
+#define DOT11_MNG_IBSS_DFS_ID           41  
+#define DOT11_MNG_ERP_ID            42  
+#define DOT11_MNG_TS_DELAY_ID           43  
+#define DOT11_MNG_HT_CAP            45  
+#define DOT11_MNG_QOS_CAP_ID            46  
+#define DOT11_MNG_NONERP_ID         47  
+#define DOT11_MNG_RSN_ID            48  
+#define DOT11_MNG_EXT_RATES_ID          50  
+#define DOT11_MNG_AP_CHREP_ID       51  
+#define DOT11_MNG_NBR_REP_ID        52  
+#define DOT11_MNG_MDIE_ID       54  
+#define DOT11_MNG_FTIE_ID       55  
+#define DOT11_MNG_FT_TI_ID      56  
+#define DOT11_MNG_REGCLASS_ID           59  
+#define DOT11_MNG_EXT_CSA_ID            60  
+#define DOT11_MNG_HT_ADD            61  
+#define DOT11_MNG_EXT_CHANNEL_OFFSET        62  
+
+
+#define DOT11_MNG_RRM_CAP_ID        70  
+#define DOT11_MNG_HT_BSS_COEXINFO_ID        72  
+#define DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID  73  
+#define DOT11_MNG_HT_OBSS_ID            74  
+#define DOT11_MNG_EXT_CAP           127 
+#define DOT11_MNG_WPA_ID            221 
+#define DOT11_MNG_PROPR_ID          221 
+
+#define DOT11_MNG_VS_ID             221 
+
+
+#define DOT11_RATE_BASIC            0x80    
+#define DOT11_RATE_MASK             0x7F    
+
+
+#define DOT11_MNG_ERP_LEN           1   
+#define DOT11_MNG_NONERP_PRESENT        0x01    
+#define DOT11_MNG_USE_PROTECTION        0x02    
+#define DOT11_MNG_BARKER_PREAMBLE       0x04    
+
+#define DOT11_MGN_TS_DELAY_LEN      4   
+#define TS_DELAY_FIELD_SIZE         4   
+
+
+#define DOT11_CAP_ESS               0x0001  
+#define DOT11_CAP_IBSS              0x0002  
+#define DOT11_CAP_POLLABLE          0x0004  
+#define DOT11_CAP_POLL_RQ           0x0008  
+#define DOT11_CAP_PRIVACY           0x0010  
+#define DOT11_CAP_SHORT             0x0020  
+#define DOT11_CAP_PBCC              0x0040  
+#define DOT11_CAP_AGILITY           0x0080  
+#define DOT11_CAP_SPECTRUM          0x0100  
+#define DOT11_CAP_SHORTSLOT         0x0400  
+#define DOT11_CAP_RRM           0x1000  
+#define DOT11_CAP_CCK_OFDM          0x2000  
+
+
+#define DOT11_OBSS_COEX_MNG_SUPPORT 0x01    
+
+
+#define DOT11_ACTION_HDR_LEN        2   
+#define DOT11_ACTION_CAT_OFF        0   
+#define DOT11_ACTION_ACT_OFF        1   
+
+
+#define DOT11_ACTION_CAT_ERR_MASK   0x80    
+#define DOT11_ACTION_CAT_MASK       0x7F    
+#define DOT11_ACTION_CAT_SPECT_MNG  0   
+#define DOT11_ACTION_CAT_QOS        1   
+#define DOT11_ACTION_CAT_DLS        2   
+#define DOT11_ACTION_CAT_BLOCKACK   3   
+#define DOT11_ACTION_CAT_PUBLIC     4   
+#define DOT11_ACTION_CAT_RRM        5   
+#define DOT11_ACTION_CAT_FBT    6   
+#define DOT11_ACTION_CAT_HT     7   
+#define DOT11_ACTION_CAT_BSSMGMT    10  
+#define DOT11_ACTION_NOTIFICATION   17
+#define DOT11_ACTION_CAT_VS     127 
+
+
+#define DOT11_SM_ACTION_M_REQ       0   
+#define DOT11_SM_ACTION_M_REP       1   
+#define DOT11_SM_ACTION_TPC_REQ     2   
+#define DOT11_SM_ACTION_TPC_REP     3   
+#define DOT11_SM_ACTION_CHANNEL_SWITCH  4   
+#define DOT11_SM_ACTION_EXT_CSA     5   
+
+
+#define DOT11_ACTION_ID_HT_CH_WIDTH 0   
+#define DOT11_ACTION_ID_HT_MIMO_PS  1   
+
+
+#define DOT11_PUB_ACTION_BSS_COEX_MNG   0   
+#define DOT11_PUB_ACTION_CHANNEL_SWITCH 4   
+
+
+#define DOT11_BA_ACTION_ADDBA_REQ   0   
+#define DOT11_BA_ACTION_ADDBA_RESP  1   
+#define DOT11_BA_ACTION_DELBA       2   
+
+
+#define DOT11_ADDBA_PARAM_AMSDU_SUP 0x0001  
+#define DOT11_ADDBA_PARAM_POLICY_MASK   0x0002  
+#define DOT11_ADDBA_PARAM_POLICY_SHIFT  1   
+#define DOT11_ADDBA_PARAM_TID_MASK  0x003c  
+#define DOT11_ADDBA_PARAM_TID_SHIFT 2   
+#define DOT11_ADDBA_PARAM_BSIZE_MASK    0xffc0  
+#define DOT11_ADDBA_PARAM_BSIZE_SHIFT   6   
+
+#define DOT11_ADDBA_POLICY_DELAYED  0   
+#define DOT11_ADDBA_POLICY_IMMEDIATE    1   
+
+BWL_PRE_PACKED_STRUCT struct dot11_addba_req {
+        uint8 category;             
+        uint8 action;               
+        uint8 token;                
+        uint16 addba_param_set;         
+        uint16 timeout;             
+        uint16 start_seqnum;            
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_addba_req dot11_addba_req_t;
+#define DOT11_ADDBA_REQ_LEN     9   
+
+BWL_PRE_PACKED_STRUCT struct dot11_addba_resp {
+        uint8 category;             
+        uint8 action;               
+        uint8 token;                
+        uint16 status;              
+        uint16 addba_param_set;         
+        uint16 timeout;             
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_addba_resp dot11_addba_resp_t;
+#define DOT11_ADDBA_RESP_LEN        9   
+
+
+#define DOT11_DELBA_PARAM_INIT_MASK 0x0800  
+#define DOT11_DELBA_PARAM_INIT_SHIFT    11  
+#define DOT11_DELBA_PARAM_TID_MASK  0xf000  
+#define DOT11_DELBA_PARAM_TID_SHIFT 12  
+
+BWL_PRE_PACKED_STRUCT struct dot11_delba {
+        uint8 category;             
+        uint8 action;               
+        uint16 delba_param_set;         
+        uint16 reason;              
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_delba dot11_delba_t;
+#define DOT11_DELBA_LEN         6   
+
+
+
+
+
+#define DOT11_RRM_CAP_LEN       5   
+BWL_PRE_PACKED_STRUCT struct dot11_rrm_cap_ie {
+        uint8 cap[DOT11_RRM_CAP_LEN];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rrm_cap_ie dot11_rrm_cap_ie_t;
+
+
+#define DOT11_RRM_CAP_LINK          0
+#define DOT11_RRM_CAP_NEIGHBOR_REPORT   1
+#define DOT11_RRM_CAP_PARALLEL      2
+#define DOT11_RRM_CAP_REPEATED      3
+#define DOT11_RRM_CAP_BCN_PASSIVE   4
+#define DOT11_RRM_CAP_BCN_ACTIVE    5
+#define DOT11_RRM_CAP_BCN_TABLE     6
+#define DOT11_RRM_CAP_BCN_REP_COND  7
+#define DOT11_RRM_CAP_AP_CHANREP    16
+
+
+#define DOT11_RM_ACTION_RM_REQ      0   
+#define DOT11_RM_ACTION_RM_REP      1   
+#define DOT11_RM_ACTION_LM_REQ      2   
+#define DOT11_RM_ACTION_LM_REP      3   
+#define DOT11_RM_ACTION_NR_REQ      4   
+#define DOT11_RM_ACTION_NR_REP      5   
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_rm_action {
+        uint8 category;             
+        uint8 action;               
+        uint8 token;                
+        uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rm_action dot11_rm_action_t;
+#define DOT11_RM_ACTION_LEN 3
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq {
+        uint8 category;             
+        uint8 action;               
+        uint8 token;                
+        uint16 reps;                
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq dot11_rmreq_t;
+#define DOT11_RMREQ_LEN 5
+
+BWL_PRE_PACKED_STRUCT struct dot11_rm_ie {
+        uint8 id;
+        uint8 len;
+        uint8 token;
+        uint8 mode;
+        uint8 type;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rm_ie dot11_rm_ie_t;
+#define DOT11_RM_IE_LEN 5
+
+
+#define DOT11_RMREQ_MODE_PARALLEL   1
+#define DOT11_RMREQ_MODE_ENABLE     2
+#define DOT11_RMREQ_MODE_REQUEST    4
+#define DOT11_RMREQ_MODE_REPORT     8
+#define DOT11_RMREQ_MODE_DURMAND    0x10    
+
+
+#define DOT11_RMREP_MODE_LATE       1
+#define DOT11_RMREP_MODE_INCAPABLE  2
+#define DOT11_RMREP_MODE_REFUSED    4
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
+        uint8 id;
+        uint8 len;
+        uint8 token;
+        uint8 mode;
+        uint8 type;
+        uint8 reg;
+        uint8 channel;
+        uint16 interval;
+        uint16 duration;
+        uint8 bcn_mode;
+        struct ether_addr   bssid;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_bcn dot11_rmreq_bcn_t;
+#define DOT11_RMREQ_BCN_LEN 18
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
+        uint8 reg;
+        uint8 channel;
+        uint32 starttime[2];
+        uint16 duration;
+        uint8 frame_info;
+        uint8 rcpi;
+        uint8 rsni;
+        struct ether_addr   bssid;
+        uint8 antenna_id;
+        uint32 parent_tsf;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_bcn dot11_rmrep_bcn_t;
+#define DOT11_RMREP_BCN_LEN 26
+
+
+#define DOT11_RMREQ_BCN_PASSIVE 0
+#define DOT11_RMREQ_BCN_ACTIVE  1
+#define DOT11_RMREQ_BCN_TABLE   2
+
+
+#define DOT11_RMREQ_BCN_SSID_ID 0
+#define DOT11_RMREQ_BCN_REPINFO_ID  1
+#define DOT11_RMREQ_BCN_REPDET_ID   2
+#define DOT11_RMREQ_BCN_REQUEST_ID  10
+#define DOT11_RMREQ_BCN_APCHREP_ID  51
+
+
+#define DOT11_RMREQ_BCN_REPDET_FIXED    0   
+#define DOT11_RMREQ_BCN_REPDET_REQUEST  1   
+#define DOT11_RMREQ_BCN_REPDET_ALL  2   
+
+
+#define DOT11_RMREP_BCN_FRM_BODY    1
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_nbr {
+        struct ether_addr   bssid;
+        uint32  bssid_info;
+        uint8 reg;
+        uint8 channel;
+        uint8 phytype;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_nbr dot11_rmrep_nbr_t;
+#define DOT11_RMREP_NBR_LEN 13
+
+
+#define DOT11_BSSTYPE_INFRASTRUCTURE        0   
+#define DOT11_BSSTYPE_INDEPENDENT       1   
+#define DOT11_BSSTYPE_ANY           2   
+#define DOT11_SCANTYPE_ACTIVE           0   
+#define DOT11_SCANTYPE_PASSIVE          1   
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_lmreq {
+        uint8 category;             
+        uint8 action;               
+        uint8 token;                
+        uint8 txpwr;                
+        uint8 maxtxpwr;             
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmreq dot11_lmreq_t;
+#define DOT11_LMREQ_LEN 5
+
+BWL_PRE_PACKED_STRUCT struct dot11_lmrep {
+        uint8 category;             
+        uint8 action;               
+        uint8 token;                
+        dot11_tpc_rep_t tpc;            
+        uint8 rxant;                
+        uint8 txant;                
+        uint8 rcpi;             
+        uint8 rsni;             
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmrep dot11_lmrep_t;
+#define DOT11_LMREP_LEN 11
+
+
+#define PREN_PREAMBLE       24  
+#define PREN_MM_EXT     12  
+#define PREN_PREAMBLE_EXT   4   
+
+
+#define RIFS_11N_TIME       2   
+
+
+
+#define HT_SIG1_MCS_MASK        0x00007F
+#define HT_SIG1_CBW             0x000080
+#define HT_SIG1_HT_LENGTH       0xFFFF00
+
+
+#define HT_SIG2_SMOOTHING       0x000001
+#define HT_SIG2_NOT_SOUNDING    0x000002
+#define HT_SIG2_RESERVED        0x000004
+#define HT_SIG2_AGGREGATION     0x000008
+#define HT_SIG2_STBC_MASK       0x000030
+#define HT_SIG2_STBC_SHIFT      4
+#define HT_SIG2_FEC_CODING      0x000040
+#define HT_SIG2_SHORT_GI        0x000080
+#define HT_SIG2_ESS_MASK        0x000300
+#define HT_SIG2_ESS_SHIFT       8
+#define HT_SIG2_CRC             0x03FC00
+#define HT_SIG2_TAIL            0x1C0000
+
+
+#define APHY_SLOT_TIME      9   
+#define APHY_SIFS_TIME      16  
+#define APHY_DIFS_TIME      (APHY_SIFS_TIME + (2 * APHY_SLOT_TIME)) 
+#define APHY_PREAMBLE_TIME  16  
+#define APHY_SIGNAL_TIME    4   
+#define APHY_SYMBOL_TIME    4   
+#define APHY_SERVICE_NBITS  16  
+#define APHY_TAIL_NBITS     6   
+#define APHY_CWMIN      15  
+
+
+#define BPHY_SLOT_TIME      20  
+#define BPHY_SIFS_TIME      10  
+#define BPHY_DIFS_TIME      50  
+#define BPHY_PLCP_TIME      192 
+#define BPHY_PLCP_SHORT_TIME    96  
+#define BPHY_CWMIN      31  
+
+
+#define DOT11_OFDM_SIGNAL_EXTENSION 6   
+
+#define PHY_CWMAX       1023    
+
+#define DOT11_MAXNUMFRAGS   16  
+
+
+typedef struct d11cnt {
+        uint32      txfrag;     
+        uint32      txmulti;    
+        uint32      txfail;     
+        uint32      txretry;    
+        uint32      txretrie;   
+        uint32      rxdup;      
+        uint32      txrts;      
+        uint32      txnocts;    
+        uint32      txnoack;    
+        uint32      rxfrag;     
+        uint32      rxmulti;    
+        uint32      rxcrc;      
+        uint32      txfrmsnt;   
+        uint32      rxundec;    
+} d11cnt_t;
+
+
+#define BRCM_PROP_OUI       "\x00\x90\x4C"  
+
+
+
+#define BRCM_OUI        "\x00\x10\x18"  
+
+
+BWL_PRE_PACKED_STRUCT struct brcm_ie {
+        uint8   id;     
+        uint8   len;        
+        uint8   oui[3];     
+        uint8   ver;        
+        uint8   assoc;      
+        uint8   flags;      
+        uint8   flags1;     
+        uint16  amsdu_mtu_pref; 
+} BWL_POST_PACKED_STRUCT;
+typedef struct brcm_ie brcm_ie_t;
+#define BRCM_IE_LEN     11  
+#define BRCM_IE_VER     2   
+#define BRCM_IE_LEGACY_AES_VER  1   
+
+
+#ifdef WLAFTERBURNER
+#define BRF_ABCAP       0x1 
+#define BRF_ABRQRD      0x2 
+#define BRF_ABCOUNTER_MASK  0xf0    
+#define BRF_ABCOUNTER_SHIFT 4   
+#endif 
+#define BRF_LZWDS       0x4 
+#define BRF_BLOCKACK        0x8 
+
+
+#define BRF1_AMSDU      0x1 
+#define BRF1_WMEPS      0x4 
+#define BRF1_PSOFIX     0x8 
+#define BRF1_RX_LARGE_AGG   0x10    
+#define BRF1_SOFTAP             0x40    
+
+#ifdef WLAFTERBURNER
+#define AB_WDS_TIMEOUT_MAX  15  
+#define AB_WDS_TIMEOUT_MIN  1   
+#endif
+
+#define AB_GUARDCOUNT   10      
+
+
+BWL_PRE_PACKED_STRUCT struct vndr_ie {
+        uchar id;
+        uchar len;
+        uchar oui [3];
+        uchar data [1];     
+} BWL_POST_PACKED_STRUCT;
+typedef struct vndr_ie vndr_ie_t;
+
+#define VNDR_IE_HDR_LEN     2   
+#define VNDR_IE_MIN_LEN     3   
+#define VNDR_IE_MAX_LEN     256 
+
+
+#define MCSSET_LEN  16  
+#define MAX_MCS_NUM (128)   
+
+BWL_PRE_PACKED_STRUCT struct ht_cap_ie {
+        uint16  cap;
+        uint8   params;
+        uint8   supp_mcs[MCSSET_LEN];
+        uint16  ext_htcap;
+        uint32  txbf_cap;
+        uint8   as_cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_cap_ie ht_cap_ie_t;
+
+
+
+BWL_PRE_PACKED_STRUCT struct ht_prop_cap_ie {
+        uint8   id;     
+        uint8   len;        
+        uint8   oui[3];     
+        uint8   type;           
+        ht_cap_ie_t cap_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_prop_cap_ie ht_prop_cap_ie_t;
+
+#define HT_PROP_IE_OVERHEAD 4   
+#define HT_CAP_IE_LEN       26  
+#define HT_CAP_IE_TYPE      51
+
+#define HT_CAP_LDPC_CODING  0x0001  
+#define HT_CAP_40MHZ        0x0002  
+#define HT_CAP_MIMO_PS_MASK 0x000C  
+#define HT_CAP_MIMO_PS_SHIFT    0x0002  
+#define HT_CAP_MIMO_PS_OFF  0x0003  
+#define HT_CAP_MIMO_PS_RTS  0x0001  
+#define HT_CAP_MIMO_PS_ON   0x0000  
+#define HT_CAP_GF       0x0010  
+#define HT_CAP_SHORT_GI_20  0x0020  
+#define HT_CAP_SHORT_GI_40  0x0040  
+#define HT_CAP_TX_STBC      0x0080  
+#define HT_CAP_RX_STBC_MASK 0x0300  
+#define HT_CAP_RX_STBC_SHIFT    8   
+#define HT_CAP_DELAYED_BA   0x0400  
+#define HT_CAP_MAX_AMSDU    0x0800  
+#define HT_CAP_DSSS_CCK 0x1000  
+#define HT_CAP_PSMP     0x2000  
+#define HT_CAP_40MHZ_INTOLERANT 0x4000  
+#define HT_CAP_LSIG_TXOP    0x8000  
+
+#define HT_CAP_RX_STBC_NO       0x0 
+#define HT_CAP_RX_STBC_ONE_STREAM   0x1 
+#define HT_CAP_RX_STBC_TWO_STREAM   0x2 
+#define HT_CAP_RX_STBC_THREE_STREAM 0x3 
+
+#define HT_MAX_AMSDU        7935    
+#define HT_MIN_AMSDU        3835    
+
+#define HT_PARAMS_RX_FACTOR_MASK    0x03    
+#define HT_PARAMS_DENSITY_MASK      0x1C    
+#define HT_PARAMS_DENSITY_SHIFT 2   
+
+
+#define AMPDU_MAX_MPDU_DENSITY  7   
+#define AMPDU_RX_FACTOR_8K  0   
+#define AMPDU_RX_FACTOR_16K 1   
+#define AMPDU_RX_FACTOR_32K 2   
+#define AMPDU_RX_FACTOR_64K 3   
+#define AMPDU_RX_FACTOR_BASE    8*1024  
+
+#define AMPDU_DELIMITER_LEN 4   
+#define AMPDU_DELIMITER_LEN_MAX 63  
+
+BWL_PRE_PACKED_STRUCT struct ht_add_ie {
+        uint8   ctl_ch;         
+        uint8   byte1;          
+        uint16  opmode;         
+        uint16  misc_bits;      
+        uint8   basic_mcs[MCSSET_LEN];  
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_add_ie ht_add_ie_t;
+
+
+
+BWL_PRE_PACKED_STRUCT struct ht_prop_add_ie {
+        uint8   id;     
+        uint8   len;        
+        uint8   oui[3];     
+        uint8   type;       
+        ht_add_ie_t add_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_prop_add_ie ht_prop_add_ie_t;
+
+#define HT_ADD_IE_LEN   22
+#define HT_ADD_IE_TYPE  52
+
+
+#define HT_BW_ANY       0x04    
+#define HT_RIFS_PERMITTED       0x08    
+
+
+#define HT_OPMODE_MASK          0x0003  
+#define HT_OPMODE_SHIFT     0   
+#define HT_OPMODE_PURE      0x0000  
+#define HT_OPMODE_OPTIONAL  0x0001  
+#define HT_OPMODE_HT20IN40  0x0002  
+#define HT_OPMODE_MIXED 0x0003  
+#define HT_OPMODE_NONGF 0x0004  
+#define DOT11N_TXBURST      0x0008  
+#define DOT11N_OBSS_NONHT   0x0010  
+
+
+#define HT_BASIC_STBC_MCS   0x007f  
+#define HT_DUAL_STBC_PROT   0x0080  
+#define HT_SECOND_BCN       0x0100  
+#define HT_LSIG_TXOP        0x0200  
+#define HT_PCO_ACTIVE       0x0400  
+#define HT_PCO_PHASE        0x0800  
+
+
+#define DOT11N_2G_TXBURST_LIMIT 6160    
+#define DOT11N_5G_TXBURST_LIMIT 3080    
+
+
+#define GET_HT_OPMODE(add_ie)       ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                        >> HT_OPMODE_SHIFT)
+#define HT_MIXEDMODE_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                        == HT_OPMODE_MIXED) 
+#define HT_HT20_PRESENT(add_ie) ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                        == HT_OPMODE_HT20IN40)  
+#define HT_OPTIONAL_PRESENT(add_ie) ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                        == HT_OPMODE_OPTIONAL)  
+#define HT_USE_PROTECTION(add_ie)   (HT_HT20_PRESENT((add_ie)) || \
+                                        HT_MIXEDMODE_PRESENT((add_ie))) 
+#define HT_NONGF_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_NONGF) \
+                                        == HT_OPMODE_NONGF) 
+#define DOT11N_TXBURST_PRESENT(add_ie)  ((ltoh16_ua(&add_ie->opmode) & DOT11N_TXBURST) \
+                                        == DOT11N_TXBURST)  
+#define DOT11N_OBSS_NONHT_PRESENT(add_ie)   ((ltoh16_ua(&add_ie->opmode) & DOT11N_OBSS_NONHT) \
+                                        == DOT11N_OBSS_NONHT)   
+
+BWL_PRE_PACKED_STRUCT struct obss_params {
+        uint16  passive_dwell;
+        uint16  active_dwell;
+        uint16  bss_widthscan_interval;
+        uint16  passive_total;
+        uint16  active_total;
+        uint16  chanwidth_transition_dly;
+        uint16  activity_threshold;
+} BWL_POST_PACKED_STRUCT;
+typedef struct obss_params obss_params_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_ie {
+        uint8   id;
+        uint8   len;
+        obss_params_t obss_params;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_ie dot11_obss_ie_t;
+#define DOT11_OBSS_SCAN_IE_LEN  sizeof(obss_params_t)   
+
+
+#define HT_CTRL_LA_TRQ      0x00000002  
+#define HT_CTRL_LA_MAI      0x0000003C  
+#define HT_CTRL_LA_MAI_SHIFT    2
+#define HT_CTRL_LA_MAI_MRQ  0x00000004  
+#define HT_CTRL_LA_MAI_MSI  0x00000038  
+#define HT_CTRL_LA_MFSI     0x000001C0  
+#define HT_CTRL_LA_MFSI_SHIFT   6
+#define HT_CTRL_LA_MFB_ASELC    0x0000FE00  
+#define HT_CTRL_LA_MFB_ASELC_SH 9
+#define HT_CTRL_LA_ASELC_CMD    0x00000C00  
+#define HT_CTRL_LA_ASELC_DATA   0x0000F000  
+#define HT_CTRL_CAL_POS     0x00030000  
+#define HT_CTRL_CAL_SEQ     0x000C0000  
+#define HT_CTRL_CSI_STEERING    0x00C00000  
+#define HT_CTRL_CSI_STEER_SHIFT 22
+#define HT_CTRL_CSI_STEER_NFB   0       
+#define HT_CTRL_CSI_STEER_CSI   1       
+#define HT_CTRL_CSI_STEER_NCOM  2       
+#define HT_CTRL_CSI_STEER_COM   3       
+#define HT_CTRL_NDP_ANNOUNCE    0x01000000  
+#define HT_CTRL_AC_CONSTRAINT   0x40000000  
+#define HT_CTRL_RDG_MOREPPDU    0x80000000  
+
+#define HT_OPMODE_OPTIONAL  0x0001  
+#define HT_OPMODE_HT20IN40  0x0002  
+#define HT_OPMODE_MIXED 0x0003  
+#define HT_OPMODE_NONGF 0x0004  
+#define DOT11N_TXBURST      0x0008  
+#define DOT11N_OBSS_NONHT   0x0010  
+
+
+
+#define WPA_OUI         "\x00\x50\xF2"  
+#define WPA_OUI_LEN     3       
+#define WPA_OUI_TYPE        1
+#define WPA_VERSION     1   
+#define WPA2_OUI        "\x00\x0F\xAC"  
+#define WPA2_OUI_LEN        3       
+#define WPA2_VERSION        1   
+#define WPA2_VERSION_LEN    2   
+
+
+#define WPS_OUI         "\x00\x50\xF2"  
+#define WPS_OUI_LEN     3       
+#define WPS_OUI_TYPE        4
+
+
+#define WFA_OUI         "\x50\x6F\x9A"  
+#define WFA_OUI_LEN 3   
+
+#define WFA_OUI_TYPE_WPA    1
+#define WFA_OUI_TYPE_WPS    4
+#define WFA_OUI_TYPE_TPC    8
+#define WFA_OUI_TYPE_P2P    9
+
+
+#define RSN_AKM_NONE        0   
+#define RSN_AKM_UNSPECIFIED 1   
+#define RSN_AKM_PSK     2   
+#define RSN_AKM_FBT_1X      3   
+#define RSN_AKM_FBT_PSK     4   
+
+
+#define DOT11_MAX_DEFAULT_KEYS  4   
+#define DOT11_MAX_KEY_SIZE  32  
+#define DOT11_MAX_IV_SIZE   16  
+#define DOT11_EXT_IV_FLAG   (1<<5)  
+#define DOT11_WPA_KEY_RSC_LEN   8       
+
+#define WEP1_KEY_SIZE       5   
+#define WEP1_KEY_HEX_SIZE   10  
+#define WEP128_KEY_SIZE     13  
+#define WEP128_KEY_HEX_SIZE 26  
+#define TKIP_MIC_SIZE       8   
+#define TKIP_EOM_SIZE       7   
+#define TKIP_EOM_FLAG       0x5a    
+#define TKIP_KEY_SIZE       32  
+#define TKIP_MIC_AUTH_TX    16  
+#define TKIP_MIC_AUTH_RX    24  
+#define TKIP_MIC_SUP_RX     TKIP_MIC_AUTH_TX    
+#define TKIP_MIC_SUP_TX     TKIP_MIC_AUTH_RX    
+#define AES_KEY_SIZE        16  
+#define AES_MIC_SIZE        8   
+
+
+#define WCN_OUI         "\x00\x50\xf2"  
+#define WCN_TYPE        4   
+
+
+
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_mdid_ie {
+        uint8 id;
+        uint8 len;
+        uint16 mdid;        
+        uint8 cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_mdid_ie dot11_mdid_ie_t;
+
+#define FBT_MDID_CAP_OVERDS 0x01    
+#define FBT_MDID_CAP_RRP    0x02    
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_ft_ie {
+        uint8 id;
+        uint8 len;
+        uint16 mic_control;     
+        uint8 mic[16];
+        uint8 anonce[32];
+        uint8 snonce[32];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_ie dot11_ft_ie_t;
+
+
+BWL_PRE_PACKED_STRUCT struct dot11_gtk_ie {
+        uint8 id;
+        uint8 len;
+        uint16 key_info;
+        uint8 key_len;
+        uint8 rsc[8];
+        uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_gtk_ie dot11_gtk_ie_t;
+
+
+
+#include <packed_section_end.h>
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/proto/802.11_bta.h b/drivers/net/wireless/bcmdhd/include/proto/802.11_bta.h
new file mode 100644
index 00000000000..4ccfab02056
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/802.11_bta.h
@@ -0,0 +1,45 @@
+/*
+ * BT-AMP (BlueTooth Alternate Mac and Phy) 802.11 PAL (Protocol Adaptation Layer)
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: 802.11_bta.h,v 9.2 2008-10-28 23:27:13 Exp $
+*/
+
+#ifndef _802_11_BTA_H_
+#define _802_11_BTA_H_
+
+#define BT_SIG_SNAP_MPROT               "\xAA\xAA\x03\x00\x19\x58"
+
+/* BT-AMP 802.11 PAL Protocols */
+#define BTA_PROT_L2CAP                          1
+#define BTA_PROT_ACTIVITY_REPORT                2
+#define BTA_PROT_SECURITY                       3
+#define BTA_PROT_LINK_SUPERVISION_REQUEST       4
+#define BTA_PROT_LINK_SUPERVISION_REPLY         5
+
+/* BT-AMP 802.11 PAL AMP_ASSOC Type IDs */
+#define BTA_TYPE_ID_MAC_ADDRESS                 1
+#define BTA_TYPE_ID_PREFERRED_CHANNELS          2
+#define BTA_TYPE_ID_CONNECTED_CHANNELS          3
+#define BTA_TYPE_ID_CAPABILITIES                4
+#define BTA_TYPE_ID_VERSION                     5
+#endif /* _802_11_bta_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/proto/802.11e.h b/drivers/net/wireless/bcmdhd/include/proto/802.11e.h
new file mode 100644
index 00000000000..ce8ad083f28
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/802.11e.h
@@ -0,0 +1,131 @@
+/*
+ * 802.11e protocol header file
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: 802.11e.h,v 1.6 2008-12-01 22:55:11 Exp $
+ */
+
+#ifndef _802_11e_H_
+#define _802_11e_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* WME Traffic Specification (TSPEC) element */
+#define WME_TSPEC_HDR_LEN           2           /* WME TSPEC header length */
+#define WME_TSPEC_BODY_OFF          2           /* WME TSPEC body offset */
+
+#define WME_CATEGORY_CODE_OFFSET        0               /* WME Category code offset */
+#define WME_ACTION_CODE_OFFSET          1               /* WME Action code offset */
+#define WME_TOKEN_CODE_OFFSET           2               /* WME Token code offset */
+#define WME_STATUS_CODE_OFFSET          3               /* WME Status code offset */
+
+BWL_PRE_PACKED_STRUCT struct tsinfo {
+        uint8 octets[3];
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct tsinfo tsinfo_t;
+
+/* 802.11e TSPEC IE */
+typedef BWL_PRE_PACKED_STRUCT struct tspec {
+        uint8 oui[DOT11_OUI_LEN];       /* WME_OUI */
+        uint8 type;                                     /* WME_TYPE */
+        uint8 subtype;                          /* WME_SUBTYPE_TSPEC */
+        uint8 version;                          /* WME_VERSION */
+        tsinfo_t tsinfo;                        /* TS Info bit field */
+        uint16 nom_msdu_size;           /* (Nominal or fixed) MSDU Size (bytes) */
+        uint16 max_msdu_size;           /* Maximum MSDU Size (bytes) */
+        uint32 min_srv_interval;        /* Minimum Service Interval (us) */
+        uint32 max_srv_interval;        /* Maximum Service Interval (us) */
+        uint32 inactivity_interval;     /* Inactivity Interval (us) */
+        uint32 suspension_interval; /* Suspension Interval (us) */
+        uint32 srv_start_time;          /* Service Start Time (us) */
+        uint32 min_data_rate;           /* Minimum Data Rate (bps) */
+        uint32 mean_data_rate;          /* Mean Data Rate (bps) */
+        uint32 peak_data_rate;          /* Peak Data Rate (bps) */
+        uint32 max_burst_size;          /* Maximum Burst Size (bytes) */
+        uint32 delay_bound;                     /* Delay Bound (us) */
+        uint32 min_phy_rate;            /* Minimum PHY Rate (bps) */
+        uint16 surplus_bw;                      /* Surplus Bandwidth Allowance (range 1.0-8.0) */
+        uint16 medium_time;                     /* Medium Time (32 us/s periods) */
+} BWL_POST_PACKED_STRUCT tspec_t;
+
+#define WME_TSPEC_LEN   (sizeof(tspec_t))               /* not including 2-bytes of header */
+
+/* ts_info */
+/* 802.1D priority is duplicated - bits 13-11 AND bits 3-1 */
+#define TS_INFO_TID_SHIFT               1       /* TS info. TID shift */
+#define TS_INFO_TID_MASK                (0xf << TS_INFO_TID_SHIFT)      /* TS info. TID mask */
+#define TS_INFO_CONTENTION_SHIFT        7       /* TS info. contention shift */
+#define TS_INFO_CONTENTION_MASK (0x1 << TS_INFO_CONTENTION_SHIFT) /* TS info. contention mask */
+#define TS_INFO_DIRECTION_SHIFT 5       /* TS info. direction shift */
+#define TS_INFO_DIRECTION_MASK  (0x3 << TS_INFO_DIRECTION_SHIFT) /* TS info. direction mask */
+#define TS_INFO_PSB_SHIFT               2               /* TS info. PSB bit Shift */
+#define TS_INFO_PSB_MASK                (1 << TS_INFO_PSB_SHIFT)        /* TS info. PSB mask */
+#define TS_INFO_UPLINK                  (0 << TS_INFO_DIRECTION_SHIFT)  /* TS info. uplink */
+#define TS_INFO_DOWNLINK                (1 << TS_INFO_DIRECTION_SHIFT)  /* TS info. downlink */
+#define TS_INFO_BIDIRECTIONAL   (3 << TS_INFO_DIRECTION_SHIFT)  /* TS info. bidirectional */
+#define TS_INFO_USER_PRIO_SHIFT 3       /* TS info. user priority shift */
+/* TS info. user priority mask */
+#define TS_INFO_USER_PRIO_MASK  (0x7 << TS_INFO_USER_PRIO_SHIFT)
+
+/* Macro to get/set bit(s) field in TSINFO */
+#define WLC_CAC_GET_TID(pt)     ((((pt).octets[0]) & TS_INFO_TID_MASK) >> TS_INFO_TID_SHIFT)
+#define WLC_CAC_GET_DIR(pt)     ((((pt).octets[0]) & \
+        TS_INFO_DIRECTION_MASK) >> TS_INFO_DIRECTION_SHIFT)
+#define WLC_CAC_GET_PSB(pt)     ((((pt).octets[1]) & TS_INFO_PSB_MASK) >> TS_INFO_PSB_SHIFT)
+#define WLC_CAC_GET_USER_PRIO(pt)       ((((pt).octets[1]) & \
+        TS_INFO_USER_PRIO_MASK) >> TS_INFO_USER_PRIO_SHIFT)
+
+#define WLC_CAC_SET_TID(pt, id) ((((pt).octets[0]) & (~TS_INFO_TID_MASK)) | \
+        ((id) << TS_INFO_TID_SHIFT))
+#define WLC_CAC_SET_USER_PRIO(pt, prio) ((((pt).octets[0]) & (~TS_INFO_USER_PRIO_MASK)) | \
+        ((prio) << TS_INFO_USER_PRIO_SHIFT))
+
+/* 802.11e QBSS Load IE */
+#define QBSS_LOAD_IE_LEN                5       /* QBSS Load IE length */
+#define QBSS_LOAD_AAC_OFF               3       /* AAC offset in IE */
+
+#define CAC_ADDTS_RESP_TIMEOUT          300     /* default ADDTS response timeout in ms */
+
+/* 802.11e ADDTS status code */
+#define DOT11E_STATUS_ADMISSION_ACCEPTED        0       /* TSPEC Admission accepted status */
+#define DOT11E_STATUS_ADDTS_INVALID_PARAM       1       /* TSPEC invalid parameter status */
+#define DOT11E_STATUS_ADDTS_REFUSED_NSBW        3       /* ADDTS refused (non-sufficient BW) */
+#define DOT11E_STATUS_ADDTS_REFUSED_AWHILE      47      /* ADDTS refused but could retry later */
+
+/* 802.11e DELTS status code */
+#define DOT11E_STATUS_QSTA_LEAVE_QBSS           36      /* STA leave QBSS */
+#define DOT11E_STATUS_END_TS                            37      /* END TS */
+#define DOT11E_STATUS_UNKNOWN_TS                        38      /* UNKNOWN TS */
+#define DOT11E_STATUS_QSTA_REQ_TIMEOUT          39      /* STA ADDTS request timeout */
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _802_11e_CAC_H_ */
diff --git a/drivers/net/wireless/bcmdhd/include/proto/802.1d.h b/drivers/net/wireless/bcmdhd/include/proto/802.1d.h
new file mode 100644
index 00000000000..cf206250246
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/802.1d.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * Fundamental types and constants relating to 802.1D
+ *
+ * $Id: 802.1d.h,v 9.3 2007-04-10 21:33:06 Exp $
+ */
+
+
+#ifndef _802_1_D_
+#define _802_1_D_
+
+
+#define PRIO_8021D_NONE         2       
+#define PRIO_8021D_BK           1       
+#define PRIO_8021D_BE           0       
+#define PRIO_8021D_EE           3       
+#define PRIO_8021D_CL           4       
+#define PRIO_8021D_VI           5       
+#define PRIO_8021D_VO           6       
+#define PRIO_8021D_NC           7       
+#define MAXPRIO                 7       
+#define NUMPRIO                 (MAXPRIO + 1)
+
+#define ALLPRIO         -1      
+
+
+#define PRIO2PREC(prio) \
+        (((prio) == PRIO_8021D_NONE || (prio) == PRIO_8021D_BE) ? ((prio^2)) : (prio))
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/proto/bcmeth.h b/drivers/net/wireless/bcmdhd/include/proto/bcmeth.h
new file mode 100644
index 00000000000..46fa4c9f89e
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/bcmeth.h
@@ -0,0 +1,83 @@
+/*
+ * Broadcom Ethernettype  protocol definitions
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmeth.h,v 9.12 2009-12-29 19:57:18 Exp $
+ */
+
+
+
+
+#ifndef _BCMETH_H_
+#define _BCMETH_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+
+#include <packed_section_start.h>
+
+
+
+
+
+
+
+#define BCMILCP_SUBTYPE_RATE            1
+#define BCMILCP_SUBTYPE_LINK            2
+#define BCMILCP_SUBTYPE_CSA             3
+#define BCMILCP_SUBTYPE_LARQ            4
+#define BCMILCP_SUBTYPE_VENDOR          5
+#define BCMILCP_SUBTYPE_FLH             17
+
+#define BCMILCP_SUBTYPE_VENDOR_LONG     32769
+#define BCMILCP_SUBTYPE_CERT            32770
+#define BCMILCP_SUBTYPE_SES             32771
+
+
+#define BCMILCP_BCM_SUBTYPE_RESERVED            0
+#define BCMILCP_BCM_SUBTYPE_EVENT               1
+#define BCMILCP_BCM_SUBTYPE_SES                 2
+
+
+#define BCMILCP_BCM_SUBTYPE_DPT                 4
+
+#define BCMILCP_BCM_SUBTYPEHDR_MINLENGTH        8
+#define BCMILCP_BCM_SUBTYPEHDR_VERSION          0
+
+
+typedef BWL_PRE_PACKED_STRUCT struct bcmeth_hdr
+{
+        uint16  subtype;        
+        uint16  length;
+        uint8   version;        
+        uint8   oui[3];         
+        
+        uint16  usr_subtype;
+} BWL_POST_PACKED_STRUCT bcmeth_hdr_t;
+
+
+
+#include <packed_section_end.h>
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/proto/bcmevent.h b/drivers/net/wireless/bcmdhd/include/proto/bcmevent.h
new file mode 100644
index 00000000000..30ec848c40a
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/bcmevent.h
@@ -0,0 +1,312 @@
+/*
+ * Broadcom Event  protocol definitions
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * Dependencies: proto/bcmeth.h
+ *
+ * $Id: bcmevent.h,v 9.64.2.9 2011-02-01 06:24:21 Exp $
+ *
+ */
+
+
+
+
+#ifndef _BCMEVENT_H_
+#define _BCMEVENT_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+
+#include <packed_section_start.h>
+
+#define BCM_EVENT_MSG_VERSION           2       
+#define BCM_MSG_IFNAME_MAX              16      
+
+
+#define WLC_EVENT_MSG_LINK              0x01    
+#define WLC_EVENT_MSG_FLUSHTXQ          0x02    
+#define WLC_EVENT_MSG_GROUP             0x04    
+#define WLC_EVENT_MSG_UNKBSS            0x08    
+#define WLC_EVENT_MSG_UNKIF             0x10    
+
+
+
+
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+        uint16  version;
+        uint16  flags;                  
+        uint32  event_type;             
+        uint32  status;                 
+        uint32  reason;                 
+        uint32  auth_type;              
+        uint32  datalen;                
+        struct ether_addr       addr;   
+        char    ifname[BCM_MSG_IFNAME_MAX]; 
+} BWL_POST_PACKED_STRUCT wl_event_msg_v1_t;
+
+
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+        uint16  version;
+        uint16  flags;                  
+        uint32  event_type;             
+        uint32  status;                 
+        uint32  reason;                 
+        uint32  auth_type;              
+        uint32  datalen;                
+        struct ether_addr       addr;   
+        char    ifname[BCM_MSG_IFNAME_MAX]; 
+        uint8   ifidx;                  
+        uint8   bsscfgidx;              
+} BWL_POST_PACKED_STRUCT wl_event_msg_t;
+
+
+typedef BWL_PRE_PACKED_STRUCT struct bcm_event {
+        struct ether_header eth;
+        bcmeth_hdr_t            bcm_hdr;
+        wl_event_msg_t          event;
+        
+} BWL_POST_PACKED_STRUCT bcm_event_t;
+
+#define BCM_MSG_LEN     (sizeof(bcm_event_t) - sizeof(bcmeth_hdr_t) - sizeof(struct ether_header))
+
+
+#define WLC_E_SET_SSID          0       
+#define WLC_E_JOIN              1       
+#define WLC_E_START             2       
+#define WLC_E_AUTH              3       
+#define WLC_E_AUTH_IND          4       
+#define WLC_E_DEAUTH            5       
+#define WLC_E_DEAUTH_IND        6       
+#define WLC_E_ASSOC             7       
+#define WLC_E_ASSOC_IND         8       
+#define WLC_E_REASSOC           9       
+#define WLC_E_REASSOC_IND       10      
+#define WLC_E_DISASSOC          11      
+#define WLC_E_DISASSOC_IND      12      
+#define WLC_E_QUIET_START       13      
+#define WLC_E_QUIET_END         14      
+#define WLC_E_BEACON_RX         15      
+#define WLC_E_LINK              16      
+#define WLC_E_MIC_ERROR         17      
+#define WLC_E_NDIS_LINK         18      
+#define WLC_E_ROAM              19      
+#define WLC_E_TXFAIL            20      
+#define WLC_E_PMKID_CACHE       21      
+#define WLC_E_RETROGRADE_TSF    22      
+#define WLC_E_PRUNE             23      
+#define WLC_E_AUTOAUTH          24      
+#define WLC_E_EAPOL_MSG         25      
+#define WLC_E_SCAN_COMPLETE     26      
+#define WLC_E_ADDTS_IND         27      
+#define WLC_E_DELTS_IND         28      
+#define WLC_E_BCNSENT_IND       29      
+#define WLC_E_BCNRX_MSG         30      
+#define WLC_E_BCNLOST_MSG       31      
+#define WLC_E_ROAM_PREP         32      
+#define WLC_E_PFN_NET_FOUND     33      
+#define WLC_E_PFN_NET_LOST      34      
+#define WLC_E_RESET_COMPLETE    35
+#define WLC_E_JOIN_START        36
+#define WLC_E_ROAM_START        37
+#define WLC_E_ASSOC_START       38
+#define WLC_E_IBSS_ASSOC        39
+#define WLC_E_RADIO             40
+#define WLC_E_PSM_WATCHDOG      41      
+#define WLC_E_PROBREQ_MSG       44      
+#define WLC_E_SCAN_CONFIRM_IND  45
+#define WLC_E_PSK_SUP           46      
+#define WLC_E_COUNTRY_CODE_CHANGED 47
+#define WLC_E_EXCEEDED_MEDIUM_TIME 48   
+#define WLC_E_ICV_ERROR         49      
+#define WLC_E_UNICAST_DECODE_ERROR 50   
+#define WLC_E_MULTICAST_DECODE_ERROR 51 
+#define WLC_E_TRACE             52
+#define WLC_E_BTA_HCI_EVENT     53      
+#define WLC_E_IF                54      
+#ifdef WLP2P
+#define WLC_E_P2P_DISC_LISTEN_COMPLETE  55      
+#endif
+#define WLC_E_RSSI              56      
+#define WLC_E_PFN_SCAN_COMPLETE 57      
+#define WLC_E_EXTLOG_MSG        58
+#define WLC_E_ACTION_FRAME      59      
+#define WLC_E_ACTION_FRAME_COMPLETE 60  
+#define WLC_E_PRE_ASSOC_IND     61      
+#define WLC_E_PRE_REASSOC_IND   62      
+#define WLC_E_CHANNEL_ADOPTED   63
+#define WLC_E_AP_STARTED        64      
+#define WLC_E_DFS_AP_STOP       65      
+#define WLC_E_DFS_AP_RESUME     66      
+#define WLC_E_WAI_STA_EVENT     67      
+#define WLC_E_WAI_MSG           68      
+#define WLC_E_ESCAN_RESULT      69      
+#define WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE    70      
+#if defined(WLP2P)
+#define WLC_E_PROBRESP_MSG      71      
+#define WLC_E_P2P_PROBREQ_MSG   72      
+#endif
+#define WLC_E_DCS_REQUEST 73
+
+#define WLC_E_FIFO_CREDIT_MAP   74 
+
+#define WLC_E_ACTION_FRAME_RX   75      
+#define WLC_E_WAKE_EVENT        76      
+#define WLC_E_RM_COMPLETE       77      
+#define WLC_E_HTSFSYNC          78      
+#define WLC_E_OVERLAY_REQ       79      
+#define WLC_E_CSA_COMPLETE_IND  80
+#define WLC_E_EXCESS_PM_WAKE_EVENT      81      
+#define WLC_E_PFN_SCAN_NONE             82      
+#define WLC_E_PFN_SCAN_ALLGONE  83      
+#define WLC_E_GTK_PLUMBED 84
+#define WLC_E_LAST      85
+
+
+typedef struct {
+        uint event;
+        const char *name;
+} bcmevent_name_t;
+
+extern const bcmevent_name_t    bcmevent_names[];
+extern const int                bcmevent_names_size;
+
+
+#define WLC_E_STATUS_SUCCESS            0       
+#define WLC_E_STATUS_FAIL               1       
+#define WLC_E_STATUS_TIMEOUT            2       
+#define WLC_E_STATUS_NO_NETWORKS        3       
+#define WLC_E_STATUS_ABORT              4       
+#define WLC_E_STATUS_NO_ACK             5       
+#define WLC_E_STATUS_UNSOLICITED        6       
+#define WLC_E_STATUS_ATTEMPT            7       
+#define WLC_E_STATUS_PARTIAL            8       
+#define WLC_E_STATUS_NEWSCAN            9       
+#define WLC_E_STATUS_NEWASSOC           10      
+#define WLC_E_STATUS_11HQUIET           11      
+#define WLC_E_STATUS_SUPPRESS           12      
+#define WLC_E_STATUS_NOCHANS            13      
+#define WLC_E_STATUS_CS_ABORT           15      
+#define WLC_E_STATUS_ERROR              16      
+
+
+#define WLC_E_REASON_INITIAL_ASSOC      0       
+#define WLC_E_REASON_LOW_RSSI           1       
+#define WLC_E_REASON_DEAUTH             2       
+#define WLC_E_REASON_DISASSOC           3       
+#define WLC_E_REASON_BCNS_LOST          4       
+#define WLC_E_REASON_MINTXRATE          9       
+#define WLC_E_REASON_TXFAIL             10      
+
+
+#define WLC_E_REASON_FAST_ROAM_FAILED   5       
+#define WLC_E_REASON_DIRECTED_ROAM      6       
+#define WLC_E_REASON_TSPEC_REJECTED     7       
+#define WLC_E_REASON_BETTER_AP          8       
+
+
+#define WLC_E_PRUNE_ENCR_MISMATCH       1       
+#define WLC_E_PRUNE_BCAST_BSSID         2       
+#define WLC_E_PRUNE_MAC_DENY            3       
+#define WLC_E_PRUNE_MAC_NA              4       
+#define WLC_E_PRUNE_REG_PASSV           5       
+#define WLC_E_PRUNE_SPCT_MGMT           6       
+#define WLC_E_PRUNE_RADAR               7       
+#define WLC_E_RSN_MISMATCH              8       
+#define WLC_E_PRUNE_NO_COMMON_RATES     9       
+#define WLC_E_PRUNE_BASIC_RATES         10      
+#define WLC_E_PRUNE_CIPHER_NA           12      
+#define WLC_E_PRUNE_KNOWN_STA           13      
+#define WLC_E_PRUNE_WDS_PEER            15      
+#define WLC_E_PRUNE_QBSS_LOAD           16      
+#define WLC_E_PRUNE_HOME_AP             17      
+
+
+#define WLC_E_SUP_OTHER                 0       
+#define WLC_E_SUP_DECRYPT_KEY_DATA      1       
+#define WLC_E_SUP_BAD_UCAST_WEP128      2       
+#define WLC_E_SUP_BAD_UCAST_WEP40       3       
+#define WLC_E_SUP_UNSUP_KEY_LEN         4       
+#define WLC_E_SUP_PW_KEY_CIPHER         5       
+#define WLC_E_SUP_MSG3_TOO_MANY_IE      6       
+#define WLC_E_SUP_MSG3_IE_MISMATCH      7       
+#define WLC_E_SUP_NO_INSTALL_FLAG       8       
+#define WLC_E_SUP_MSG3_NO_GTK           9       
+#define WLC_E_SUP_GRP_KEY_CIPHER        10      
+#define WLC_E_SUP_GRP_MSG1_NO_GTK       11      
+#define WLC_E_SUP_GTK_DECRYPT_FAIL      12      
+#define WLC_E_SUP_SEND_FAIL             13      
+#define WLC_E_SUP_DEAUTH                14      
+#define WLC_E_SUP_WPA_PSK_TMO           15      
+
+
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_rx_frame_data {
+        uint16  version;
+        uint16  channel;        
+        int32   rssi;
+        uint32  mactime;
+        uint32  rate;
+} BWL_POST_PACKED_STRUCT wl_event_rx_frame_data_t;
+
+#define BCM_RX_FRAME_DATA_VERSION 1
+
+
+typedef struct wl_event_data_if {
+        uint8 ifidx;
+        uint8 opcode;           
+        uint8 reserved;
+        uint8 bssidx;           
+        uint8 role;             
+} wl_event_data_if_t;
+
+
+#define WLC_E_IF_ADD            1       
+#define WLC_E_IF_DEL            2       
+#define WLC_E_IF_CHANGE         3       
+
+
+#define WLC_E_IF_ROLE_STA               0       
+#define WLC_E_IF_ROLE_AP                1       
+#define WLC_E_IF_ROLE_WDS               2       
+#define WLC_E_IF_ROLE_P2P_GO            3       
+#define WLC_E_IF_ROLE_P2P_CLIENT        4       
+#define WLC_E_IF_ROLE_BTA_CREATOR       5       
+#define WLC_E_IF_ROLE_BTA_ACCEPTOR      6       
+
+
+#define WLC_E_LINK_BCN_LOSS     1       
+#define WLC_E_LINK_DISASSOC     2       
+#define WLC_E_LINK_ASSOC_REC    3       
+#define WLC_E_LINK_BSSCFG_DIS   4       
+
+
+#define WLC_E_OVL_DOWNLOAD      0       
+#define WLC_E_OVL_UPDATE_IND    1       
+
+
+#include <packed_section_end.h>
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/proto/bcmip.h b/drivers/net/wireless/bcmdhd/include/proto/bcmip.h
new file mode 100644
index 00000000000..8a8f3146d56
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/bcmip.h
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * Fundamental constants relating to IP Protocol
+ *
+ * $Id: bcmip.h,v 9.19 2009-11-10 20:08:33 Exp $
+ */
+
+
+#ifndef _bcmip_h_
+#define _bcmip_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+
+#include <packed_section_start.h>
+
+
+
+#define IP_VER_OFFSET           0x0     
+#define IP_VER_MASK             0xf0    
+#define IP_VER_SHIFT            4       
+#define IP_VER_4                4       
+#define IP_VER_6                6       
+
+#define IP_VER(ip_body) \
+        ((((uint8 *)(ip_body))[IP_VER_OFFSET] & IP_VER_MASK) >> IP_VER_SHIFT)
+
+#define IP_PROT_ICMP            0x1     
+#define IP_PROT_TCP             0x6     
+#define IP_PROT_UDP             0x11    
+
+
+#define IPV4_VER_HL_OFFSET      0       
+#define IPV4_TOS_OFFSET         1       
+#define IPV4_PKTLEN_OFFSET      2       
+#define IPV4_PKTFLAG_OFFSET     6       
+#define IPV4_PROT_OFFSET        9       
+#define IPV4_CHKSUM_OFFSET      10      
+#define IPV4_SRC_IP_OFFSET      12      
+#define IPV4_DEST_IP_OFFSET     16      
+#define IPV4_OPTIONS_OFFSET     20      
+
+
+#define IPV4_VER_MASK           0xf0    
+#define IPV4_VER_SHIFT          4       
+
+#define IPV4_HLEN_MASK          0x0f    
+#define IPV4_HLEN(ipv4_body)    (4 * (((uint8 *)(ipv4_body))[IPV4_VER_HL_OFFSET] & IPV4_HLEN_MASK))
+
+#define IPV4_ADDR_LEN           4       
+
+#define IPV4_ADDR_NULL(a)       ((((uint8 *)(a))[0] | ((uint8 *)(a))[1] | \
+                                  ((uint8 *)(a))[2] | ((uint8 *)(a))[3]) == 0)
+
+#define IPV4_ADDR_BCAST(a)      ((((uint8 *)(a))[0] & ((uint8 *)(a))[1] & \
+                                  ((uint8 *)(a))[2] & ((uint8 *)(a))[3]) == 0xff)
+
+#define IPV4_TOS_DSCP_MASK      0xfc    
+#define IPV4_TOS_DSCP_SHIFT     2       
+
+#define IPV4_TOS(ipv4_body)     (((uint8 *)(ipv4_body))[IPV4_TOS_OFFSET])
+
+#define IPV4_TOS_PREC_MASK      0xe0    
+#define IPV4_TOS_PREC_SHIFT     5       
+
+#define IPV4_TOS_LOWDELAY       0x10    
+#define IPV4_TOS_THROUGHPUT     0x8     
+#define IPV4_TOS_RELIABILITY    0x4     
+
+#define IPV4_PROT(ipv4_body)    (((uint8 *)(ipv4_body))[IPV4_PROT_OFFSET])
+
+#define IPV4_FRAG_RESV          0x8000  
+#define IPV4_FRAG_DONT          0x4000  
+#define IPV4_FRAG_MORE          0x2000  
+#define IPV4_FRAG_OFFSET_MASK   0x1fff  
+
+#define IPV4_ADDR_STR_LEN       16      
+
+
+BWL_PRE_PACKED_STRUCT struct ipv4_addr {
+        uint8   addr[IPV4_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct ipv4_hdr {
+        uint8   version_ihl;            
+        uint8   tos;                    
+        uint16  tot_len;                
+        uint16  id;
+        uint16  frag;                   
+        uint8   ttl;                    
+        uint8   prot;                   
+        uint16  hdr_chksum;             
+        uint8   src_ip[IPV4_ADDR_LEN];  
+        uint8   dst_ip[IPV4_ADDR_LEN];  
+} BWL_POST_PACKED_STRUCT;
+
+
+#define IPV6_PAYLOAD_LEN_OFFSET 4       
+#define IPV6_NEXT_HDR_OFFSET    6       
+#define IPV6_HOP_LIMIT_OFFSET   7       
+#define IPV6_SRC_IP_OFFSET      8       
+#define IPV6_DEST_IP_OFFSET     24      
+
+
+#define IPV6_TRAFFIC_CLASS(ipv6_body) \
+        (((((uint8 *)(ipv6_body))[0] & 0x0f) << 4) | \
+         ((((uint8 *)(ipv6_body))[1] & 0xf0) >> 4))
+
+#define IPV6_FLOW_LABEL(ipv6_body) \
+        (((((uint8 *)(ipv6_body))[1] & 0x0f) << 16) | \
+         (((uint8 *)(ipv6_body))[2] << 8) | \
+         (((uint8 *)(ipv6_body))[3]))
+
+#define IPV6_PAYLOAD_LEN(ipv6_body) \
+        ((((uint8 *)(ipv6_body))[IPV6_PAYLOAD_LEN_OFFSET + 0] << 8) | \
+         ((uint8 *)(ipv6_body))[IPV6_PAYLOAD_LEN_OFFSET + 1])
+
+#define IPV6_NEXT_HDR(ipv6_body) \
+        (((uint8 *)(ipv6_body))[IPV6_NEXT_HDR_OFFSET])
+
+#define IPV6_PROT(ipv6_body)    IPV6_NEXT_HDR(ipv6_body)
+
+#define IPV6_ADDR_LEN           16      
+
+
+#define IP_TOS46(ip_body) \
+        (IP_VER(ip_body) == IP_VER_4 ? IPV4_TOS(ip_body) : \
+         IP_VER(ip_body) == IP_VER_6 ? IPV6_TRAFFIC_CLASS(ip_body) : 0)
+
+
+#include <packed_section_end.h>
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/proto/bt_amp_hci.h b/drivers/net/wireless/bcmdhd/include/proto/bt_amp_hci.h
new file mode 100644
index 00000000000..89c11817915
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/bt_amp_hci.h
@@ -0,0 +1,442 @@
+/*
+ * BT-AMP (BlueTooth Alternate Mac and Phy) HCI (Host/Controller Interface)
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bt_amp_hci.h,v 9.14.8.2 2010-09-10 18:37:47 Exp $
+*/
+
+#ifndef _bt_amp_hci_h
+#define _bt_amp_hci_h
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* AMP HCI CMD packet format */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_cmd {
+        uint16 opcode;
+        uint8 plen;
+        uint8 parms[1];
+} BWL_POST_PACKED_STRUCT amp_hci_cmd_t;
+
+#define HCI_CMD_PREAMBLE_SIZE           OFFSETOF(amp_hci_cmd_t, parms)
+#define HCI_CMD_DATA_SIZE               255
+
+/* AMP HCI CMD opcode layout */
+#define HCI_CMD_OPCODE(ogf, ocf)        ((((ogf) & 0x3F) << 10) | ((ocf) & 0x03FF))
+#define HCI_CMD_OGF(opcode)             ((uint8)(((opcode) >> 10) & 0x3F))
+#define HCI_CMD_OCF(opcode)             ((opcode) & 0x03FF)
+
+/* AMP HCI command opcodes */
+#define HCI_Read_Failed_Contact_Counter         HCI_CMD_OPCODE(0x05, 0x0001)
+#define HCI_Reset_Failed_Contact_Counter        HCI_CMD_OPCODE(0x05, 0x0002)
+#define HCI_Read_Link_Quality                   HCI_CMD_OPCODE(0x05, 0x0003)
+#define HCI_Read_Local_AMP_Info                 HCI_CMD_OPCODE(0x05, 0x0009)
+#define HCI_Read_Local_AMP_ASSOC                HCI_CMD_OPCODE(0x05, 0x000A)
+#define HCI_Write_Remote_AMP_ASSOC              HCI_CMD_OPCODE(0x05, 0x000B)
+#define HCI_Create_Physical_Link                HCI_CMD_OPCODE(0x01, 0x0035)
+#define HCI_Accept_Physical_Link_Request        HCI_CMD_OPCODE(0x01, 0x0036)
+#define HCI_Disconnect_Physical_Link            HCI_CMD_OPCODE(0x01, 0x0037)
+#define HCI_Create_Logical_Link                 HCI_CMD_OPCODE(0x01, 0x0038)
+#define HCI_Accept_Logical_Link                 HCI_CMD_OPCODE(0x01, 0x0039)
+#define HCI_Disconnect_Logical_Link             HCI_CMD_OPCODE(0x01, 0x003A)
+#define HCI_Logical_Link_Cancel                 HCI_CMD_OPCODE(0x01, 0x003B)
+#define HCI_Flow_Spec_Modify                    HCI_CMD_OPCODE(0x01, 0x003C)
+#define HCI_Write_Flow_Control_Mode             HCI_CMD_OPCODE(0x01, 0x0067)
+#define HCI_Read_Best_Effort_Flush_Timeout      HCI_CMD_OPCODE(0x01, 0x0069)
+#define HCI_Write_Best_Effort_Flush_Timeout     HCI_CMD_OPCODE(0x01, 0x006A)
+#define HCI_Short_Range_Mode                    HCI_CMD_OPCODE(0x01, 0x006B)
+#define HCI_Reset                               HCI_CMD_OPCODE(0x03, 0x0003)
+#define HCI_Read_Connection_Accept_Timeout      HCI_CMD_OPCODE(0x03, 0x0015)
+#define HCI_Write_Connection_Accept_Timeout     HCI_CMD_OPCODE(0x03, 0x0016)
+#define HCI_Read_Link_Supervision_Timeout       HCI_CMD_OPCODE(0x03, 0x0036)
+#define HCI_Write_Link_Supervision_Timeout      HCI_CMD_OPCODE(0x03, 0x0037)
+#define HCI_Enhanced_Flush                      HCI_CMD_OPCODE(0x03, 0x005F)
+#define HCI_Read_Logical_Link_Accept_Timeout    HCI_CMD_OPCODE(0x03, 0x0061)
+#define HCI_Write_Logical_Link_Accept_Timeout   HCI_CMD_OPCODE(0x03, 0x0062)
+#define HCI_Set_Event_Mask_Page_2               HCI_CMD_OPCODE(0x03, 0x0063)
+#define HCI_Read_Location_Data_Command          HCI_CMD_OPCODE(0x03, 0x0064)
+#define HCI_Write_Location_Data_Command         HCI_CMD_OPCODE(0x03, 0x0065)
+#define HCI_Read_Local_Version_Info             HCI_CMD_OPCODE(0x04, 0x0001)
+#define HCI_Read_Local_Supported_Commands       HCI_CMD_OPCODE(0x04, 0x0002)
+#define HCI_Read_Buffer_Size                    HCI_CMD_OPCODE(0x04, 0x0005)
+#define HCI_Read_Data_Block_Size                HCI_CMD_OPCODE(0x04, 0x000A)
+
+/* AMP HCI command parameters */
+typedef BWL_PRE_PACKED_STRUCT struct read_local_cmd_parms {
+        uint8 plh;
+        uint8 offset[2];                        /* length so far */
+        uint8 max_remote[2];
+} BWL_POST_PACKED_STRUCT read_local_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct write_remote_cmd_parms {
+        uint8 plh;
+        uint8 offset[2];
+        uint8 len[2];
+        uint8 frag[1];
+} BWL_POST_PACKED_STRUCT write_remote_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct phy_link_cmd_parms {
+        uint8 plh;
+        uint8 key_length;
+        uint8 key_type;
+        uint8 key[1];
+} BWL_POST_PACKED_STRUCT phy_link_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct dis_phy_link_cmd_parms {
+        uint8 plh;
+        uint8 reason;
+} BWL_POST_PACKED_STRUCT dis_phy_link_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_cmd_parms {
+        uint8 plh;
+        uint8 txflow[16];
+        uint8 rxflow[16];
+} BWL_POST_PACKED_STRUCT log_link_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ext_flow_spec {
+        uint8 id;
+        uint8 service_type;
+        uint8 max_sdu[2];
+        uint8 sdu_ia_time[4];
+        uint8 access_latency[4];
+        uint8 flush_timeout[4];
+} BWL_POST_PACKED_STRUCT ext_flow_spec_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_cancel_cmd_parms {
+        uint8 plh;
+        uint8 tx_fs_ID;
+} BWL_POST_PACKED_STRUCT log_link_cancel_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct flow_spec_mod_cmd_parms {
+        uint8 llh[2];
+        uint8 txflow[16];
+        uint8 rxflow[16];
+} BWL_POST_PACKED_STRUCT flow_spec_mod_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct plh_pad {
+        uint8 plh;
+        uint8 pad;
+} BWL_POST_PACKED_STRUCT plh_pad_t;
+
+typedef BWL_PRE_PACKED_STRUCT union hci_handle {
+        uint16 bredr;
+        plh_pad_t amp;
+} BWL_POST_PACKED_STRUCT hci_handle_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ls_to_cmd_parms {
+        hci_handle_t handle;
+        uint8 timeout[2];
+} BWL_POST_PACKED_STRUCT ls_to_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct befto_cmd_parms {
+        uint8 llh[2];
+        uint8 befto[4];
+} BWL_POST_PACKED_STRUCT befto_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct srm_cmd_parms {
+        uint8 plh;
+        uint8 srm;
+} BWL_POST_PACKED_STRUCT srm_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ld_cmd_parms {
+        uint8 ld_aware;
+        uint8 ld[2];
+        uint8 ld_opts;
+        uint8 l_opts;
+} BWL_POST_PACKED_STRUCT ld_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct eflush_cmd_parms {
+        uint8 llh[2];
+        uint8 packet_type;
+} BWL_POST_PACKED_STRUCT eflush_cmd_parms_t;
+
+/* Generic AMP extended flow spec service types */
+#define EFS_SVCTYPE_NO_TRAFFIC          0
+#define EFS_SVCTYPE_BEST_EFFORT         1
+#define EFS_SVCTYPE_GUARANTEED          2
+
+/* AMP HCI event packet format */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_event {
+        uint8 ecode;
+        uint8 plen;
+        uint8 parms[1];
+} BWL_POST_PACKED_STRUCT amp_hci_event_t;
+
+#define HCI_EVT_PREAMBLE_SIZE                   OFFSETOF(amp_hci_event_t, parms)
+
+/* AMP HCI event codes */
+#define HCI_Command_Complete                    0x0E
+#define HCI_Command_Status                      0x0F
+#define HCI_Flush_Occurred                      0x11
+#define HCI_Enhanced_Flush_Complete             0x39
+#define HCI_Physical_Link_Complete              0x40
+#define HCI_Channel_Select                      0x41
+#define HCI_Disconnect_Physical_Link_Complete   0x42
+#define HCI_Logical_Link_Complete               0x45
+#define HCI_Disconnect_Logical_Link_Complete    0x46
+#define HCI_Flow_Spec_Modify_Complete           0x47
+#define HCI_Number_of_Completed_Data_Blocks     0x48
+#define HCI_Short_Range_Mode_Change_Complete    0x4C
+#define HCI_Status_Change_Event                 0x4D
+#define HCI_Vendor_Specific                     0xFF
+
+/* AMP HCI event mask bit positions */
+#define HCI_Physical_Link_Complete_Event_Mask                   0x0001
+#define HCI_Channel_Select_Event_Mask                           0x0002
+#define HCI_Disconnect_Physical_Link_Complete_Event_Mask        0x0004
+#define HCI_Logical_Link_Complete_Event_Mask                    0x0020
+#define HCI_Disconnect_Logical_Link_Complete_Event_Mask         0x0040
+#define HCI_Flow_Spec_Modify_Complete_Event_Mask                0x0080
+#define HCI_Number_of_Completed_Data_Blocks_Event_Mask          0x0100
+#define HCI_Short_Range_Mode_Change_Complete_Event_Mask         0x1000
+#define HCI_Status_Change_Event_Mask                            0x2000
+#define HCI_All_Event_Mask                                      0x31e7
+
+/* AMP HCI event parameters */
+typedef BWL_PRE_PACKED_STRUCT struct cmd_status_parms {
+        uint8 status;
+        uint8 cmdpkts;
+        uint16 opcode;
+} BWL_POST_PACKED_STRUCT cmd_status_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct cmd_complete_parms {
+        uint8 cmdpkts;
+        uint16 opcode;
+        uint8 parms[1];
+} BWL_POST_PACKED_STRUCT cmd_complete_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct flush_occurred_evt_parms {
+        uint16 handle;
+} BWL_POST_PACKED_STRUCT flush_occurred_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct write_remote_evt_parms {
+        uint8 status;
+        uint8 plh;
+} BWL_POST_PACKED_STRUCT write_remote_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_local_evt_parms {
+        uint8 status;
+        uint8 plh;
+        uint16 len;
+        uint8 frag[1];
+} BWL_POST_PACKED_STRUCT read_local_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_local_info_evt_parms {
+        uint8 status;
+        uint8 AMP_status;
+        uint32 bandwidth;
+        uint32 gbandwidth;
+        uint32 latency;
+        uint32 PDU_size;
+        uint8 ctrl_type;
+        uint16 PAL_cap;
+        uint16 AMP_ASSOC_len;
+        uint32 max_flush_timeout;
+        uint32 be_flush_timeout;
+} BWL_POST_PACKED_STRUCT read_local_info_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_evt_parms {
+        uint8 status;
+        uint16 llh;
+        uint8 plh;
+        uint8 tx_fs_ID;
+} BWL_POST_PACKED_STRUCT log_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct disc_log_link_evt_parms {
+        uint8 status;
+        uint16 llh;
+        uint8 reason;
+} BWL_POST_PACKED_STRUCT disc_log_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_cancel_evt_parms {
+        uint8 status;
+        uint8 plh;
+        uint8 tx_fs_ID;
+} BWL_POST_PACKED_STRUCT log_link_cancel_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct flow_spec_mod_evt_parms {
+        uint8 status;
+        uint16 llh;
+} BWL_POST_PACKED_STRUCT flow_spec_mod_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct phy_link_evt_parms {
+        uint8 status;
+        uint8 plh;
+} BWL_POST_PACKED_STRUCT phy_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct dis_phy_link_evt_parms {
+        uint8 status;
+        uint8 plh;
+        uint8 reason;
+} BWL_POST_PACKED_STRUCT dis_phy_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_ls_to_evt_parms {
+        uint8 status;
+        hci_handle_t handle;
+        uint16 timeout;
+} BWL_POST_PACKED_STRUCT read_ls_to_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_lla_ca_to_evt_parms {
+        uint8 status;
+        uint16 timeout;
+} BWL_POST_PACKED_STRUCT read_lla_ca_to_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_data_block_size_evt_parms {
+        uint8 status;
+        uint16 ACL_pkt_len;
+        uint16 data_block_len;
+        uint16 data_block_num;
+} BWL_POST_PACKED_STRUCT read_data_block_size_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct data_blocks {
+        uint16 handle;
+        uint16 pkts;
+        uint16 blocks;
+} BWL_POST_PACKED_STRUCT data_blocks_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct num_completed_data_blocks_evt_parms {
+        uint16 num_blocks;
+        uint8 num_handles;
+        data_blocks_t completed[1];
+} BWL_POST_PACKED_STRUCT num_completed_data_blocks_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct befto_evt_parms {
+        uint8 status;
+        uint32 befto;
+} BWL_POST_PACKED_STRUCT befto_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct srm_evt_parms {
+        uint8 status;
+        uint8 plh;
+        uint8 srm;
+} BWL_POST_PACKED_STRUCT srm_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct contact_counter_evt_parms {
+        uint8 status;
+        uint8 llh[2];
+        uint16 counter;
+} BWL_POST_PACKED_STRUCT contact_counter_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct contact_counter_reset_evt_parms {
+        uint8 status;
+        uint8 llh[2];
+} BWL_POST_PACKED_STRUCT contact_counter_reset_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_linkq_evt_parms {
+        uint8 status;
+        hci_handle_t handle;
+        uint8 link_quality;
+} BWL_POST_PACKED_STRUCT read_linkq_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ld_evt_parms {
+        uint8 status;
+        uint8 ld_aware;
+        uint8 ld[2];
+        uint8 ld_opts;
+        uint8 l_opts;
+} BWL_POST_PACKED_STRUCT ld_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct eflush_complete_evt_parms {
+        uint16 handle;
+} BWL_POST_PACKED_STRUCT eflush_complete_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct vendor_specific_evt_parms {
+        uint8 len;
+        uint8 parms[1];
+} BWL_POST_PACKED_STRUCT vendor_specific_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct local_version_info_evt_parms {
+        uint8 status;
+        uint8 hci_version;
+        uint16 hci_revision;
+        uint8 pal_version;
+        uint16 mfg_name;
+        uint16 pal_subversion;
+} BWL_POST_PACKED_STRUCT local_version_info_evt_parms_t;
+
+#define MAX_SUPPORTED_CMD_BYTE  64
+typedef BWL_PRE_PACKED_STRUCT struct local_supported_cmd_evt_parms {
+        uint8 status;
+        uint8 cmd[MAX_SUPPORTED_CMD_BYTE];
+} BWL_POST_PACKED_STRUCT local_supported_cmd_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct status_change_evt_parms {
+        uint8 status;
+        uint8 amp_status;
+} BWL_POST_PACKED_STRUCT status_change_evt_parms_t;
+
+/* AMP HCI error codes */
+#define HCI_SUCCESS                             0x00
+#define HCI_ERR_ILLEGAL_COMMAND                 0x01
+#define HCI_ERR_NO_CONNECTION                   0x02
+#define HCI_ERR_MEMORY_FULL                     0x07
+#define HCI_ERR_CONNECTION_TIMEOUT              0x08
+#define HCI_ERR_MAX_NUM_OF_CONNECTIONS          0x09
+#define HCI_ERR_CONNECTION_EXISTS               0x0B
+#define HCI_ERR_CONNECTION_DISALLOWED           0x0C
+#define HCI_ERR_CONNECTION_ACCEPT_TIMEOUT       0x10
+#define HCI_ERR_UNSUPPORTED_VALUE               0x11
+#define HCI_ERR_ILLEGAL_PARAMETER_FMT           0x12
+#define HCI_ERR_CONN_TERM_BY_LOCAL_HOST         0x16
+#define HCI_ERR_UNSPECIFIED                     0x1F
+#define HCI_ERR_UNIT_KEY_USED                   0x26
+#define HCI_ERR_QOS_REJECTED                    0x2D
+#define HCI_ERR_PARAM_OUT_OF_RANGE              0x30
+#define HCI_ERR_NO_SUITABLE_CHANNEL             0x39
+#define HCI_ERR_CHANNEL_MOVE                    0xFF
+
+/* AMP HCI ACL Data packet format */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_ACL_data {
+        uint16  handle;                 /* 12-bit connection handle + 2-bit PB and 2-bit BC flags */
+        uint16  dlen;                   /* data total length */
+        uint8 data[1];
+} BWL_POST_PACKED_STRUCT amp_hci_ACL_data_t;
+
+#define HCI_ACL_DATA_PREAMBLE_SIZE      OFFSETOF(amp_hci_ACL_data_t, data)
+
+#define HCI_ACL_DATA_BC_FLAGS           (0x0 << 14)
+#define HCI_ACL_DATA_PB_FLAGS           (0x3 << 12)
+
+#define HCI_ACL_DATA_HANDLE(handle)     ((handle) & 0x0fff)
+#define HCI_ACL_DATA_FLAGS(handle)      ((handle) >> 12)
+
+/* AMP Activity Report packet formats */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_activity_report {
+        uint8   ScheduleKnown;
+        uint8   NumReports;
+        uint8   data[1];
+} BWL_POST_PACKED_STRUCT amp_hci_activity_report_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_activity_report_triple {
+        uint32  StartTime;
+        uint32  Duration;
+        uint32  Periodicity;
+} BWL_POST_PACKED_STRUCT amp_hci_activity_report_triple_t;
+
+#define HCI_AR_SCHEDULE_KNOWN           0x01
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _bt_amp_hci_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/proto/eapol.h b/drivers/net/wireless/bcmdhd/include/proto/eapol.h
new file mode 100644
index 00000000000..5781d1312e3
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/eapol.h
@@ -0,0 +1,173 @@
+/*
+ * 802.1x EAPOL definitions
+ *
+ * See
+ * IEEE Std 802.1X-2001
+ * IEEE 802.1X RADIUS Usage Guidelines
+ *
+ * Copyright (C) 2002 Broadcom Corporation
+ *
+ * $Id: eapol.h,v 9.23.86.1 2010-09-02 18:09:39 Exp $
+ */
+
+#ifndef _eapol_h_
+#define _eapol_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#include <bcmcrypto/aeskeywrap.h>
+
+/* EAPOL for 802.3/Ethernet */
+typedef struct {
+        struct ether_header eth;        /* 802.3/Ethernet header */
+        unsigned char version;          /* EAPOL protocol version */
+        unsigned char type;             /* EAPOL type */
+        unsigned short length;          /* Length of body */
+        unsigned char body[1];          /* Body (optional) */
+} eapol_header_t;
+
+#define EAPOL_HEADER_LEN 18
+
+/* EAPOL version */
+#define WPA2_EAPOL_VERSION      2
+#define WPA_EAPOL_VERSION       1
+#define LEAP_EAPOL_VERSION      1
+#define SES_EAPOL_VERSION       1
+
+/* EAPOL types */
+#define EAP_PACKET              0
+#define EAPOL_START             1
+#define EAPOL_LOGOFF            2
+#define EAPOL_KEY               3
+#define EAPOL_ASF               4
+
+/* EAPOL-Key types */
+#define EAPOL_RC4_KEY           1
+#define EAPOL_WPA2_KEY          2       /* 802.11i/WPA2 */
+#define EAPOL_WPA_KEY           254     /* WPA */
+
+/* RC4 EAPOL-Key header field sizes */
+#define EAPOL_KEY_REPLAY_LEN    8
+#define EAPOL_KEY_IV_LEN        16
+#define EAPOL_KEY_SIG_LEN       16
+
+/* RC4 EAPOL-Key */
+typedef BWL_PRE_PACKED_STRUCT struct {
+        unsigned char type;                     /* Key Descriptor Type */
+        unsigned short length;                  /* Key Length (unaligned) */
+        unsigned char replay[EAPOL_KEY_REPLAY_LEN];     /* Replay Counter */
+        unsigned char iv[EAPOL_KEY_IV_LEN];             /* Key IV */
+        unsigned char index;                            /* Key Flags & Index */
+        unsigned char signature[EAPOL_KEY_SIG_LEN];     /* Key Signature */
+        unsigned char key[1];                           /* Key (optional) */
+} BWL_POST_PACKED_STRUCT eapol_key_header_t;
+
+#define EAPOL_KEY_HEADER_LEN    44
+
+/* RC4 EAPOL-Key flags */
+#define EAPOL_KEY_FLAGS_MASK    0x80
+#define EAPOL_KEY_BROADCAST     0
+#define EAPOL_KEY_UNICAST       0x80
+
+/* RC4 EAPOL-Key index */
+#define EAPOL_KEY_INDEX_MASK    0x7f
+
+/* WPA/802.11i/WPA2 EAPOL-Key header field sizes */
+#define EAPOL_WPA_KEY_REPLAY_LEN        8
+#define EAPOL_WPA_KEY_NONCE_LEN         32
+#define EAPOL_WPA_KEY_IV_LEN            16
+#define EAPOL_WPA_KEY_RSC_LEN           8
+#define EAPOL_WPA_KEY_ID_LEN            8
+#define EAPOL_WPA_KEY_MIC_LEN           16
+#define EAPOL_WPA_KEY_DATA_LEN          (EAPOL_WPA_MAX_KEY_SIZE + AKW_BLOCK_LEN)
+#define EAPOL_WPA_MAX_KEY_SIZE          32
+
+/* WPA EAPOL-Key */
+typedef BWL_PRE_PACKED_STRUCT struct {
+        unsigned char type;             /* Key Descriptor Type */
+        unsigned short key_info;        /* Key Information (unaligned) */
+        unsigned short key_len;         /* Key Length (unaligned) */
+        unsigned char replay[EAPOL_WPA_KEY_REPLAY_LEN]; /* Replay Counter */
+        unsigned char nonce[EAPOL_WPA_KEY_NONCE_LEN];   /* Nonce */
+        unsigned char iv[EAPOL_WPA_KEY_IV_LEN];         /* Key IV */
+        unsigned char rsc[EAPOL_WPA_KEY_RSC_LEN];       /* Key RSC */
+        unsigned char id[EAPOL_WPA_KEY_ID_LEN];         /* WPA:Key ID, 802.11i/WPA2: Reserved */
+        unsigned char mic[EAPOL_WPA_KEY_MIC_LEN];       /* Key MIC */
+        unsigned short data_len;                        /* Key Data Length */
+        unsigned char data[EAPOL_WPA_KEY_DATA_LEN];     /* Key data */
+} BWL_POST_PACKED_STRUCT eapol_wpa_key_header_t;
+
+#define EAPOL_WPA_KEY_LEN               95
+
+/* WPA/802.11i/WPA2 KEY KEY_INFO bits */
+#define WPA_KEY_DESC_V1         0x01
+#define WPA_KEY_DESC_V2         0x02
+#define WPA_KEY_DESC_V3         0x03
+#define WPA_KEY_PAIRWISE        0x08
+#define WPA_KEY_INSTALL         0x40
+#define WPA_KEY_ACK             0x80
+#define WPA_KEY_MIC             0x100
+#define WPA_KEY_SECURE          0x200
+#define WPA_KEY_ERROR           0x400
+#define WPA_KEY_REQ             0x800
+
+/* WPA-only KEY KEY_INFO bits */
+#define WPA_KEY_INDEX_0         0x00
+#define WPA_KEY_INDEX_1         0x10
+#define WPA_KEY_INDEX_2         0x20
+#define WPA_KEY_INDEX_3         0x30
+#define WPA_KEY_INDEX_MASK      0x30
+#define WPA_KEY_INDEX_SHIFT     0x04
+
+/* 802.11i/WPA2-only KEY KEY_INFO bits */
+#define WPA_KEY_ENCRYPTED_DATA  0x1000
+
+/* Key Data encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+        uint8 type;
+        uint8 length;
+        uint8 oui[3];
+        uint8 subtype;
+        uint8 data[1];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_encap_data_t;
+
+#define EAPOL_WPA2_ENCAP_DATA_HDR_LEN   6
+
+#define WPA2_KEY_DATA_SUBTYPE_GTK       1
+#define WPA2_KEY_DATA_SUBTYPE_STAKEY    2
+#define WPA2_KEY_DATA_SUBTYPE_MAC       3
+#define WPA2_KEY_DATA_SUBTYPE_PMKID     4
+
+/* GTK encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+        uint8   flags;
+        uint8   reserved;
+        uint8   gtk[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_gtk_encap_t;
+
+#define EAPOL_WPA2_KEY_GTK_ENCAP_HDR_LEN        2
+
+#define WPA2_GTK_INDEX_MASK     0x03
+#define WPA2_GTK_INDEX_SHIFT    0x00
+
+#define WPA2_GTK_TRANSMIT       0x04
+
+/* STAKey encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+        uint8   reserved[2];
+        uint8   mac[ETHER_ADDR_LEN];
+        uint8   stakey[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_stakey_encap_t;
+
+#define WPA2_KEY_DATA_PAD       0xdd
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _eapol_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/proto/ethernet.h b/drivers/net/wireless/bcmdhd/include/proto/ethernet.h
new file mode 100644
index 00000000000..6a6dd14c1bb
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/ethernet.h
@@ -0,0 +1,162 @@
+/*
+ * From FreeBSD 2.2.7: Fundamental constants relating to ethernet.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: ethernet.h,v 9.56 2009-10-15 22:54:58 Exp $
+ */
+
+
+#ifndef _NET_ETHERNET_H_              
+#define _NET_ETHERNET_H_
+
+#ifndef _TYPEDEFS_H_
+#include "typedefs.h"
+#endif
+
+
+#include <packed_section_start.h>
+
+
+
+#define ETHER_ADDR_LEN          6
+
+
+#define ETHER_TYPE_LEN          2
+
+
+#define ETHER_CRC_LEN           4
+
+
+#define ETHER_HDR_LEN           (ETHER_ADDR_LEN * 2 + ETHER_TYPE_LEN)
+
+
+#define ETHER_MIN_LEN           64
+
+
+#define ETHER_MIN_DATA          46
+
+
+#define ETHER_MAX_LEN           1518
+
+
+#define ETHER_MAX_DATA          1500
+
+
+#define ETHER_TYPE_MIN          0x0600          
+#define ETHER_TYPE_IP           0x0800          
+#define ETHER_TYPE_ARP          0x0806          
+#define ETHER_TYPE_8021Q        0x8100          
+#define ETHER_TYPE_BRCM         0x886c          
+#define ETHER_TYPE_802_1X       0x888e          
+#define ETHER_TYPE_802_1X_PREAUTH 0x88c7        
+#define ETHER_TYPE_WAI          0x88b4          
+
+
+
+#define ETHER_BRCM_SUBTYPE_LEN  4       
+#define ETHER_BRCM_CRAM         1       
+
+
+#define ETHER_DEST_OFFSET       (0 * ETHER_ADDR_LEN)    
+#define ETHER_SRC_OFFSET        (1 * ETHER_ADDR_LEN)    
+#define ETHER_TYPE_OFFSET       (2 * ETHER_ADDR_LEN)    
+
+
+#define ETHER_IS_VALID_LEN(foo) \
+        ((foo) >= ETHER_MIN_LEN && (foo) <= ETHER_MAX_LEN)
+
+#define ETHER_FILL_MCAST_ADDR_FROM_IP(ea, mgrp_ip) {            \
+                ((uint8 *)ea)[0] = 0x01;                        \
+                ((uint8 *)ea)[1] = 0x00;                        \
+                ((uint8 *)ea)[2] = 0x5e;                        \
+                ((uint8 *)ea)[3] = ((mgrp_ip) >> 16) & 0x7f;    \
+                ((uint8 *)ea)[4] = ((mgrp_ip) >>  8) & 0xff;    \
+                ((uint8 *)ea)[5] = ((mgrp_ip) >>  0) & 0xff;    \
+}
+
+#ifndef __INCif_etherh       
+
+BWL_PRE_PACKED_STRUCT struct ether_header {
+        uint8   ether_dhost[ETHER_ADDR_LEN];
+        uint8   ether_shost[ETHER_ADDR_LEN];
+        uint16  ether_type;
+} BWL_POST_PACKED_STRUCT;
+
+
+BWL_PRE_PACKED_STRUCT struct    ether_addr {
+        uint8 octet[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+#endif  
+
+
+#define ETHER_SET_LOCALADDR(ea) (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] | 2))
+#define ETHER_IS_LOCALADDR(ea)  (((uint8 *)(ea))[0] & 2)
+#define ETHER_CLR_LOCALADDR(ea) (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & 0xd))
+#define ETHER_TOGGLE_LOCALADDR(ea)      (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] ^ 2))
+
+
+#define ETHER_SET_UNICAST(ea)   (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & ~1))
+
+
+#define ETHER_ISMULTI(ea) (((const uint8 *)(ea))[0] & 1)
+
+
+
+#define ether_cmp(a, b) (!(((short*)a)[0] == ((short*)b)[0]) | \
+                         !(((short*)a)[1] == ((short*)b)[1]) | \
+                         !(((short*)a)[2] == ((short*)b)[2]))
+
+
+#define ether_copy(s, d) { \
+                ((short*)d)[0] = ((short*)s)[0]; \
+                ((short*)d)[1] = ((short*)s)[1]; \
+                ((short*)d)[2] = ((short*)s)[2]; }
+
+
+static const struct ether_addr ether_bcast = {{255, 255, 255, 255, 255, 255}};
+static const struct ether_addr ether_null = {{0, 0, 0, 0, 0, 0}};
+
+#define ETHER_ISBCAST(ea)       ((((uint8 *)(ea))[0] &          \
+                                  ((uint8 *)(ea))[1] &          \
+                                  ((uint8 *)(ea))[2] &          \
+                                  ((uint8 *)(ea))[3] &          \
+                                  ((uint8 *)(ea))[4] &          \
+                                  ((uint8 *)(ea))[5]) == 0xff)
+#define ETHER_ISNULLADDR(ea)    ((((uint8 *)(ea))[0] |          \
+                                  ((uint8 *)(ea))[1] |          \
+                                  ((uint8 *)(ea))[2] |          \
+                                  ((uint8 *)(ea))[3] |          \
+                                  ((uint8 *)(ea))[4] |          \
+                                  ((uint8 *)(ea))[5]) == 0)
+
+
+#define ETHER_MOVE_HDR(d, s) \
+do { \
+        struct ether_header t; \
+        t = *(struct ether_header *)(s); \
+        *(struct ether_header *)(d) = t; \
+} while (0)
+
+
+#include <packed_section_end.h>
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/proto/p2p.h b/drivers/net/wireless/bcmdhd/include/proto/p2p.h
new file mode 100644
index 00000000000..4a0c9d1ddc3
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/p2p.h
@@ -0,0 +1,512 @@
+/*
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * Fundamental types and constants relating to WFA P2P (aka WiFi Direct)
+ *
+ * $Id: p2p.h,v 9.17.2.4 2010-12-15 21:41:21 Exp $
+ */
+
+#ifndef _P2P_H_
+#define _P2P_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+#include <wlioctl.h>
+#include <proto/802.11.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* WiFi P2P OUI values */
+#define P2P_OUI         WFA_OUI             /* WiFi P2P OUI */
+#define P2P_VER         WFA_OUI_TYPE_P2P    /* P2P version: 9=WiFi P2P v1.0 */
+
+#define P2P_IE_ID       0xdd            /* P2P IE element ID */
+
+/* WiFi P2P IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ie {
+        uint8   id;     /* IE ID: 0xDD */
+        uint8   len;        /* IE length */
+        uint8   OUI[3];     /* WiFi P2P specific OUI: P2P_OUI */
+        uint8   oui_type;   /* Identifies P2P version: P2P_VER */
+        uint8   subelts[1]; /* variable length subelements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ie wifi_p2p_ie_t;
+
+#define P2P_IE_FIXED_LEN    6
+
+#define P2P_ATTR_ID_OFF         0
+#define P2P_ATTR_LEN_OFF        1
+#define P2P_ATTR_DATA_OFF       3
+
+#define P2P_ATTR_HDR_LEN        3 /* ID + 2-byte length field spec 1.02 */
+
+/* P2P IE Subelement IDs from WiFi P2P Technical Spec 1.00 */
+#define P2P_SEID_STATUS         0   /* Status */
+#define P2P_SEID_MINOR_RC       1   /* Minor Reason Code */
+#define P2P_SEID_P2P_INFO       2   /* P2P Capability (capabilities info) */
+#define P2P_SEID_DEV_ID         3   /* P2P Device ID */
+#define P2P_SEID_INTENT         4   /* Group Owner Intent */
+#define P2P_SEID_CFG_TIMEOUT        5   /* Configuration Timeout */
+#define P2P_SEID_CHANNEL        6   /* Channel */
+#define P2P_SEID_GRP_BSSID      7   /* P2P Group BSSID */
+#define P2P_SEID_XT_TIMING      8   /* Extended Listen Timing */
+#define P2P_SEID_INTINTADDR     9   /* Intended P2P Interface Address */
+#define P2P_SEID_P2P_MGBTY      10  /* P2P Manageability */
+#define P2P_SEID_CHAN_LIST      11  /* Channel List */
+#define P2P_SEID_ABSENCE        12  /* Notice of Absence */
+#define P2P_SEID_DEV_INFO       13  /* Device Info */
+#define P2P_SEID_GROUP_INFO     14  /* Group Info */
+#define P2P_SEID_GROUP_ID       15  /* Group ID */
+#define P2P_SEID_P2P_IF         16  /* P2P Interface */
+#define P2P_SEID_VNDR           221 /* Vendor-specific subelement */
+
+#define P2P_SE_VS_ID_SERVICES   0x1b /* BRCM proprietary subel: L2 Services */
+
+
+/* WiFi P2P IE subelement: P2P Capability (capabilities info) */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_info_se_s {
+        uint8   eltId;      /* SE ID: P2P_SEID_P2P_INFO */
+        uint8   len[2];     /* SE length not including eltId, len fields */
+        uint8   dev;        /* Device Capability Bitmap */
+        uint8   group;      /* Group Capability Bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_info_se_s wifi_p2p_info_se_t;
+
+/* P2P Capability subelement's Device Capability Bitmap bit values */
+#define P2P_CAPSE_DEV_SERVICE_DIS   0x1 /* Service Discovery */
+#define P2P_CAPSE_DEV_CLIENT_DIS    0x2 /* Client Discoverability */
+#define P2P_CAPSE_DEV_CONCURRENT    0x4 /* Concurrent Operation */
+#define P2P_CAPSE_DEV_INFRA_MAN     0x8 /* P2P Infrastructure Managed */
+#define P2P_CAPSE_DEV_LIMIT         0x10 /* P2P Device Limit */
+#define P2P_CAPSE_INVITE_PROC       0x20 /* P2P Invitation Procedure */
+
+/* P2P Capability subelement's Group Capability Bitmap bit values */
+#define P2P_CAPSE_GRP_OWNER         0x1 /* P2P Group Owner */
+#define P2P_CAPSE_PERSIST_GRP       0x2 /* Persistent P2P Group */
+#define P2P_CAPSE_GRP_LIMIT         0x4 /* P2P Group Limit */
+#define P2P_CAPSE_GRP_INTRA_BSS     0x8 /* Intra-BSS Distribution */
+#define P2P_CAPSE_GRP_X_CONNECT     0x10 /* Cross Connection */
+#define P2P_CAPSE_GRP_PERSISTENT    0x20 /* Persistent Reconnect */
+#define P2P_CAPSE_GRP_FORMATION     0x40 /* Group Formation */
+
+
+/* WiFi P2P IE subelement: Group Owner Intent */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intent_se_s {
+        uint8   eltId;      /* SE ID: P2P_SEID_INTENT */
+        uint8   len[2];     /* SE length not including eltId, len fields */
+        uint8   intent;     /* Intent Value 0...15 (0=legacy 15=master only) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intent_se_s wifi_p2p_intent_se_t;
+
+/* WiFi P2P IE subelement: Configuration Timeout */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cfg_tmo_se_s {
+        uint8   eltId;      /* SE ID: P2P_SEID_CFG_TIMEOUT */
+        uint8   len[2];     /* SE length not including eltId, len fields */
+        uint8   go_tmo;     /* GO config timeout in units of 10 ms */
+        uint8   client_tmo; /* Client config timeout in units of 10 ms */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cfg_tmo_se_s wifi_p2p_cfg_tmo_se_t;
+
+
+/* WiFi P2P IE subelement: Status */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_status_se_s {
+        uint8   eltId;      /* SE ID: P2P_SEID_STATUS */
+        uint8   len[2];     /* SE length not including eltId, len fields */
+        uint8   status;     /* Status Code: P2P_STATSE_* */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_status_se_s wifi_p2p_status_se_t;
+
+/* Status subelement Status Code definitions */
+#define P2P_STATSE_SUCCESS              0
+                                /* Success */
+#define P2P_STATSE_FAIL_INFO_CURR_UNAVAIL   1
+                                /* Failed, information currently unavailable */
+#define P2P_STATSE_PASSED_UP            P2P_STATSE_FAIL_INFO_CURR_UNAVAIL
+                                /* Old name for above in P2P spec 1.08 and older */
+#define P2P_STATSE_FAIL_INCOMPAT_PARAMS     2
+                                /* Failed, incompatible parameters */
+#define P2P_STATSE_FAIL_LIMIT_REACHED       3
+                                /* Failed, limit reached */
+#define P2P_STATSE_FAIL_INVALID_PARAMS      4
+                                /* Failed, invalid parameters */
+#define P2P_STATSE_FAIL_UNABLE_TO_ACCOM     5
+                                /* Failed, unable to accomodate request */
+#define P2P_STATSE_FAIL_PROTO_ERROR         6
+                                /* Failed, previous protocol error or disruptive behaviour */
+#define P2P_STATSE_FAIL_NO_COMMON_CHAN      7
+                                /* Failed, no common channels */
+#define P2P_STATSE_FAIL_UNKNOWN_GROUP       8
+                                /* Failed, unknown P2P Group */
+#define P2P_STATSE_FAIL_INTENT          9
+                                /* Failed, both peers indicated Intent 15 in GO Negotiation */
+#define P2P_STATSE_FAIL_INCOMPAT_PROVIS     10
+                                /* Failed, incompatible provisioning method */
+#define P2P_STATSE_FAIL_USER_REJECT     11
+                                /* Failed, rejected by user */
+
+/* WiFi P2P IE attribute: Extended Listen Timing */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ext_se_s {
+        uint8   eltId;      /* ID: P2P_SEID_EXT_TIMING */
+        uint8   len[2];     /* length not including eltId, len fields */
+        uint8   avail[2];   /* availibility period */
+        uint8   interval[2];    /* availibility interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ext_se_s wifi_p2p_ext_se_t;
+
+#define P2P_EXT_MIN 10  /* minimum 10ms */
+
+/* WiFi P2P IE subelement: Intended P2P Interface Address */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intintad_se_s {
+        uint8   eltId;      /* SE ID: P2P_SEID_INTINTADDR */
+        uint8   len[2];     /* SE length not including eltId, len fields */
+        uint8   mac[6];     /* intended P2P interface MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intintad_se_s wifi_p2p_intintad_se_t;
+
+/* WiFi P2P IE subelement: Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_channel_se_s {
+        uint8   eltId;      /* SE ID: P2P_SEID_STATUS */
+        uint8   len[2];     /* SE length not including eltId, len fields */
+        uint8   band;       /* Regulatory Class (band) */
+        uint8   channel;    /* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_channel_se_s wifi_p2p_channel_se_t;
+
+
+/* Channel Entry structure within the Channel List SE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_entry_s {
+        uint8   band;                       /* Regulatory Class (band) */
+        uint8   num_channels;               /* # of channels in the channel list */
+        uint8   channels[WL_NUMCHANNELS];   /* Channel List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_entry_s wifi_p2p_chanlist_entry_t;
+#define WIFI_P2P_CHANLIST_SE_MAX_ENTRIES 2
+
+/* WiFi P2P IE subelement: Channel List */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_se_s {
+        uint8   eltId;      /* SE ID: P2P_SEID_STATUS */
+        uint8   len[2];     /* SE length not including eltId, len fields */
+        uint8   country[3]; /* Country String */
+        uint8   num_entries;    /* # of channel entries */
+        wifi_p2p_chanlist_entry_t   entries[WIFI_P2P_CHANLIST_SE_MAX_ENTRIES];
+                                                /* Channel Entry List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_se_s wifi_p2p_chanlist_se_t;
+
+/* WiFi P2P IE's Device Info subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devinfo_se_s {
+        uint8   eltId;          /* SE ID: P2P_SEID_DEVINFO */
+        uint8   len[2];         /* SE length not including eltId, len fields */
+        uint8   mac[6];         /* P2P Device MAC address */
+        uint16  wps_cfg_meths;      /* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+        uint8   pri_devtype[8];     /* Primary Device Type */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devinfo_se_s wifi_p2p_devinfo_se_t;
+
+#define P2P_DEV_TYPE_LEN    8
+
+/* WiFi P2P IE's Group Info subelement Client Info Descriptor */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cid_fixed_s {
+        uint8   len;
+        uint8   devaddr[ETHER_ADDR_LEN];    /* P2P Device Address */
+        uint8   ifaddr[ETHER_ADDR_LEN];     /* P2P Interface Address */
+        uint8   devcap;             /* Device Capability */
+        uint8   cfg_meths[2];           /* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+        uint8   pridt[P2P_DEV_TYPE_LEN];    /* Primary Device Type */
+        uint8   secdts;             /* Number of Secondary Device Types */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cid_fixed_s wifi_p2p_cid_fixed_t;
+
+/* WiFi P2P IE's Device ID subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devid_se_s {
+        uint8   eltId;
+        uint8   len[2];
+        struct ether_addr   addr;           /* P2P Device MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devid_se_s wifi_p2p_devid_se_t;
+
+/* WiFi P2P IE subelement: P2P Manageability */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_mgbt_se_s {
+        uint8   eltId;      /* SE ID: P2P_SEID_P2P_MGBTY */
+        uint8   len[2];     /* SE length not including eltId, len fields */
+        uint8   mg_bitmap;  /* manageability bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_mgbt_se_s wifi_p2p_mgbt_se_t;
+/* mg_bitmap field bit values */
+#define P2P_MGBTSE_P2PDEVMGMT_FLAG   0x1 /* AP supports Managed P2P Device */
+
+/* WiFi P2P IE subelement: Group Info */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grpinfo_se_s {
+        uint8   eltId;          /* SE ID: P2P_SEID_GROUP_INFO */
+        uint8   len[2];         /* SE length not including eltId, len fields */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grpinfo_se_s wifi_p2p_grpinfo_se_t;
+
+
+/* WiFi P2P Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_action_frame {
+        uint8   category;   /* P2P_AF_CATEGORY */
+        uint8   OUI[3];     /* OUI - P2P_OUI */
+        uint8   type;       /* OUI Type - P2P_VER */
+        uint8   subtype;    /* OUI Subtype - P2P_AF_* */
+        uint8   dialog_token;   /* nonzero, identifies req/resp tranaction */
+        uint8   elts[1];    /* Variable length information elements.  Max size =
+                                 * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+                                 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_action_frame wifi_p2p_action_frame_t;
+#define P2P_AF_CATEGORY     0x7f
+
+#define P2P_AF_FIXED_LEN    7
+
+/* WiFi P2P Action Frame OUI Subtypes */
+#define P2P_AF_NOTICE_OF_ABSENCE    0   /* Notice of Absence */
+#define P2P_AF_PRESENCE_REQ     1   /* P2P Presence Request */
+#define P2P_AF_PRESENCE_RSP     2   /* P2P Presence Response */
+#define P2P_AF_GO_DISC_REQ      3   /* GO Discoverability Request */
+
+
+/* WiFi P2P Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_pub_act_frame {
+        uint8   category;   /* P2P_PUB_AF_CATEGORY */
+        uint8   action;     /* P2P_PUB_AF_ACTION */
+        uint8   oui[3];     /* P2P_OUI */
+        uint8   oui_type;   /* OUI type - P2P_VER */
+        uint8   subtype;    /* OUI subtype - P2P_TYPE_* */
+        uint8   dialog_token;   /* nonzero, identifies req/rsp transaction */
+        uint8   elts[1];    /* Variable length information elements.  Max size =
+                                 * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+                                 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_pub_act_frame wifi_p2p_pub_act_frame_t;
+#define P2P_PUB_AF_FIXED_LEN    8
+#define P2P_PUB_AF_CATEGORY 0x04
+#define P2P_PUB_AF_ACTION   0x09
+
+/* WiFi P2P Public Action Frame OUI Subtypes */
+#define P2P_PAF_GON_REQ     0   /* Group Owner Negotiation Req */
+#define P2P_PAF_GON_RSP     1   /* Group Owner Negotiation Rsp */
+#define P2P_PAF_GON_CONF    2   /* Group Owner Negotiation Confirm */
+#define P2P_PAF_INVITE_REQ  3   /* P2P Invitation Request */
+#define P2P_PAF_INVITE_RSP  4   /* P2P Invitation Response */
+#define P2P_PAF_DEVDIS_REQ  5   /* Device Discoverability Request */
+#define P2P_PAF_DEVDIS_RSP  6   /* Device Discoverability Response */
+#define P2P_PAF_PROVDIS_REQ 7   /* Provision Discovery Request */
+#define P2P_PAF_PROVDIS_RSP 8   /* Provision Discovery Request */
+
+/* TODO: Stop using these obsolete aliases for P2P_PAF_GON_* */
+#define P2P_TYPE_MNREQ      P2P_PAF_GON_REQ
+#define P2P_TYPE_MNRSP      P2P_PAF_GON_RSP
+#define P2P_TYPE_MNCONF     P2P_PAF_GON_CONF
+
+/* WiFi P2P IE subelement: Notice of Absence */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_desc {
+        uint8   cnt_type;   /* Count/Type */
+        uint32  duration;   /* Duration */
+        uint32  interval;   /* Interval */
+        uint32  start;      /* Start Time */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_desc wifi_p2p_noa_desc_t;
+
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_se {
+        uint8   eltId;      /* Subelement ID */
+        uint8   len[2];     /* Length */
+        uint8   index;      /* Index */
+        uint8   ops_ctw_parms;  /* CTWindow and OppPS Parameters */
+        wifi_p2p_noa_desc_t desc[1];    /* Notice of Absence Descriptor(s) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_se wifi_p2p_noa_se_t;
+
+#define P2P_NOA_SE_FIXED_LEN    5
+
+/* cnt_type field values */
+#define P2P_NOA_DESC_CNT_RESERVED   0   /* reserved and should not be used */
+#define P2P_NOA_DESC_CNT_REPEAT     255 /* continuous schedule */
+#define P2P_NOA_DESC_TYPE_PREFERRED 1   /* preferred values */
+#define P2P_NOA_DESC_TYPE_ACCEPTABLE    2   /* acceptable limits */
+
+/* ctw_ops_parms field values */
+#define P2P_NOA_CTW_MASK    0x7f
+#define P2P_NOA_OPS_MASK    0x80
+#define P2P_NOA_OPS_SHIFT   7
+
+#define P2P_CTW_MIN 10  /* minimum 10TU */
+
+/*
+ * P2P Service Discovery related
+ */
+#define P2PSD_ACTION_CATEGORY       0x04
+                                /* Public action frame */
+#define P2PSD_ACTION_ID_GAS_IREQ    0x0a
+                                /* Action value for GAS Initial Request AF */
+#define P2PSD_ACTION_ID_GAS_IRESP   0x0b
+                                /* Action value for GAS Initial Response AF */
+#define P2PSD_ACTION_ID_GAS_CREQ    0x0c
+                                /* Action value for GAS Comback Request AF */
+#define P2PSD_ACTION_ID_GAS_CRESP   0x0d
+                                /* Action value for GAS Comback Response AF */
+#define P2PSD_AD_EID                0x6c
+                                /* Advertisement Protocol IE ID */
+#define P2PSD_ADP_TUPLE_QLMT_PAMEBI 0x00
+                                /* Query Response Length Limit 7 bits plus PAME-BI 1 bit */
+#define P2PSD_ADP_PROTO_ID          0x00
+                                /* Advertisement Protocol ID. Always 0 for P2P SD */
+#define P2PSD_GAS_OUI               P2P_OUI
+                                /* WFA OUI */
+#define P2PSD_GAS_OUI_SUBTYPE       P2P_VER
+                                /* OUI Subtype for GAS IE */
+#define P2PSD_GAS_NQP_INFOID        0xDDDD
+                                /* NQP Query Info ID: 56797 */
+#define P2PSD_GAS_COMEBACKDEALY     0x00
+                                /* Not used in the Native GAS protocol */
+
+/* Service Protocol Type */
+typedef enum p2psd_svc_protype {
+        SVC_RPOTYPE_ALL = 0,
+        SVC_RPOTYPE_BONJOUR = 1,
+        SVC_RPOTYPE_UPNP = 2,
+        SVC_RPOTYPE_WSD = 3,
+        SVC_RPOTYPE_VENDOR = 255
+} p2psd_svc_protype_t;
+
+/* Service Discovery response status code */
+typedef enum {
+        P2PSD_RESP_STATUS_SUCCESS = 0,
+        P2PSD_RESP_STATUS_PROTYPE_NA = 1,
+        P2PSD_RESP_STATUS_DATA_NA = 2,
+        P2PSD_RESP_STATUS_BAD_REQUEST = 3
+} p2psd_resp_status_t;
+
+/* Advertisement Protocol IE tuple field */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_tpl {
+        uint8   llm_pamebi; /* Query Response Length Limit bit 0-6, set to 0 plus
+                                * Pre-Associated Message Exchange BSSID Independent bit 7, set to 0
+                                */
+        uint8   adp_id;     /* Advertisement Protocol ID: 0 for NQP Native Query Protocol */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_tpl wifi_p2psd_adp_tpl_t;
+
+/* Advertisement Protocol IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_ie {
+        uint8   id;     /* IE ID: 0x6c - 108 */
+        uint8   len;    /* IE length */
+        wifi_p2psd_adp_tpl_t adp_tpl;  /* Advertisement Protocol Tuple field. Only one
+                                * tuple is defined for P2P Service Discovery
+                                */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_ie wifi_p2psd_adp_ie_t;
+
+/* NQP Vendor-specific Content */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_nqp_query_vsc {
+        uint8   oui_subtype;    /* OUI Subtype: 0x09 */
+        uint16  svc_updi;       /* Service Update Indicator */
+        uint8   svc_tlvs[1];    /* wifi_p2psd_qreq_tlv_t type for service request,
+                                * wifi_p2psd_qresp_tlv_t type for service response
+                                */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_nqp_query_vsc wifi_p2psd_nqp_query_vsc_t;
+
+/* Service Request TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_tlv {
+        uint16  len;            /* Length: 5 plus size of Query Data */
+        uint8   svc_prot;       /* Service Protocol Type */
+        uint8   svc_tscid;      /* Service Transaction ID */
+        uint8   query_data[1];  /* Query Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_tlv wifi_p2psd_qreq_tlv_t;
+
+/* Query Request Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_frame {
+        uint16  info_id;    /* Info ID: 0xDDDD */
+        uint16  len;        /* Length of service request TLV, 5 plus the size of request data */
+        uint8   oui[3];     /* WFA OUI: 0x0050F2 */
+        uint8   qreq_vsc[1]; /* Vendor-specific Content: wifi_p2psd_nqp_query_vsc_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_frame wifi_p2psd_qreq_frame_t;
+
+/* GAS Initial Request AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_ireq_frame {
+        wifi_p2psd_adp_ie_t     adp_ie;     /* Advertisement Protocol IE */
+        uint16                  qreq_len;   /* Query Request Length */
+        uint8   qreq_frm[1];    /* Query Request Frame wifi_p2psd_qreq_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_ireq_frame wifi_p2psd_gas_ireq_frame_t;
+
+/* Service Response TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_tlv {
+        uint16  len;                /* Length: 5 plus size of Query Data */
+        uint8   svc_prot;           /* Service Protocol Type */
+        uint8   svc_tscid;          /* Service Transaction ID */
+        uint8   status;             /* Value defined in Table 57 of P2P spec. */
+        uint8   query_data[1];      /* Response Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_tlv wifi_p2psd_qresp_tlv_t;
+
+/* Query Response Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_frame {
+        uint16  info_id;    /* Info ID: 0xDDDD */
+        uint16  len;        /* Lenth of service response TLV, 6 plus the size of resp data */
+        uint8   oui[3];     /* WFA OUI: 0x0050F2 */
+        uint8   qresp_vsc[1]; /* Vendor-specific Content: wifi_p2psd_qresp_tlv_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_frame wifi_p2psd_qresp_frame_t;
+
+/* GAS Initial Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_iresp_frame {
+        uint16      status;     /* Value defined in Table 7-23 of IEEE P802.11u */
+        uint16  cb_delay;       /* GAS Comeback Delay */
+        wifi_p2psd_adp_ie_t adp_ie;     /* Advertisement Protocol IE */
+        uint16      qresp_len;  /* Query Response Length */
+        uint8   qresp_frm[1];   /* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_iresp_frame wifi_p2psd_gas_iresp_frame_t;
+
+/* GAS Comeback Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_cresp_frame {
+        uint16  status;         /* Value defined in Table 7-23 of IEEE P802.11u */
+        uint8   fragment_id;    /* Fragmentation ID */
+        uint16  cb_delay;       /* GAS Comeback Delay */
+        wifi_p2psd_adp_ie_t adp_ie;     /* Advertisement Protocol IE */
+        uint16  qresp_len;      /* Query Response Length */
+        uint8   qresp_frm[1];   /* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_cresp_frame wifi_p2psd_gas_cresp_frame_t;
+
+/* Wi-Fi GAS Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_pub_act_frame {
+        uint8   category;       /* 0x04 Public Action Frame */
+        uint8   action;         /* 0x6c Advertisement Protocol */
+        uint8   dialog_token;   /* nonzero, identifies req/rsp transaction */
+        uint8   query_data[1];  /* Query Data. wifi_p2psd_gas_ireq_frame_t
+                                         * or wifi_p2psd_gas_iresp_frame_t format
+                                         */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_pub_act_frame wifi_p2psd_gas_pub_act_frame_t;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _P2P_H_ */
diff --git a/drivers/net/wireless/bcmdhd/include/proto/sdspi.h b/drivers/net/wireless/bcmdhd/include/proto/sdspi.h
new file mode 100644
index 00000000000..7fe4fbce310
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/sdspi.h
@@ -0,0 +1,76 @@
+/*
+ * SD-SPI Protocol Standard
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sdspi.h,v 9.2.120.1 2010-11-15 17:56:25 Exp $
+ */
+
+#ifndef _SD_SPI_H
+#define _SD_SPI_H
+
+#define SPI_START_M             BITFIELD_MASK(1)        /* Bit [31]     - Start Bit */
+#define SPI_START_S             31
+#define SPI_DIR_M               BITFIELD_MASK(1)        /* Bit [30]     - Direction */
+#define SPI_DIR_S               30
+#define SPI_CMD_INDEX_M         BITFIELD_MASK(6)        /* Bits [29:24] - Command number */
+#define SPI_CMD_INDEX_S         24
+#define SPI_RW_M                BITFIELD_MASK(1)        /* Bit [23]     - Read=0, Write=1 */
+#define SPI_RW_S                23
+#define SPI_FUNC_M              BITFIELD_MASK(3)        /* Bits [22:20] - Function Number */
+#define SPI_FUNC_S              20
+#define SPI_RAW_M               BITFIELD_MASK(1)        /* Bit [19]     - Read After Wr */
+#define SPI_RAW_S               19
+#define SPI_STUFF_M             BITFIELD_MASK(1)        /* Bit [18]     - Stuff bit */
+#define SPI_STUFF_S             18
+#define SPI_BLKMODE_M           BITFIELD_MASK(1)        /* Bit [19]     - Blockmode 1=blk */
+#define SPI_BLKMODE_S           19
+#define SPI_OPCODE_M            BITFIELD_MASK(1)        /* Bit [18]     - OP Code */
+#define SPI_OPCODE_S            18
+#define SPI_ADDR_M              BITFIELD_MASK(17)       /* Bits [17:1]  - Address */
+#define SPI_ADDR_S              1
+#define SPI_STUFF0_M            BITFIELD_MASK(1)        /* Bit [0]      - Stuff bit */
+#define SPI_STUFF0_S            0
+
+#define SPI_RSP_START_M         BITFIELD_MASK(1)        /* Bit [7]      - Start Bit (always 0) */
+#define SPI_RSP_START_S         7
+#define SPI_RSP_PARAM_ERR_M     BITFIELD_MASK(1)        /* Bit [6]      - Parameter Error */
+#define SPI_RSP_PARAM_ERR_S     6
+#define SPI_RSP_RFU5_M          BITFIELD_MASK(1)        /* Bit [5]      - RFU (Always 0) */
+#define SPI_RSP_RFU5_S          5
+#define SPI_RSP_FUNC_ERR_M      BITFIELD_MASK(1)        /* Bit [4]      - Function number error */
+#define SPI_RSP_FUNC_ERR_S      4
+#define SPI_RSP_CRC_ERR_M       BITFIELD_MASK(1)        /* Bit [3]      - COM CRC Error */
+#define SPI_RSP_CRC_ERR_S       3
+#define SPI_RSP_ILL_CMD_M       BITFIELD_MASK(1)        /* Bit [2]      - Illegal Command error */
+#define SPI_RSP_ILL_CMD_S       2
+#define SPI_RSP_RFU1_M          BITFIELD_MASK(1)        /* Bit [1]      - RFU (Always 0) */
+#define SPI_RSP_RFU1_S          1
+#define SPI_RSP_IDLE_M          BITFIELD_MASK(1)        /* Bit [0]      - In idle state */
+#define SPI_RSP_IDLE_S          0
+
+/* SD-SPI Protocol Definitions */
+#define SDSPI_COMMAND_LEN       6       /* Number of bytes in an SD command */
+#define SDSPI_START_BLOCK       0xFE    /* SD Start Block Token */
+#define SDSPI_IDLE_PAD          0xFF    /* SD-SPI idle value for MOSI */
+#define SDSPI_START_BIT_MASK    0x80
+
+#endif /* _SD_SPI_H */
diff --git a/drivers/net/wireless/bcmdhd/include/proto/vlan.h b/drivers/net/wireless/bcmdhd/include/proto/vlan.h
new file mode 100644
index 00000000000..07fa7e499c2
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/vlan.h
@@ -0,0 +1,70 @@
+/*
+ * 802.1Q VLAN protocol definitions
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: vlan.h,v 9.7 2009-03-13 01:11:50 Exp $
+ */
+
+
+#ifndef _vlan_h_
+#define _vlan_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+
+#include <packed_section_start.h>
+
+#define VLAN_VID_MASK           0xfff   
+#define VLAN_CFI_SHIFT          12      
+#define VLAN_PRI_SHIFT          13      
+
+#define VLAN_PRI_MASK           7       
+
+#define VLAN_TAG_LEN            4
+#define VLAN_TAG_OFFSET         (2 * ETHER_ADDR_LEN)    
+
+#define VLAN_TPID               0x8100  
+
+struct ethervlan_header {
+        uint8   ether_dhost[ETHER_ADDR_LEN];
+        uint8   ether_shost[ETHER_ADDR_LEN];
+        uint16  vlan_type;              
+        uint16  vlan_tag;               
+        uint16  ether_type;
+};
+
+#define ETHERVLAN_HDR_LEN       (ETHER_HDR_LEN + VLAN_TAG_LEN)
+
+
+
+#include <packed_section_end.h>
+
+#define ETHERVLAN_MOVE_HDR(d, s) \
+do { \
+        struct ethervlan_header t; \
+        t = *(struct ethervlan_header *)(s); \
+        *(struct ethervlan_header *)(d) = t; \
+} while (0)
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/proto/wpa.h b/drivers/net/wireless/bcmdhd/include/proto/wpa.h
new file mode 100644
index 00000000000..1ff06dc7942
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/proto/wpa.h
@@ -0,0 +1,160 @@
+/*
+ * Fundamental types and constants relating to WPA
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wpa.h,v 1.19 2009-07-13 08:29:58 Exp $
+ */
+
+
+#ifndef _proto_wpa_h_
+#define _proto_wpa_h_
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+
+
+
+#include <packed_section_start.h>
+
+
+
+
+#define DOT11_RC_INVALID_WPA_IE         13      
+#define DOT11_RC_MIC_FAILURE            14      
+#define DOT11_RC_4WH_TIMEOUT            15      
+#define DOT11_RC_GTK_UPDATE_TIMEOUT     16      
+#define DOT11_RC_WPA_IE_MISMATCH        17      
+#define DOT11_RC_INVALID_MC_CIPHER      18      
+#define DOT11_RC_INVALID_UC_CIPHER      19      
+#define DOT11_RC_INVALID_AKMP           20      
+#define DOT11_RC_BAD_WPA_VERSION        21      
+#define DOT11_RC_INVALID_WPA_CAP        22      
+#define DOT11_RC_8021X_AUTH_FAIL        23      
+
+#define WPA2_PMKID_LEN  16
+
+
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+        uint8 tag;      
+        uint8 length;   
+        uint8 oui[3];   
+        uint8 oui_type; 
+        BWL_PRE_PACKED_STRUCT struct {
+                uint8 low;
+                uint8 high;
+        } BWL_POST_PACKED_STRUCT version;       
+} BWL_POST_PACKED_STRUCT wpa_ie_fixed_t;
+#define WPA_IE_OUITYPE_LEN      4
+#define WPA_IE_FIXED_LEN        8
+#define WPA_IE_TAG_FIXED_LEN    6
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+        uint8 tag;      
+        uint8 length;   
+        BWL_PRE_PACKED_STRUCT struct {
+                uint8 low;
+                uint8 high;
+        } BWL_POST_PACKED_STRUCT version;       
+} BWL_POST_PACKED_STRUCT wpa_rsn_ie_fixed_t;
+#define WPA_RSN_IE_FIXED_LEN    4
+#define WPA_RSN_IE_TAG_FIXED_LEN        2
+typedef uint8 wpa_pmkid_t[WPA2_PMKID_LEN];
+
+
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+        uint8 oui[3];
+        uint8 type;
+} BWL_POST_PACKED_STRUCT wpa_suite_t, wpa_suite_mcast_t;
+#define WPA_SUITE_LEN   4
+
+
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+        BWL_PRE_PACKED_STRUCT struct {
+                uint8 low;
+                uint8 high;
+        } BWL_POST_PACKED_STRUCT count;
+        wpa_suite_t list[1];
+} BWL_POST_PACKED_STRUCT wpa_suite_ucast_t, wpa_suite_auth_key_mgmt_t;
+#define WPA_IE_SUITE_COUNT_LEN  2
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+        BWL_PRE_PACKED_STRUCT struct {
+                uint8 low;
+                uint8 high;
+        } BWL_POST_PACKED_STRUCT count;
+        wpa_pmkid_t list[1];
+} BWL_POST_PACKED_STRUCT wpa_pmkid_list_t;
+
+
+#define WPA_CIPHER_NONE         0       
+#define WPA_CIPHER_WEP_40       1       
+#define WPA_CIPHER_TKIP         2       
+#define WPA_CIPHER_AES_OCB      3       
+#define WPA_CIPHER_AES_CCM      4       
+#define WPA_CIPHER_WEP_104      5       
+
+
+#define IS_WPA_CIPHER(cipher)   ((cipher) == WPA_CIPHER_NONE || \
+                                 (cipher) == WPA_CIPHER_WEP_40 || \
+                                 (cipher) == WPA_CIPHER_WEP_104 || \
+                                 (cipher) == WPA_CIPHER_TKIP || \
+                                 (cipher) == WPA_CIPHER_AES_OCB || \
+                                 (cipher) == WPA_CIPHER_AES_CCM)
+
+
+#define WPA_TKIP_CM_DETECT      60      
+#define WPA_TKIP_CM_BLOCK       60      
+
+
+#define RSN_CAP_LEN             2       
+
+
+#define RSN_CAP_PREAUTH                 0x0001
+#define RSN_CAP_NOPAIRWISE              0x0002
+#define RSN_CAP_PTK_REPLAY_CNTR_MASK    0x000C
+#define RSN_CAP_PTK_REPLAY_CNTR_SHIFT   2
+#define RSN_CAP_GTK_REPLAY_CNTR_MASK    0x0030
+#define RSN_CAP_GTK_REPLAY_CNTR_SHIFT   4
+#define RSN_CAP_1_REPLAY_CNTR           0
+#define RSN_CAP_2_REPLAY_CNTRS          1
+#define RSN_CAP_4_REPLAY_CNTRS          2
+#define RSN_CAP_16_REPLAY_CNTRS         3
+
+
+#define WPA_CAP_4_REPLAY_CNTRS          RSN_CAP_4_REPLAY_CNTRS
+#define WPA_CAP_16_REPLAY_CNTRS         RSN_CAP_16_REPLAY_CNTRS
+#define WPA_CAP_REPLAY_CNTR_SHIFT       RSN_CAP_PTK_REPLAY_CNTR_SHIFT
+#define WPA_CAP_REPLAY_CNTR_MASK        RSN_CAP_PTK_REPLAY_CNTR_MASK
+
+
+#define WPA_CAP_LEN     RSN_CAP_LEN     
+
+#define WPA_CAP_WPA2_PREAUTH            RSN_CAP_PREAUTH
+
+
+
+#include <packed_section_end.h>
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/sbchipc.h b/drivers/net/wireless/bcmdhd/include/sbchipc.h
new file mode 100644
index 00000000000..cbd37490f1c
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sbchipc.h
@@ -0,0 +1,1615 @@
+/*
+ * SiliconBackplane Chipcommon core hardware definitions.
+ *
+ * The chipcommon core provides chip identification, SB control,
+ * JTAG, 0/1/2 UARTs, clock frequency control, a watchdog interrupt timer,
+ * GPIO interface, extbus, and support for serial and parallel flashes.
+ *
+ * $Id: sbchipc.h,v 13.169.2.14 2011-02-10 23:43:55 Exp $
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ */
+
+
+#ifndef _SBCHIPC_H
+#define _SBCHIPC_H
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+
+#ifndef PAD
+#define _PADLINE(line)  pad ## line
+#define _XSTR(line)     _PADLINE(line)
+#define PAD             _XSTR(__LINE__)
+#endif  
+
+typedef volatile struct {
+        uint32  chipid;                 
+        uint32  capabilities;
+        uint32  corecontrol;            
+        uint32  bist;
+
+        
+        uint32  otpstatus;              
+        uint32  otpcontrol;
+        uint32  otpprog;
+        uint32  otplayout;              
+
+        
+        uint32  intstatus;              
+        uint32  intmask;
+
+        
+        uint32  chipcontrol;            
+        uint32  chipstatus;             
+
+        
+        uint32  jtagcmd;                
+        uint32  jtagir;
+        uint32  jtagdr;
+        uint32  jtagctrl;
+
+        
+        uint32  flashcontrol;           
+        uint32  flashaddress;
+        uint32  flashdata;
+        uint32  PAD[1];
+
+        
+        uint32  broadcastaddress;       
+        uint32  broadcastdata;
+
+        
+        uint32  gpiopullup;             
+        uint32  gpiopulldown;           
+        uint32  gpioin;                 
+        uint32  gpioout;                
+        uint32  gpioouten;              
+        uint32  gpiocontrol;            
+        uint32  gpiointpolarity;        
+        uint32  gpiointmask;            
+
+        
+        uint32  gpioevent;
+        uint32  gpioeventintmask;
+
+        
+        uint32  watchdog;               
+
+        
+        uint32  gpioeventintpolarity;
+
+        
+        uint32  gpiotimerval;           
+        uint32  gpiotimeroutmask;
+
+        
+        uint32  clockcontrol_n;         
+        uint32  clockcontrol_sb;        
+        uint32  clockcontrol_pci;       
+        uint32  clockcontrol_m2;        
+        uint32  clockcontrol_m3;        
+        uint32  clkdiv;                 
+        uint32  gpiodebugsel;           
+        uint32  capabilities_ext;                       
+
+        
+        uint32  pll_on_delay;           
+        uint32  fref_sel_delay;
+        uint32  slow_clk_ctl;           
+        uint32  PAD;
+
+        
+        uint32  system_clk_ctl;         
+        uint32  clkstatestretch;
+        uint32  PAD[2];
+
+        
+        uint32  bp_addrlow;             
+        uint32  bp_addrhigh;
+        uint32  bp_data;
+        uint32  PAD;
+        uint32  bp_indaccess;
+        
+        uint32  gsioctrl;
+        uint32  gsioaddress;
+        uint32  gsiodata;
+
+        
+        uint32  clkdiv2;
+        uint32  PAD[2];
+
+        
+        uint32  eromptr;                
+
+        
+        uint32  pcmcia_config;          
+        uint32  pcmcia_memwait;
+        uint32  pcmcia_attrwait;
+        uint32  pcmcia_iowait;
+        uint32  ide_config;
+        uint32  ide_memwait;
+        uint32  ide_attrwait;
+        uint32  ide_iowait;
+        uint32  prog_config;
+        uint32  prog_waitcount;
+        uint32  flash_config;
+        uint32  flash_waitcount;
+        uint32  PAD[4];
+        uint32  PAD[40];
+
+        
+        
+        uint32  clk_ctl_st;             
+        uint32  hw_war;
+        uint32  PAD[70];
+
+        
+        uint8   uart0data;              
+        uint8   uart0imr;
+        uint8   uart0fcr;
+        uint8   uart0lcr;
+        uint8   uart0mcr;
+        uint8   uart0lsr;
+        uint8   uart0msr;
+        uint8   uart0scratch;
+        uint8   PAD[248];               
+
+        uint8   uart1data;              
+        uint8   uart1imr;
+        uint8   uart1fcr;
+        uint8   uart1lcr;
+        uint8   uart1mcr;
+        uint8   uart1lsr;
+        uint8   uart1msr;
+        uint8   uart1scratch;
+        uint32  PAD[126];
+
+        
+        
+        uint32  pmucontrol;             
+        uint32  pmucapabilities;
+        uint32  pmustatus;
+        uint32  res_state;
+        uint32  res_pending;
+        uint32  pmutimer;
+        uint32  min_res_mask;
+        uint32  max_res_mask;
+        uint32  res_table_sel;
+        uint32  res_dep_mask;
+        uint32  res_updn_timer;
+        uint32  res_timer;
+        uint32  clkstretch;
+        uint32  pmuwatchdog;
+        uint32  gpiosel;                
+        uint32  gpioenable;             
+        uint32  res_req_timer_sel;
+        uint32  res_req_timer;
+        uint32  res_req_mask;
+        uint32  PAD;
+        uint32  chipcontrol_addr;       
+        uint32  chipcontrol_data;       
+        uint32  regcontrol_addr;
+        uint32  regcontrol_data;
+        uint32  pllcontrol_addr;
+        uint32  pllcontrol_data;
+        uint32  pmustrapopt;            
+        uint32  pmu_xtalfreq;           
+        uint32  PAD[100];
+        uint16  sromotp[768];
+} chipcregs_t;
+
+#endif 
+
+
+#define CC_CHIPID               0
+#define CC_CAPABILITIES         4
+#define CC_CHIPST               0x2c
+#define CC_EROMPTR              0xfc
+
+
+#define CC_OTPST                0x10
+#define CC_JTAGCMD              0x30
+#define CC_JTAGIR               0x34
+#define CC_JTAGDR               0x38
+#define CC_JTAGCTRL             0x3c
+#define CC_GPIOPU               0x58
+#define CC_GPIOPD               0x5c
+#define CC_GPIOIN               0x60
+#define CC_GPIOOUT              0x64
+#define CC_GPIOOUTEN            0x68
+#define CC_GPIOCTRL             0x6c
+#define CC_GPIOPOL              0x70
+#define CC_GPIOINTM             0x74
+#define CC_WATCHDOG             0x80
+#define CC_CLKC_N               0x90
+#define CC_CLKC_M0              0x94
+#define CC_CLKC_M1              0x98
+#define CC_CLKC_M2              0x9c
+#define CC_CLKC_M3              0xa0
+#define CC_CLKDIV               0xa4
+#define CC_SYS_CLK_CTL          0xc0
+#define CC_CLK_CTL_ST           SI_CLK_CTL_ST
+#define PMU_CTL                 0x600
+#define PMU_CAP                 0x604
+#define PMU_ST                  0x608
+#define PMU_RES_STATE           0x60c
+#define PMU_TIMER               0x614
+#define PMU_MIN_RES_MASK        0x618
+#define PMU_MAX_RES_MASK        0x61c
+#define CC_CHIPCTL_ADDR         0x650
+#define CC_CHIPCTL_DATA         0x654
+#define PMU_REG_CONTROL_ADDR    0x658
+#define PMU_REG_CONTROL_DATA    0x65C
+#define PMU_PLL_CONTROL_ADDR    0x660
+#define PMU_PLL_CONTROL_DATA    0x664
+#define CC_SROM_OTP             0x800           
+
+
+#define CID_ID_MASK             0x0000ffff      
+#define CID_REV_MASK            0x000f0000      
+#define CID_REV_SHIFT           16              
+#define CID_PKG_MASK            0x00f00000      
+#define CID_PKG_SHIFT           20              
+#define CID_CC_MASK             0x0f000000      
+#define CID_CC_SHIFT            24
+#define CID_TYPE_MASK           0xf0000000      
+#define CID_TYPE_SHIFT          28
+
+
+#define CC_CAP_UARTS_MASK       0x00000003      
+#define CC_CAP_MIPSEB           0x00000004      
+#define CC_CAP_UCLKSEL          0x00000018      
+#define CC_CAP_UINTCLK          0x00000008      
+#define CC_CAP_UARTGPIO         0x00000020      
+#define CC_CAP_EXTBUS_MASK      0x000000c0      
+#define CC_CAP_EXTBUS_NONE      0x00000000      
+#define CC_CAP_EXTBUS_FULL      0x00000040      
+#define CC_CAP_EXTBUS_PROG      0x00000080      
+#define CC_CAP_FLASH_MASK       0x00000700      
+#define CC_CAP_PLL_MASK         0x00038000      
+#define CC_CAP_PWR_CTL          0x00040000      
+#define CC_CAP_OTPSIZE          0x00380000      
+#define CC_CAP_OTPSIZE_SHIFT    19              
+#define CC_CAP_OTPSIZE_BASE     5               
+#define CC_CAP_JTAGP            0x00400000      
+#define CC_CAP_ROM              0x00800000      
+#define CC_CAP_BKPLN64          0x08000000      
+#define CC_CAP_PMU              0x10000000      
+#define CC_CAP_ECI              0x20000000      
+#define CC_CAP_SROM             0x40000000      
+#define CC_CAP_NFLASH           0x80000000      
+
+#define CC_CAP2_SECI            0x00000001      
+#define CC_CAP2_GSIO            0x00000002      
+
+
+#define CC_CAP_EXT_SECI_PRESENT   0x00000001    
+
+
+#define PLL_NONE                0x00000000
+#define PLL_TYPE1               0x00010000      
+#define PLL_TYPE2               0x00020000      
+#define PLL_TYPE3               0x00030000      
+#define PLL_TYPE4               0x00008000      
+#define PLL_TYPE5               0x00018000      
+#define PLL_TYPE6               0x00028000      
+#define PLL_TYPE7               0x00038000      
+
+
+#define ILP_CLOCK               32000
+
+
+#define ALP_CLOCK               20000000
+
+
+#define HT_CLOCK                80000000
+
+
+#define CC_UARTCLKO             0x00000001      
+#define CC_SE                   0x00000002      
+#define CC_ASYNCGPIO    0x00000004      
+#define CC_UARTCLKEN            0x00000008      
+
+
+#define CHIPCTRL_4321A0_DEFAULT 0x3a4
+#define CHIPCTRL_4321A1_DEFAULT 0x0a4
+#define CHIPCTRL_4321_PLL_DOWN  0x800000        
+
+
+#define OTPS_OL_MASK            0x000000ff
+#define OTPS_OL_MFG             0x00000001      
+#define OTPS_OL_OR1             0x00000002      
+#define OTPS_OL_OR2             0x00000004      
+#define OTPS_OL_GU              0x00000008      
+#define OTPS_GUP_MASK           0x00000f00
+#define OTPS_GUP_SHIFT          8
+#define OTPS_GUP_HW             0x00000100      
+#define OTPS_GUP_SW             0x00000200      
+#define OTPS_GUP_CI             0x00000400      
+#define OTPS_GUP_FUSE           0x00000800      
+#define OTPS_READY              0x00001000
+#define OTPS_RV(x)              (1 << (16 + (x)))       
+#define OTPS_RV_MASK            0x0fff0000
+
+
+#define OTPC_PROGSEL            0x00000001
+#define OTPC_PCOUNT_MASK        0x0000000e
+#define OTPC_PCOUNT_SHIFT       1
+#define OTPC_VSEL_MASK          0x000000f0
+#define OTPC_VSEL_SHIFT         4
+#define OTPC_TMM_MASK           0x00000700
+#define OTPC_TMM_SHIFT          8
+#define OTPC_ODM                0x00000800
+#define OTPC_PROGEN             0x80000000
+
+
+#define OTPP_COL_MASK           0x000000ff
+#define OTPP_COL_SHIFT          0
+#define OTPP_ROW_MASK           0x0000ff00
+#define OTPP_ROW_SHIFT          8
+#define OTPP_OC_MASK            0x0f000000
+#define OTPP_OC_SHIFT           24
+#define OTPP_READERR            0x10000000
+#define OTPP_VALUE_MASK         0x20000000
+#define OTPP_VALUE_SHIFT        29
+#define OTPP_START_BUSY         0x80000000
+#define OTPP_READ               0x40000000      
+
+
+#define OTP_CISFORMAT_NEW       0x80000000
+
+
+#define OTPPOC_READ             0
+#define OTPPOC_BIT_PROG         1
+#define OTPPOC_VERIFY           3
+#define OTPPOC_INIT             4
+#define OTPPOC_SET              5
+#define OTPPOC_RESET            6
+#define OTPPOC_OCST             7
+#define OTPPOC_ROW_LOCK         8
+#define OTPPOC_PRESCN_TEST      9
+
+
+
+#define JTAGM_CREV_OLD          10      
+#define JTAGM_CREV_IRP          22      
+#define JTAGM_CREV_RTI          28      
+
+
+#define JCMD_START              0x80000000
+#define JCMD_BUSY               0x80000000
+#define JCMD_STATE_MASK         0x60000000
+#define JCMD_STATE_TLR          0x00000000      
+#define JCMD_STATE_PIR          0x20000000      
+#define JCMD_STATE_PDR          0x40000000      
+#define JCMD_STATE_RTI          0x60000000      
+#define JCMD0_ACC_MASK          0x0000f000
+#define JCMD0_ACC_IRDR          0x00000000
+#define JCMD0_ACC_DR            0x00001000
+#define JCMD0_ACC_IR            0x00002000
+#define JCMD0_ACC_RESET         0x00003000
+#define JCMD0_ACC_IRPDR         0x00004000
+#define JCMD0_ACC_PDR           0x00005000
+#define JCMD0_IRW_MASK          0x00000f00
+#define JCMD_ACC_MASK           0x000f0000      
+#define JCMD_ACC_IRDR           0x00000000
+#define JCMD_ACC_DR             0x00010000
+#define JCMD_ACC_IR             0x00020000
+#define JCMD_ACC_RESET          0x00030000
+#define JCMD_ACC_IRPDR          0x00040000
+#define JCMD_ACC_PDR            0x00050000
+#define JCMD_ACC_PIR            0x00060000
+#define JCMD_ACC_IRDR_I         0x00070000      
+#define JCMD_ACC_DR_I           0x00080000      
+#define JCMD_IRW_MASK           0x00001f00
+#define JCMD_IRW_SHIFT          8
+#define JCMD_DRW_MASK           0x0000003f
+
+
+#define JCTRL_FORCE_CLK         4               
+#define JCTRL_EXT_EN            2               
+#define JCTRL_EN                1               
+
+
+#define CLKD_SFLASH             0x0f000000
+#define CLKD_SFLASH_SHIFT       24
+#define CLKD_OTP                0x000f0000
+#define CLKD_OTP_SHIFT          16
+#define CLKD_JTAG               0x00000f00
+#define CLKD_JTAG_SHIFT         8
+#define CLKD_UART               0x000000ff
+
+#define CLKD2_SROM              0x00000003
+
+
+#define CI_GPIO                 0x00000001      
+#define CI_EI                   0x00000002      
+#define CI_TEMP                 0x00000004      
+#define CI_SIRQ                 0x00000008      
+#define CI_ECI                  0x00000010      
+#define CI_PMU                  0x00000020      
+#define CI_UART                 0x00000040      
+#define CI_WDRESET              0x80000000      
+
+
+#define SCC_SS_MASK             0x00000007      
+#define SCC_SS_LPO              0x00000000      
+#define SCC_SS_XTAL             0x00000001      
+#define SCC_SS_PCI              0x00000002      
+#define SCC_LF                  0x00000200      
+#define SCC_LP                  0x00000400      
+#define SCC_FS                  0x00000800      
+#define SCC_IP                  0x00001000      
+#define SCC_XC                  0x00002000      
+#define SCC_XP                  0x00004000      
+#define SCC_CD_MASK             0xffff0000      
+#define SCC_CD_SHIFT            16
+
+
+#define SYCC_IE                 0x00000001      
+#define SYCC_AE                 0x00000002      
+#define SYCC_FP                 0x00000004      
+#define SYCC_AR                 0x00000008      
+#define SYCC_HR                 0x00000010      
+#define SYCC_CD_MASK            0xffff0000      
+#define SYCC_CD_SHIFT           16
+
+
+#define BPIA_BYTEEN             0x0000000f
+#define BPIA_SZ1                0x00000001
+#define BPIA_SZ2                0x00000003
+#define BPIA_SZ4                0x00000007
+#define BPIA_SZ8                0x0000000f
+#define BPIA_WRITE              0x00000100
+#define BPIA_START              0x00000200
+#define BPIA_BUSY               0x00000200
+#define BPIA_ERROR              0x00000400
+
+
+#define CF_EN                   0x00000001      
+#define CF_EM_MASK              0x0000000e      
+#define CF_EM_SHIFT             1
+#define CF_EM_FLASH             0               
+#define CF_EM_SYNC              2               
+#define CF_EM_PCMCIA            4               
+#define CF_DS                   0x00000010      
+#define CF_BS                   0x00000020      
+#define CF_CD_MASK              0x000000c0      
+#define CF_CD_SHIFT             6
+#define CF_CD_DIV2              0x00000000      
+#define CF_CD_DIV3              0x00000040      
+#define CF_CD_DIV4              0x00000080      
+#define CF_CE                   0x00000100      
+#define CF_SB                   0x00000200      
+
+
+#define PM_W0_MASK              0x0000003f      
+#define PM_W1_MASK              0x00001f00      
+#define PM_W1_SHIFT             8
+#define PM_W2_MASK              0x001f0000      
+#define PM_W2_SHIFT             16
+#define PM_W3_MASK              0x1f000000      
+#define PM_W3_SHIFT             24
+
+
+#define PA_W0_MASK              0x0000003f      
+#define PA_W1_MASK              0x00001f00      
+#define PA_W1_SHIFT             8
+#define PA_W2_MASK              0x001f0000      
+#define PA_W2_SHIFT             16
+#define PA_W3_MASK              0x1f000000      
+#define PA_W3_SHIFT             24
+
+
+#define PI_W0_MASK              0x0000003f      
+#define PI_W1_MASK              0x00001f00      
+#define PI_W1_SHIFT             8
+#define PI_W2_MASK              0x001f0000      
+#define PI_W2_SHIFT             16
+#define PI_W3_MASK              0x1f000000      
+#define PI_W3_SHIFT             24
+
+
+#define PW_W0_MASK              0x0000001f      
+#define PW_W1_MASK              0x00001f00      
+#define PW_W1_SHIFT             8
+#define PW_W2_MASK              0x001f0000      
+#define PW_W2_SHIFT             16
+#define PW_W3_MASK              0x1f000000      
+#define PW_W3_SHIFT             24
+
+#define PW_W0                   0x0000000c
+#define PW_W1                   0x00000a00
+#define PW_W2                   0x00020000
+#define PW_W3                   0x01000000
+
+
+#define FW_W0_MASK              0x0000003f      
+#define FW_W1_MASK              0x00001f00      
+#define FW_W1_SHIFT             8
+#define FW_W2_MASK              0x001f0000      
+#define FW_W2_SHIFT             16
+#define FW_W3_MASK              0x1f000000      
+#define FW_W3_SHIFT             24
+
+
+#define SRC_START               0x80000000
+#define SRC_BUSY                0x80000000
+#define SRC_OPCODE              0x60000000
+#define SRC_OP_READ             0x00000000
+#define SRC_OP_WRITE            0x20000000
+#define SRC_OP_WRDIS            0x40000000
+#define SRC_OP_WREN             0x60000000
+#define SRC_OTPSEL              0x00000010
+#define SRC_LOCK                0x00000008
+#define SRC_SIZE_MASK           0x00000006
+#define SRC_SIZE_1K             0x00000000
+#define SRC_SIZE_4K             0x00000002
+#define SRC_SIZE_16K            0x00000004
+#define SRC_SIZE_SHIFT          1
+#define SRC_PRESENT             0x00000001
+
+
+#define PCTL_ILP_DIV_MASK       0xffff0000
+#define PCTL_ILP_DIV_SHIFT      16
+#define PCTL_PLL_PLLCTL_UPD     0x00000400      
+#define PCTL_NOILP_ON_WAIT      0x00000200      
+#define PCTL_HT_REQ_EN          0x00000100
+#define PCTL_ALP_REQ_EN         0x00000080
+#define PCTL_XTALFREQ_MASK      0x0000007c
+#define PCTL_XTALFREQ_SHIFT     2
+#define PCTL_ILP_DIV_EN         0x00000002
+#define PCTL_LPO_SEL            0x00000001
+
+
+#define CSTRETCH_HT             0xffff0000
+#define CSTRETCH_ALP            0x0000ffff
+
+
+#define GPIO_ONTIME_SHIFT       16
+
+
+#define CN_N1_MASK              0x3f            
+#define CN_N2_MASK              0x3f00          
+#define CN_N2_SHIFT             8
+#define CN_PLLC_MASK            0xf0000         
+#define CN_PLLC_SHIFT           16
+
+
+#define CC_M1_MASK              0x3f            
+#define CC_M2_MASK              0x3f00          
+#define CC_M2_SHIFT             8
+#define CC_M3_MASK              0x3f0000        
+#define CC_M3_SHIFT             16
+#define CC_MC_MASK              0x1f000000      
+#define CC_MC_SHIFT             24
+
+
+#define CC_F6_2                 0x02            
+#define CC_F6_3                 0x03            
+#define CC_F6_4                 0x05            
+#define CC_F6_5                 0x09
+#define CC_F6_6                 0x11
+#define CC_F6_7                 0x21
+
+#define CC_F5_BIAS              5               
+
+#define CC_MC_BYPASS            0x08
+#define CC_MC_M1                0x04
+#define CC_MC_M1M2              0x02
+#define CC_MC_M1M2M3            0x01
+#define CC_MC_M1M3              0x11
+
+
+#define CC_T2_BIAS              2               
+#define CC_T2M2_BIAS            3               
+
+#define CC_T2MC_M1BYP           1
+#define CC_T2MC_M2BYP           2
+#define CC_T2MC_M3BYP           4
+
+
+#define CC_T6_MMASK             1               
+#define CC_T6_M0                120000000       
+#define CC_T6_M1                100000000       
+#define SB2MIPS_T6(sb)          (2 * (sb))
+
+
+#define CC_CLOCK_BASE1          24000000        
+#define CC_CLOCK_BASE2          12500000        
+
+
+#define CLKC_5350_N             0x0311
+#define CLKC_5350_M             0x04020009
+
+
+#define FLASH_NONE              0x000           
+#define SFLASH_ST               0x100           
+#define SFLASH_AT               0x200           
+#define PFLASH                  0x700           
+
+
+#define CC_CFG_EN               0x0001          
+#define CC_CFG_EM_MASK          0x000e          
+#define CC_CFG_EM_ASYNC         0x0000          
+#define CC_CFG_EM_SYNC          0x0002          
+#define CC_CFG_EM_PCMCIA        0x0004          
+#define CC_CFG_EM_IDE           0x0006          
+#define CC_CFG_DS               0x0010          
+#define CC_CFG_CD_MASK          0x00e0          
+#define CC_CFG_CE               0x0100          
+#define CC_CFG_SB               0x0200          
+#define CC_CFG_IS               0x0400          
+
+
+#define CC_EB_BASE              0x1a000000      
+#define CC_EB_PCMCIA_MEM        0x1a000000      
+#define CC_EB_PCMCIA_IO         0x1a200000      
+#define CC_EB_PCMCIA_CFG        0x1a400000      
+#define CC_EB_IDE               0x1a800000      
+#define CC_EB_PCMCIA1_MEM       0x1a800000      
+#define CC_EB_PCMCIA1_IO        0x1aa00000      
+#define CC_EB_PCMCIA1_CFG       0x1ac00000      
+#define CC_EB_PROGIF            0x1b000000      
+
+
+
+#define SFLASH_OPCODE           0x000000ff
+#define SFLASH_ACTION           0x00000700
+#define SFLASH_CS_ACTIVE        0x00001000      
+#define SFLASH_START            0x80000000
+#define SFLASH_BUSY             SFLASH_START
+
+
+#define SFLASH_ACT_OPONLY       0x0000          
+#define SFLASH_ACT_OP1D         0x0100          
+#define SFLASH_ACT_OP3A         0x0200          
+#define SFLASH_ACT_OP3A1D       0x0300          
+#define SFLASH_ACT_OP3A4D       0x0400          
+#define SFLASH_ACT_OP3A4X4D     0x0500          
+#define SFLASH_ACT_OP3A1X4D     0x0700          
+
+
+#define SFLASH_ST_WREN          0x0006          
+#define SFLASH_ST_WRDIS         0x0004          
+#define SFLASH_ST_RDSR          0x0105          
+#define SFLASH_ST_WRSR          0x0101          
+#define SFLASH_ST_READ          0x0303          
+#define SFLASH_ST_PP            0x0302          
+#define SFLASH_ST_SE            0x02d8          
+#define SFLASH_ST_BE            0x00c7          
+#define SFLASH_ST_DP            0x00b9          
+#define SFLASH_ST_RES           0x03ab          
+#define SFLASH_ST_CSA           0x1000          
+#define SFLASH_ST_SSE           0x0220          
+
+
+#define SFLASH_ST_WIP           0x01            
+#define SFLASH_ST_WEL           0x02            
+#define SFLASH_ST_BP_MASK       0x1c            
+#define SFLASH_ST_BP_SHIFT      2
+#define SFLASH_ST_SRWD          0x80            
+
+
+#define SFLASH_AT_READ                          0x07e8
+#define SFLASH_AT_PAGE_READ                     0x07d2
+#define SFLASH_AT_BUF1_READ
+#define SFLASH_AT_BUF2_READ
+#define SFLASH_AT_STATUS                        0x01d7
+#define SFLASH_AT_BUF1_WRITE                    0x0384
+#define SFLASH_AT_BUF2_WRITE                    0x0387
+#define SFLASH_AT_BUF1_ERASE_PROGRAM            0x0283
+#define SFLASH_AT_BUF2_ERASE_PROGRAM            0x0286
+#define SFLASH_AT_BUF1_PROGRAM                  0x0288
+#define SFLASH_AT_BUF2_PROGRAM                  0x0289
+#define SFLASH_AT_PAGE_ERASE                    0x0281
+#define SFLASH_AT_BLOCK_ERASE                   0x0250
+#define SFLASH_AT_BUF1_WRITE_ERASE_PROGRAM      0x0382
+#define SFLASH_AT_BUF2_WRITE_ERASE_PROGRAM      0x0385
+#define SFLASH_AT_BUF1_LOAD                     0x0253
+#define SFLASH_AT_BUF2_LOAD                     0x0255
+#define SFLASH_AT_BUF1_COMPARE                  0x0260
+#define SFLASH_AT_BUF2_COMPARE                  0x0261
+#define SFLASH_AT_BUF1_REPROGRAM                0x0258
+#define SFLASH_AT_BUF2_REPROGRAM                0x0259
+
+
+#define SFLASH_AT_READY                         0x80
+#define SFLASH_AT_MISMATCH                      0x40
+#define SFLASH_AT_ID_MASK                       0x38
+#define SFLASH_AT_ID_SHIFT                      3
+
+
+#define GSIO_START                      0x80000000
+#define GSIO_BUSY                       GSIO_START
+
+
+
+#define UART_RX         0       
+#define UART_TX         0       
+#define UART_DLL        0       
+#define UART_IER        1       
+#define UART_DLM        1       
+#define UART_IIR        2       
+#define UART_FCR        2       
+#define UART_LCR        3       
+#define UART_MCR        4       
+#define UART_LSR        5       
+#define UART_MSR        6       
+#define UART_SCR        7       
+#define UART_LCR_DLAB   0x80    
+#define UART_LCR_WLEN8  0x03    
+#define UART_MCR_OUT2   0x08    
+#define UART_MCR_LOOP   0x10    
+#define UART_LSR_RX_FIFO        0x80    
+#define UART_LSR_TDHR           0x40    
+#define UART_LSR_THRE           0x20    
+#define UART_LSR_BREAK          0x10    
+#define UART_LSR_FRAMING        0x08    
+#define UART_LSR_PARITY         0x04    
+#define UART_LSR_OVERRUN        0x02    
+#define UART_LSR_RXRDY          0x01    
+#define UART_FCR_FIFO_ENABLE 1  
+
+
+#define UART_IIR_FIFO_MASK      0xc0    
+#define UART_IIR_INT_MASK       0xf     
+#define UART_IIR_MDM_CHG        0x0     
+#define UART_IIR_NOINT          0x1     
+#define UART_IIR_THRE           0x2     
+#define UART_IIR_RCVD_DATA      0x4     
+#define UART_IIR_RCVR_STATUS    0x6     
+#define UART_IIR_CHAR_TIME      0xc     
+
+
+#define UART_IER_EDSSI  8       
+#define UART_IER_ELSI   4       
+#define UART_IER_ETBEI  2       
+#define UART_IER_ERBFI  1       
+
+
+#define PST_EXTLPOAVAIL 0x0100
+#define PST_WDRESET     0x0080
+#define PST_INTPEND     0x0040
+#define PST_SBCLKST     0x0030
+#define PST_SBCLKST_ILP 0x0010
+#define PST_SBCLKST_ALP 0x0020
+#define PST_SBCLKST_HT  0x0030
+#define PST_ALPAVAIL    0x0008
+#define PST_HTAVAIL     0x0004
+#define PST_RESINIT     0x0003
+
+
+#define PCAP_REV_MASK   0x000000ff
+#define PCAP_RC_MASK    0x00001f00
+#define PCAP_RC_SHIFT   8
+#define PCAP_TC_MASK    0x0001e000
+#define PCAP_TC_SHIFT   13
+#define PCAP_PC_MASK    0x001e0000
+#define PCAP_PC_SHIFT   17
+#define PCAP_VC_MASK    0x01e00000
+#define PCAP_VC_SHIFT   21
+#define PCAP_CC_MASK    0x1e000000
+#define PCAP_CC_SHIFT   25
+#define PCAP5_PC_MASK   0x003e0000      
+#define PCAP5_PC_SHIFT  17
+#define PCAP5_VC_MASK   0x07c00000
+#define PCAP5_VC_SHIFT  22
+#define PCAP5_CC_MASK   0xf8000000
+#define PCAP5_CC_SHIFT  27
+
+
+
+#define PRRT_TIME_MASK  0x03ff
+#define PRRT_INTEN      0x0400
+#define PRRT_REQ_ACTIVE 0x0800
+#define PRRT_ALP_REQ    0x1000
+#define PRRT_HT_REQ     0x2000
+
+
+#define PMURES_BIT(bit) (1 << (bit))
+
+
+#define PMURES_MAX_RESNUM       30
+
+
+#define PMU_CHIPCTL0            0
+
+
+#define PMU_CC1_CLKREQ_TYPE_SHIFT       19
+#define PMU_CC1_CLKREQ_TYPE_MASK        (1 << PMU_CC1_CLKREQ_TYPE_SHIFT)
+
+#define CLKREQ_TYPE_CONFIG_OPENDRAIN            0
+#define CLKREQ_TYPE_CONFIG_PUSHPULL             1
+
+
+#define PMU_CHIPCTL1                    1
+#define PMU_CC1_RXC_DLL_BYPASS          0x00010000
+
+#define PMU_CC1_IF_TYPE_MASK            0x00000030
+#define PMU_CC1_IF_TYPE_RMII            0x00000000
+#define PMU_CC1_IF_TYPE_MII             0x00000010
+#define PMU_CC1_IF_TYPE_RGMII           0x00000020
+
+#define PMU_CC1_SW_TYPE_MASK            0x000000c0
+#define PMU_CC1_SW_TYPE_EPHY            0x00000000
+#define PMU_CC1_SW_TYPE_EPHYMII         0x00000040
+#define PMU_CC1_SW_TYPE_EPHYRMII        0x00000080
+#define PMU_CC1_SW_TYPE_RGMII           0x000000c0
+
+
+
+
+
+#define PMU0_PLL0_PLLCTL0               0
+#define PMU0_PLL0_PC0_PDIV_MASK         1
+#define PMU0_PLL0_PC0_PDIV_FREQ         25000
+#define PMU0_PLL0_PC0_DIV_ARM_MASK      0x00000038
+#define PMU0_PLL0_PC0_DIV_ARM_SHIFT     3
+#define PMU0_PLL0_PC0_DIV_ARM_BASE      8
+
+
+#define PMU0_PLL0_PC0_DIV_ARM_110MHZ    0
+#define PMU0_PLL0_PC0_DIV_ARM_97_7MHZ   1
+#define PMU0_PLL0_PC0_DIV_ARM_88MHZ     2
+#define PMU0_PLL0_PC0_DIV_ARM_80MHZ     3 
+#define PMU0_PLL0_PC0_DIV_ARM_73_3MHZ   4
+#define PMU0_PLL0_PC0_DIV_ARM_67_7MHZ   5
+#define PMU0_PLL0_PC0_DIV_ARM_62_9MHZ   6
+#define PMU0_PLL0_PC0_DIV_ARM_58_6MHZ   7
+
+
+#define PMU0_PLL0_PLLCTL1               1
+#define PMU0_PLL0_PC1_WILD_INT_MASK     0xf0000000
+#define PMU0_PLL0_PC1_WILD_INT_SHIFT    28
+#define PMU0_PLL0_PC1_WILD_FRAC_MASK    0x0fffff00
+#define PMU0_PLL0_PC1_WILD_FRAC_SHIFT   8
+#define PMU0_PLL0_PC1_STOP_MOD          0x00000040
+
+
+#define PMU0_PLL0_PLLCTL2               2
+#define PMU0_PLL0_PC2_WILD_INT_MASK     0xf
+#define PMU0_PLL0_PC2_WILD_INT_SHIFT    4
+
+
+
+#define PMU1_PLL0_PLLCTL0               0
+#define PMU1_PLL0_PC0_P1DIV_MASK        0x00f00000
+#define PMU1_PLL0_PC0_P1DIV_SHIFT       20
+#define PMU1_PLL0_PC0_P2DIV_MASK        0x0f000000
+#define PMU1_PLL0_PC0_P2DIV_SHIFT       24
+
+
+#define PMU1_PLL0_PLLCTL1               1
+#define PMU1_PLL0_PC1_M1DIV_MASK        0x000000ff
+#define PMU1_PLL0_PC1_M1DIV_SHIFT       0
+#define PMU1_PLL0_PC1_M2DIV_MASK        0x0000ff00
+#define PMU1_PLL0_PC1_M2DIV_SHIFT       8
+#define PMU1_PLL0_PC1_M3DIV_MASK        0x00ff0000
+#define PMU1_PLL0_PC1_M3DIV_SHIFT       16
+#define PMU1_PLL0_PC1_M4DIV_MASK        0xff000000
+#define PMU1_PLL0_PC1_M4DIV_SHIFT       24
+#define PMU1_PLL0_PC1_M4DIV_BY_9        9
+#define PMU1_PLL0_PC1_M4DIV_BY_18       0x12
+#define PMU1_PLL0_PC1_M4DIV_BY_36       0x24
+
+#define DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT 8
+#define DOT11MAC_880MHZ_CLK_DIVISOR_MASK (0xFF << DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT)
+#define DOT11MAC_880MHZ_CLK_DIVISOR_VAL  (0xE << DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT)
+
+
+#define PMU1_PLL0_PLLCTL2               2
+#define PMU1_PLL0_PC2_M5DIV_MASK        0x000000ff
+#define PMU1_PLL0_PC2_M5DIV_SHIFT       0
+#define PMU1_PLL0_PC2_M5DIV_BY_12       0xc
+#define PMU1_PLL0_PC2_M5DIV_BY_18       0x12
+#define PMU1_PLL0_PC2_M5DIV_BY_36       0x24
+#define PMU1_PLL0_PC2_M6DIV_MASK        0x0000ff00
+#define PMU1_PLL0_PC2_M6DIV_SHIFT       8
+#define PMU1_PLL0_PC2_M6DIV_BY_18       0x12
+#define PMU1_PLL0_PC2_M6DIV_BY_36       0x24
+#define PMU1_PLL0_PC2_NDIV_MODE_MASK    0x000e0000
+#define PMU1_PLL0_PC2_NDIV_MODE_SHIFT   17
+#define PMU1_PLL0_PC2_NDIV_MODE_MASH    1
+#define PMU1_PLL0_PC2_NDIV_MODE_MFB     2       
+#define PMU1_PLL0_PC2_NDIV_INT_MASK     0x1ff00000
+#define PMU1_PLL0_PC2_NDIV_INT_SHIFT    20
+
+
+#define PMU1_PLL0_PLLCTL3               3
+#define PMU1_PLL0_PC3_NDIV_FRAC_MASK    0x00ffffff
+#define PMU1_PLL0_PC3_NDIV_FRAC_SHIFT   0
+
+
+#define PMU1_PLL0_PLLCTL4               4
+
+
+#define PMU1_PLL0_PLLCTL5               5
+#define PMU1_PLL0_PC5_CLK_DRV_MASK 0xffffff00
+#define PMU1_PLL0_PC5_CLK_DRV_SHIFT 8
+
+
+#define PMU2_PHY_PLL_PLLCTL             4
+#define PMU2_SI_PLL_PLLCTL              10
+
+
+
+
+#define PMU2_PLL_PLLCTL0                0
+#define PMU2_PLL_PC0_P1DIV_MASK         0x00f00000
+#define PMU2_PLL_PC0_P1DIV_SHIFT        20
+#define PMU2_PLL_PC0_P2DIV_MASK         0x0f000000
+#define PMU2_PLL_PC0_P2DIV_SHIFT        24
+
+
+#define PMU2_PLL_PLLCTL1                1
+#define PMU2_PLL_PC1_M1DIV_MASK         0x000000ff
+#define PMU2_PLL_PC1_M1DIV_SHIFT        0
+#define PMU2_PLL_PC1_M2DIV_MASK         0x0000ff00
+#define PMU2_PLL_PC1_M2DIV_SHIFT        8
+#define PMU2_PLL_PC1_M3DIV_MASK         0x00ff0000
+#define PMU2_PLL_PC1_M3DIV_SHIFT        16
+#define PMU2_PLL_PC1_M4DIV_MASK         0xff000000
+#define PMU2_PLL_PC1_M4DIV_SHIFT        24
+
+
+#define PMU2_PLL_PLLCTL2                2
+#define PMU2_PLL_PC2_M5DIV_MASK         0x000000ff
+#define PMU2_PLL_PC2_M5DIV_SHIFT        0
+#define PMU2_PLL_PC2_M6DIV_MASK         0x0000ff00
+#define PMU2_PLL_PC2_M6DIV_SHIFT        8
+#define PMU2_PLL_PC2_NDIV_MODE_MASK     0x000e0000
+#define PMU2_PLL_PC2_NDIV_MODE_SHIFT    17
+#define PMU2_PLL_PC2_NDIV_INT_MASK      0x1ff00000
+#define PMU2_PLL_PC2_NDIV_INT_SHIFT     20
+
+
+#define PMU2_PLL_PLLCTL3                3
+#define PMU2_PLL_PC3_NDIV_FRAC_MASK     0x00ffffff
+#define PMU2_PLL_PC3_NDIV_FRAC_SHIFT    0
+
+
+#define PMU2_PLL_PLLCTL4                4
+
+
+#define PMU2_PLL_PLLCTL5                5
+#define PMU2_PLL_PC5_CLKDRIVE_CH1_MASK  0x00000f00
+#define PMU2_PLL_PC5_CLKDRIVE_CH1_SHIFT 8
+#define PMU2_PLL_PC5_CLKDRIVE_CH2_MASK  0x0000f000
+#define PMU2_PLL_PC5_CLKDRIVE_CH2_SHIFT 12
+#define PMU2_PLL_PC5_CLKDRIVE_CH3_MASK  0x000f0000
+#define PMU2_PLL_PC5_CLKDRIVE_CH3_SHIFT 16
+#define PMU2_PLL_PC5_CLKDRIVE_CH4_MASK  0x00f00000
+#define PMU2_PLL_PC5_CLKDRIVE_CH4_SHIFT 20
+#define PMU2_PLL_PC5_CLKDRIVE_CH5_MASK  0x0f000000
+#define PMU2_PLL_PC5_CLKDRIVE_CH5_SHIFT 24
+#define PMU2_PLL_PC5_CLKDRIVE_CH6_MASK  0xf0000000
+#define PMU2_PLL_PC5_CLKDRIVE_CH6_SHIFT 28
+
+
+#define PMU5_PLL_P1P2_OFF               0
+#define PMU5_PLL_P1_MASK                0x0f000000
+#define PMU5_PLL_P1_SHIFT               24
+#define PMU5_PLL_P2_MASK                0x00f00000
+#define PMU5_PLL_P2_SHIFT               20
+#define PMU5_PLL_M14_OFF                1
+#define PMU5_PLL_MDIV_MASK              0x000000ff
+#define PMU5_PLL_MDIV_WIDTH             8
+#define PMU5_PLL_NM5_OFF                2
+#define PMU5_PLL_NDIV_MASK              0xfff00000
+#define PMU5_PLL_NDIV_SHIFT             20
+#define PMU5_PLL_NDIV_MODE_MASK         0x000e0000
+#define PMU5_PLL_NDIV_MODE_SHIFT        17
+#define PMU5_PLL_FMAB_OFF               3
+#define PMU5_PLL_MRAT_MASK              0xf0000000
+#define PMU5_PLL_MRAT_SHIFT             28
+#define PMU5_PLL_ABRAT_MASK             0x08000000
+#define PMU5_PLL_ABRAT_SHIFT            27
+#define PMU5_PLL_FDIV_MASK              0x07ffffff
+#define PMU5_PLL_PLLCTL_OFF             4
+#define PMU5_PLL_PCHI_OFF               5
+#define PMU5_PLL_PCHI_MASK              0x0000003f
+
+
+#define PMU_XTALFREQ_REG_ILPCTR_MASK    0x00001FFF
+#define PMU_XTALFREQ_REG_MEASURE_MASK   0x80000000
+#define PMU_XTALFREQ_REG_MEASURE_SHIFT  31
+
+
+#define PMU5_MAINPLL_CPU                1
+#define PMU5_MAINPLL_MEM                2
+#define PMU5_MAINPLL_SI                 3
+
+#define PMU7_PLL_PLLCTL7                7
+#define PMU7_PLL_CTL7_M4DIV_MASK        0xff000000
+#define PMU7_PLL_CTL7_M4DIV_SHIFT       24
+#define PMU7_PLL_CTL7_M4DIV_BY_6        6
+#define PMU7_PLL_CTL7_M4DIV_BY_12       0xc
+#define PMU7_PLL_CTL7_M4DIV_BY_24       0x18
+#define PMU7_PLL_PLLCTL8                8
+#define PMU7_PLL_CTL8_M5DIV_MASK        0x000000ff
+#define PMU7_PLL_CTL8_M5DIV_SHIFT       0
+#define PMU7_PLL_CTL8_M5DIV_BY_8        8
+#define PMU7_PLL_CTL8_M5DIV_BY_12       0xc
+#define PMU7_PLL_CTL8_M5DIV_BY_24       0x18
+#define PMU7_PLL_CTL8_M6DIV_MASK        0x0000ff00
+#define PMU7_PLL_CTL8_M6DIV_SHIFT       8
+#define PMU7_PLL_CTL8_M6DIV_BY_12       0xc
+#define PMU7_PLL_CTL8_M6DIV_BY_24       0x18
+#define PMU7_PLL_PLLCTL11               11
+#define PMU7_PLL_PLLCTL11_MASK          0xffffff00
+#define PMU7_PLL_PLLCTL11_VAL           0x22222200
+
+
+#define PMU4716_MAINPLL_PLL0            12
+
+
+#define PMU5356_MAINPLL_PLL0            0
+#define PMU5357_MAINPLL_PLL0            0
+
+
+#define RES4716_PROC_PLL_ON             0x00000040
+#define RES4716_PROC_HT_AVAIL           0x00000080
+
+
+#define CCTRL_471X_I2S_PINS_ENABLE      0x0080 
+
+
+
+#define CCTRL_5357_I2S_PINS_ENABLE      0x00040000 
+#define CCTRL_5357_I2CSPI_PINS_ENABLE   0x00080000 
+
+
+#define RES5354_EXT_SWITCHER_PWM        0       
+#define RES5354_BB_SWITCHER_PWM         1       
+#define RES5354_BB_SWITCHER_BURST       2       
+#define RES5354_BB_EXT_SWITCHER_BURST   3       
+#define RES5354_ILP_REQUEST             4       
+#define RES5354_RADIO_SWITCHER_PWM      5       
+#define RES5354_RADIO_SWITCHER_BURST    6       
+#define RES5354_ROM_SWITCH              7       
+#define RES5354_PA_REF_LDO              8       
+#define RES5354_RADIO_LDO               9       
+#define RES5354_AFE_LDO                 10      
+#define RES5354_PLL_LDO                 11      
+#define RES5354_BG_FILTBYP              12      
+#define RES5354_TX_FILTBYP              13      
+#define RES5354_RX_FILTBYP              14      
+#define RES5354_XTAL_PU                 15      
+#define RES5354_XTAL_EN                 16      
+#define RES5354_BB_PLL_FILTBYP          17      
+#define RES5354_RF_PLL_FILTBYP          18      
+#define RES5354_BB_PLL_PU               19      
+
+
+#define CCTRL5357_EXTPA                 (1<<14)  
+#define CCTRL5357_ANT_MUX_2o3           (1<<15)  
+
+
+#define RES4328_EXT_SWITCHER_PWM        0       
+#define RES4328_BB_SWITCHER_PWM         1       
+#define RES4328_BB_SWITCHER_BURST       2       
+#define RES4328_BB_EXT_SWITCHER_BURST   3       
+#define RES4328_ILP_REQUEST             4       
+#define RES4328_RADIO_SWITCHER_PWM      5       
+#define RES4328_RADIO_SWITCHER_BURST    6       
+#define RES4328_ROM_SWITCH              7       
+#define RES4328_PA_REF_LDO              8       
+#define RES4328_RADIO_LDO               9       
+#define RES4328_AFE_LDO                 10      
+#define RES4328_PLL_LDO                 11      
+#define RES4328_BG_FILTBYP              12      
+#define RES4328_TX_FILTBYP              13      
+#define RES4328_RX_FILTBYP              14      
+#define RES4328_XTAL_PU                 15      
+#define RES4328_XTAL_EN                 16      
+#define RES4328_BB_PLL_FILTBYP          17      
+#define RES4328_RF_PLL_FILTBYP          18      
+#define RES4328_BB_PLL_PU               19      
+
+
+#define RES4325_BUCK_BOOST_BURST        0       
+#define RES4325_CBUCK_BURST             1       
+#define RES4325_CBUCK_PWM               2       
+#define RES4325_CLDO_CBUCK_BURST        3       
+#define RES4325_CLDO_CBUCK_PWM          4       
+#define RES4325_BUCK_BOOST_PWM          5       
+#define RES4325_ILP_REQUEST             6       
+#define RES4325_ABUCK_BURST             7       
+#define RES4325_ABUCK_PWM               8       
+#define RES4325_LNLDO1_PU               9       
+#define RES4325_OTP_PU                  10      
+#define RES4325_LNLDO3_PU               11      
+#define RES4325_LNLDO4_PU               12      
+#define RES4325_XTAL_PU                 13      
+#define RES4325_ALP_AVAIL               14      
+#define RES4325_RX_PWRSW_PU             15      
+#define RES4325_TX_PWRSW_PU             16      
+#define RES4325_RFPLL_PWRSW_PU          17      
+#define RES4325_LOGEN_PWRSW_PU          18      
+#define RES4325_AFE_PWRSW_PU            19      
+#define RES4325_BBPLL_PWRSW_PU          20      
+#define RES4325_HT_AVAIL                21      
+
+
+#define RES4325B0_CBUCK_LPOM            1       
+#define RES4325B0_CBUCK_BURST           2       
+#define RES4325B0_CBUCK_PWM             3       
+#define RES4325B0_CLDO_PU               4       
+
+
+#define RES4325C1_LNLDO2_PU             12      
+
+
+#define CST4325_SPROM_OTP_SEL_MASK      0x00000003
+#define CST4325_DEFCIS_SEL              0       
+#define CST4325_SPROM_SEL               1       
+#define CST4325_OTP_SEL                 2       
+#define CST4325_OTP_PWRDN               3       
+#define CST4325_SDIO_USB_MODE_MASK      0x00000004
+#define CST4325_SDIO_USB_MODE_SHIFT     2
+#define CST4325_RCAL_VALID_MASK         0x00000008
+#define CST4325_RCAL_VALID_SHIFT        3
+#define CST4325_RCAL_VALUE_MASK         0x000001f0
+#define CST4325_RCAL_VALUE_SHIFT        4
+#define CST4325_PMUTOP_2B_MASK          0x00000200      
+#define CST4325_PMUTOP_2B_SHIFT         9
+
+#define RES4329_RESERVED0               0       
+#define RES4329_CBUCK_LPOM              1       
+#define RES4329_CBUCK_BURST             2       
+#define RES4329_CBUCK_PWM               3       
+#define RES4329_CLDO_PU                 4       
+#define RES4329_PALDO_PU                5       
+#define RES4329_ILP_REQUEST             6       
+#define RES4329_RESERVED7               7       
+#define RES4329_RESERVED8               8       
+#define RES4329_LNLDO1_PU               9       
+#define RES4329_OTP_PU                  10      
+#define RES4329_RESERVED11              11      
+#define RES4329_LNLDO2_PU               12      
+#define RES4329_XTAL_PU                 13      
+#define RES4329_ALP_AVAIL               14      
+#define RES4329_RX_PWRSW_PU             15      
+#define RES4329_TX_PWRSW_PU             16      
+#define RES4329_RFPLL_PWRSW_PU          17      
+#define RES4329_LOGEN_PWRSW_PU          18      
+#define RES4329_AFE_PWRSW_PU            19      
+#define RES4329_BBPLL_PWRSW_PU          20      
+#define RES4329_HT_AVAIL                21      
+
+#define CST4329_SPROM_OTP_SEL_MASK      0x00000003
+#define CST4329_DEFCIS_SEL              0       
+#define CST4329_SPROM_SEL               1       
+#define CST4329_OTP_SEL                 2       
+#define CST4329_OTP_PWRDN               3       
+#define CST4329_SPI_SDIO_MODE_MASK      0x00000004
+#define CST4329_SPI_SDIO_MODE_SHIFT     2
+
+
+#define CST4312_SPROM_OTP_SEL_MASK      0x00000003
+#define CST4312_DEFCIS_SEL              0       
+#define CST4312_SPROM_SEL               1       
+#define CST4312_OTP_SEL                 2       
+#define CST4312_OTP_BAD                 3       
+
+
+#define RES4312_SWITCHER_BURST          0       
+#define RES4312_SWITCHER_PWM            1       
+#define RES4312_PA_REF_LDO              2       
+#define RES4312_CORE_LDO_BURST          3       
+#define RES4312_CORE_LDO_PWM            4       
+#define RES4312_RADIO_LDO               5       
+#define RES4312_ILP_REQUEST             6       
+#define RES4312_BG_FILTBYP              7       
+#define RES4312_TX_FILTBYP              8       
+#define RES4312_RX_FILTBYP              9       
+#define RES4312_XTAL_PU                 10      
+#define RES4312_ALP_AVAIL               11      
+#define RES4312_BB_PLL_FILTBYP          12      
+#define RES4312_RF_PLL_FILTBYP          13      
+#define RES4312_HT_AVAIL                14      
+
+
+#define RES4322_RF_LDO                  0
+#define RES4322_ILP_REQUEST             1
+#define RES4322_XTAL_PU                 2
+#define RES4322_ALP_AVAIL               3
+#define RES4322_SI_PLL_ON               4
+#define RES4322_HT_SI_AVAIL             5
+#define RES4322_PHY_PLL_ON              6
+#define RES4322_HT_PHY_AVAIL            7
+#define RES4322_OTP_PU                  8
+
+
+#define CST4322_XTAL_FREQ_20_40MHZ      0x00000020
+#define CST4322_SPROM_OTP_SEL_MASK      0x000000c0
+#define CST4322_SPROM_OTP_SEL_SHIFT     6
+#define CST4322_NO_SPROM_OTP            0       
+#define CST4322_SPROM_PRESENT           1       
+#define CST4322_OTP_PRESENT             2       
+#define CST4322_PCI_OR_USB              0x00000100
+#define CST4322_BOOT_MASK               0x00000600
+#define CST4322_BOOT_SHIFT              9
+#define CST4322_BOOT_FROM_SRAM          0       
+#define CST4322_BOOT_FROM_ROM           1       
+#define CST4322_BOOT_FROM_FLASH         2       
+#define CST4322_BOOT_FROM_INVALID       3
+#define CST4322_ILP_DIV_EN              0x00000800
+#define CST4322_FLASH_TYPE_MASK         0x00001000
+#define CST4322_FLASH_TYPE_SHIFT        12
+#define CST4322_FLASH_TYPE_SHIFT_ST     0       
+#define CST4322_FLASH_TYPE_SHIFT_ATMEL  1       
+#define CST4322_ARM_TAP_SEL             0x00002000
+#define CST4322_RES_INIT_MODE_MASK      0x0000c000
+#define CST4322_RES_INIT_MODE_SHIFT     14
+#define CST4322_RES_INIT_MODE_ILPAVAIL  0       
+#define CST4322_RES_INIT_MODE_ILPREQ    1       
+#define CST4322_RES_INIT_MODE_ALPAVAIL  2       
+#define CST4322_RES_INIT_MODE_HTAVAIL   3       
+#define CST4322_PCIPLLCLK_GATING        0x00010000
+#define CST4322_CLK_SWITCH_PCI_TO_ALP   0x00020000
+#define CST4322_PCI_CARDBUS_MODE        0x00040000
+
+
+#define CCTRL43224_GPIO_TOGGLE          0x8000 
+#define CCTRL_43224A0_12MA_LED_DRIVE    0x00F000F0 
+#define CCTRL_43224B0_12MA_LED_DRIVE    0xF0    
+
+
+#define RES43236_REGULATOR              0
+#define RES43236_ILP_REQUEST            1
+#define RES43236_XTAL_PU                2
+#define RES43236_ALP_AVAIL              3
+#define RES43236_SI_PLL_ON              4
+#define RES43236_HT_SI_AVAIL            5
+
+
+#define CCTRL43236_BT_COEXIST           (1<<0)  
+#define CCTRL43236_SECI                 (1<<1)  
+#define CCTRL43236_EXT_LNA              (1<<2)  
+#define CCTRL43236_ANT_MUX_2o3          (1<<3)  
+#define CCTRL43236_GSIO                 (1<<4)  
+
+
+#define CST43236_SFLASH_MASK            0x00000040
+#define CST43236_OTP_SEL_MASK           0x00000080
+#define CST43236_OTP_SEL_SHIFT          7
+#define CST43236_HSIC_MASK              0x00000100      
+#define CST43236_BP_CLK                 0x00000200      
+#define CST43236_BOOT_MASK              0x00001800
+#define CST43236_BOOT_SHIFT             11
+#define CST43236_BOOT_FROM_SRAM         0       
+#define CST43236_BOOT_FROM_ROM          1       
+#define CST43236_BOOT_FROM_FLASH        2       
+#define CST43236_BOOT_FROM_INVALID      3
+
+
+#define RES43237_REGULATOR              0
+#define RES43237_ILP_REQUEST            1
+#define RES43237_XTAL_PU                2
+#define RES43237_ALP_AVAIL              3
+#define RES43237_SI_PLL_ON              4
+#define RES43237_HT_SI_AVAIL            5
+
+
+#define CCTRL43237_BT_COEXIST           (1<<0)  
+#define CCTRL43237_SECI                 (1<<1)  
+#define CCTRL43237_EXT_LNA              (1<<2)  
+#define CCTRL43237_ANT_MUX_2o3          (1<<3)  
+#define CCTRL43237_GSIO                 (1<<4)  
+
+
+#define CST43237_SFLASH_MASK            0x00000040
+#define CST43237_OTP_SEL_MASK           0x00000080
+#define CST43237_OTP_SEL_SHIFT          7
+#define CST43237_HSIC_MASK              0x00000100      
+#define CST43237_BP_CLK                 0x00000200      
+#define CST43237_BOOT_MASK              0x00001800
+#define CST43237_BOOT_SHIFT             11
+#define CST43237_BOOT_FROM_SRAM         0       
+#define CST43237_BOOT_FROM_ROM          1       
+#define CST43237_BOOT_FROM_FLASH        2       
+#define CST43237_BOOT_FROM_INVALID      3
+
+
+#define RES43239_OTP_PU                 9
+#define RES43239_MACPHY_CLKAVAIL        23
+#define RES43239_HT_AVAIL               24
+
+
+#define CST43239_SPROM_MASK                     0x00000002
+#define CST43239_SFLASH_MASK            0x00000004
+#define CST43239_RES_INIT_MODE_SHIFT    7
+#define CST43239_RES_INIT_MODE_MASK             0x000001f0
+#define CST43239_CHIPMODE_SDIOD(cs)     ((cs) & (1 << 15))      
+#define CST43239_CHIPMODE_USB20D(cs)    ((cs) & !(1 << 15))     
+#define CST43239_CHIPMODE_SDIO(cs)      (((cs) & (1 << 0)) == 0)        
+#define CST43239_CHIPMODE_GSPI(cs)      (((cs) & (1 << 0)) == (1 << 0)) 
+
+
+#define CCTRL43239_XTAL_STRENGTH(ctl)   ((ctl & 0x3F) << 12)
+
+
+
+
+#define RES4315_CBUCK_LPOM              1       
+#define RES4315_CBUCK_BURST             2       
+#define RES4315_CBUCK_PWM               3       
+#define RES4315_CLDO_PU                 4       
+#define RES4315_PALDO_PU                5       
+#define RES4315_ILP_REQUEST             6       
+#define RES4315_LNLDO1_PU               9       
+#define RES4315_OTP_PU                  10      
+#define RES4315_LNLDO2_PU               12      
+#define RES4315_XTAL_PU                 13      
+#define RES4315_ALP_AVAIL               14      
+#define RES4315_RX_PWRSW_PU             15      
+#define RES4315_TX_PWRSW_PU             16      
+#define RES4315_RFPLL_PWRSW_PU          17      
+#define RES4315_LOGEN_PWRSW_PU          18      
+#define RES4315_AFE_PWRSW_PU            19      
+#define RES4315_BBPLL_PWRSW_PU          20      
+#define RES4315_HT_AVAIL                21      
+
+
+#define CST4315_SPROM_OTP_SEL_MASK      0x00000003      
+#define CST4315_DEFCIS_SEL              0x00000000      
+#define CST4315_SPROM_SEL               0x00000001      
+#define CST4315_OTP_SEL                 0x00000002      
+#define CST4315_OTP_PWRDN               0x00000003      
+#define CST4315_SDIO_MODE               0x00000004      
+#define CST4315_RCAL_VALID              0x00000008
+#define CST4315_RCAL_VALUE_MASK         0x000001f0
+#define CST4315_RCAL_VALUE_SHIFT        4
+#define CST4315_PALDO_EXTPNP            0x00000200      
+#define CST4315_CBUCK_MODE_MASK         0x00000c00
+#define CST4315_CBUCK_MODE_BURST        0x00000400
+#define CST4315_CBUCK_MODE_LPBURST      0x00000c00
+
+
+#define RES4319_CBUCK_LPOM              1       
+#define RES4319_CBUCK_BURST             2       
+#define RES4319_CBUCK_PWM               3       
+#define RES4319_CLDO_PU                 4       
+#define RES4319_PALDO_PU                5       
+#define RES4319_ILP_REQUEST             6       
+#define RES4319_LNLDO1_PU               9       
+#define RES4319_OTP_PU                  10      
+#define RES4319_LNLDO2_PU               12      
+#define RES4319_XTAL_PU                 13      
+#define RES4319_ALP_AVAIL               14      
+#define RES4319_RX_PWRSW_PU             15      
+#define RES4319_TX_PWRSW_PU             16      
+#define RES4319_RFPLL_PWRSW_PU          17      
+#define RES4319_LOGEN_PWRSW_PU          18      
+#define RES4319_AFE_PWRSW_PU            19      
+#define RES4319_BBPLL_PWRSW_PU          20      
+#define RES4319_HT_AVAIL                21      
+
+
+#define CST4319_SPI_CPULESSUSB          0x00000001
+#define CST4319_SPI_CLK_POL             0x00000002
+#define CST4319_SPI_CLK_PH              0x00000008
+#define CST4319_SPROM_OTP_SEL_MASK      0x000000c0      
+#define CST4319_SPROM_OTP_SEL_SHIFT     6
+#define CST4319_DEFCIS_SEL              0x00000000      
+#define CST4319_SPROM_SEL               0x00000040      
+#define CST4319_OTP_SEL                 0x00000080      
+#define CST4319_OTP_PWRDN               0x000000c0      
+#define CST4319_SDIO_USB_MODE           0x00000100      
+#define CST4319_REMAP_SEL_MASK          0x00000600
+#define CST4319_ILPDIV_EN               0x00000800
+#define CST4319_XTAL_PD_POL             0x00001000
+#define CST4319_LPO_SEL                 0x00002000
+#define CST4319_RES_INIT_MODE           0x0000c000
+#define CST4319_PALDO_EXTPNP            0x00010000      
+#define CST4319_CBUCK_MODE_MASK         0x00060000
+#define CST4319_CBUCK_MODE_BURST        0x00020000
+#define CST4319_CBUCK_MODE_LPBURST      0x00060000
+#define CST4319_RCAL_VALID              0x01000000
+#define CST4319_RCAL_VALUE_MASK         0x3e000000
+#define CST4319_RCAL_VALUE_SHIFT        25
+
+#define PMU1_PLL0_CHIPCTL0              0
+#define PMU1_PLL0_CHIPCTL1              1
+#define PMU1_PLL0_CHIPCTL2              2
+#define CCTL_4319USB_XTAL_SEL_MASK      0x00180000
+#define CCTL_4319USB_XTAL_SEL_SHIFT     19
+#define CCTL_4319USB_48MHZ_PLL_SEL      1
+#define CCTL_4319USB_24MHZ_PLL_SEL      2
+
+
+#define RES4336_CBUCK_LPOM              0
+#define RES4336_CBUCK_BURST             1
+#define RES4336_CBUCK_LP_PWM            2
+#define RES4336_CBUCK_PWM               3
+#define RES4336_CLDO_PU                 4
+#define RES4336_DIS_INT_RESET_PD        5
+#define RES4336_ILP_REQUEST             6
+#define RES4336_LNLDO_PU                7
+#define RES4336_LDO3P3_PU               8
+#define RES4336_OTP_PU                  9
+#define RES4336_XTAL_PU                 10
+#define RES4336_ALP_AVAIL               11
+#define RES4336_RADIO_PU                12
+#define RES4336_BG_PU                   13
+#define RES4336_VREG1p4_PU_PU           14
+#define RES4336_AFE_PWRSW_PU            15
+#define RES4336_RX_PWRSW_PU             16
+#define RES4336_TX_PWRSW_PU             17
+#define RES4336_BB_PWRSW_PU             18
+#define RES4336_SYNTH_PWRSW_PU          19
+#define RES4336_MISC_PWRSW_PU           20
+#define RES4336_LOGEN_PWRSW_PU          21
+#define RES4336_BBPLL_PWRSW_PU          22
+#define RES4336_MACPHY_CLKAVAIL         23
+#define RES4336_HT_AVAIL                24
+#define RES4336_RSVD                    25
+
+
+#define CST4336_SPI_MODE_MASK           0x00000001
+#define CST4336_SPROM_PRESENT           0x00000002
+#define CST4336_OTP_PRESENT             0x00000004
+#define CST4336_ARMREMAP_0              0x00000008
+#define CST4336_ILPDIV_EN_MASK          0x00000010
+#define CST4336_ILPDIV_EN_SHIFT         4
+#define CST4336_XTAL_PD_POL_MASK        0x00000020
+#define CST4336_XTAL_PD_POL_SHIFT       5
+#define CST4336_LPO_SEL_MASK            0x00000040
+#define CST4336_LPO_SEL_SHIFT           6
+#define CST4336_RES_INIT_MODE_MASK      0x00000180
+#define CST4336_RES_INIT_MODE_SHIFT     7
+#define CST4336_CBUCK_MODE_MASK         0x00000600
+#define CST4336_CBUCK_MODE_SHIFT        9
+
+
+#define PCTL_4336_SERIAL_ENAB   (1  << 24)
+
+
+#define RES4330_CBUCK_LPOM              0
+#define RES4330_CBUCK_BURST             1
+#define RES4330_CBUCK_LP_PWM            2
+#define RES4330_CBUCK_PWM               3
+#define RES4330_CLDO_PU                 4
+#define RES4330_DIS_INT_RESET_PD        5
+#define RES4330_ILP_REQUEST             6
+#define RES4330_LNLDO_PU                7
+#define RES4330_LDO3P3_PU               8
+#define RES4330_OTP_PU                  9
+#define RES4330_XTAL_PU                 10
+#define RES4330_ALP_AVAIL               11
+#define RES4330_RADIO_PU                12
+#define RES4330_BG_PU                   13
+#define RES4330_VREG1p4_PU_PU           14
+#define RES4330_AFE_PWRSW_PU            15
+#define RES4330_RX_PWRSW_PU             16
+#define RES4330_TX_PWRSW_PU             17
+#define RES4330_BB_PWRSW_PU             18
+#define RES4330_SYNTH_PWRSW_PU          19
+#define RES4330_MISC_PWRSW_PU           20
+#define RES4330_LOGEN_PWRSW_PU          21
+#define RES4330_BBPLL_PWRSW_PU          22
+#define RES4330_MACPHY_CLKAVAIL         23
+#define RES4330_HT_AVAIL                24
+#define RES4330_5gRX_PWRSW_PU           25
+#define RES4330_5gTX_PWRSW_PU           26
+#define RES4330_5g_LOGEN_PWRSW_PU       27
+
+
+#define CST4330_CHIPMODE_SDIOD(cs)      (((cs) & 0x7) < 6)      
+#define CST4330_CHIPMODE_USB20D(cs)     (((cs) & 0x7) >= 6)     
+#define CST4330_CHIPMODE_SDIO(cs)       (((cs) & 0x4) == 0)     
+#define CST4330_CHIPMODE_GSPI(cs)       (((cs) & 0x6) == 4)     
+#define CST4330_CHIPMODE_USB(cs)        (((cs) & 0x7) == 6)     
+#define CST4330_CHIPMODE_USBDA(cs)      (((cs) & 0x7) == 7)     
+#define CST4330_OTP_PRESENT             0x00000010
+#define CST4330_LPO_AUTODET_EN          0x00000020
+#define CST4330_ARMREMAP_0              0x00000040
+#define CST4330_SPROM_PRESENT           0x00000080      
+#define CST4330_ILPDIV_EN               0x00000100
+#define CST4330_LPO_SEL                 0x00000200
+#define CST4330_RES_INIT_MODE_SHIFT     10
+#define CST4330_RES_INIT_MODE_MASK      0x00000c00
+#define CST4330_CBUCK_MODE_SHIFT        12
+#define CST4330_CBUCK_MODE_MASK         0x00003000
+#define CST4330_CBUCK_POWER_OK          0x00004000
+#define CST4330_BB_PLL_LOCKED           0x00008000
+#define SOCDEVRAM_4330_BP_ADDR          0x1E000000
+#define SOCDEVRAM_4330_ARM_ADDR         0x00800000
+
+
+#define PCTL_4330_SERIAL_ENAB   (1  << 24)
+
+
+#define CCTRL_4330_GPIO_SEL             0x00000001    
+#define CCTRL_4330_ERCX_SEL             0x00000002    
+#define CCTRL_4330_SDIO_HOST_WAKE       0x00000004    
+#define CCTRL_4330_JTAG_DISABLE 0x00000008    
+
+
+#define RES4313_BB_PU_RSRC              0
+#define RES4313_ILP_REQ_RSRC            1
+#define RES4313_XTAL_PU_RSRC            2
+#define RES4313_ALP_AVAIL_RSRC          3
+#define RES4313_RADIO_PU_RSRC           4
+#define RES4313_BG_PU_RSRC              5
+#define RES4313_VREG1P4_PU_RSRC         6
+#define RES4313_AFE_PWRSW_RSRC          7
+#define RES4313_RX_PWRSW_RSRC           8
+#define RES4313_TX_PWRSW_RSRC           9
+#define RES4313_BB_PWRSW_RSRC           10
+#define RES4313_SYNTH_PWRSW_RSRC        11
+#define RES4313_MISC_PWRSW_RSRC         12
+#define RES4313_BB_PLL_PWRSW_RSRC       13
+#define RES4313_HT_AVAIL_RSRC           14
+#define RES4313_MACPHY_CLK_AVAIL_RSRC   15
+
+
+#define CST4313_SPROM_PRESENT                   1
+#define CST4313_OTP_PRESENT                     2
+#define CST4313_SPROM_OTP_SEL_MASK              0x00000002
+#define CST4313_SPROM_OTP_SEL_SHIFT             0
+
+
+#define CCTRL_4313_12MA_LED_DRIVE    0x00000007    
+
+
+#define RES43228_NOT_USED               0
+#define RES43228_ILP_REQUEST            1
+#define RES43228_XTAL_PU                2
+#define RES43228_ALP_AVAIL              3
+#define RES43228_PLL_EN                 4
+#define RES43228_HT_PHY_AVAIL           5
+
+
+#define CST43228_ILP_DIV_EN             0x1
+#define CST43228_OTP_PRESENT            0x2
+#define CST43228_SERDES_REFCLK_PADSEL   0x4
+#define CST43228_SDIO_MODE              0x8
+#define CST43228_SDIO_OTP_PRESENT       0x10
+#define CST43228_SDIO_RESET             0x20
+
+
+#define PMU_MAX_TRANSITION_DLY  15000
+
+
+#define PMURES_UP_TRANSITION    2
+
+
+
+
+
+#define ECI_BW_20   0x0
+#define ECI_BW_25   0x1
+#define ECI_BW_30   0x2
+#define ECI_BW_35   0x3
+#define ECI_BW_40   0x4
+#define ECI_BW_45   0x5
+#define ECI_BW_50   0x6
+#define ECI_BW_ALL  0x7
+
+
+#define WLAN_NUM_ANT1 TXANT_0
+#define WLAN_NUM_ANT2 TXANT_1
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/sbconfig.h b/drivers/net/wireless/bcmdhd/include/sbconfig.h
new file mode 100644
index 00000000000..76f05ae34bd
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sbconfig.h
@@ -0,0 +1,276 @@
+/*
+ * Broadcom SiliconBackplane hardware register definitions.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sbconfig.h,v 13.70 2008-03-28 19:17:04 Exp $
+ */
+
+
+#ifndef _SBCONFIG_H
+#define _SBCONFIG_H
+
+
+#ifndef PAD
+#define _PADLINE(line)  pad ## line
+#define _XSTR(line)     _PADLINE(line)
+#define PAD             _XSTR(__LINE__)
+#endif
+
+
+#define SB_BUS_SIZE             0x10000         
+#define SB_BUS_BASE(b)          (SI_ENUM_BASE + (b) * SB_BUS_SIZE)
+#define SB_BUS_MAXCORES         (SB_BUS_SIZE / SI_CORE_SIZE)    
+
+
+#define SBCONFIGOFF             0xf00           
+#define SBCONFIGSIZE            256             
+
+#define SBIPSFLAG               0x08
+#define SBTPSFLAG               0x18
+#define SBTMERRLOGA             0x48            
+#define SBTMERRLOG              0x50            
+#define SBADMATCH3              0x60
+#define SBADMATCH2              0x68
+#define SBADMATCH1              0x70
+#define SBIMSTATE               0x90
+#define SBINTVEC                0x94
+#define SBTMSTATELOW            0x98
+#define SBTMSTATEHIGH           0x9c
+#define SBBWA0                  0xa0
+#define SBIMCONFIGLOW           0xa8
+#define SBIMCONFIGHIGH          0xac
+#define SBADMATCH0              0xb0
+#define SBTMCONFIGLOW           0xb8
+#define SBTMCONFIGHIGH          0xbc
+#define SBBCONFIG               0xc0
+#define SBBSTATE                0xc8
+#define SBACTCNFG               0xd8
+#define SBFLAGST                0xe8
+#define SBIDLOW                 0xf8
+#define SBIDHIGH                0xfc
+
+
+
+#define SBIMERRLOGA             0xea8
+#define SBIMERRLOG              0xeb0
+#define SBTMPORTCONNID0         0xed8
+#define SBTMPORTLOCK0           0xef8
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+typedef volatile struct _sbconfig {
+        uint32  PAD[2];
+        uint32  sbipsflag;              
+        uint32  PAD[3];
+        uint32  sbtpsflag;              
+        uint32  PAD[11];
+        uint32  sbtmerrloga;            
+        uint32  PAD;
+        uint32  sbtmerrlog;             
+        uint32  PAD[3];
+        uint32  sbadmatch3;             
+        uint32  PAD;
+        uint32  sbadmatch2;             
+        uint32  PAD;
+        uint32  sbadmatch1;             
+        uint32  PAD[7];
+        uint32  sbimstate;              
+        uint32  sbintvec;               
+        uint32  sbtmstatelow;           
+        uint32  sbtmstatehigh;          
+        uint32  sbbwa0;                 
+        uint32  PAD;
+        uint32  sbimconfiglow;          
+        uint32  sbimconfighigh;         
+        uint32  sbadmatch0;             
+        uint32  PAD;
+        uint32  sbtmconfiglow;          
+        uint32  sbtmconfighigh;         
+        uint32  sbbconfig;              
+        uint32  PAD;
+        uint32  sbbstate;               
+        uint32  PAD[3];
+        uint32  sbactcnfg;              
+        uint32  PAD[3];
+        uint32  sbflagst;               
+        uint32  PAD[3];
+        uint32  sbidlow;                
+        uint32  sbidhigh;               
+} sbconfig_t;
+
+#endif 
+
+
+#define SBIPS_INT1_MASK         0x3f            
+#define SBIPS_INT1_SHIFT        0
+#define SBIPS_INT2_MASK         0x3f00          
+#define SBIPS_INT2_SHIFT        8
+#define SBIPS_INT3_MASK         0x3f0000        
+#define SBIPS_INT3_SHIFT        16
+#define SBIPS_INT4_MASK         0x3f000000      
+#define SBIPS_INT4_SHIFT        24
+
+
+#define SBTPS_NUM0_MASK         0x3f            
+#define SBTPS_F0EN0             0x40            
+
+
+#define SBTMEL_CM               0x00000007      
+#define SBTMEL_CI               0x0000ff00      
+#define SBTMEL_EC               0x0f000000      
+#define SBTMEL_ME               0x80000000      
+
+
+#define SBIM_PC                 0xf             
+#define SBIM_AP_MASK            0x30            
+#define SBIM_AP_BOTH            0x00            
+#define SBIM_AP_TS              0x10            
+#define SBIM_AP_TK              0x20            
+#define SBIM_AP_RSV             0x30            
+#define SBIM_IBE                0x20000         
+#define SBIM_TO                 0x40000         
+#define SBIM_BY                 0x01800000      
+#define SBIM_RJ                 0x02000000      
+
+
+#define SBTML_RESET             0x0001          
+#define SBTML_REJ_MASK          0x0006          
+#define SBTML_REJ               0x0002          
+#define SBTML_TMPREJ            0x0004          
+
+#define SBTML_SICF_SHIFT        16              
+
+
+#define SBTMH_SERR              0x0001          
+#define SBTMH_INT               0x0002          
+#define SBTMH_BUSY              0x0004          
+#define SBTMH_TO                0x0020          
+
+#define SBTMH_SISF_SHIFT        16              
+
+
+#define SBBWA_TAB0_MASK         0xffff          
+#define SBBWA_TAB1_MASK         0xffff          
+#define SBBWA_TAB1_SHIFT        16
+
+
+#define SBIMCL_STO_MASK         0x7             
+#define SBIMCL_RTO_MASK         0x70            
+#define SBIMCL_RTO_SHIFT        4
+#define SBIMCL_CID_MASK         0xff0000        
+#define SBIMCL_CID_SHIFT        16
+
+
+#define SBIMCH_IEM_MASK         0xc             
+#define SBIMCH_TEM_MASK         0x30            
+#define SBIMCH_TEM_SHIFT        4
+#define SBIMCH_BEM_MASK         0xc0            
+#define SBIMCH_BEM_SHIFT        6
+
+
+#define SBAM_TYPE_MASK          0x3             
+#define SBAM_AD64               0x4             
+#define SBAM_ADINT0_MASK        0xf8            
+#define SBAM_ADINT0_SHIFT       3
+#define SBAM_ADINT1_MASK        0x1f8           
+#define SBAM_ADINT1_SHIFT       3
+#define SBAM_ADINT2_MASK        0x1f8           
+#define SBAM_ADINT2_SHIFT       3
+#define SBAM_ADEN               0x400           
+#define SBAM_ADNEG              0x800           
+#define SBAM_BASE0_MASK         0xffffff00      
+#define SBAM_BASE0_SHIFT        8
+#define SBAM_BASE1_MASK         0xfffff000      
+#define SBAM_BASE1_SHIFT        12
+#define SBAM_BASE2_MASK         0xffff0000      
+#define SBAM_BASE2_SHIFT        16
+
+
+#define SBTMCL_CD_MASK          0xff            
+#define SBTMCL_CO_MASK          0xf800          
+#define SBTMCL_CO_SHIFT         11
+#define SBTMCL_IF_MASK          0xfc0000        
+#define SBTMCL_IF_SHIFT         18
+#define SBTMCL_IM_MASK          0x3000000       
+#define SBTMCL_IM_SHIFT         24
+
+
+#define SBTMCH_BM_MASK          0x3             
+#define SBTMCH_RM_MASK          0x3             
+#define SBTMCH_RM_SHIFT         2
+#define SBTMCH_SM_MASK          0x30            
+#define SBTMCH_SM_SHIFT         4
+#define SBTMCH_EM_MASK          0x300           
+#define SBTMCH_EM_SHIFT         8
+#define SBTMCH_IM_MASK          0xc00           
+#define SBTMCH_IM_SHIFT         10
+
+
+#define SBBC_LAT_MASK           0x3             
+#define SBBC_MAX0_MASK          0xf0000         
+#define SBBC_MAX0_SHIFT         16
+#define SBBC_MAX1_MASK          0xf00000        
+#define SBBC_MAX1_SHIFT         20
+
+
+#define SBBS_SRD                0x1             
+#define SBBS_HRD                0x2             
+
+
+#define SBIDL_CS_MASK           0x3             
+#define SBIDL_AR_MASK           0x38            
+#define SBIDL_AR_SHIFT          3
+#define SBIDL_SYNCH             0x40            
+#define SBIDL_INIT              0x80            
+#define SBIDL_MINLAT_MASK       0xf00           
+#define SBIDL_MINLAT_SHIFT      8
+#define SBIDL_MAXLAT            0xf000          
+#define SBIDL_MAXLAT_SHIFT      12
+#define SBIDL_FIRST             0x10000         
+#define SBIDL_CW_MASK           0xc0000         
+#define SBIDL_CW_SHIFT          18
+#define SBIDL_TP_MASK           0xf00000        
+#define SBIDL_TP_SHIFT          20
+#define SBIDL_IP_MASK           0xf000000       
+#define SBIDL_IP_SHIFT          24
+#define SBIDL_RV_MASK           0xf0000000      
+#define SBIDL_RV_SHIFT          28
+#define SBIDL_RV_2_2            0x00000000      
+#define SBIDL_RV_2_3            0x10000000      
+
+
+#define SBIDH_RC_MASK           0x000f          
+#define SBIDH_RCE_MASK          0x7000          
+#define SBIDH_RCE_SHIFT         8
+#define SBCOREREV(sbidh) \
+        ((((sbidh) & SBIDH_RCE_MASK) >> SBIDH_RCE_SHIFT) | ((sbidh) & SBIDH_RC_MASK))
+#define SBIDH_CC_MASK           0x8ff0          
+#define SBIDH_CC_SHIFT          4
+#define SBIDH_VC_MASK           0xffff0000      
+#define SBIDH_VC_SHIFT          16
+
+#define SB_COMMIT               0xfd8           
+
+
+#define SB_VEND_BCM             0x4243          
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/sbhnddma.h b/drivers/net/wireless/bcmdhd/include/sbhnddma.h
new file mode 100644
index 00000000000..05d0587bc20
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sbhnddma.h
@@ -0,0 +1,327 @@
+/*
+ * Generic Broadcom Home Networking Division (HND) DMA engine HW interface
+ * This supports the following chips: BCM42xx, 44xx, 47xx .
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sbhnddma.h,v 13.20.2.3 2010-10-14 22:21:29 Exp $
+ */
+
+
+#ifndef _sbhnddma_h_
+#define _sbhnddma_h_
+
+
+
+
+
+
+
+typedef volatile struct {
+        uint32  control;                
+        uint32  addr;                   
+        uint32  ptr;                    
+        uint32  status;                 
+} dma32regs_t;
+
+typedef volatile struct {
+        dma32regs_t     xmt;            
+        dma32regs_t     rcv;            
+} dma32regp_t;
+
+typedef volatile struct {       
+        uint32  fifoaddr;               
+        uint32  fifodatalow;            
+        uint32  fifodatahigh;           
+        uint32  pad;                    
+} dma32diag_t;
+
+
+typedef volatile struct {
+        uint32  ctrl;           
+        uint32  addr;           
+} dma32dd_t;
+
+
+#define D32RINGALIGN_BITS       12
+#define D32MAXRINGSZ            (1 << D32RINGALIGN_BITS)
+#define D32RINGALIGN            (1 << D32RINGALIGN_BITS)
+
+#define D32MAXDD        (D32MAXRINGSZ / sizeof (dma32dd_t))
+
+
+#define XC_XE           ((uint32)1 << 0)        
+#define XC_SE           ((uint32)1 << 1)        
+#define XC_LE           ((uint32)1 << 2)        
+#define XC_FL           ((uint32)1 << 4)        
+#define XC_PD           ((uint32)1 << 11)       
+#define XC_AE           ((uint32)3 << 16)       
+#define XC_AE_SHIFT     16
+#define XC_BL_MASK      0x001C0000                      
+#define XC_BL_SHIFT     18
+
+
+#define XP_LD_MASK      0xfff                   
+
+
+#define XS_CD_MASK      0x0fff                  
+#define XS_XS_MASK      0xf000                  
+#define XS_XS_SHIFT     12
+#define XS_XS_DISABLED  0x0000                  
+#define XS_XS_ACTIVE    0x1000                  
+#define XS_XS_IDLE      0x2000                  
+#define XS_XS_STOPPED   0x3000                  
+#define XS_XS_SUSP      0x4000                  
+#define XS_XE_MASK      0xf0000                 
+#define XS_XE_SHIFT     16
+#define XS_XE_NOERR     0x00000                 
+#define XS_XE_DPE       0x10000                 
+#define XS_XE_DFU       0x20000                 
+#define XS_XE_BEBR      0x30000                 
+#define XS_XE_BEDA      0x40000                 
+#define XS_AD_MASK      0xfff00000              
+#define XS_AD_SHIFT     20
+
+
+#define RC_RE           ((uint32)1 << 0)        
+#define RC_RO_MASK      0xfe                    
+#define RC_RO_SHIFT     1
+#define RC_FM           ((uint32)1 << 8)        
+#define RC_SH           ((uint32)1 << 9)        
+#define RC_OC           ((uint32)1 << 10)       
+#define RC_PD           ((uint32)1 << 11)       
+#define RC_AE           ((uint32)3 << 16)       
+#define RC_AE_SHIFT     16
+#define RC_BL_MASK      0x001C0000                      
+#define RC_BL_SHIFT     18
+
+
+#define RP_LD_MASK      0xfff                   
+
+
+#define RS_CD_MASK      0x0fff                  
+#define RS_RS_MASK      0xf000                  
+#define RS_RS_SHIFT     12
+#define RS_RS_DISABLED  0x0000                  
+#define RS_RS_ACTIVE    0x1000                  
+#define RS_RS_IDLE      0x2000                  
+#define RS_RS_STOPPED   0x3000                  
+#define RS_RE_MASK      0xf0000                 
+#define RS_RE_SHIFT     16
+#define RS_RE_NOERR     0x00000                 
+#define RS_RE_DPE       0x10000                 
+#define RS_RE_DFO       0x20000                 
+#define RS_RE_BEBW      0x30000                 
+#define RS_RE_BEDA      0x40000                 
+#define RS_AD_MASK      0xfff00000              
+#define RS_AD_SHIFT     20
+
+
+#define FA_OFF_MASK     0xffff                  
+#define FA_SEL_MASK     0xf0000                 
+#define FA_SEL_SHIFT    16
+#define FA_SEL_XDD      0x00000                 
+#define FA_SEL_XDP      0x10000                 
+#define FA_SEL_RDD      0x40000                 
+#define FA_SEL_RDP      0x50000                 
+#define FA_SEL_XFD      0x80000                 
+#define FA_SEL_XFP      0x90000                 
+#define FA_SEL_RFD      0xc0000                 
+#define FA_SEL_RFP      0xd0000                 
+#define FA_SEL_RSD      0xe0000                 
+#define FA_SEL_RSP      0xf0000                 
+
+
+#define CTRL_BC_MASK    0x00001fff              
+#define CTRL_AE         ((uint32)3 << 16)       
+#define CTRL_AE_SHIFT   16
+#define CTRL_PARITY     ((uint32)3 << 18)       
+#define CTRL_EOT        ((uint32)1 << 28)       
+#define CTRL_IOC        ((uint32)1 << 29)       
+#define CTRL_EOF        ((uint32)1 << 30)       
+#define CTRL_SOF        ((uint32)1 << 31)       
+
+
+#define CTRL_CORE_MASK  0x0ff00000
+
+
+
+
+typedef volatile struct {
+        uint32  control;                
+        uint32  ptr;                    
+        uint32  addrlow;                
+        uint32  addrhigh;               
+        uint32  status0;                
+        uint32  status1;                
+} dma64regs_t;
+
+typedef volatile struct {
+        dma64regs_t     tx;             
+        dma64regs_t     rx;             
+} dma64regp_t;
+
+typedef volatile struct {               
+        uint32  fifoaddr;               
+        uint32  fifodatalow;            
+        uint32  fifodatahigh;           
+        uint32  pad;                    
+} dma64diag_t;
+
+
+typedef volatile struct {
+        uint32  ctrl1;          
+        uint32  ctrl2;          
+        uint32  addrlow;        
+        uint32  addrhigh;       
+} dma64dd_t;
+
+
+#define D64RINGALIGN_BITS       13
+#define D64MAXRINGSZ            (1 << D64RINGALIGN_BITS)
+#define D64RINGALIGN            (1 << D64RINGALIGN_BITS)
+
+#define D64MAXDD        (D64MAXRINGSZ / sizeof (dma64dd_t))
+
+
+#define D64_DEF_USBBURSTLEN             2
+#define D64_DEF_SDIOBURSTLEN    1
+
+
+#define D64_XC_XE               0x00000001      
+#define D64_XC_SE               0x00000002      
+#define D64_XC_LE               0x00000004      
+#define D64_XC_FL               0x00000010      
+#define D64_XC_PD               0x00000800      
+#define D64_XC_AE               0x00030000      
+#define D64_XC_AE_SHIFT         16
+#define D64_XC_BL_MASK  0x001C0000      
+#define D64_XC_BL_SHIFT         18
+
+
+#define D64_XP_LD_MASK          0x00000fff      
+
+
+#define D64_XS0_CD_MASK         0x00001fff      
+#define D64_XS0_XS_MASK         0xf0000000      
+#define D64_XS0_XS_SHIFT                28
+#define D64_XS0_XS_DISABLED     0x00000000      
+#define D64_XS0_XS_ACTIVE       0x10000000      
+#define D64_XS0_XS_IDLE         0x20000000      
+#define D64_XS0_XS_STOPPED      0x30000000      
+#define D64_XS0_XS_SUSP         0x40000000      
+
+#define D64_XS1_AD_MASK         0x00001fff      
+#define D64_XS1_XE_MASK         0xf0000000      
+#define D64_XS1_XE_SHIFT                28
+#define D64_XS1_XE_NOERR        0x00000000      
+#define D64_XS1_XE_DPE          0x10000000      
+#define D64_XS1_XE_DFU          0x20000000      
+#define D64_XS1_XE_DTE          0x30000000      
+#define D64_XS1_XE_DESRE        0x40000000      
+#define D64_XS1_XE_COREE        0x50000000      
+
+
+#define D64_RC_RE               0x00000001      
+#define D64_RC_RO_MASK          0x000000fe      
+#define D64_RC_RO_SHIFT         1
+#define D64_RC_FM               0x00000100      
+#define D64_RC_SH               0x00000200      
+#define D64_RC_OC               0x00000400      
+#define D64_RC_PD               0x00000800      
+#define D64_RC_AE               0x00030000      
+#define D64_RC_AE_SHIFT         16
+#define D64_RC_BL_MASK  0x001C0000      
+#define D64_RC_BL_SHIFT         18
+
+
+#define DMA_CTRL_PEN            (1 << 0)        
+#define DMA_CTRL_ROC            (1 << 1)        
+#define DMA_CTRL_RXMULTI        (1 << 2)        
+#define DMA_CTRL_UNFRAMED       (1 << 3)        
+#define DMA_CTRL_USB_BOUNDRY4KB_WAR (1 << 4)
+
+
+#define D64_RP_LD_MASK          0x00000fff      
+
+
+#define D64_RS0_CD_MASK         0x00001fff      
+#define D64_RS0_RS_MASK         0xf0000000      
+#define D64_RS0_RS_SHIFT                28
+#define D64_RS0_RS_DISABLED     0x00000000      
+#define D64_RS0_RS_ACTIVE       0x10000000      
+#define D64_RS0_RS_IDLE         0x20000000      
+#define D64_RS0_RS_STOPPED      0x30000000      
+#define D64_RS0_RS_SUSP         0x40000000      
+
+#define D64_RS1_AD_MASK         0x0001ffff      
+#define D64_RS1_RE_MASK         0xf0000000      
+#define D64_RS1_RE_SHIFT                28
+#define D64_RS1_RE_NOERR        0x00000000      
+#define D64_RS1_RE_DPO          0x10000000      
+#define D64_RS1_RE_DFU          0x20000000      
+#define D64_RS1_RE_DTE          0x30000000      
+#define D64_RS1_RE_DESRE        0x40000000      
+#define D64_RS1_RE_COREE        0x50000000      
+
+
+#define D64_FA_OFF_MASK         0xffff          
+#define D64_FA_SEL_MASK         0xf0000         
+#define D64_FA_SEL_SHIFT        16
+#define D64_FA_SEL_XDD          0x00000         
+#define D64_FA_SEL_XDP          0x10000         
+#define D64_FA_SEL_RDD          0x40000         
+#define D64_FA_SEL_RDP          0x50000         
+#define D64_FA_SEL_XFD          0x80000         
+#define D64_FA_SEL_XFP          0x90000         
+#define D64_FA_SEL_RFD          0xc0000         
+#define D64_FA_SEL_RFP          0xd0000         
+#define D64_FA_SEL_RSD          0xe0000         
+#define D64_FA_SEL_RSP          0xf0000         
+
+
+#define D64_CTRL_COREFLAGS      0x0ff00000      
+#define D64_CTRL1_EOT           ((uint32)1 << 28)       
+#define D64_CTRL1_IOC           ((uint32)1 << 29)       
+#define D64_CTRL1_EOF           ((uint32)1 << 30)       
+#define D64_CTRL1_SOF           ((uint32)1 << 31)       
+
+
+#define D64_CTRL2_BC_MASK       0x00007fff      
+#define D64_CTRL2_AE            0x00030000      
+#define D64_CTRL2_AE_SHIFT      16
+#define D64_CTRL2_PARITY        0x00040000      
+
+
+#define D64_CTRL_CORE_MASK      0x0ff00000
+
+#define D64_RX_FRM_STS_LEN      0x0000ffff      
+#define D64_RX_FRM_STS_OVFL     0x00800000      
+#define D64_RX_FRM_STS_DSCRCNT  0x0f000000      
+#define D64_RX_FRM_STS_DATATYPE 0xf0000000      
+
+
+typedef volatile struct {
+        uint16 len;
+        uint16 flags;
+} dma_rxh_t;
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/sbpcmcia.h b/drivers/net/wireless/bcmdhd/include/sbpcmcia.h
new file mode 100644
index 00000000000..aba914bd014
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sbpcmcia.h
@@ -0,0 +1,109 @@
+/*
+ * BCM43XX Sonics SiliconBackplane PCMCIA core hardware definitions.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sbpcmcia.h,v 13.48.12.6 2010-11-04 09:39:42 Exp $
+ */
+
+
+#ifndef _SBPCMCIA_H
+#define _SBPCMCIA_H
+
+
+
+
+#define PCMCIA_FCR              (0x700 / 2)
+
+#define FCR0_OFF                0
+#define FCR1_OFF                (0x40 / 2)
+#define FCR2_OFF                (0x80 / 2)
+#define FCR3_OFF                (0xc0 / 2)
+
+#define PCMCIA_FCR0             (0x700 / 2)
+#define PCMCIA_FCR1             (0x740 / 2)
+#define PCMCIA_FCR2             (0x780 / 2)
+#define PCMCIA_FCR3             (0x7c0 / 2)
+
+
+
+#define PCMCIA_COR              0
+
+#define COR_RST                 0x80
+#define COR_LEV                 0x40
+#define COR_IRQEN               0x04
+#define COR_BLREN               0x01
+#define COR_FUNEN               0x01
+
+
+#define PCICIA_FCSR             (2 / 2)
+#define PCICIA_PRR              (4 / 2)
+#define PCICIA_SCR              (6 / 2)
+#define PCICIA_ESR              (8 / 2)
+
+
+#define PCM_MEMOFF              0x0000
+#define F0_MEMOFF               0x1000
+#define F1_MEMOFF               0x2000
+#define F2_MEMOFF               0x3000
+#define F3_MEMOFF               0x4000
+
+
+#define MEM_ADDR0               (0x728 / 2)
+#define MEM_ADDR1               (0x72a / 2)
+#define MEM_ADDR2               (0x72c / 2)
+
+
+#define PCMCIA_ADDR0            (0x072e / 2)
+#define PCMCIA_ADDR1            (0x0730 / 2)
+#define PCMCIA_ADDR2            (0x0732 / 2)
+
+#define MEM_SEG                 (0x0734 / 2)
+#define SROM_CS                 (0x0736 / 2)
+#define SROM_DATAL              (0x0738 / 2)
+#define SROM_DATAH              (0x073a / 2)
+#define SROM_ADDRL              (0x073c / 2)
+#define SROM_ADDRH              (0x073e / 2)
+#define SROM_INFO2              (0x0772 / 2)    
+#define SROM_INFO               (0x07be / 2)    
+
+
+#define SROM_IDLE               0
+#define SROM_WRITE              1
+#define SROM_READ               2
+#define SROM_WEN                4
+#define SROM_WDS                7
+#define SROM_DONE               8
+
+
+#define SRI_SZ_MASK             0x03
+#define SRI_BLANK               0x04
+#define SRI_OTP                 0x80
+
+
+
+#define SBTML_INT_ACK           0x40000         
+#define SBTML_INT_EN            0x20000         
+
+
+#define SBTMH_INT_STATUS        0x40000         
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/sbsdio.h b/drivers/net/wireless/bcmdhd/include/sbsdio.h
new file mode 100644
index 00000000000..4280d5bf9c1
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sbsdio.h
@@ -0,0 +1,166 @@
+/*
+ * SDIO device core hardware definitions.
+ * sdio is a portion of the pcmcia core in core rev 3 - rev 8
+ *
+ * SDIO core support 1bit, 4 bit SDIO mode as well as SPI mode.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sbsdio.h,v 13.34 2009-03-11 20:27:16 Exp $
+ */
+
+#ifndef _SBSDIO_H
+#define _SBSDIO_H
+
+#define SBSDIO_NUM_FUNCTION             3       /* as of sdiod rev 0, supports 3 functions */
+
+/* function 1 miscellaneous registers */
+#define SBSDIO_SPROM_CS                 0x10000         /* sprom command and status */
+#define SBSDIO_SPROM_INFO               0x10001         /* sprom info register */
+#define SBSDIO_SPROM_DATA_LOW           0x10002         /* sprom indirect access data byte 0 */
+#define SBSDIO_SPROM_DATA_HIGH          0x10003         /* sprom indirect access data byte 1 */
+#define SBSDIO_SPROM_ADDR_LOW           0x10004         /* sprom indirect access addr byte 0 */
+#define SBSDIO_SPROM_ADDR_HIGH          0x10005         /* sprom indirect access addr byte 0 */
+#define SBSDIO_CHIP_CTRL_DATA           0x10006         /* xtal_pu (gpio) output */
+#define SBSDIO_CHIP_CTRL_EN             0x10007         /* xtal_pu (gpio) enable */
+#define SBSDIO_WATERMARK                0x10008         /* rev < 7, watermark for sdio device */
+#define SBSDIO_DEVICE_CTL               0x10009         /* control busy signal generation */
+
+/* registers introduced in rev 8, some content (mask/bits) defs in sbsdpcmdev.h */
+#define SBSDIO_FUNC1_SBADDRLOW          0x1000A         /* SB Address Window Low (b15) */
+#define SBSDIO_FUNC1_SBADDRMID          0x1000B         /* SB Address Window Mid (b23:b16) */
+#define SBSDIO_FUNC1_SBADDRHIGH         0x1000C         /* SB Address Window High (b31:b24)    */
+#define SBSDIO_FUNC1_FRAMECTRL          0x1000D         /* Frame Control (frame term/abort) */
+#define SBSDIO_FUNC1_CHIPCLKCSR         0x1000E         /* ChipClockCSR (ALP/HT ctl/status) */
+#define SBSDIO_FUNC1_SDIOPULLUP         0x1000F         /* SdioPullUp (on cmd, d0-d2) */
+#define SBSDIO_FUNC1_WFRAMEBCLO         0x10019         /* Write Frame Byte Count Low */
+#define SBSDIO_FUNC1_WFRAMEBCHI         0x1001A         /* Write Frame Byte Count High */
+#define SBSDIO_FUNC1_RFRAMEBCLO         0x1001B         /* Read Frame Byte Count Low */
+#define SBSDIO_FUNC1_RFRAMEBCHI         0x1001C         /* Read Frame Byte Count High */
+
+#define SBSDIO_FUNC1_MISC_REG_START     0x10000         /* f1 misc register start */
+#define SBSDIO_FUNC1_MISC_REG_LIMIT     0x1001C         /* f1 misc register end */
+
+/* SBSDIO_SPROM_CS */
+#define SBSDIO_SPROM_IDLE               0
+#define SBSDIO_SPROM_WRITE              1
+#define SBSDIO_SPROM_READ               2
+#define SBSDIO_SPROM_WEN                4
+#define SBSDIO_SPROM_WDS                7
+#define SBSDIO_SPROM_DONE               8
+
+/* SBSDIO_SPROM_INFO */
+#define SROM_SZ_MASK                    0x03            /* SROM size, 1: 4k, 2: 16k */
+#define SROM_BLANK                      0x04            /* depreciated in corerev 6 */
+#define SROM_OTP                        0x80            /* OTP present */
+
+/* SBSDIO_CHIP_CTRL */
+#define SBSDIO_CHIP_CTRL_XTAL           0x01            /* or'd with onchip xtal_pu,
+                                                         * 1: power on oscillator
+                                                         * (for 4318 only)
+                                                         */
+/* SBSDIO_WATERMARK */
+#define SBSDIO_WATERMARK_MASK           0x7f            /* number of words - 1 for sd device
+                                                         * to wait before sending data to host
+                                                         */
+
+/* SBSDIO_DEVICE_CTL */
+#define SBSDIO_DEVCTL_SETBUSY           0x01            /* 1: device will assert busy signal when
+                                                         * receiving CMD53
+                                                         */
+#define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02            /* 1: assertion of sdio interrupt is
+                                                         * synchronous to the sdio clock
+                                                         */
+#define SBSDIO_DEVCTL_CA_INT_ONLY       0x04            /* 1: mask all interrupts to host
+                                                         * except the chipActive (rev 8)
+                                                         */
+#define SBSDIO_DEVCTL_PADS_ISO          0x08            /* 1: isolate internal sdio signals, put
+                                                         * external pads in tri-state; requires
+                                                         * sdio bus power cycle to clear (rev 9)
+                                                         */
+#define SBSDIO_DEVCTL_SB_RST_CTL        0x30            /* Force SD->SB reset mapping (rev 11) */
+#define SBSDIO_DEVCTL_RST_CORECTL       0x00            /*   Determined by CoreControl bit */
+#define SBSDIO_DEVCTL_RST_BPRESET       0x10            /*   Force backplane reset */
+#define SBSDIO_DEVCTL_RST_NOBPRESET     0x20            /*   Force no backplane reset */
+
+
+/* SBSDIO_FUNC1_CHIPCLKCSR */
+#define SBSDIO_FORCE_ALP                0x01            /* Force ALP request to backplane */
+#define SBSDIO_FORCE_HT                 0x02            /* Force HT request to backplane */
+#define SBSDIO_FORCE_ILP                0x04            /* Force ILP request to backplane */
+#define SBSDIO_ALP_AVAIL_REQ            0x08            /* Make ALP ready (power up xtal) */
+#define SBSDIO_HT_AVAIL_REQ             0x10            /* Make HT ready (power up PLL) */
+#define SBSDIO_FORCE_HW_CLKREQ_OFF      0x20            /* Squelch clock requests from HW */
+#define SBSDIO_ALP_AVAIL                0x40            /* Status: ALP is ready */
+#define SBSDIO_HT_AVAIL                 0x80            /* Status: HT is ready */
+/* In rev8, actual avail bits followed original docs */
+#define SBSDIO_Rev8_HT_AVAIL            0x40
+#define SBSDIO_Rev8_ALP_AVAIL           0x80
+
+#define SBSDIO_AVBITS                   (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
+#define SBSDIO_ALPAV(regval)            ((regval) & SBSDIO_AVBITS)
+#define SBSDIO_HTAV(regval)             (((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
+#define SBSDIO_ALPONLY(regval)          (SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
+#define SBSDIO_CLKAV(regval, alponly)   (SBSDIO_ALPAV(regval) && \
+                                        (alponly ? 1 : SBSDIO_HTAV(regval)))
+
+/* SBSDIO_FUNC1_SDIOPULLUP */
+#define SBSDIO_PULLUP_D0                0x01            /* Enable D0/MISO pullup */
+#define SBSDIO_PULLUP_D1                0x02            /* Enable D1/INT# pullup */
+#define SBSDIO_PULLUP_D2                0x04            /* Enable D2 pullup */
+#define SBSDIO_PULLUP_CMD               0x08            /* Enable CMD/MOSI pullup */
+#define SBSDIO_PULLUP_ALL               0x0f            /* All valid bits */
+
+/* function 1 OCP space */
+#define SBSDIO_SB_OFT_ADDR_MASK         0x07FFF         /* sb offset addr is <= 15 bits, 32k */
+#define SBSDIO_SB_OFT_ADDR_LIMIT        0x08000
+#define SBSDIO_SB_ACCESS_2_4B_FLAG      0x08000         /* with b15, maps to 32-bit SB access */
+
+/* some duplication with sbsdpcmdev.h here */
+/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
+#define SBSDIO_SBADDRLOW_MASK           0x80            /* Valid bits in SBADDRLOW */
+#define SBSDIO_SBADDRMID_MASK           0xff            /* Valid bits in SBADDRMID */
+#define SBSDIO_SBADDRHIGH_MASK          0xffU           /* Valid bits in SBADDRHIGH */
+#define SBSDIO_SBWINDOW_MASK            0xffff8000      /* Address bits from SBADDR regs */
+
+/* direct(mapped) cis space */
+#define SBSDIO_CIS_BASE_COMMON          0x1000          /* MAPPED common CIS address */
+#define SBSDIO_CIS_SIZE_LIMIT           0x200           /* maximum bytes in one CIS */
+#define SBSDIO_OTP_CIS_SIZE_LIMIT       0x078           /* maximum bytes OTP CIS */
+
+#define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF         /* cis offset addr is < 17 bits */
+
+#define SBSDIO_CIS_MANFID_TUPLE_LEN     6               /* manfid tuple length, include tuple,
+                                                         * link bytes
+                                                         */
+
+/* indirect cis access (in sprom) */
+#define SBSDIO_SPROM_CIS_OFFSET         0x8             /* 8 control bytes first, CIS starts from
+                                                         * 8th byte
+                                                         */
+
+#define SBSDIO_BYTEMODE_DATALEN_MAX     64              /* sdio byte mode: maximum length of one
+                                                         * data comamnd
+                                                         */
+
+#define SBSDIO_CORE_ADDR_MASK           0x1FFFF         /* sdio core function one address mask */
+
+#endif  /* _SBSDIO_H */
diff --git a/drivers/net/wireless/bcmdhd/include/sbsdpcmdev.h b/drivers/net/wireless/bcmdhd/include/sbsdpcmdev.h
new file mode 100644
index 00000000000..107a8b07c9e
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sbsdpcmdev.h
@@ -0,0 +1,293 @@
+/*
+ * Broadcom SiliconBackplane SDIO/PCMCIA hardware-specific
+ * device core support
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sbsdpcmdev.h,v 13.38 2009-09-22 22:56:45 Exp $
+ */
+
+#ifndef _sbsdpcmdev_h_
+#define _sbsdpcmdev_h_
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define _PADLINE(line)  pad ## line
+#define _XSTR(line)     _PADLINE(line)
+#define PAD             _XSTR(__LINE__)
+#endif  /* PAD */
+
+
+typedef volatile struct {
+        dma64regs_t     xmt;            /* dma tx */
+        uint32 PAD[2];
+        dma64regs_t     rcv;            /* dma rx */
+        uint32 PAD[2];
+} dma64p_t;
+
+/* dma64 sdiod corerev >= 1 */
+typedef volatile struct {
+        dma64p_t dma64regs[2];
+        dma64diag_t dmafifo;            /* DMA Diagnostic Regs, 0x280-0x28c */
+        uint32 PAD[92];
+} sdiodma64_t;
+
+/* dma32 sdiod corerev == 0 */
+typedef volatile struct {
+        dma32regp_t dma32regs[2];       /* dma tx & rx, 0x200-0x23c */
+        dma32diag_t dmafifo;            /* DMA Diagnostic Regs, 0x240-0x24c */
+        uint32 PAD[108];
+} sdiodma32_t;
+
+/* dma32 regs for pcmcia core */
+typedef volatile struct {
+        dma32regp_t dmaregs;            /* DMA Regs, 0x200-0x21c, rev8 */
+        dma32diag_t dmafifo;            /* DMA Diagnostic Regs, 0x220-0x22c */
+        uint32 PAD[116];
+} pcmdma32_t;
+
+/* core registers */
+typedef volatile struct {
+        uint32 corecontrol;             /* CoreControl, 0x000, rev8 */
+        uint32 corestatus;              /* CoreStatus, 0x004, rev8  */
+        uint32 PAD[1];
+        uint32 biststatus;              /* BistStatus, 0x00c, rev8  */
+
+        /* PCMCIA access */
+        uint16 pcmciamesportaladdr;     /* PcmciaMesPortalAddr, 0x010, rev8   */
+        uint16 PAD[1];
+        uint16 pcmciamesportalmask;     /* PcmciaMesPortalMask, 0x014, rev8   */
+        uint16 PAD[1];
+        uint16 pcmciawrframebc;         /* PcmciaWrFrameBC, 0x018, rev8   */
+        uint16 PAD[1];
+        uint16 pcmciaunderflowtimer;    /* PcmciaUnderflowTimer, 0x01c, rev8   */
+        uint16 PAD[1];
+
+        /* interrupt */
+        uint32 intstatus;               /* IntStatus, 0x020, rev8   */
+        uint32 hostintmask;             /* IntHostMask, 0x024, rev8   */
+        uint32 intmask;                 /* IntSbMask, 0x028, rev8   */
+        uint32 sbintstatus;             /* SBIntStatus, 0x02c, rev8   */
+        uint32 sbintmask;               /* SBIntMask, 0x030, rev8   */
+        uint32 funcintmask;             /* SDIO Function Interrupt Mask, SDIO rev4 */
+        uint32 PAD[2];
+        uint32 tosbmailbox;             /* ToSBMailbox, 0x040, rev8   */
+        uint32 tohostmailbox;           /* ToHostMailbox, 0x044, rev8   */
+        uint32 tosbmailboxdata;         /* ToSbMailboxData, 0x048, rev8   */
+        uint32 tohostmailboxdata;       /* ToHostMailboxData, 0x04c, rev8   */
+
+        /* synchronized access to registers in SDIO clock domain */
+        uint32 sdioaccess;              /* SdioAccess, 0x050, rev8   */
+        uint32 PAD[3];
+
+        /* PCMCIA frame control */
+        uint8 pcmciaframectrl;          /* pcmciaFrameCtrl, 0x060, rev8   */
+        uint8 PAD[3];
+        uint8 pcmciawatermark;          /* pcmciaWaterMark, 0x064, rev8   */
+        uint8 PAD[155];
+
+        /* interrupt batching control */
+        uint32 intrcvlazy;              /* IntRcvLazy, 0x100, rev8 */
+        uint32 PAD[3];
+
+        /* counters */
+        uint32 cmd52rd;                 /* Cmd52RdCount, 0x110, rev8, SDIO: cmd52 reads */
+        uint32 cmd52wr;                 /* Cmd52WrCount, 0x114, rev8, SDIO: cmd52 writes */
+        uint32 cmd53rd;                 /* Cmd53RdCount, 0x118, rev8, SDIO: cmd53 reads */
+        uint32 cmd53wr;                 /* Cmd53WrCount, 0x11c, rev8, SDIO: cmd53 writes */
+        uint32 abort;                   /* AbortCount, 0x120, rev8, SDIO: aborts */
+        uint32 datacrcerror;            /* DataCrcErrorCount, 0x124, rev8, SDIO: frames w/bad CRC */
+        uint32 rdoutofsync;             /* RdOutOfSyncCount, 0x128, rev8, SDIO/PCMCIA: Rd Frm OOS */
+        uint32 wroutofsync;             /* RdOutOfSyncCount, 0x12c, rev8, SDIO/PCMCIA: Wr Frm OOS */
+        uint32 writebusy;               /* WriteBusyCount, 0x130, rev8, SDIO: dev asserted "busy" */
+        uint32 readwait;                /* ReadWaitCount, 0x134, rev8, SDIO: read: no data avail */
+        uint32 readterm;                /* ReadTermCount, 0x138, rev8, SDIO: rd frm terminates */
+        uint32 writeterm;               /* WriteTermCount, 0x13c, rev8, SDIO: wr frm terminates */
+        uint32 PAD[40];
+        uint32 clockctlstatus;          /* ClockCtlStatus, 0x1e0, rev8 */
+        uint32 PAD[7];
+
+        /* DMA engines */
+        volatile union {
+                pcmdma32_t pcm32;
+                sdiodma32_t sdiod32;
+                sdiodma64_t sdiod64;
+        } dma;
+
+        /* SDIO/PCMCIA CIS region */
+        char cis[512];                  /* 512 byte CIS, 0x400-0x5ff, rev6 */
+
+        /* PCMCIA function control registers */
+        char pcmciafcr[256];            /* PCMCIA FCR, 0x600-6ff, rev6 */
+        uint16 PAD[55];
+
+        /* PCMCIA backplane access */
+        uint16 backplanecsr;            /* BackplaneCSR, 0x76E, rev6 */
+        uint16 backplaneaddr0;          /* BackplaneAddr0, 0x770, rev6 */
+        uint16 backplaneaddr1;          /* BackplaneAddr1, 0x772, rev6 */
+        uint16 backplaneaddr2;          /* BackplaneAddr2, 0x774, rev6 */
+        uint16 backplaneaddr3;          /* BackplaneAddr3, 0x776, rev6 */
+        uint16 backplanedata0;          /* BackplaneData0, 0x778, rev6 */
+        uint16 backplanedata1;          /* BackplaneData1, 0x77a, rev6 */
+        uint16 backplanedata2;          /* BackplaneData2, 0x77c, rev6 */
+        uint16 backplanedata3;          /* BackplaneData3, 0x77e, rev6 */
+        uint16 PAD[31];
+
+        /* sprom "size" & "blank" info */
+        uint16 spromstatus;             /* SPROMStatus, 0x7BE, rev2 */
+        uint32 PAD[464];
+
+        /* Sonics SiliconBackplane registers */
+        sbconfig_t sbconfig;            /* SbConfig Regs, 0xf00-0xfff, rev8 */
+} sdpcmd_regs_t;
+
+/* corecontrol */
+#define CC_CISRDY               (1 << 0)        /* CIS Ready */
+#define CC_BPRESEN              (1 << 1)        /* CCCR RES signal causes backplane reset */
+#define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
+#define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation bit (rev 11) */
+#define CC_XMTDATAAVAIL_MODE    (1 << 4)        /* data avail generates an interrupt */
+#define CC_XMTDATAAVAIL_CTRL    (1 << 5)        /* data avail interrupt ctrl */
+
+/* corestatus */
+#define CS_PCMCIAMODE   (1 << 0)        /* Device Mode; 0=SDIO, 1=PCMCIA */
+#define CS_SMARTDEV     (1 << 1)        /* 1=smartDev enabled */
+#define CS_F2ENABLED    (1 << 2)        /* 1=host has enabled the device */
+
+#define PCMCIA_MES_PA_MASK      0x7fff  /* PCMCIA Message Portal Address Mask */
+#define PCMCIA_MES_PM_MASK      0x7fff  /* PCMCIA Message Portal Mask Mask */
+#define PCMCIA_WFBC_MASK        0xffff  /* PCMCIA Write Frame Byte Count Mask */
+#define PCMCIA_UT_MASK          0x07ff  /* PCMCIA Underflow Timer Mask */
+
+/* intstatus */
+#define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
+#define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
+#define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
+#define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
+#define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
+#define I_SMB_SW_SHIFT  0               /* To SB Mail S/W interrupts shift */
+#define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
+#define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
+#define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
+#define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
+#define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
+#define I_HMB_SW_SHIFT  4               /* To Host Mail S/W interrupts shift */
+#define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
+#define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
+#define I_PC            (1 << 10)       /* descriptor error */
+#define I_PD            (1 << 11)       /* data error */
+#define I_DE            (1 << 12)       /* Descriptor protocol Error */
+#define I_RU            (1 << 13)       /* Receive descriptor Underflow */
+#define I_RO            (1 << 14)       /* Receive fifo Overflow */
+#define I_XU            (1 << 15)       /* Transmit fifo Underflow */
+#define I_RI            (1 << 16)       /* Receive Interrupt */
+#define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
+#define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
+#define I_XI            (1 << 24)       /* Transmit Interrupt */
+#define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
+#define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
+#define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
+#define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
+#define I_CHIPACTIVE    (1 << 29)       /* chip transitioned from doze to active state */
+#define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
+#define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
+#define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)       /* DMA Errors */
+#define I_DMA           (I_RI | I_XI | I_ERRORS)
+
+/* sbintstatus */
+#define I_SB_SERR       (1 << 8)        /* Backplane SError (write) */
+#define I_SB_RESPERR    (1 << 9)        /* Backplane Response Error (read) */
+#define I_SB_SPROMERR   (1 << 10)       /* Error accessing the sprom */
+
+/* sdioaccess */
+#define SDA_DATA_MASK   0x000000ff      /* Read/Write Data Mask */
+#define SDA_ADDR_MASK   0x000fff00      /* Read/Write Address Mask */
+#define SDA_ADDR_SHIFT  8               /* Read/Write Address Shift */
+#define SDA_WRITE       0x01000000      /* Write bit  */
+#define SDA_READ        0x00000000      /* Write bit cleared for Read */
+#define SDA_BUSY        0x80000000      /* Busy bit */
+
+/* sdioaccess-accessible register address spaces */
+#define SDA_CCCR_SPACE          0x000   /* sdioAccess CCCR register space */
+#define SDA_F1_FBR_SPACE        0x100   /* sdioAccess F1 FBR register space */
+#define SDA_F2_FBR_SPACE        0x200   /* sdioAccess F2 FBR register space */
+#define SDA_F1_REG_SPACE        0x300   /* sdioAccess F1 core-specific register space */
+
+/* SDA_F1_REG_SPACE sdioaccess-accessible F1 reg space register offsets */
+#define SDA_CHIPCONTROLDATA     0x006   /* ChipControlData */
+#define SDA_CHIPCONTROLENAB     0x007   /* ChipControlEnable */
+#define SDA_F2WATERMARK         0x008   /* Function 2 Watermark */
+#define SDA_DEVICECONTROL       0x009   /* DeviceControl */
+#define SDA_SBADDRLOW           0x00a   /* SbAddrLow */
+#define SDA_SBADDRMID           0x00b   /* SbAddrMid */
+#define SDA_SBADDRHIGH          0x00c   /* SbAddrHigh */
+#define SDA_FRAMECTRL           0x00d   /* FrameCtrl */
+#define SDA_CHIPCLOCKCSR        0x00e   /* ChipClockCSR */
+#define SDA_SDIOPULLUP          0x00f   /* SdioPullUp */
+#define SDA_SDIOWRFRAMEBCLOW    0x019   /* SdioWrFrameBCLow */
+#define SDA_SDIOWRFRAMEBCHIGH   0x01a   /* SdioWrFrameBCHigh */
+#define SDA_SDIORDFRAMEBCLOW    0x01b   /* SdioRdFrameBCLow */
+#define SDA_SDIORDFRAMEBCHIGH   0x01c   /* SdioRdFrameBCHigh */
+
+/* SDA_F2WATERMARK */
+#define SDA_F2WATERMARK_MASK    0x7f    /* F2Watermark Mask */
+
+/* SDA_SBADDRLOW */
+#define SDA_SBADDRLOW_MASK      0x80    /* SbAddrLow Mask */
+
+/* SDA_SBADDRMID */
+#define SDA_SBADDRMID_MASK      0xff    /* SbAddrMid Mask */
+
+/* SDA_SBADDRHIGH */
+#define SDA_SBADDRHIGH_MASK     0xff    /* SbAddrHigh Mask */
+
+/* SDA_FRAMECTRL */
+#define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
+#define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
+#define SFC_CRC4WOOS    (1 << 2)        /* HW reports CRC error for write out of sync */
+#define SFC_ABORTALL    (1 << 3)        /* Abort cancels all in-progress frames */
+
+/* pcmciaframectrl */
+#define PFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
+#define PFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
+
+/* intrcvlazy */
+#define IRL_TO_MASK     0x00ffffff      /* timeout */
+#define IRL_FC_MASK     0xff000000      /* frame count */
+#define IRL_FC_SHIFT    24              /* frame count */
+
+/* rx header */
+typedef volatile struct {
+        uint16 len;
+        uint16 flags;
+} sdpcmd_rxh_t;
+
+/* rx header flags */
+#define RXF_CRC         0x0001          /* CRC error detected */
+#define RXF_WOOS        0x0002          /* write frame out of sync */
+#define RXF_WF_TERM     0x0004          /* write frame terminated */
+#define RXF_ABORT       0x0008          /* write frame aborted */
+#define RXF_DISCARD     (RXF_CRC | RXF_WOOS | RXF_WF_TERM | RXF_ABORT)  /* bad frame */
+
+/* HW frame tag */
+#define SDPCM_FRAMETAG_LEN      4       /* HW frametag: 2 bytes len, 2 bytes check val */
+
+#endif  /* _sbsdpcmdev_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/sbsocram.h b/drivers/net/wireless/bcmdhd/include/sbsocram.h
new file mode 100644
index 00000000000..1cba4223890
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sbsocram.h
@@ -0,0 +1,186 @@
+/*
+ * BCM47XX Sonics SiliconBackplane embedded ram core
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sbsocram.h,v 13.15 2009-10-02 16:55:44 Exp $
+ */
+
+
+#ifndef _SBSOCRAM_H
+#define _SBSOCRAM_H
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+
+#ifndef PAD
+#define _PADLINE(line)  pad ## line
+#define _XSTR(line)     _PADLINE(line)
+#define PAD             _XSTR(__LINE__)
+#endif  
+
+
+typedef volatile struct sbsocramregs {
+        uint32  coreinfo;
+        uint32  bwalloc;
+        uint32  extracoreinfo;
+        uint32  biststat;
+        uint32  bankidx;
+        uint32  standbyctrl;
+
+        uint32  errlogstatus;   
+        uint32  errlogaddr;     
+        
+        uint32  cambankidx;
+        uint32  cambankstandbyctrl;
+        uint32  cambankpatchctrl;
+        uint32  cambankpatchtblbaseaddr;
+        uint32  cambankcmdreg;
+        uint32  cambankdatareg;
+        uint32  cambankmaskreg;
+        uint32  PAD[1];
+        uint32  bankinfo;       
+        uint32  PAD[15];
+        uint32  extmemconfig;
+        uint32  extmemparitycsr;
+        uint32  extmemparityerrdata;
+        uint32  extmemparityerrcnt;
+        uint32  extmemwrctrlandsize;
+        uint32  PAD[84];
+        uint32  workaround;
+        uint32  pwrctl;         
+        uint32  PAD[133];
+        uint32  sr_control;     
+        uint32  sr_status;      
+        uint32  sr_address;     
+        uint32  sr_data;        
+} sbsocramregs_t;
+
+#endif  
+
+
+#define SR_COREINFO             0x00
+#define SR_BWALLOC              0x04
+#define SR_BISTSTAT             0x0c
+#define SR_BANKINDEX            0x10
+#define SR_BANKSTBYCTL          0x14
+#define SR_PWRCTL               0x1e8
+
+
+#define SRCI_PT_MASK            0x00070000      
+#define SRCI_PT_SHIFT           16
+
+#define SRCI_PT_OCP_OCP         0
+#define SRCI_PT_AXI_OCP         1
+#define SRCI_PT_ARM7AHB_OCP     2
+#define SRCI_PT_CM3AHB_OCP      3
+#define SRCI_PT_AXI_AXI         4
+#define SRCI_PT_AHB_AXI         5
+
+#define SRCI_LSS_MASK           0x00f00000
+#define SRCI_LSS_SHIFT          20
+#define SRCI_LRS_MASK           0x0f000000
+#define SRCI_LRS_SHIFT          24
+
+
+#define SRCI_MS0_MASK           0xf
+#define SR_MS0_BASE             16
+
+
+#define SRCI_ROMNB_MASK         0xf000
+#define SRCI_ROMNB_SHIFT        12
+#define SRCI_ROMBSZ_MASK        0xf00
+#define SRCI_ROMBSZ_SHIFT       8
+#define SRCI_SRNB_MASK          0xf0
+#define SRCI_SRNB_SHIFT         4
+#define SRCI_SRBSZ_MASK         0xf
+#define SRCI_SRBSZ_SHIFT        0
+
+#define SR_BSZ_BASE             14
+
+
+#define SRSC_SBYOVR_MASK        0x80000000
+#define SRSC_SBYOVR_SHIFT       31
+#define SRSC_SBYOVRVAL_MASK     0x60000000
+#define SRSC_SBYOVRVAL_SHIFT    29
+#define SRSC_SBYEN_MASK         0x01000000      
+#define SRSC_SBYEN_SHIFT        24
+
+
+#define SRPC_PMU_STBYDIS_MASK   0x00000010      
+#define SRPC_PMU_STBYDIS_SHIFT  4
+#define SRPC_STBYOVRVAL_MASK    0x00000008
+#define SRPC_STBYOVRVAL_SHIFT   3
+#define SRPC_STBYOVR_MASK       0x00000007
+#define SRPC_STBYOVR_SHIFT      0
+
+
+#define SRECC_NUM_BANKS_MASK   0x000000F0
+#define SRECC_NUM_BANKS_SHIFT  4
+#define SRECC_BANKSIZE_MASK    0x0000000F
+#define SRECC_BANKSIZE_SHIFT   0
+
+#define SRECC_BANKSIZE(value)    (1 << (value))
+
+
+#define SRCBPC_PATCHENABLE 0x80000000
+
+#define SRP_ADDRESS   0x0001FFFC
+#define SRP_VALID     0x8000
+
+
+#define SRCMD_WRITE  0x00020000
+#define SRCMD_READ   0x00010000
+#define SRCMD_DONE   0x80000000
+
+#define SRCMD_DONE_DLY  1000
+
+
+#define SOCRAM_BANKINFO_SZMASK          0x3f
+#define SOCRAM_BANKIDX_ROM_MASK         0x100
+
+#define SOCRAM_BANKIDX_MEMTYPE_SHIFT    8
+
+#define SOCRAM_MEMTYPE_RAM              0
+#define SOCRAM_MEMTYPE_R0M              1
+#define SOCRAM_MEMTYPE_DEVRAM           2
+
+#define SOCRAM_BANKINFO_REG             0x40
+#define SOCRAM_BANKIDX_REG              0x10
+#define SOCRAM_BANKINFO_STDBY_MASK      0x400
+#define SOCRAM_BANKINFO_STDBY_TIMER     0x800
+
+
+#define SOCRAM_BANKINFO_DEVRAMSEL_SHIFT 13
+#define SOCRAM_BANKINFO_DEVRAMSEL_MASK  0x2000
+#define SOCRAM_BANKINFO_DEVRAMPRO_SHIFT 14
+#define SOCRAM_BANKINFO_DEVRAMPRO_MASK  0x4000
+
+
+#define SOCRAM_DEVRAMBANK_MASK          0xF000
+#define SOCRAM_DEVRAMBANK_SHIFT         12
+
+
+#define SOCRAM_BANKINFO_SZBASE          8192
+#define SOCRAM_BANKSIZE_SHIFT           13      
+
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/sdio.h b/drivers/net/wireless/bcmdhd/include/sdio.h
new file mode 100644
index 00000000000..ca932266a1b
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sdio.h
@@ -0,0 +1,611 @@
+/*
+ * SDIO spec header file
+ * Protocol and standard (common) device definitions
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sdio.h,v 13.27.14.1 2010-09-07 13:37:45 Exp $
+ */
+
+#ifndef _SDIO_H
+#define _SDIO_H
+
+
+/* CCCR structure for function 0 */
+typedef volatile struct {
+        uint8   cccr_sdio_rev;          /* RO, cccr and sdio revision */
+        uint8   sd_rev;                 /* RO, sd spec revision */
+        uint8   io_en;                  /* I/O enable */
+        uint8   io_rdy;                 /* I/O ready reg */
+        uint8   intr_ctl;               /* Master and per function interrupt enable control */
+        uint8   intr_status;            /* RO, interrupt pending status */
+        uint8   io_abort;               /* read/write abort or reset all functions */
+        uint8   bus_inter;              /* bus interface control */
+        uint8   capability;             /* RO, card capability */
+
+        uint8   cis_base_low;           /* 0x9 RO, common CIS base address, LSB */
+        uint8   cis_base_mid;
+        uint8   cis_base_high;          /* 0xB RO, common CIS base address, MSB */
+
+        /* suspend/resume registers */
+        uint8   bus_suspend;            /* 0xC */
+        uint8   func_select;            /* 0xD */
+        uint8   exec_flag;              /* 0xE */
+        uint8   ready_flag;             /* 0xF */
+
+        uint8   fn0_blk_size[2];        /* 0x10(LSB), 0x11(MSB) */
+
+        uint8   power_control;          /* 0x12 (SDIO version 1.10) */
+
+        uint8   speed_control;          /* 0x13 */
+} sdio_regs_t;
+
+/* SDIO Device CCCR offsets */
+#define SDIOD_CCCR_REV                  0x00
+#define SDIOD_CCCR_SDREV                0x01
+#define SDIOD_CCCR_IOEN                 0x02
+#define SDIOD_CCCR_IORDY                0x03
+#define SDIOD_CCCR_INTEN                0x04
+#define SDIOD_CCCR_INTPEND              0x05
+#define SDIOD_CCCR_IOABORT              0x06
+#define SDIOD_CCCR_BICTRL               0x07
+#define SDIOD_CCCR_CAPABLITIES          0x08
+#define SDIOD_CCCR_CISPTR_0             0x09
+#define SDIOD_CCCR_CISPTR_1             0x0A
+#define SDIOD_CCCR_CISPTR_2             0x0B
+#define SDIOD_CCCR_BUSSUSP              0x0C
+#define SDIOD_CCCR_FUNCSEL              0x0D
+#define SDIOD_CCCR_EXECFLAGS            0x0E
+#define SDIOD_CCCR_RDYFLAGS             0x0F
+#define SDIOD_CCCR_BLKSIZE_0            0x10
+#define SDIOD_CCCR_BLKSIZE_1            0x11
+#define SDIOD_CCCR_POWER_CONTROL        0x12
+#define SDIOD_CCCR_SPEED_CONTROL        0x13
+#define SDIOD_CCCR_UHSI_SUPPORT         0x14
+#define SDIOD_CCCR_DRIVER_STRENGTH      0x15
+#define SDIOD_CCCR_INTR_EXTN            0x16
+
+/* Broadcom extensions (corerev >= 1) */
+#define SDIOD_CCCR_BRCM_SEPINT          0xf2
+
+/* cccr_sdio_rev */
+#define SDIO_REV_SDIOID_MASK    0xf0    /* SDIO spec revision number */
+#define SDIO_REV_CCCRID_MASK    0x0f    /* CCCR format version number */
+
+/* sd_rev */
+#define SD_REV_PHY_MASK         0x0f    /* SD format version number */
+
+/* io_en */
+#define SDIO_FUNC_ENABLE_1      0x02    /* function 1 I/O enable */
+#define SDIO_FUNC_ENABLE_2      0x04    /* function 2 I/O enable */
+
+/* io_rdys */
+#define SDIO_FUNC_READY_1       0x02    /* function 1 I/O ready */
+#define SDIO_FUNC_READY_2       0x04    /* function 2 I/O ready */
+
+/* intr_ctl */
+#define INTR_CTL_MASTER_EN      0x1     /* interrupt enable master */
+#define INTR_CTL_FUNC1_EN       0x2     /* interrupt enable for function 1 */
+#define INTR_CTL_FUNC2_EN       0x4     /* interrupt enable for function 2 */
+
+/* intr_status */
+#define INTR_STATUS_FUNC1       0x2     /* interrupt pending for function 1 */
+#define INTR_STATUS_FUNC2       0x4     /* interrupt pending for function 2 */
+
+/* io_abort */
+#define IO_ABORT_RESET_ALL      0x08    /* I/O card reset */
+#define IO_ABORT_FUNC_MASK      0x07    /* abort selction: function x */
+
+/* bus_inter */
+#define BUS_CARD_DETECT_DIS     0x80    /* Card Detect disable */
+#define BUS_SPI_CONT_INTR_CAP   0x40    /* support continuous SPI interrupt */
+#define BUS_SPI_CONT_INTR_EN    0x20    /* continuous SPI interrupt enable */
+#define BUS_SD_DATA_WIDTH_MASK  0x03    /* bus width mask */
+#define BUS_SD_DATA_WIDTH_4BIT  0x02    /* bus width 4-bit mode */
+#define BUS_SD_DATA_WIDTH_1BIT  0x00    /* bus width 1-bit mode */
+
+/* capability */
+#define SDIO_CAP_4BLS           0x80    /* 4-bit support for low speed card */
+#define SDIO_CAP_LSC            0x40    /* low speed card */
+#define SDIO_CAP_E4MI           0x20    /* enable interrupt between block of data in 4-bit mode */
+#define SDIO_CAP_S4MI           0x10    /* support interrupt between block of data in 4-bit mode */
+#define SDIO_CAP_SBS            0x08    /* support suspend/resume */
+#define SDIO_CAP_SRW            0x04    /* support read wait */
+#define SDIO_CAP_SMB            0x02    /* support multi-block transfer */
+#define SDIO_CAP_SDC            0x01    /* Support Direct commands during multi-byte transfer */
+
+/* power_control */
+#define SDIO_POWER_SMPC         0x01    /* supports master power control (RO) */
+#define SDIO_POWER_EMPC         0x02    /* enable master power control (allow > 200mA) (RW) */
+
+/* speed_control (control device entry into high-speed clocking mode) */
+#define SDIO_SPEED_SHS          0x01    /* supports high-speed [clocking] mode (RO) */
+#define SDIO_SPEED_EHS          0x02    /* enable high-speed [clocking] mode (RW) */
+
+/* for setting bus speed in card: 0x13h */
+#define SDIO_BUS_SPEED_UHSISEL_M        BITFIELD_MASK(3)
+#define SDIO_BUS_SPEED_UHSISEL_S        1
+
+/* for getting bus speed cap in card: 0x14h */
+#define SDIO_BUS_SPEED_UHSICAP_M        BITFIELD_MASK(3)
+#define SDIO_BUS_SPEED_UHSICAP_S        0
+
+/* for getting driver type CAP in card: 0x15h */
+#define SDIO_BUS_DRVR_TYPE_CAP_M        BITFIELD_MASK(3)
+#define SDIO_BUS_DRVR_TYPE_CAP_S        0
+
+/* for setting driver type selection in card: 0x15h */
+#define SDIO_BUS_DRVR_TYPE_SEL_M        BITFIELD_MASK(2)
+#define SDIO_BUS_DRVR_TYPE_SEL_S        4
+
+/* for getting async int support in card: 0x16h */
+#define SDIO_BUS_ASYNCINT_CAP_M BITFIELD_MASK(1)
+#define SDIO_BUS_ASYNCINT_CAP_S 0
+
+/* for setting async int selection in card: 0x16h */
+#define SDIO_BUS_ASYNCINT_SEL_M BITFIELD_MASK(1)
+#define SDIO_BUS_ASYNCINT_SEL_S 1
+
+/* brcm sepint */
+#define SDIO_SEPINT_MASK        0x01    /* route sdpcmdev intr onto separate pad (chip-specific) */
+#define SDIO_SEPINT_OE          0x02    /* 1 asserts output enable for above pad */
+#define SDIO_SEPINT_ACT_HI      0x04    /* use active high interrupt level instead of active low */
+
+/* FBR structure for function 1-7, FBR addresses and register offsets */
+typedef volatile struct {
+        uint8   devctr;                 /* device interface, CSA control */
+        uint8   ext_dev;                /* extended standard I/O device type code */
+        uint8   pwr_sel;                /* power selection support */
+        uint8   PAD[6];                 /* reserved */
+
+        uint8   cis_low;                /* CIS LSB */
+        uint8   cis_mid;
+        uint8   cis_high;               /* CIS MSB */
+        uint8   csa_low;                /* code storage area, LSB */
+        uint8   csa_mid;
+        uint8   csa_high;               /* code storage area, MSB */
+        uint8   csa_dat_win;            /* data access window to function */
+
+        uint8   fnx_blk_size[2];        /* block size, little endian */
+} sdio_fbr_t;
+
+/* Maximum number of I/O funcs */
+#define SDIOD_MAX_IOFUNCS               7
+
+/* SDIO Device FBR Start Address  */
+#define SDIOD_FBR_STARTADDR             0x100
+
+/* SDIO Device FBR Size */
+#define SDIOD_FBR_SIZE                  0x100
+
+/* Macro to calculate FBR register base */
+#define SDIOD_FBR_BASE(n)               ((n) * 0x100)
+
+/* Function register offsets */
+#define SDIOD_FBR_DEVCTR                0x00    /* basic info for function */
+#define SDIOD_FBR_EXT_DEV               0x01    /* extended I/O device code */
+#define SDIOD_FBR_PWR_SEL               0x02    /* power selection bits */
+
+/* SDIO Function CIS ptr offset */
+#define SDIOD_FBR_CISPTR_0              0x09
+#define SDIOD_FBR_CISPTR_1              0x0A
+#define SDIOD_FBR_CISPTR_2              0x0B
+
+/* Code Storage Area pointer */
+#define SDIOD_FBR_CSA_ADDR_0            0x0C
+#define SDIOD_FBR_CSA_ADDR_1            0x0D
+#define SDIOD_FBR_CSA_ADDR_2            0x0E
+#define SDIOD_FBR_CSA_DATA              0x0F
+
+/* SDIO Function I/O Block Size */
+#define SDIOD_FBR_BLKSIZE_0             0x10
+#define SDIOD_FBR_BLKSIZE_1             0x11
+
+/* devctr */
+#define SDIOD_FBR_DEVCTR_DIC    0x0f    /* device interface code */
+#define SDIOD_FBR_DECVTR_CSA    0x40    /* CSA support flag */
+#define SDIOD_FBR_DEVCTR_CSA_EN 0x80    /* CSA enabled */
+/* interface codes */
+#define SDIOD_DIC_NONE          0       /* SDIO standard interface is not supported */
+#define SDIOD_DIC_UART          1
+#define SDIOD_DIC_BLUETOOTH_A   2
+#define SDIOD_DIC_BLUETOOTH_B   3
+#define SDIOD_DIC_GPS           4
+#define SDIOD_DIC_CAMERA        5
+#define SDIOD_DIC_PHS           6
+#define SDIOD_DIC_WLAN          7
+#define SDIOD_DIC_EXT           0xf     /* extended device interface, read ext_dev register */
+
+/* pwr_sel */
+#define SDIOD_PWR_SEL_SPS       0x01    /* supports power selection */
+#define SDIOD_PWR_SEL_EPS       0x02    /* enable power selection (low-current mode) */
+
+/* misc defines */
+#define SDIO_FUNC_0             0
+#define SDIO_FUNC_1             1
+#define SDIO_FUNC_2             2
+#define SDIO_FUNC_3             3
+#define SDIO_FUNC_4             4
+#define SDIO_FUNC_5             5
+#define SDIO_FUNC_6             6
+#define SDIO_FUNC_7             7
+
+#define SD_CARD_TYPE_UNKNOWN    0       /* bad type or unrecognized */
+#define SD_CARD_TYPE_IO         1       /* IO only card */
+#define SD_CARD_TYPE_MEMORY     2       /* memory only card */
+#define SD_CARD_TYPE_COMBO      3       /* IO and memory combo card */
+
+#define SDIO_MAX_BLOCK_SIZE     2048    /* maximum block size for block mode operation */
+#define SDIO_MIN_BLOCK_SIZE     1       /* minimum block size for block mode operation */
+
+/* Card registers: status bit position */
+#define CARDREG_STATUS_BIT_OUTOFRANGE           31
+#define CARDREG_STATUS_BIT_COMCRCERROR          23
+#define CARDREG_STATUS_BIT_ILLEGALCOMMAND       22
+#define CARDREG_STATUS_BIT_ERROR                19
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE3      12
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE2      11
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE1      10
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE0      9
+#define CARDREG_STATUS_BIT_FUN_NUM_ERROR        4
+
+
+
+#define SD_CMD_GO_IDLE_STATE            0       /* mandatory for SDIO */
+#define SD_CMD_SEND_OPCOND              1
+#define SD_CMD_MMC_SET_RCA              3
+#define SD_CMD_IO_SEND_OP_COND          5       /* mandatory for SDIO */
+#define SD_CMD_SELECT_DESELECT_CARD     7
+#define SD_CMD_SEND_CSD                 9
+#define SD_CMD_SEND_CID                 10
+#define SD_CMD_STOP_TRANSMISSION        12
+#define SD_CMD_SEND_STATUS              13
+#define SD_CMD_GO_INACTIVE_STATE        15
+#define SD_CMD_SET_BLOCKLEN             16
+#define SD_CMD_READ_SINGLE_BLOCK        17
+#define SD_CMD_READ_MULTIPLE_BLOCK      18
+#define SD_CMD_WRITE_BLOCK              24
+#define SD_CMD_WRITE_MULTIPLE_BLOCK     25
+#define SD_CMD_PROGRAM_CSD              27
+#define SD_CMD_SET_WRITE_PROT           28
+#define SD_CMD_CLR_WRITE_PROT           29
+#define SD_CMD_SEND_WRITE_PROT          30
+#define SD_CMD_ERASE_WR_BLK_START       32
+#define SD_CMD_ERASE_WR_BLK_END         33
+#define SD_CMD_ERASE                    38
+#define SD_CMD_LOCK_UNLOCK              42
+#define SD_CMD_IO_RW_DIRECT             52      /* mandatory for SDIO */
+#define SD_CMD_IO_RW_EXTENDED           53      /* mandatory for SDIO */
+#define SD_CMD_APP_CMD                  55
+#define SD_CMD_GEN_CMD                  56
+#define SD_CMD_READ_OCR                 58
+#define SD_CMD_CRC_ON_OFF               59      /* mandatory for SDIO */
+#define SD_ACMD_SD_STATUS               13
+#define SD_ACMD_SEND_NUM_WR_BLOCKS      22
+#define SD_ACMD_SET_WR_BLOCK_ERASE_CNT  23
+#define SD_ACMD_SD_SEND_OP_COND         41
+#define SD_ACMD_SET_CLR_CARD_DETECT     42
+#define SD_ACMD_SEND_SCR                51
+
+/* argument for SD_CMD_IO_RW_DIRECT and SD_CMD_IO_RW_EXTENDED */
+#define SD_IO_OP_READ           0   /* Read_Write: Read */
+#define SD_IO_OP_WRITE          1   /* Read_Write: Write */
+#define SD_IO_RW_NORMAL         0   /* no RAW */
+#define SD_IO_RW_RAW            1   /* RAW */
+#define SD_IO_BYTE_MODE         0   /* Byte Mode */
+#define SD_IO_BLOCK_MODE        1   /* BlockMode */
+#define SD_IO_FIXED_ADDRESS     0   /* fix Address */
+#define SD_IO_INCREMENT_ADDRESS 1   /* IncrementAddress */
+
+/* build SD_CMD_IO_RW_DIRECT Argument */
+#define SDIO_IO_RW_DIRECT_ARG(rw, raw, func, addr, data) \
+        ((((rw) & 1) << 31) | (((func) & 0x7) << 28) | (((raw) & 1) << 27) | \
+         (((addr) & 0x1FFFF) << 9) | ((data) & 0xFF))
+
+/* build SD_CMD_IO_RW_EXTENDED Argument */
+#define SDIO_IO_RW_EXTENDED_ARG(rw, blk, func, addr, inc_addr, count) \
+        ((((rw) & 1) << 31) | (((func) & 0x7) << 28) | (((blk) & 1) << 27) | \
+         (((inc_addr) & 1) << 26) | (((addr) & 0x1FFFF) << 9) | ((count) & 0x1FF))
+
+/* SDIO response parameters */
+#define SD_RSP_NO_NONE                  0
+#define SD_RSP_NO_1                     1
+#define SD_RSP_NO_2                     2
+#define SD_RSP_NO_3                     3
+#define SD_RSP_NO_4                     4
+#define SD_RSP_NO_5                     5
+#define SD_RSP_NO_6                     6
+
+        /* Modified R6 response (to CMD3) */
+#define SD_RSP_MR6_COM_CRC_ERROR        0x8000
+#define SD_RSP_MR6_ILLEGAL_COMMAND      0x4000
+#define SD_RSP_MR6_ERROR                0x2000
+
+        /* Modified R1 in R4 Response (to CMD5) */
+#define SD_RSP_MR1_SBIT                 0x80
+#define SD_RSP_MR1_PARAMETER_ERROR      0x40
+#define SD_RSP_MR1_RFU5                 0x20
+#define SD_RSP_MR1_FUNC_NUM_ERROR       0x10
+#define SD_RSP_MR1_COM_CRC_ERROR        0x08
+#define SD_RSP_MR1_ILLEGAL_COMMAND      0x04
+#define SD_RSP_MR1_RFU1                 0x02
+#define SD_RSP_MR1_IDLE_STATE           0x01
+
+        /* R5 response (to CMD52 and CMD53) */
+#define SD_RSP_R5_COM_CRC_ERROR         0x80
+#define SD_RSP_R5_ILLEGAL_COMMAND       0x40
+#define SD_RSP_R5_IO_CURRENTSTATE1      0x20
+#define SD_RSP_R5_IO_CURRENTSTATE0      0x10
+#define SD_RSP_R5_ERROR                 0x08
+#define SD_RSP_R5_RFU                   0x04
+#define SD_RSP_R5_FUNC_NUM_ERROR        0x02
+#define SD_RSP_R5_OUT_OF_RANGE          0x01
+
+#define SD_RSP_R5_ERRBITS               0xCB
+
+
+/* ------------------------------------------------
+ *  SDIO Commands and responses
+ *
+ *  I/O only commands are:
+ *      CMD0, CMD3, CMD5, CMD7, CMD15, CMD52, CMD53
+ * ------------------------------------------------
+ */
+
+/* SDIO Commands */
+#define SDIOH_CMD_0             0
+#define SDIOH_CMD_3             3
+#define SDIOH_CMD_5             5
+#define SDIOH_CMD_7             7
+#define SDIOH_CMD_11            11
+#define SDIOH_CMD_14            14
+#define SDIOH_CMD_15            15
+#define SDIOH_CMD_19            19
+#define SDIOH_CMD_52            52
+#define SDIOH_CMD_53            53
+#define SDIOH_CMD_59            59
+
+/* SDIO Command Responses */
+#define SDIOH_RSP_NONE          0
+#define SDIOH_RSP_R1            1
+#define SDIOH_RSP_R2            2
+#define SDIOH_RSP_R3            3
+#define SDIOH_RSP_R4            4
+#define SDIOH_RSP_R5            5
+#define SDIOH_RSP_R6            6
+
+/*
+ *  SDIO Response Error flags
+ */
+#define SDIOH_RSP5_ERROR_FLAGS  0xCB
+
+/* ------------------------------------------------
+ * SDIO Command structures. I/O only commands are:
+ *
+ *      CMD0, CMD3, CMD5, CMD7, CMD15, CMD52, CMD53
+ * ------------------------------------------------
+ */
+
+#define CMD5_OCR_M              BITFIELD_MASK(24)
+#define CMD5_OCR_S              0
+
+#define CMD5_S18R_M             BITFIELD_MASK(1)
+#define CMD5_S18R_S             24
+
+#define CMD7_RCA_M              BITFIELD_MASK(16)
+#define CMD7_RCA_S              16
+#define CMD14_RCA_M             BITFIELD_MASK(16)
+#define CMD14_RCA_S             16
+#define CMD14_SLEEP_M           BITFIELD_MASK(1)
+#define CMD14_SLEEP_S           15
+
+#define CMD_15_RCA_M            BITFIELD_MASK(16)
+#define CMD_15_RCA_S            16
+
+#define CMD52_DATA_M            BITFIELD_MASK(8)  /* Bits [7:0]    - Write Data/Stuff bits of CMD52
+                                                   */
+#define CMD52_DATA_S            0
+#define CMD52_REG_ADDR_M        BITFIELD_MASK(17) /* Bits [25:9]   - register address */
+#define CMD52_REG_ADDR_S        9
+#define CMD52_RAW_M             BITFIELD_MASK(1)  /* Bit  27       - Read after Write flag */
+#define CMD52_RAW_S             27
+#define CMD52_FUNCTION_M        BITFIELD_MASK(3)  /* Bits [30:28]  - Function number */
+#define CMD52_FUNCTION_S        28
+#define CMD52_RW_FLAG_M         BITFIELD_MASK(1)  /* Bit  31       - R/W flag */
+#define CMD52_RW_FLAG_S         31
+
+
+#define CMD53_BYTE_BLK_CNT_M    BITFIELD_MASK(9) /* Bits [8:0]     - Byte/Block Count of CMD53 */
+#define CMD53_BYTE_BLK_CNT_S    0
+#define CMD53_REG_ADDR_M        BITFIELD_MASK(17) /* Bits [25:9]   - register address */
+#define CMD53_REG_ADDR_S        9
+#define CMD53_OP_CODE_M         BITFIELD_MASK(1)  /* Bit  26       - R/W Operation Code */
+#define CMD53_OP_CODE_S         26
+#define CMD53_BLK_MODE_M        BITFIELD_MASK(1)  /* Bit  27       - Block Mode */
+#define CMD53_BLK_MODE_S        27
+#define CMD53_FUNCTION_M        BITFIELD_MASK(3)  /* Bits [30:28]  - Function number */
+#define CMD53_FUNCTION_S        28
+#define CMD53_RW_FLAG_M         BITFIELD_MASK(1)  /* Bit  31       - R/W flag */
+#define CMD53_RW_FLAG_S         31
+
+/* ------------------------------------------------------
+ * SDIO Command Response structures for SD1 and SD4 modes
+ *  -----------------------------------------------------
+ */
+#define RSP4_IO_OCR_M           BITFIELD_MASK(24) /* Bits [23:0]  - Card's OCR Bits [23:0] */
+#define RSP4_IO_OCR_S           0
+
+#define RSP4_S18A_M                     BITFIELD_MASK(1) /* Bits [23:0]  - Card's OCR Bits [23:0] */
+#define RSP4_S18A_S                     24
+
+#define RSP4_STUFF_M            BITFIELD_MASK(3)  /* Bits [26:24] - Stuff bits */
+#define RSP4_STUFF_S            24
+#define RSP4_MEM_PRESENT_M      BITFIELD_MASK(1)  /* Bit  27      - Memory present */
+#define RSP4_MEM_PRESENT_S      27
+#define RSP4_NUM_FUNCS_M        BITFIELD_MASK(3)  /* Bits [30:28] - Number of I/O funcs */
+#define RSP4_NUM_FUNCS_S        28
+#define RSP4_CARD_READY_M       BITFIELD_MASK(1)  /* Bit  31      - SDIO card ready */
+#define RSP4_CARD_READY_S       31
+
+#define RSP6_STATUS_M           BITFIELD_MASK(16) /* Bits [15:0]  - Card status bits [19,22,23,12:0]
+                                                   */
+#define RSP6_STATUS_S           0
+#define RSP6_IO_RCA_M           BITFIELD_MASK(16) /* Bits [31:16] - RCA bits[31-16] */
+#define RSP6_IO_RCA_S           16
+
+#define RSP1_AKE_SEQ_ERROR_M    BITFIELD_MASK(1)  /* Bit 3       - Authentication seq error */
+#define RSP1_AKE_SEQ_ERROR_S    3
+#define RSP1_APP_CMD_M          BITFIELD_MASK(1)  /* Bit 5       - Card expects ACMD */
+#define RSP1_APP_CMD_S          5
+#define RSP1_READY_FOR_DATA_M   BITFIELD_MASK(1)  /* Bit 8       - Ready for data (buff empty) */
+#define RSP1_READY_FOR_DATA_S   8
+#define RSP1_CURR_STATE_M       BITFIELD_MASK(4)  /* Bits [12:9] - State of card
+                                                   * when Cmd was received
+                                                   */
+#define RSP1_CURR_STATE_S       9
+#define RSP1_EARSE_RESET_M      BITFIELD_MASK(1)  /* Bit 13   - Erase seq cleared */
+#define RSP1_EARSE_RESET_S      13
+#define RSP1_CARD_ECC_DISABLE_M BITFIELD_MASK(1)  /* Bit 14   - Card ECC disabled */
+#define RSP1_CARD_ECC_DISABLE_S 14
+#define RSP1_WP_ERASE_SKIP_M    BITFIELD_MASK(1)  /* Bit 15   - Partial blocks erased due to W/P */
+#define RSP1_WP_ERASE_SKIP_S    15
+#define RSP1_CID_CSD_OVERW_M    BITFIELD_MASK(1)  /* Bit 16   - Illegal write to CID or R/O bits
+                                                   * of CSD
+                                                   */
+#define RSP1_CID_CSD_OVERW_S    16
+#define RSP1_ERROR_M            BITFIELD_MASK(1)  /* Bit 19   - General/Unknown error */
+#define RSP1_ERROR_S            19
+#define RSP1_CC_ERROR_M         BITFIELD_MASK(1)  /* Bit 20   - Internal Card Control error */
+#define RSP1_CC_ERROR_S         20
+#define RSP1_CARD_ECC_FAILED_M  BITFIELD_MASK(1)  /* Bit 21   - Card internal ECC failed
+                                                   * to correct data
+                                                   */
+#define RSP1_CARD_ECC_FAILED_S  21
+#define RSP1_ILLEGAL_CMD_M      BITFIELD_MASK(1)  /* Bit 22   - Cmd not legal for the card state */
+#define RSP1_ILLEGAL_CMD_S      22
+#define RSP1_COM_CRC_ERROR_M    BITFIELD_MASK(1)  /* Bit 23   - CRC check of previous command failed
+                                                   */
+#define RSP1_COM_CRC_ERROR_S    23
+#define RSP1_LOCK_UNLOCK_FAIL_M BITFIELD_MASK(1)  /* Bit 24   - Card lock-unlock Cmd Seq error */
+#define RSP1_LOCK_UNLOCK_FAIL_S 24
+#define RSP1_CARD_LOCKED_M      BITFIELD_MASK(1)  /* Bit 25   - Card locked by the host */
+#define RSP1_CARD_LOCKED_S      25
+#define RSP1_WP_VIOLATION_M     BITFIELD_MASK(1)  /* Bit 26   - Attempt to program
+                                                   * write-protected blocks
+                                                   */
+#define RSP1_WP_VIOLATION_S     26
+#define RSP1_ERASE_PARAM_M      BITFIELD_MASK(1)  /* Bit 27   - Invalid erase blocks */
+#define RSP1_ERASE_PARAM_S      27
+#define RSP1_ERASE_SEQ_ERR_M    BITFIELD_MASK(1)  /* Bit 28   - Erase Cmd seq error */
+#define RSP1_ERASE_SEQ_ERR_S    28
+#define RSP1_BLK_LEN_ERR_M      BITFIELD_MASK(1)  /* Bit 29   - Block length error */
+#define RSP1_BLK_LEN_ERR_S      29
+#define RSP1_ADDR_ERR_M         BITFIELD_MASK(1)  /* Bit 30   - Misaligned address */
+#define RSP1_ADDR_ERR_S         30
+#define RSP1_OUT_OF_RANGE_M     BITFIELD_MASK(1)  /* Bit 31   - Cmd arg was out of range */
+#define RSP1_OUT_OF_RANGE_S     31
+
+
+#define RSP5_DATA_M             BITFIELD_MASK(8)  /* Bits [0:7]   - data */
+#define RSP5_DATA_S             0
+#define RSP5_FLAGS_M            BITFIELD_MASK(8)  /* Bit  [15:8]  - Rsp flags */
+#define RSP5_FLAGS_S            8
+#define RSP5_STUFF_M            BITFIELD_MASK(16) /* Bits [31:16] - Stuff bits */
+#define RSP5_STUFF_S            16
+
+/* ----------------------------------------------
+ * SDIO Command Response structures for SPI mode
+ * ----------------------------------------------
+ */
+#define SPIRSP4_IO_OCR_M        BITFIELD_MASK(16) /* Bits [15:0]    - Card's OCR Bits [23:8] */
+#define SPIRSP4_IO_OCR_S        0
+#define SPIRSP4_STUFF_M         BITFIELD_MASK(3)  /* Bits [18:16]   - Stuff bits */
+#define SPIRSP4_STUFF_S         16
+#define SPIRSP4_MEM_PRESENT_M   BITFIELD_MASK(1)  /* Bit  19        - Memory present */
+#define SPIRSP4_MEM_PRESENT_S   19
+#define SPIRSP4_NUM_FUNCS_M     BITFIELD_MASK(3)  /* Bits [22:20]   - Number of I/O funcs */
+#define SPIRSP4_NUM_FUNCS_S     20
+#define SPIRSP4_CARD_READY_M    BITFIELD_MASK(1)  /* Bit  23        - SDIO card ready */
+#define SPIRSP4_CARD_READY_S    23
+#define SPIRSP4_IDLE_STATE_M    BITFIELD_MASK(1)  /* Bit  24        - idle state */
+#define SPIRSP4_IDLE_STATE_S    24
+#define SPIRSP4_ILLEGAL_CMD_M   BITFIELD_MASK(1)  /* Bit  26        - Illegal Cmd error */
+#define SPIRSP4_ILLEGAL_CMD_S   26
+#define SPIRSP4_COM_CRC_ERROR_M BITFIELD_MASK(1)  /* Bit  27        - COM CRC error */
+#define SPIRSP4_COM_CRC_ERROR_S 27
+#define SPIRSP4_FUNC_NUM_ERROR_M        BITFIELD_MASK(1)  /* Bit  28        - Function number error
+                                                           */
+#define SPIRSP4_FUNC_NUM_ERROR_S        28
+#define SPIRSP4_PARAM_ERROR_M   BITFIELD_MASK(1)  /* Bit  30        - Parameter Error Bit */
+#define SPIRSP4_PARAM_ERROR_S   30
+#define SPIRSP4_START_BIT_M     BITFIELD_MASK(1)  /* Bit  31        - Start Bit */
+#define SPIRSP4_START_BIT_S     31
+
+#define SPIRSP5_DATA_M                  BITFIELD_MASK(8)  /* Bits [23:16]   - R/W Data */
+#define SPIRSP5_DATA_S                  16
+#define SPIRSP5_IDLE_STATE_M            BITFIELD_MASK(1)  /* Bit  24        - Idle state */
+#define SPIRSP5_IDLE_STATE_S            24
+#define SPIRSP5_ILLEGAL_CMD_M           BITFIELD_MASK(1)  /* Bit  26        - Illegal Cmd error */
+#define SPIRSP5_ILLEGAL_CMD_S           26
+#define SPIRSP5_COM_CRC_ERROR_M         BITFIELD_MASK(1)  /* Bit  27        - COM CRC error */
+#define SPIRSP5_COM_CRC_ERROR_S         27
+#define SPIRSP5_FUNC_NUM_ERROR_M        BITFIELD_MASK(1)  /* Bit  28        - Function number error
+                                                           */
+#define SPIRSP5_FUNC_NUM_ERROR_S        28
+#define SPIRSP5_PARAM_ERROR_M           BITFIELD_MASK(1)  /* Bit  30        - Parameter Error Bit */
+#define SPIRSP5_PARAM_ERROR_S           30
+#define SPIRSP5_START_BIT_M             BITFIELD_MASK(1)  /* Bit  31        - Start Bit */
+#define SPIRSP5_START_BIT_S             31
+
+/* RSP6 card status format; Pg 68 Physical Layer spec v 1.10 */
+#define RSP6STAT_AKE_SEQ_ERROR_M        BITFIELD_MASK(1)  /* Bit 3      - Authentication seq error
+                                                           */
+#define RSP6STAT_AKE_SEQ_ERROR_S        3
+#define RSP6STAT_APP_CMD_M              BITFIELD_MASK(1)  /* Bit 5      - Card expects ACMD */
+#define RSP6STAT_APP_CMD_S              5
+#define RSP6STAT_READY_FOR_DATA_M       BITFIELD_MASK(1)  /* Bit 8      - Ready for data
+                                                           * (buff empty)
+                                                           */
+#define RSP6STAT_READY_FOR_DATA_S       8
+#define RSP6STAT_CURR_STATE_M           BITFIELD_MASK(4)  /* Bits [12:9] - Card state at
+                                                           * Cmd reception
+                                                           */
+#define RSP6STAT_CURR_STATE_S           9
+#define RSP6STAT_ERROR_M                BITFIELD_MASK(1)  /* Bit 13  - General/Unknown error Bit 19
+                                                           */
+#define RSP6STAT_ERROR_S                13
+#define RSP6STAT_ILLEGAL_CMD_M          BITFIELD_MASK(1)  /* Bit 14  - Illegal cmd for
+                                                           * card state Bit 22
+                                                           */
+#define RSP6STAT_ILLEGAL_CMD_S          14
+#define RSP6STAT_COM_CRC_ERROR_M        BITFIELD_MASK(1)  /* Bit 15  - CRC previous command
+                                                           * failed Bit 23
+                                                           */
+#define RSP6STAT_COM_CRC_ERROR_S        15
+
+#define SDIOH_XFER_TYPE_READ    SD_IO_OP_READ
+#define SDIOH_XFER_TYPE_WRITE   SD_IO_OP_WRITE
+
+/* command issue options */
+#define CMD_OPTION_DEFAULT      0
+#define CMD_OPTION_TUNING       1
+
+#endif /* _SDIO_H */
diff --git a/drivers/net/wireless/bcmdhd/include/sdioh.h b/drivers/net/wireless/bcmdhd/include/sdioh.h
new file mode 100644
index 00000000000..3d37c7a7e30
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sdioh.h
@@ -0,0 +1,412 @@
+/*
+ * SDIO Host Controller Spec header file
+ * Register map and definitions for the Standard Host Controller
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sdioh.h,v 13.17.2.3 2011-01-08 05:28:21 Exp $
+ */
+
+#ifndef _SDIOH_H
+#define _SDIOH_H
+
+#define SD_SysAddr                      0x000
+#define SD_BlockSize                    0x004
+#define SD_BlockCount                   0x006
+#define SD_Arg0                         0x008
+#define SD_Arg1                         0x00A
+#define SD_TransferMode                 0x00C
+#define SD_Command                      0x00E
+#define SD_Response0                    0x010
+#define SD_Response1                    0x012
+#define SD_Response2                    0x014
+#define SD_Response3                    0x016
+#define SD_Response4                    0x018
+#define SD_Response5                    0x01A
+#define SD_Response6                    0x01C
+#define SD_Response7                    0x01E
+#define SD_BufferDataPort0              0x020
+#define SD_BufferDataPort1              0x022
+#define SD_PresentState                 0x024
+#define SD_HostCntrl                    0x028
+#define SD_PwrCntrl                     0x029
+#define SD_BlockGapCntrl                0x02A
+#define SD_WakeupCntrl                  0x02B
+#define SD_ClockCntrl                   0x02C
+#define SD_TimeoutCntrl                 0x02E
+#define SD_SoftwareReset                0x02F
+#define SD_IntrStatus                   0x030
+#define SD_ErrorIntrStatus              0x032
+#define SD_IntrStatusEnable             0x034
+#define SD_ErrorIntrStatusEnable        0x036
+#define SD_IntrSignalEnable             0x038
+#define SD_ErrorIntrSignalEnable        0x03A
+#define SD_CMD12ErrorStatus             0x03C
+#define SD_Capabilities                 0x040
+#define SD_Capabilities3                0x044
+#define SD_MaxCurCap                    0x048
+#define SD_MaxCurCap_Reserved           0x04C
+#define SD_ADMA_ErrStatus               0x054
+#define SD_ADMA_SysAddr                 0x58
+#define SD_SlotInterruptStatus          0x0FC
+#define SD_HostControllerVersion        0x0FE
+
+/* SD specific registers in PCI config space */
+#define SD_SlotInfo     0x40
+
+/* HC 3.0 specific registers and offsets */
+#define SD3_HostCntrl2                  0x03E
+/* preset regsstart and count */
+#define SD3_PresetValStart              0x060
+#define SD3_PresetValCount              8
+/* preset-indiv regs */
+#define SD3_PresetVal_init              0x060
+#define SD3_PresetVal_default   0x062
+#define SD3_PresetVal_HS                0x064
+#define SD3_PresetVal_SDR12             0x066
+#define SD3_PresetVal_SDR25             0x068
+#define SD3_PresetVal_SDR50             0x06a
+#define SD3_PresetVal_SDR104    0x06c
+#define SD3_PresetVal_DDR50             0x06e
+
+/* preset value indices */
+#define SD3_PRESETVAL_INITIAL_IX        0
+#define SD3_PRESETVAL_DESPEED_IX        1
+#define SD3_PRESETVAL_HISPEED_IX        2
+#define SD3_PRESETVAL_SDR12_IX          3
+#define SD3_PRESETVAL_SDR25_IX          4
+#define SD3_PRESETVAL_SDR50_IX          5
+#define SD3_PRESETVAL_SDR104_IX         6
+#define SD3_PRESETVAL_DDR50_IX          7
+
+/* SD_Capabilities reg (0x040) */
+#define CAP_TO_CLKFREQ_M        BITFIELD_MASK(6)
+#define CAP_TO_CLKFREQ_S        0
+#define CAP_TO_CLKUNIT_M        BITFIELD_MASK(1)
+#define CAP_TO_CLKUNIT_S        7
+/* Note: for sdio-2.0 case, this mask has to be 6 bits, but msb 2
+        bits are reserved. going ahead with 8 bits, as it is req for 3.0
+*/
+#define CAP_BASECLK_M           BITFIELD_MASK(8)
+#define CAP_BASECLK_S           8
+#define CAP_MAXBLOCK_M          BITFIELD_MASK(2)
+#define CAP_MAXBLOCK_S          16
+#define CAP_ADMA2_M             BITFIELD_MASK(1)
+#define CAP_ADMA2_S             19
+#define CAP_ADMA1_M             BITFIELD_MASK(1)
+#define CAP_ADMA1_S             20
+#define CAP_HIGHSPEED_M         BITFIELD_MASK(1)
+#define CAP_HIGHSPEED_S         21
+#define CAP_DMA_M               BITFIELD_MASK(1)
+#define CAP_DMA_S               22
+#define CAP_SUSPEND_M           BITFIELD_MASK(1)
+#define CAP_SUSPEND_S           23
+#define CAP_VOLT_3_3_M          BITFIELD_MASK(1)
+#define CAP_VOLT_3_3_S          24
+#define CAP_VOLT_3_0_M          BITFIELD_MASK(1)
+#define CAP_VOLT_3_0_S          25
+#define CAP_VOLT_1_8_M          BITFIELD_MASK(1)
+#define CAP_VOLT_1_8_S          26
+#define CAP_64BIT_HOST_M        BITFIELD_MASK(1)
+#define CAP_64BIT_HOST_S        28
+
+#define SDIO_OCR_READ_FAIL      (2)
+
+
+#define CAP_ASYNCINT_SUP_M      BITFIELD_MASK(1)
+#define CAP_ASYNCINT_SUP_S      29
+
+#define CAP_SLOTTYPE_M          BITFIELD_MASK(2)
+#define CAP_SLOTTYPE_S          30
+
+#define CAP3_MSBits_OFFSET      (32)
+/* note: following are caps MSB32 bits.
+        So the bits start from 0, instead of 32. that is why
+        CAP3_MSBits_OFFSET is subtracted.
+*/
+#define CAP3_SDR50_SUP_M                BITFIELD_MASK(1)
+#define CAP3_SDR50_SUP_S                (32 - CAP3_MSBits_OFFSET)
+
+#define CAP3_SDR104_SUP_M       BITFIELD_MASK(1)
+#define CAP3_SDR104_SUP_S       (33 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DDR50_SUP_M        BITFIELD_MASK(1)
+#define CAP3_DDR50_SUP_S        (34 - CAP3_MSBits_OFFSET)
+
+/* for knowing the clk caps in a single read */
+#define CAP3_30CLKCAP_M         BITFIELD_MASK(3)
+#define CAP3_30CLKCAP_S         (32 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_A_M       BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_A_S       (36 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_C_M       BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_C_S       (37 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_D_M       BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_D_S       (38 - CAP3_MSBits_OFFSET)
+
+#define CAP3_RETUNING_TC_M      BITFIELD_MASK(4)
+#define CAP3_RETUNING_TC_S      (40 - CAP3_MSBits_OFFSET)
+
+#define CAP3_TUNING_SDR50_M     BITFIELD_MASK(1)
+#define CAP3_TUNING_SDR50_S     (45 - CAP3_MSBits_OFFSET)
+
+#define CAP3_RETUNING_MODES_M   BITFIELD_MASK(2)
+#define CAP3_RETUNING_MODES_S   (46 - CAP3_MSBits_OFFSET)
+
+#define CAP3_CLK_MULT_M         BITFIELD_MASK(8)
+#define CAP3_CLK_MULT_S         (48 - CAP3_MSBits_OFFSET)
+
+#define PRESET_DRIVR_SELECT_M   BITFIELD_MASK(2)
+#define PRESET_DRIVR_SELECT_S   14
+
+#define PRESET_CLK_DIV_M        BITFIELD_MASK(10)
+#define PRESET_CLK_DIV_S        0
+
+/* SD_MaxCurCap reg (0x048) */
+#define CAP_CURR_3_3_M          BITFIELD_MASK(8)
+#define CAP_CURR_3_3_S          0
+#define CAP_CURR_3_0_M          BITFIELD_MASK(8)
+#define CAP_CURR_3_0_S          8
+#define CAP_CURR_1_8_M          BITFIELD_MASK(8)
+#define CAP_CURR_1_8_S          16
+
+/* SD_SysAddr: Offset 0x0000, Size 4 bytes */
+
+/* SD_BlockSize: Offset 0x004, Size 2 bytes */
+#define BLKSZ_BLKSZ_M           BITFIELD_MASK(12)
+#define BLKSZ_BLKSZ_S           0
+#define BLKSZ_BNDRY_M           BITFIELD_MASK(3)
+#define BLKSZ_BNDRY_S           12
+
+/* SD_BlockCount: Offset 0x006, size 2 bytes */
+
+/* SD_Arg0: Offset 0x008, size = 4 bytes  */
+/* SD_TransferMode Offset 0x00C, size = 2 bytes */
+#define XFER_DMA_ENABLE_M       BITFIELD_MASK(1)
+#define XFER_DMA_ENABLE_S       0
+#define XFER_BLK_COUNT_EN_M     BITFIELD_MASK(1)
+#define XFER_BLK_COUNT_EN_S     1
+#define XFER_CMD_12_EN_M        BITFIELD_MASK(1)
+#define XFER_CMD_12_EN_S        2
+#define XFER_DATA_DIRECTION_M   BITFIELD_MASK(1)
+#define XFER_DATA_DIRECTION_S   4
+#define XFER_MULTI_BLOCK_M      BITFIELD_MASK(1)
+#define XFER_MULTI_BLOCK_S      5
+
+/* SD_Command: Offset 0x00E, size = 2 bytes */
+/* resp_type field */
+#define RESP_TYPE_NONE          0
+#define RESP_TYPE_136           1
+#define RESP_TYPE_48            2
+#define RESP_TYPE_48_BUSY       3
+/* type field */
+#define CMD_TYPE_NORMAL         0
+#define CMD_TYPE_SUSPEND        1
+#define CMD_TYPE_RESUME         2
+#define CMD_TYPE_ABORT          3
+
+#define CMD_RESP_TYPE_M         BITFIELD_MASK(2)        /* Bits [0-1]   - Response type */
+#define CMD_RESP_TYPE_S         0
+#define CMD_CRC_EN_M            BITFIELD_MASK(1)        /* Bit 3        - CRC enable */
+#define CMD_CRC_EN_S            3
+#define CMD_INDEX_EN_M          BITFIELD_MASK(1)        /* Bit 4        - Enable index checking */
+#define CMD_INDEX_EN_S          4
+#define CMD_DATA_EN_M           BITFIELD_MASK(1)        /* Bit 5        - Using DAT line */
+#define CMD_DATA_EN_S           5
+#define CMD_TYPE_M              BITFIELD_MASK(2)        /* Bit [6-7]    - Normal, abort, resume, etc
+                                                         */
+#define CMD_TYPE_S              6
+#define CMD_INDEX_M             BITFIELD_MASK(6)        /* Bits [8-13]  - Command number */
+#define CMD_INDEX_S             8
+
+/* SD_BufferDataPort0   : Offset 0x020, size = 2 or 4 bytes */
+/* SD_BufferDataPort1   : Offset 0x022, size = 2 bytes */
+/* SD_PresentState      : Offset 0x024, size = 4 bytes */
+#define PRES_CMD_INHIBIT_M      BITFIELD_MASK(1)        /* Bit 0        May use CMD */
+#define PRES_CMD_INHIBIT_S      0
+#define PRES_DAT_INHIBIT_M      BITFIELD_MASK(1)        /* Bit 1        May use DAT */
+#define PRES_DAT_INHIBIT_S      1
+#define PRES_DAT_BUSY_M         BITFIELD_MASK(1)        /* Bit 2        DAT is busy */
+#define PRES_DAT_BUSY_S         2
+#define PRES_PRESENT_RSVD_M     BITFIELD_MASK(5)        /* Bit [3-7]    rsvd */
+#define PRES_PRESENT_RSVD_S     3
+#define PRES_WRITE_ACTIVE_M     BITFIELD_MASK(1)        /* Bit 8        Write is active */
+#define PRES_WRITE_ACTIVE_S     8
+#define PRES_READ_ACTIVE_M      BITFIELD_MASK(1)        /* Bit 9        Read is active */
+#define PRES_READ_ACTIVE_S      9
+#define PRES_WRITE_DATA_RDY_M   BITFIELD_MASK(1)        /* Bit 10       Write buf is avail */
+#define PRES_WRITE_DATA_RDY_S   10
+#define PRES_READ_DATA_RDY_M    BITFIELD_MASK(1)        /* Bit 11       Read buf data avail */
+#define PRES_READ_DATA_RDY_S    11
+#define PRES_CARD_PRESENT_M     BITFIELD_MASK(1)        /* Bit 16       Card present - debounced */
+#define PRES_CARD_PRESENT_S     16
+#define PRES_CARD_STABLE_M      BITFIELD_MASK(1)        /* Bit 17       Debugging */
+#define PRES_CARD_STABLE_S      17
+#define PRES_CARD_PRESENT_RAW_M BITFIELD_MASK(1)        /* Bit 18       Not debounced */
+#define PRES_CARD_PRESENT_RAW_S 18
+#define PRES_WRITE_ENABLED_M    BITFIELD_MASK(1)        /* Bit 19       Write protected? */
+#define PRES_WRITE_ENABLED_S    19
+#define PRES_DAT_SIGNAL_M       BITFIELD_MASK(4)        /* Bit [20-23]  Debugging */
+#define PRES_DAT_SIGNAL_S       20
+#define PRES_CMD_SIGNAL_M       BITFIELD_MASK(1)        /* Bit 24       Debugging */
+#define PRES_CMD_SIGNAL_S       24
+
+/* SD_HostCntrl: Offset 0x028, size = 1 bytes */
+#define HOST_LED_M              BITFIELD_MASK(1)        /* Bit 0        LED On/Off */
+#define HOST_LED_S              0
+#define HOST_DATA_WIDTH_M       BITFIELD_MASK(1)        /* Bit 1        4 bit enable */
+#define HOST_DATA_WIDTH_S       1
+#define HOST_HI_SPEED_EN_M      BITFIELD_MASK(1)        /* Bit 2        High speed vs low speed */
+#define HOST_DMA_SEL_S          3
+#define HOST_DMA_SEL_M          BITFIELD_MASK(2)        /* Bit 4:3      DMA Select */
+#define HOST_HI_SPEED_EN_S      2
+
+/* Host Control2: */
+#define HOSTCtrl2_PRESVAL_EN_M  BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_PRESVAL_EN_S  15                                      /* bit# */
+
+#define HOSTCtrl2_ASYINT_EN_M   BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_ASYINT_EN_S   14                                      /* bit# */
+
+#define HOSTCtrl2_SAMPCLK_SEL_M BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_SAMPCLK_SEL_S 7                                       /* bit# */
+
+#define HOSTCtrl2_EXEC_TUNING_M BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_EXEC_TUNING_S 6                                       /* bit# */
+
+#define HOSTCtrl2_DRIVSTRENGTH_SEL_M    BITFIELD_MASK(2)        /* 2 bit */
+#define HOSTCtrl2_DRIVSTRENGTH_SEL_S    4                                       /* bit# */
+
+#define HOSTCtrl2_1_8SIG_EN_M   BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_1_8SIG_EN_S   3                                       /* bit# */
+
+#define HOSTCtrl2_UHSMODE_SEL_M BITFIELD_MASK(3)        /* 3 bit */
+#define HOSTCtrl2_UHSMODE_SEL_S 0                                       /* bit# */
+
+#define HOST_CONTR_VER_2                (1)
+#define HOST_CONTR_VER_3                (2)
+
+/* misc defines */
+#define SD1_MODE                0x1     /* SD Host Cntrlr Spec */
+#define SD4_MODE                0x2     /* SD Host Cntrlr Spec */
+
+/* SD_PwrCntrl: Offset 0x029, size = 1 bytes */
+#define PWR_BUS_EN_M            BITFIELD_MASK(1)        /* Bit 0        Power the bus */
+#define PWR_BUS_EN_S            0
+#define PWR_VOLTS_M             BITFIELD_MASK(3)        /* Bit [1-3]    Voltage Select */
+#define PWR_VOLTS_S             1
+
+/* SD_SoftwareReset: Offset 0x02F, size = 1 byte */
+#define SW_RESET_ALL_M          BITFIELD_MASK(1)        /* Bit 0        Reset All */
+#define SW_RESET_ALL_S          0
+#define SW_RESET_CMD_M          BITFIELD_MASK(1)        /* Bit 1        CMD Line Reset */
+#define SW_RESET_CMD_S          1
+#define SW_RESET_DAT_M          BITFIELD_MASK(1)        /* Bit 2        DAT Line Reset */
+#define SW_RESET_DAT_S          2
+
+/* SD_IntrStatus: Offset 0x030, size = 2 bytes */
+/* Defs also serve SD_IntrStatusEnable and SD_IntrSignalEnable */
+#define INTSTAT_CMD_COMPLETE_M          BITFIELD_MASK(1)        /* Bit 0 */
+#define INTSTAT_CMD_COMPLETE_S          0
+#define INTSTAT_XFER_COMPLETE_M         BITFIELD_MASK(1)
+#define INTSTAT_XFER_COMPLETE_S         1
+#define INTSTAT_BLOCK_GAP_EVENT_M       BITFIELD_MASK(1)
+#define INTSTAT_BLOCK_GAP_EVENT_S       2
+#define INTSTAT_DMA_INT_M               BITFIELD_MASK(1)
+#define INTSTAT_DMA_INT_S               3
+#define INTSTAT_BUF_WRITE_READY_M       BITFIELD_MASK(1)
+#define INTSTAT_BUF_WRITE_READY_S       4
+#define INTSTAT_BUF_READ_READY_M        BITFIELD_MASK(1)
+#define INTSTAT_BUF_READ_READY_S        5
+#define INTSTAT_CARD_INSERTION_M        BITFIELD_MASK(1)
+#define INTSTAT_CARD_INSERTION_S        6
+#define INTSTAT_CARD_REMOVAL_M          BITFIELD_MASK(1)
+#define INTSTAT_CARD_REMOVAL_S          7
+#define INTSTAT_CARD_INT_M              BITFIELD_MASK(1)
+#define INTSTAT_CARD_INT_S              8
+#define INTSTAT_RETUNING_INT_M          BITFIELD_MASK(1)        /* Bit 12 */
+#define INTSTAT_RETUNING_INT_S          12
+#define INTSTAT_ERROR_INT_M             BITFIELD_MASK(1)        /* Bit 15 */
+#define INTSTAT_ERROR_INT_S             15
+
+/* SD_ErrorIntrStatus: Offset 0x032, size = 2 bytes */
+/* Defs also serve SD_ErrorIntrStatusEnable and SD_ErrorIntrSignalEnable */
+#define ERRINT_CMD_TIMEOUT_M            BITFIELD_MASK(1)
+#define ERRINT_CMD_TIMEOUT_S            0
+#define ERRINT_CMD_CRC_M                BITFIELD_MASK(1)
+#define ERRINT_CMD_CRC_S                1
+#define ERRINT_CMD_ENDBIT_M             BITFIELD_MASK(1)
+#define ERRINT_CMD_ENDBIT_S             2
+#define ERRINT_CMD_INDEX_M              BITFIELD_MASK(1)
+#define ERRINT_CMD_INDEX_S              3
+#define ERRINT_DATA_TIMEOUT_M           BITFIELD_MASK(1)
+#define ERRINT_DATA_TIMEOUT_S           4
+#define ERRINT_DATA_CRC_M               BITFIELD_MASK(1)
+#define ERRINT_DATA_CRC_S               5
+#define ERRINT_DATA_ENDBIT_M            BITFIELD_MASK(1)
+#define ERRINT_DATA_ENDBIT_S            6
+#define ERRINT_CURRENT_LIMIT_M          BITFIELD_MASK(1)
+#define ERRINT_CURRENT_LIMIT_S          7
+#define ERRINT_AUTO_CMD12_M             BITFIELD_MASK(1)
+#define ERRINT_AUTO_CMD12_S             8
+#define ERRINT_VENDOR_M                 BITFIELD_MASK(4)
+#define ERRINT_VENDOR_S                 12
+#define ERRINT_ADMA_M                   BITFIELD_MASK(1)
+#define ERRINT_ADMA_S                   9
+
+/* Also provide definitions in "normal" form to allow combined masks */
+#define ERRINT_CMD_TIMEOUT_BIT          0x0001
+#define ERRINT_CMD_CRC_BIT              0x0002
+#define ERRINT_CMD_ENDBIT_BIT           0x0004
+#define ERRINT_CMD_INDEX_BIT            0x0008
+#define ERRINT_DATA_TIMEOUT_BIT         0x0010
+#define ERRINT_DATA_CRC_BIT             0x0020
+#define ERRINT_DATA_ENDBIT_BIT          0x0040
+#define ERRINT_CURRENT_LIMIT_BIT        0x0080
+#define ERRINT_AUTO_CMD12_BIT           0x0100
+#define ERRINT_ADMA_BIT         0x0200
+
+/* Masks to select CMD vs. DATA errors */
+#define ERRINT_CMD_ERRS         (ERRINT_CMD_TIMEOUT_BIT | ERRINT_CMD_CRC_BIT |\
+                                 ERRINT_CMD_ENDBIT_BIT | ERRINT_CMD_INDEX_BIT)
+#define ERRINT_DATA_ERRS        (ERRINT_DATA_TIMEOUT_BIT | ERRINT_DATA_CRC_BIT |\
+                                 ERRINT_DATA_ENDBIT_BIT | ERRINT_ADMA_BIT)
+#define ERRINT_TRANSFER_ERRS    (ERRINT_CMD_ERRS | ERRINT_DATA_ERRS)
+
+/* SD_WakeupCntr_BlockGapCntrl : Offset 0x02A , size = bytes */
+/* SD_ClockCntrl        : Offset 0x02C , size = bytes */
+/* SD_SoftwareReset_TimeoutCntrl        : Offset 0x02E , size = bytes */
+/* SD_IntrStatus        : Offset 0x030 , size = bytes */
+/* SD_ErrorIntrStatus   : Offset 0x032 , size = bytes */
+/* SD_IntrStatusEnable  : Offset 0x034 , size = bytes */
+/* SD_ErrorIntrStatusEnable : Offset 0x036 , size = bytes */
+/* SD_IntrSignalEnable  : Offset 0x038 , size = bytes */
+/* SD_ErrorIntrSignalEnable : Offset 0x03A , size = bytes */
+/* SD_CMD12ErrorStatus  : Offset 0x03C , size = bytes */
+/* SD_Capabilities      : Offset 0x040 , size = bytes */
+/* SD_MaxCurCap         : Offset 0x048 , size = bytes */
+/* SD_MaxCurCap_Reserved: Offset 0x04C , size = bytes */
+/* SD_SlotInterruptStatus: Offset 0x0FC , size = bytes */
+/* SD_HostControllerVersion : Offset 0x0FE , size = bytes */
+
+#endif /* _SDIOH_H */
diff --git a/drivers/net/wireless/bcmdhd/include/sdiovar.h b/drivers/net/wireless/bcmdhd/include/sdiovar.h
new file mode 100644
index 00000000000..2c5bcf97e91
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/sdiovar.h
@@ -0,0 +1,58 @@
+/*
+ * Structure used by apps whose drivers access SDIO drivers.
+ * Pulled out separately so dhdu and wlu can both use it.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sdiovar.h,v 13.9 2009-12-08 22:30:15 Exp $
+ */
+
+#ifndef _sdiovar_h_
+#define _sdiovar_h_
+
+#include <typedefs.h>
+
+/* require default structure packing */
+#define BWL_DEFAULT_PACKING
+#include <packed_section_start.h>
+
+typedef struct sdreg {
+        int func;
+        int offset;
+        int value;
+} sdreg_t;
+
+/* Common msglevel constants */
+#define SDH_ERROR_VAL           0x0001  /* Error */
+#define SDH_TRACE_VAL           0x0002  /* Trace */
+#define SDH_INFO_VAL            0x0004  /* Info */
+#define SDH_DEBUG_VAL           0x0008  /* Debug */
+#define SDH_DATA_VAL            0x0010  /* Data */
+#define SDH_CTRL_VAL            0x0020  /* Control Regs */
+#define SDH_LOG_VAL             0x0040  /* Enable bcmlog */
+#define SDH_DMA_VAL             0x0080  /* DMA */
+
+#define NUM_PREV_TRANSACTIONS   16
+
+
+#include <packed_section_end.h>
+
+#endif /* _sdiovar_h_ */
diff --git a/drivers/net/wireless/bcmdhd/include/siutils.h b/drivers/net/wireless/bcmdhd/include/siutils.h
new file mode 100644
index 00000000000..c5a33832b58
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/siutils.h
@@ -0,0 +1,247 @@
+/*
+ * Misc utility routines for accessing the SOC Interconnects
+ * of Broadcom HNBU chips.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: siutils.h,v 13.251.2.10 2011-02-04 05:06:32 Exp $
+ */
+
+
+#ifndef _siutils_h_
+#define _siutils_h_
+
+
+struct si_pub {
+        uint    socitype;               
+
+        uint    bustype;                
+        uint    buscoretype;            
+        uint    buscorerev;             
+        uint    buscoreidx;             
+        int     ccrev;                  
+        uint32  cccaps;                 
+        uint32  cccaps_ext;                     
+        int     pmurev;                 
+        uint32  pmucaps;                
+        uint    boardtype;              
+        uint    boardvendor;            
+        uint    boardflags;             
+        uint    boardflags2;            
+        uint    chip;                   
+        uint    chiprev;                
+        uint    chippkg;                
+        uint32  chipst;                 
+        bool    issim;                  
+        uint    socirev;                
+        bool    pci_pr32414;
+
+};
+
+
+typedef const struct si_pub si_t;
+
+
+#define SI_OSH          NULL    
+
+#define BADIDX          (SI_MAXCORES + 1)
+
+
+#define XTAL                    0x1     
+#define PLL                     0x2     
+
+
+#define CLK_FAST                0       
+#define CLK_DYNAMIC             2       
+
+
+#define GPIO_DRV_PRIORITY       0       
+#define GPIO_APP_PRIORITY       1       
+#define GPIO_HI_PRIORITY        2       
+
+
+#define GPIO_PULLUP             0
+#define GPIO_PULLDN             1
+
+
+#define GPIO_REGEVT             0       
+#define GPIO_REGEVT_INTMSK      1       
+#define GPIO_REGEVT_INTPOL      2       
+
+
+#define SI_DEVPATH_BUFSZ        16      
+
+
+#define SI_DOATTACH     1
+#define SI_PCIDOWN      2
+#define SI_PCIUP        3
+
+#define ISSIM_ENAB(sih) 0
+
+
+#if defined(BCMPMUCTL)
+#define PMUCTL_ENAB(sih)        (BCMPMUCTL)
+#else
+#define PMUCTL_ENAB(sih)        ((sih)->cccaps & CC_CAP_PMU)
+#endif
+
+
+#if defined(BCMPMUCTL) && BCMPMUCTL
+#define CCCTL_ENAB(sih)         (0)
+#define CCPLL_ENAB(sih)         (0)
+#else
+#define CCCTL_ENAB(sih)         ((sih)->cccaps & CC_CAP_PWR_CTL)
+#define CCPLL_ENAB(sih)         ((sih)->cccaps & CC_CAP_PLL_MASK)
+#endif
+
+typedef void (*gpio_handler_t)(uint32 stat, void *arg);
+
+
+
+extern si_t *si_attach(uint pcidev, osl_t *osh, void *regs, uint bustype,
+                       void *sdh, char **vars, uint *varsz);
+extern si_t *si_kattach(osl_t *osh);
+extern void si_detach(si_t *sih);
+extern bool si_pci_war16165(si_t *sih);
+
+extern uint si_corelist(si_t *sih, uint coreid[]);
+extern uint si_coreid(si_t *sih);
+extern uint si_flag(si_t *sih);
+extern uint si_intflag(si_t *sih);
+extern uint si_coreidx(si_t *sih);
+extern uint si_coreunit(si_t *sih);
+extern uint si_corevendor(si_t *sih);
+extern uint si_corerev(si_t *sih);
+extern void *si_osh(si_t *sih);
+extern void si_setosh(si_t *sih, osl_t *osh);
+extern uint si_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern void *si_coreregs(si_t *sih);
+extern uint si_wrapperreg(si_t *sih, uint32 offset, uint32 mask, uint32 val);
+extern uint32 si_core_cflags(si_t *sih, uint32 mask, uint32 val);
+extern void si_core_cflags_wo(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_core_sflags(si_t *sih, uint32 mask, uint32 val);
+extern bool si_iscoreup(si_t *sih);
+extern uint si_findcoreidx(si_t *sih, uint coreid, uint coreunit);
+extern void *si_setcoreidx(si_t *sih, uint coreidx);
+extern void *si_setcore(si_t *sih, uint coreid, uint coreunit);
+extern void *si_switch_core(si_t *sih, uint coreid, uint *origidx, uint *intr_val);
+extern void si_restore_core(si_t *sih, uint coreid, uint intr_val);
+extern int si_numaddrspaces(si_t *sih);
+extern uint32 si_addrspace(si_t *sih, uint asidx);
+extern uint32 si_addrspacesize(si_t *sih, uint asidx);
+extern int si_corebist(si_t *sih);
+extern void si_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void si_core_disable(si_t *sih, uint32 bits);
+extern uint32 si_clock_rate(uint32 pll_type, uint32 n, uint32 m);
+extern bool si_read_pmu_autopll(si_t *sih);
+extern uint32 si_clock(si_t *sih);
+extern uint32 si_alp_clock(si_t *sih);
+extern uint32 si_ilp_clock(si_t *sih);
+extern void si_pci_setup(si_t *sih, uint coremask);
+extern void si_pcmcia_init(si_t *sih);
+extern void si_setint(si_t *sih, int siflag);
+extern bool si_backplane64(si_t *sih);
+extern void si_register_intr_callback(si_t *sih, void *intrsoff_fn, void *intrsrestore_fn,
+        void *intrsenabled_fn, void *intr_arg);
+extern void si_deregister_intr_callback(si_t *sih);
+extern void si_clkctl_init(si_t *sih);
+extern uint16 si_clkctl_fast_pwrup_delay(si_t *sih);
+extern bool si_clkctl_cc(si_t *sih, uint mode);
+extern int si_clkctl_xtal(si_t *sih, uint what, bool on);
+extern uint32 si_gpiotimerval(si_t *sih, uint32 mask, uint32 val);
+extern void si_btcgpiowar(si_t *sih);
+extern bool si_deviceremoved(si_t *sih);
+extern uint32 si_socram_size(si_t *sih);
+extern uint32 si_socdevram_size(si_t *sih);
+extern void si_socdevram(si_t *sih, bool set, uint8 *ennable, uint8 *protect);
+extern bool si_socdevram_pkg(si_t *sih);
+
+extern void si_watchdog(si_t *sih, uint ticks);
+extern void si_watchdog_ms(si_t *sih, uint32 ms);
+extern void *si_gpiosetcore(si_t *sih);
+extern uint32 si_gpiocontrol(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioouten(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioout(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioin(si_t *sih);
+extern uint32 si_gpiointpolarity(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpiointmask(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioled(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_gpioreserve(si_t *sih, uint32 gpio_num, uint8 priority);
+extern uint32 si_gpiorelease(si_t *sih, uint32 gpio_num, uint8 priority);
+extern uint32 si_gpiopull(si_t *sih, bool updown, uint32 mask, uint32 val);
+extern uint32 si_gpioevent(si_t *sih, uint regtype, uint32 mask, uint32 val);
+extern uint32 si_gpio_int_enable(si_t *sih, bool enable);
+
+
+extern void *si_gpio_handler_register(si_t *sih, uint32 e, bool lev, gpio_handler_t cb, void *arg);
+extern void si_gpio_handler_unregister(si_t *sih, void* gpioh);
+extern void si_gpio_handler_process(si_t *sih);
+
+
+extern bool si_pci_pmecap(si_t *sih);
+struct osl_info;
+extern bool si_pci_fastpmecap(struct osl_info *osh);
+extern bool si_pci_pmestat(si_t *sih);
+extern void si_pci_pmeclr(si_t *sih);
+extern void si_pci_pmeen(si_t *sih);
+extern uint si_pcie_readreg(void *sih, uint addrtype, uint offset);
+
+extern void si_sdio_init(si_t *sih);
+
+extern uint16 si_d11_devid(si_t *sih);
+extern int si_corepciid(si_t *sih, uint func, uint16 *pcivendor, uint16 *pcidevice,
+        uint8 *pciclass, uint8 *pcisubclass, uint8 *pciprogif, uint8 *pciheader);
+
+#define si_eci(sih) 0
+#define si_eci_init(sih) (0)
+#define si_eci_notify_bt(sih, type, val)  (0)
+
+
+
+extern int si_devpath(si_t *sih, char *path, int size);
+
+extern char *si_getdevpathvar(si_t *sih, const char *name);
+extern int si_getdevpathintvar(si_t *sih, const char *name);
+
+
+extern uint8 si_pcieclkreq(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcielcreg(si_t *sih, uint32 mask, uint32 val);
+extern void si_war42780_clkreq(si_t *sih, bool clkreq);
+extern void si_pci_sleep(si_t *sih);
+extern void si_pci_down(si_t *sih);
+extern void si_pci_up(si_t *sih);
+extern void si_pcie_war_ovr_update(si_t *sih, uint8 aspm);
+extern void si_pcie_extendL1timer(si_t *sih, bool extend);
+extern int si_pci_fixcfg(si_t *sih);
+extern uint si_pll_reset(si_t *sih);
+
+
+
+extern bool si_taclear(si_t *sih, bool details);
+
+
+
+extern uint32 si_pciereg(si_t *sih, uint32 offset, uint32 mask, uint32 val, uint type);
+extern uint32 si_pcieserdesreg(si_t *sih, uint32 mdioslave, uint32 offset, uint32 mask, uint32 val);
+
+char *si_getnvramflvar(si_t *sih, const char *name);
+
+#endif  
diff --git a/drivers/net/wireless/bcmdhd/include/trxhdr.h b/drivers/net/wireless/bcmdhd/include/trxhdr.h
new file mode 100644
index 00000000000..397006ab005
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/trxhdr.h
@@ -0,0 +1,52 @@
+/*
+ * TRX image file header format.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: trxhdr.h,v 13.15.108.2 2010-11-15 17:57:30 Exp $
+ */
+
+#ifndef _TRX_HDR_H_
+#define _TRX_HDR_H_
+
+#include <typedefs.h>
+
+#define TRX_MAGIC       0x30524448      /* "HDR0" */
+#define TRX_VERSION     1               /* Version 1 */
+#define TRX_MAX_LEN     0x3B0000        /* Max length */
+#define TRX_NO_HEADER   1               /* Do not write TRX header */
+#define TRX_GZ_FILES    0x2     /* Contains up to TRX_MAX_OFFSET individual gzip files */
+#define TRX_OVERLAYS    0x4     /* Contains an overlay header after the trx header */
+#define TRX_MAX_OFFSET  3               /* Max number of individual files */
+#define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed rtecdc.bin image */
+
+struct trx_header {
+        uint32 magic;           /* "HDR0" */
+        uint32 len;             /* Length of file including header */
+        uint32 crc32;           /* 32-bit CRC from flag_version to end of file */
+        uint32 flag_version;    /* 0:15 flags, 16:31 version */
+        uint32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of header */
+};
+
+/* Compatibility */
+typedef struct trx_header TRXHDR, *PTRXHDR;
+
+#endif /* _TRX_HDR_H_ */
diff --git a/drivers/net/wireless/bcmdhd/include/typedefs.h b/drivers/net/wireless/bcmdhd/include/typedefs.h
new file mode 100644
index 00000000000..228b5dcf11c
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/typedefs.h
@@ -0,0 +1,309 @@
+/*
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ * $Id: typedefs.h,v 1.103.2.1 2010-05-11 18:19:28 Exp $
+ */
+
+
+#ifndef _TYPEDEFS_H_
+#define _TYPEDEFS_H_
+
+#ifdef SITE_TYPEDEFS
+
+
+
+#include "site_typedefs.h"
+
+#else
+
+
+
+#ifdef __cplusplus
+
+#define TYPEDEF_BOOL
+#ifndef FALSE
+#define FALSE   false
+#endif
+#ifndef TRUE
+#define TRUE    true
+#endif
+
+#else   
+
+
+#endif  
+
+#if defined(__x86_64__)
+#define TYPEDEF_UINTPTR
+typedef unsigned long long int uintptr;
+#endif
+
+
+
+
+
+#if defined(_NEED_SIZE_T_)
+typedef long unsigned int size_t;
+#endif
+
+
+
+
+
+#if defined(__sparc__)
+#define TYPEDEF_ULONG
+#endif
+
+
+
+#if !defined(LINUX_HYBRID) || defined(LINUX_PORT)
+#define TYPEDEF_UINT
+#ifndef TARGETENV_android
+#define TYPEDEF_USHORT
+#define TYPEDEF_ULONG
+#endif 
+#ifdef __KERNEL__
+#include <linux/version.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19))
+#define TYPEDEF_BOOL
+#endif  
+
+#if (LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18))
+#include <linux/compiler.h>
+#ifdef noinline_for_stack
+#define TYPEDEF_BOOL
+#endif
+#endif  
+#endif  
+#endif  
+
+
+
+
+
+#if defined(__GNUC__) && defined(__STRICT_ANSI__)
+#define TYPEDEF_INT64
+#define TYPEDEF_UINT64
+#endif
+
+
+#if defined(__ICL)
+
+#define TYPEDEF_INT64
+
+#if defined(__STDC__)
+#define TYPEDEF_UINT64
+#endif
+
+#endif 
+
+#if !defined(__DJGPP__)
+
+
+#if defined(__KERNEL__)
+
+
+#if !defined(LINUX_HYBRID) || defined(LINUX_PORT)
+#include <linux/types.h>        
+#endif 
+
+#else
+
+
+#include <sys/types.h>
+
+#endif 
+
+#endif 
+
+
+
+
+#define USE_TYPEDEF_DEFAULTS
+
+#endif 
+
+
+
+
+#ifdef USE_TYPEDEF_DEFAULTS
+#undef USE_TYPEDEF_DEFAULTS
+
+#ifndef TYPEDEF_BOOL
+typedef  unsigned char  bool;
+#endif
+
+
+
+#ifndef TYPEDEF_UCHAR
+typedef unsigned char   uchar;
+#endif
+
+#ifndef TYPEDEF_USHORT
+typedef unsigned short  ushort;
+#endif
+
+#ifndef TYPEDEF_UINT
+typedef unsigned int    uint;
+#endif
+
+#ifndef TYPEDEF_ULONG
+typedef unsigned long   ulong;
+#endif
+
+
+
+#ifndef TYPEDEF_UINT8
+typedef unsigned char   uint8;
+#endif
+
+#ifndef TYPEDEF_UINT16
+typedef unsigned short  uint16;
+#endif
+
+#ifndef TYPEDEF_UINT32
+typedef unsigned int    uint32;
+#endif
+
+#ifndef TYPEDEF_UINT64
+typedef unsigned long long uint64;
+#endif
+
+#ifndef TYPEDEF_UINTPTR
+typedef unsigned int    uintptr;
+#endif
+
+#ifndef TYPEDEF_INT8
+typedef signed char     int8;
+#endif
+
+#ifndef TYPEDEF_INT16
+typedef signed short    int16;
+#endif
+
+#ifndef TYPEDEF_INT32
+typedef signed int      int32;
+#endif
+
+#ifndef TYPEDEF_INT64
+typedef signed long long int64;
+#endif
+
+
+
+#ifndef TYPEDEF_FLOAT32
+typedef float           float32;
+#endif
+
+#ifndef TYPEDEF_FLOAT64
+typedef double          float64;
+#endif
+
+
+
+#ifndef TYPEDEF_FLOAT_T
+
+#if defined(FLOAT32)
+typedef float32 float_t;
+#else 
+typedef float64 float_t;
+#endif
+
+#endif 
+
+
+
+#ifndef FALSE
+#define FALSE   0
+#endif
+
+#ifndef TRUE
+#define TRUE    1  
+#endif
+
+#ifndef NULL
+#define NULL    0
+#endif
+
+#ifndef OFF
+#define OFF     0
+#endif
+
+#ifndef ON
+#define ON      1  
+#endif
+
+#define AUTO    (-1) 
+
+
+
+#ifndef PTRSZ
+#define PTRSZ   sizeof(char*)
+#endif
+
+
+
+#if defined(__GNUC__)
+        #define BWL_COMPILER_GNU
+#elif defined(__CC_ARM) && __CC_ARM
+        #define BWL_COMPILER_ARMCC
+#else
+        #error "Unknown compiler!"
+#endif 
+
+
+#ifndef INLINE
+        #if defined(BWL_COMPILER_MICROSOFT)
+                #define INLINE __inline
+        #elif defined(BWL_COMPILER_GNU)
+                #define INLINE __inline__
+        #elif defined(BWL_COMPILER_ARMCC)
+                #define INLINE  __inline
+        #else
+                #define INLINE
+        #endif 
+#endif 
+
+#undef TYPEDEF_BOOL
+#undef TYPEDEF_UCHAR
+#undef TYPEDEF_USHORT
+#undef TYPEDEF_UINT
+#undef TYPEDEF_ULONG
+#undef TYPEDEF_UINT8
+#undef TYPEDEF_UINT16
+#undef TYPEDEF_UINT32
+#undef TYPEDEF_UINT64
+#undef TYPEDEF_UINTPTR
+#undef TYPEDEF_INT8
+#undef TYPEDEF_INT16
+#undef TYPEDEF_INT32
+#undef TYPEDEF_INT64
+#undef TYPEDEF_FLOAT32
+#undef TYPEDEF_FLOAT64
+#undef TYPEDEF_FLOAT_T
+
+#endif 
+
+
+#define UNUSED_PARAMETER(x) (void)(x)
+
+
+#include <bcmdefs.h>
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/include/wlfc_proto.h b/drivers/net/wireless/bcmdhd/include/wlfc_proto.h
new file mode 100644
index 00000000000..7230d3b67ab
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/wlfc_proto.h
@@ -0,0 +1,198 @@
+/*
+* Copyright (C) 1999-2011, Broadcom Corporation
+* 
+*         Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2 (the "GPL"),
+* available at http://www.broadcom.com/licenses/GPLv2.php, with the
+* following added to such license:
+* 
+*      As a special exception, the copyright holders of this software give you
+* permission to link this software with independent modules, and to copy and
+* distribute the resulting executable under terms of your choice, provided that
+* you also meet, for each linked independent module, the terms and conditions of
+* the license of that module.  An independent module is a module which is not
+* derived from this software.  The special exception does not apply to any
+* modifications of the software.
+* 
+*      Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a license
+* other than the GPL, without Broadcom's express prior written consent.
+* $Id: wlfc_proto.h,v 1.1.6.2 2010-05-08 01:30:41 Exp $
+*
+*/
+#ifndef __wlfc_proto_definitions_h__
+#define __wlfc_proto_definitions_h__
+
+        /* Use TLV to convey WLFC information.
+         ---------------------------------------------------------------------------
+        | Type |  Len | value                    | Description
+         ---------------------------------------------------------------------------
+        |  1   |   1  | (handle)                 | MAC OPEN
+         ---------------------------------------------------------------------------
+        |  2   |   1  | (handle)                 | MAC CLOSE
+         ---------------------------------------------------------------------------
+        |  3   |   2  | (count, handle, prec_bmp)| Set the credit depth for a MAC dstn
+         ---------------------------------------------------------------------------
+        |  4   |   4  | see pkttag comments      | TXSTATUS
+         ---------------------------------------------------------------------------
+        |  5   |   4  | see pkttag comments      | PKKTTAG [host->firmware]
+         ---------------------------------------------------------------------------
+        |  6   |   8  | (handle, ifid, MAC)      | MAC ADD
+         ---------------------------------------------------------------------------
+        |  7   |   8  | (handle, ifid, MAC)      | MAC DEL
+         ---------------------------------------------------------------------------
+        |  8   |   1  | (rssi)                   | RSSI - RSSI value for the packet.
+         ---------------------------------------------------------------------------
+        |  9   |   1  | (interface ID)           | Interface OPEN
+         ---------------------------------------------------------------------------
+        |  10  |   1  | (interface ID)           | Interface CLOSE
+         ---------------------------------------------------------------------------
+        |  11  |   8  | fifo credit returns map  | FIFO credits back to the host
+        |      |      |                          |
+        |      |      |                          | --------------------------------------
+        |      |      |                          | | ac0 | ac1 | ac2 | ac3 | bcmc | atim |
+        |      |      |                          | --------------------------------------
+        |      |      |                          |
+         ---------------------------------------------------------------------------
+        |  12  |   2  | MAC handle,              | Host provides a bitmap of pending
+        |      |      | AC[0-3] traffic bitmap   | unicast traffic for MAC-handle dstn.
+        |      |      |                          | [host->firmware]
+         ---------------------------------------------------------------------------
+        |  13  |   3  | (count, handle, prec_bmp)| One time request for packet to a specific
+        |      |      |                          | MAC destination.
+         ---------------------------------------------------------------------------
+        | 255  |  N/A |  N/A                     | FILLER - This is a special type
+        |      |      |                          | that has no length or value.
+        |      |      |                          | Typically used for padding.
+         ---------------------------------------------------------------------------
+        */
+
+#define WLFC_CTL_TYPE_MAC_OPEN                          1
+#define WLFC_CTL_TYPE_MAC_CLOSE                         2
+#define WLFC_CTL_TYPE_MAC_REQUEST_CREDIT        3
+#define WLFC_CTL_TYPE_TXSTATUS                          4
+#define WLFC_CTL_TYPE_PKTTAG                            5
+
+#define WLFC_CTL_TYPE_MACDESC_ADD                       6
+#define WLFC_CTL_TYPE_MACDESC_DEL                       7
+#define WLFC_CTL_TYPE_RSSI                                      8
+
+#define WLFC_CTL_TYPE_INTERFACE_OPEN            9
+#define WLFC_CTL_TYPE_INTERFACE_CLOSE           10
+
+#define WLFC_CTL_TYPE_FIFO_CREDITBACK           11
+
+#define WLFC_CTL_TYPE_PENDING_TRAFFIC_BMP       12
+#define WLFC_CTL_TYPE_MAC_REQUEST_PACKET        13
+
+#define WLFC_CTL_TYPE_FILLER                            255
+
+#define WLFC_CTL_VALUE_LEN_MACDESC                      8 /* handle, interface, MAC */
+
+#define WLFC_CTL_VALUE_LEN_MAC          1       /* MAC-handle */
+#define WLFC_CTL_VALUE_LEN_RSSI         1
+
+#define WLFC_CTL_VALUE_LEN_INTERFACE    1
+#define WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP  2
+
+#define WLFC_CTL_VALUE_LEN_TXSTATUS     4
+#define WLFC_CTL_VALUE_LEN_PKTTAG       4
+
+/* enough space to host all 4 ACs, bc/mc and atim fifo credit */
+#define WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK      6
+
+#define WLFC_CTL_VALUE_LEN_REQUEST_CREDIT 3 /* credit, MAC-handle, prec_bitmap */
+#define WLFC_CTL_VALUE_LEN_REQUEST_PACKET 3 /* credit, MAC-handle, prec_bitmap */
+
+
+
+#define WLFC_PKTID_GEN_MASK             0x80000000
+#define WLFC_PKTID_GEN_SHIFT    31
+
+#define WLFC_PKTID_GEN(x)       (((x) & WLFC_PKTID_GEN_MASK) >> WLFC_PKTID_GEN_SHIFT)
+#define WLFC_PKTID_SETGEN(x, gen)       (x) = ((x) & ~WLFC_PKTID_GEN_MASK) | \
+        (((gen) << WLFC_PKTID_GEN_SHIFT) & WLFC_PKTID_GEN_MASK)
+
+#define WLFC_PKTFLAG_PKTFROMHOST        0x01
+#define WLFC_PKTFLAG_PKT_REQUESTED      0x02
+
+#define WL_TXSTATUS_FLAGS_MASK                  0xf /* allow 4 bits only */
+#define WL_TXSTATUS_FLAGS_SHIFT                 27
+
+#define WL_TXSTATUS_SET_FLAGS(x, flags) ((x)  = \
+        ((x) & ~(WL_TXSTATUS_FLAGS_MASK << WL_TXSTATUS_FLAGS_SHIFT)) | \
+        (((flags) & WL_TXSTATUS_FLAGS_MASK) << WL_TXSTATUS_FLAGS_SHIFT))
+#define WL_TXSTATUS_GET_FLAGS(x)                (((x) >> WL_TXSTATUS_FLAGS_SHIFT) & \
+        WL_TXSTATUS_FLAGS_MASK)
+
+#define WL_TXSTATUS_FIFO_MASK                   0x7 /* allow 3 bits for FIFO ID */
+#define WL_TXSTATUS_FIFO_SHIFT                  24
+
+#define WL_TXSTATUS_SET_FIFO(x, flags)  ((x)  = \
+        ((x) & ~(WL_TXSTATUS_FIFO_MASK << WL_TXSTATUS_FIFO_SHIFT)) | \
+        (((flags) & WL_TXSTATUS_FIFO_MASK) << WL_TXSTATUS_FIFO_SHIFT))
+#define WL_TXSTATUS_GET_FIFO(x)         (((x) >> WL_TXSTATUS_FIFO_SHIFT) & WL_TXSTATUS_FIFO_MASK)
+
+#define WL_TXSTATUS_PKTID_MASK                  0xffffff /* allow 24 bits */
+#define WL_TXSTATUS_SET_PKTID(x, num)   ((x) = \
+        ((x) & ~WL_TXSTATUS_PKTID_MASK) | (num))
+#define WL_TXSTATUS_GET_PKTID(x)                ((x) & WL_TXSTATUS_PKTID_MASK)
+
+/* 32 STA should be enough??, 6 bits; Must be power of 2 */
+#define WLFC_MAC_DESC_TABLE_SIZE        32
+#define WLFC_MAX_IFNUM                          16
+#define WLFC_MAC_DESC_ID_INVALID        0xff
+
+/* b[7:5] -reuse guard, b[4:0] -value */
+#define WLFC_MAC_DESC_GET_LOOKUP_INDEX(x) ((x) & 0x1f)
+
+#define WLFC_PKTFLAG_SET_PKTREQUESTED(x)        (x) |= \
+        (WLFC_PKTFLAG_PKT_REQUESTED << WL_TXSTATUS_FLAGS_SHIFT)
+
+#define WLFC_PKTFLAG_CLR_PKTREQUESTED(x)        (x) &= \
+        ~(WLFC_PKTFLAG_PKT_REQUESTED << WL_TXSTATUS_FLAGS_SHIFT)
+
+#define WL_TXSTATUS_GENERATION_MASK                     1
+#define WL_TXSTATUS_GENERATION_SHIFT            31
+
+#define WLFC_PKTFLAG_SET_GENERATION(x, gen)     ((x) = \
+        ((x) & ~(WL_TXSTATUS_GENERATION_MASK << WL_TXSTATUS_GENERATION_SHIFT)) | \
+        (((gen) & WL_TXSTATUS_GENERATION_MASK) << WL_TXSTATUS_GENERATION_SHIFT))
+
+#define WLFC_PKTFLAG_GENERATION(x)      (((x) >> WL_TXSTATUS_GENERATION_SHIFT) & \
+        WL_TXSTATUS_GENERATION_MASK)
+
+#define WLFC_MAX_PENDING_DATALEN        120
+
+/* host is free to discard the packet */
+#define WLFC_CTL_PKTFLAG_DISCARD                0
+/* D11 suppressed a packet */
+#define WLFC_CTL_PKTFLAG_D11SUPPRESS    1
+/* WL firmware suppressed a packet because MAC is 
+        already in PSMode (short time window)
+*/
+#define WLFC_CTL_PKTFLAG_WLSUPPRESS             2
+/* Firmware tossed this packet */
+#define WLFC_CTL_PKTFLAG_TOSSED_BYWLC   3
+
+#define WLFC_D11_STATUS_INTERPRET(txs)  ((((txs)->status & TX_STATUS_SUPR_MASK) >> \
+                TX_STATUS_SUPR_SHIFT)) ? WLFC_CTL_PKTFLAG_D11SUPPRESS : WLFC_CTL_PKTFLAG_DISCARD
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define WLFC_DBGMESG(x) printf x
+/* wlfc-breadcrumb */
+#define WLFC_BREADCRUMB(x) do {if ((x) == NULL) \
+        {printf("WLFC: %s():%d:caller:%p\n", \
+        __FUNCTION__, __LINE__, __builtin_return_address(0));}} while (0)
+#define WLFC_PRINTMAC(banner, ea) do {printf("%s MAC: [%02x:%02x:%02x:%02x:%02x:%02x]\n", \
+        banner, ea[0],  ea[1],  ea[2],  ea[3],  ea[4],  ea[5]); } while (0)
+#define WLFC_WHEREIS(s) printf("WLFC: at %s():%d, %s\n", __FUNCTION__, __LINE__, (s))
+#else
+#define WLFC_DBGMESG(x)
+#define WLFC_BREADCRUMB(x)
+#define WLFC_PRINTMAC(banner, ea)
+#define WLFC_WHEREIS(s)
+#endif
+
+#endif /* __wlfc_proto_definitions_h__ */
diff --git a/drivers/net/wireless/bcmdhd/include/wlioctl.h b/drivers/net/wireless/bcmdhd/include/wlioctl.h
new file mode 100644
index 00000000000..9357552c919
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/include/wlioctl.h
@@ -0,0 +1,2757 @@
+/*
+ * Custom OID/ioctl definitions for
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wlioctl.h,v 1.767.2.38 2011-02-01 23:04:28 Exp $
+ */
+
+
+#ifndef _wlioctl_h_
+#define _wlioctl_h_
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+#include <proto/bcmeth.h>
+#include <proto/bcmevent.h>
+#include <proto/802.11.h>
+#include <bcmwifi.h>
+
+#include <bcmcdc.h>
+
+#ifndef INTF_NAME_SIZ
+#define INTF_NAME_SIZ   16
+#endif
+
+
+typedef struct remote_ioctl {
+        cdc_ioctl_t     msg;
+        uint        data_len;
+        char            intf_name[INTF_NAME_SIZ];
+} rem_ioctl_t;
+#define REMOTE_SIZE sizeof(rem_ioctl_t)
+
+#define ACTION_FRAME_SIZE 1040
+
+typedef struct wl_action_frame {
+        struct ether_addr   da;
+        uint16          len;
+        uint32          packetId;
+        uint8           data[ACTION_FRAME_SIZE];
+} wl_action_frame_t;
+
+#define WL_WIFI_ACTION_FRAME_SIZE sizeof(struct wl_action_frame)
+
+typedef struct ssid_info
+{
+        uint8           ssid_len;
+        uint8           ssid[32];
+} ssid_info_t;
+
+typedef struct wl_af_params {
+        uint32          channel;
+        int32           dwell_time;
+        struct ether_addr   BSSID;
+        wl_action_frame_t   action_frame;
+} wl_af_params_t;
+
+#define WL_WIFI_AF_PARAMS_SIZE sizeof(struct wl_af_params)
+
+
+#define BWL_DEFAULT_PACKING
+#include <packed_section_start.h>
+
+
+
+
+
+#define LEGACY2_WL_BSS_INFO_VERSION 108     
+
+
+typedef struct wl_bss_info_108 {
+        uint32      version;        
+        uint32      length;         
+        struct ether_addr BSSID;
+        uint16      beacon_period;      
+        uint16      capability;     
+        uint8       SSID_len;
+        uint8       SSID[32];
+        struct {
+                uint    count;          
+                uint8   rates[16];      
+        } rateset;              
+        chanspec_t  chanspec;       
+        uint16      atim_window;        
+        uint8       dtim_period;        
+        int16       RSSI;           
+        int8        phy_noise;      
+
+        uint8       n_cap;          
+        uint32      nbss_cap;       
+        uint8       ctl_ch;         
+        uint32      reserved32[1];      
+        uint8       flags;          
+        uint8       reserved[3];        
+        uint8       basic_mcs[MCSSET_LEN];  
+
+        uint16      ie_offset;      
+        uint32      ie_length;      
+        
+        
+} wl_bss_info_108_t;
+
+#define WL_BSS_INFO_VERSION 109     
+
+
+typedef struct wl_bss_info {
+        uint32      version;        
+        uint32      length;         
+        struct ether_addr BSSID;
+        uint16      beacon_period;      
+        uint16      capability;     
+        uint8       SSID_len;
+        uint8       SSID[32];
+        struct {
+                uint    count;          
+                uint8   rates[16];      
+        } rateset;              
+        chanspec_t  chanspec;       
+        uint16      atim_window;        
+        uint8       dtim_period;        
+        int16       RSSI;           
+        int8        phy_noise;      
+
+        uint8       n_cap;          
+        uint32      nbss_cap;       
+        uint8       ctl_ch;         
+        uint32      reserved32[1];      
+        uint8       flags;          
+        uint8       reserved[3];        
+        uint8       basic_mcs[MCSSET_LEN];  
+
+        uint16      ie_offset;      
+        uint32      ie_length;      
+        int16       SNR;            
+        
+        
+} wl_bss_info_t;
+
+typedef struct wl_bsscfg {
+        uint32  wsec;
+        uint32  WPA_auth;
+        uint32  wsec_index;
+        uint32  associated;
+        uint32  BSS;
+        uint32  phytest_on;
+        struct ether_addr   prev_BSSID;
+        struct ether_addr   BSSID;
+} wl_bsscfg_t;
+
+typedef struct wl_bss_config {
+        uint32  atim_window;
+        uint32  beacon_period;
+        uint32  chanspec;
+} wl_bss_config_t;
+
+
+typedef struct wlc_ssid {
+        uint32      SSID_len;
+        uchar       SSID[32];
+} wlc_ssid_t;
+
+
+#define WL_BSSTYPE_INFRA 1
+#define WL_BSSTYPE_INDEP 0
+#define WL_BSSTYPE_ANY   2
+
+
+#define WL_SCANFLAGS_PASSIVE 0x01       
+#define WL_SCANFLAGS_RESERVED 0x02      
+#define WL_SCANFLAGS_PROHIBITED 0x04    
+
+#define WL_SCAN_PARAMS_SSID_MAX         10
+typedef struct wl_scan_params {
+        wlc_ssid_t ssid;        
+        struct ether_addr bssid;    
+        int8 bss_type;          
+        uint8 scan_type;        
+        int32 nprobes;          
+        int32 active_time;      
+        int32 passive_time;     
+        int32 home_time;        
+        int32 channel_num;      
+        uint16 channel_list[1];     
+} wl_scan_params_t;
+
+
+#define WL_SCAN_PARAMS_FIXED_SIZE 64
+
+
+#define WL_SCAN_PARAMS_COUNT_MASK 0x0000ffff
+#define WL_SCAN_PARAMS_NSSID_SHIFT 16
+
+#define WL_SCAN_ACTION_START      1
+#define WL_SCAN_ACTION_CONTINUE   2
+#define WL_SCAN_ACTION_ABORT      3
+
+#define ISCAN_REQ_VERSION 1
+
+
+typedef struct wl_iscan_params {
+        uint32 version;
+        uint16 action;
+        uint16 scan_duration;
+        wl_scan_params_t params;
+} wl_iscan_params_t;
+
+
+#define WL_ISCAN_PARAMS_FIXED_SIZE (OFFSETOF(wl_iscan_params_t, params) + sizeof(wlc_ssid_t))
+
+typedef struct wl_scan_results {
+        uint32 buflen;
+        uint32 version;
+        uint32 count;
+        wl_bss_info_t bss_info[1];
+} wl_scan_results_t;
+
+
+#define WL_SCAN_RESULTS_FIXED_SIZE (sizeof(wl_scan_results_t) - sizeof(wl_bss_info_t))
+
+
+#define WL_SCAN_RESULTS_SUCCESS 0
+#define WL_SCAN_RESULTS_PARTIAL 1
+#define WL_SCAN_RESULTS_PENDING 2
+#define WL_SCAN_RESULTS_ABORTED 3
+#define WL_SCAN_RESULTS_NO_MEM  4
+
+
+#define DNGL_RXCTXT_SIZE        45
+
+#if defined(SIMPLE_ISCAN)
+#define ISCAN_RETRY_CNT   5
+#define ISCAN_STATE_IDLE   0
+#define ISCAN_STATE_SCANING 1
+#define ISCAN_STATE_PENDING 2
+
+
+#define WLC_IW_ISCAN_MAXLEN   2048
+typedef struct iscan_buf {
+        struct iscan_buf * next;
+        char   iscan_buf[WLC_IW_ISCAN_MAXLEN];
+} iscan_buf_t;
+#endif 
+
+#define ESCAN_REQ_VERSION 1
+
+typedef struct wl_escan_params {
+        uint32 version;
+        uint16 action;
+        uint16 sync_id;
+        wl_scan_params_t params;
+} wl_escan_params_t;
+
+#define WL_ESCAN_PARAMS_FIXED_SIZE (OFFSETOF(wl_escan_params_t, params) + sizeof(wlc_ssid_t))
+
+typedef struct wl_escan_result {
+        uint32 buflen;
+        uint32 version;
+        uint16 sync_id;
+        uint16 bss_count;
+        wl_bss_info_t bss_info[1];
+} wl_escan_result_t;
+
+#define WL_ESCAN_RESULTS_FIXED_SIZE (sizeof(wl_escan_result_t) - sizeof(wl_bss_info_t))
+
+
+typedef struct wl_iscan_results {
+        uint32 status;
+        wl_scan_results_t results;
+} wl_iscan_results_t;
+
+
+#define WL_ISCAN_RESULTS_FIXED_SIZE \
+        (WL_SCAN_RESULTS_FIXED_SIZE + OFFSETOF(wl_iscan_results_t, results))
+
+typedef struct wl_probe_params {
+        wlc_ssid_t ssid;
+        struct ether_addr bssid;
+        struct ether_addr mac;
+} wl_probe_params_t;
+
+#define WL_NUMRATES     16  
+typedef struct wl_rateset {
+        uint32  count;          
+        uint8   rates[WL_NUMRATES]; 
+} wl_rateset_t;
+
+typedef struct wl_rateset_args {
+        uint32  count;          
+        uint8   rates[WL_NUMRATES]; 
+        uint8   mcs[MCSSET_LEN];        
+} wl_rateset_args_t;
+
+
+typedef struct wl_uint32_list {
+        
+        uint32 count;
+        
+        uint32 element[1];
+} wl_uint32_list_t;
+
+
+typedef struct wl_assoc_params {
+        struct ether_addr bssid;    
+        uint16 bssid_cnt;       
+        int32 chanspec_num;     
+        chanspec_t chanspec_list[1];    
+} wl_assoc_params_t;
+#define WL_ASSOC_PARAMS_FIXED_SIZE  (sizeof(wl_assoc_params_t) - sizeof(chanspec_t))
+
+
+typedef wl_assoc_params_t wl_reassoc_params_t;
+#define WL_REASSOC_PARAMS_FIXED_SIZE    WL_ASSOC_PARAMS_FIXED_SIZE
+
+
+typedef wl_assoc_params_t wl_join_assoc_params_t;
+#define WL_JOIN_ASSOC_PARAMS_FIXED_SIZE        WL_ASSOC_PARAMS_FIXED_SIZE
+
+
+typedef struct wl_join_params {
+        wlc_ssid_t ssid;
+        wl_assoc_params_t params;   
+} wl_join_params_t;
+#define WL_JOIN_PARAMS_FIXED_SIZE   (sizeof(wl_join_params_t) - sizeof(chanspec_t))
+
+
+typedef struct wl_join_scan_params {
+        uint8 scan_type;                
+        int32 nprobes;                  
+        int32 active_time;              
+        int32 passive_time;             
+        int32 home_time;                
+} wl_join_scan_params_t;
+
+
+typedef struct wl_extjoin_params {
+        wlc_ssid_t ssid;                
+        wl_join_scan_params_t scan;
+        wl_join_assoc_params_t assoc;   
+} wl_extjoin_params_t;
+#define WL_EXTJOIN_PARAMS_FIXED_SIZE    (sizeof(wl_extjoin_params_t) - sizeof(chanspec_t))
+
+typedef struct {
+        uint32 num;
+        chanspec_t list[1];
+} chanspec_list_t;
+
+
+#define NRATE_MCS_INUSE 0x00000080  
+#define NRATE_RATE_MASK 0x0000007f  
+#define NRATE_STF_MASK  0x0000ff00  
+#define NRATE_STF_SHIFT 8       
+#define NRATE_OVERRIDE  0x80000000  
+#define NRATE_OVERRIDE_MCS_ONLY 0x40000000 
+#define NRATE_SGI_MASK  0x00800000      
+#define NRATE_SGI_SHIFT 23              
+#define NRATE_LDPC_CODING 0x00400000    
+#define NRATE_LDPC_SHIFT 22             
+
+#define NRATE_STF_SISO  0       
+#define NRATE_STF_CDD   1       
+#define NRATE_STF_STBC  2       
+#define NRATE_STF_SDM   3       
+
+#define ANTENNA_NUM_1   1       
+#define ANTENNA_NUM_2   2
+#define ANTENNA_NUM_3   3
+#define ANTENNA_NUM_4   4
+
+#define ANT_SELCFG_AUTO     0x80    
+#define ANT_SELCFG_MASK     0x33    
+#define ANT_SELCFG_MAX      4   
+#define ANT_SELCFG_TX_UNICAST   0   
+#define ANT_SELCFG_RX_UNICAST   1   
+#define ANT_SELCFG_TX_DEF   2   
+#define ANT_SELCFG_RX_DEF   3   
+
+#define MAX_STREAMS_SUPPORTED   4   
+
+typedef struct {
+        uint8 ant_config[ANT_SELCFG_MAX];   
+        uint8 num_antcfg;   
+} wlc_antselcfg_t;
+
+#define HIGHEST_SINGLE_STREAM_MCS   7 
+
+#define MAX_CCA_CHANNELS 38 
+#define MAX_CCA_SECS     60 
+
+#define IBSS_MED        15  
+#define IBSS_HI         25  
+#define OBSS_MED        12
+#define OBSS_HI         25
+#define INTERFER_MED    5
+#define INTERFER_HI     10
+
+#define  CCA_FLAG_2G_ONLY       0x01    
+#define  CCA_FLAG_5G_ONLY       0x02    
+#define  CCA_FLAG_IGNORE_DURATION   0x04    
+#define  CCA_FLAGS_PREFER_1_6_11    0x10
+#define  CCA_FLAG_IGNORE_INTERFER   0x20 
+
+#define CCA_ERRNO_BAND      1   
+#define CCA_ERRNO_DURATION  2   
+#define CCA_ERRNO_PREF_CHAN 3   
+#define CCA_ERRNO_INTERFER  4   
+#define CCA_ERRNO_TOO_FEW   5   
+
+typedef struct {
+        uint32 duration;    
+        uint32 congest_ibss;    
+                                
+        uint32 congest_obss;    
+        uint32 interference;    
+        uint32 timestamp;   
+} cca_congest_t;
+
+typedef struct {
+        chanspec_t chanspec;    
+        uint8 num_secs;     
+        cca_congest_t  secs[1]; 
+} cca_congest_channel_req_t;
+
+#define WLC_CNTRY_BUF_SZ    4       
+
+typedef struct wl_country {
+        char country_abbrev[WLC_CNTRY_BUF_SZ];  
+        int32 rev;              
+        char ccode[WLC_CNTRY_BUF_SZ];       
+} wl_country_t;
+
+typedef struct wl_channels_in_country {
+        uint32 buflen;
+        uint32 band;
+        char country_abbrev[WLC_CNTRY_BUF_SZ];
+        uint32 count;
+        uint32 channel[1];
+} wl_channels_in_country_t;
+
+typedef struct wl_country_list {
+        uint32 buflen;
+        uint32 band_set;
+        uint32 band;
+        uint32 count;
+        char country_abbrev[1];
+} wl_country_list_t;
+
+#define WL_NUM_RPI_BINS     8
+#define WL_RM_TYPE_BASIC    1
+#define WL_RM_TYPE_CCA      2
+#define WL_RM_TYPE_RPI      3
+
+#define WL_RM_FLAG_PARALLEL (1<<0)
+
+#define WL_RM_FLAG_LATE     (1<<1)
+#define WL_RM_FLAG_INCAPABLE    (1<<2)
+#define WL_RM_FLAG_REFUSED  (1<<3)
+
+typedef struct wl_rm_req_elt {
+        int8    type;
+        int8    flags;
+        chanspec_t  chanspec;
+        uint32  token;      
+        uint32  tsf_h;      
+        uint32  tsf_l;      
+        uint32  dur;        
+} wl_rm_req_elt_t;
+
+typedef struct wl_rm_req {
+        uint32  token;      
+        uint32  count;      
+        void    *cb;        
+        void    *cb_arg;    
+        wl_rm_req_elt_t req[1]; 
+} wl_rm_req_t;
+#define WL_RM_REQ_FIXED_LEN OFFSETOF(wl_rm_req_t, req)
+
+typedef struct wl_rm_rep_elt {
+        int8    type;
+        int8    flags;
+        chanspec_t  chanspec;
+        uint32  token;      
+        uint32  tsf_h;      
+        uint32  tsf_l;      
+        uint32  dur;        
+        uint32  len;        
+        uint8   data[1];    
+} wl_rm_rep_elt_t;
+#define WL_RM_REP_ELT_FIXED_LEN 24  
+
+#define WL_RPI_REP_BIN_NUM 8
+typedef struct wl_rm_rpi_rep {
+        uint8   rpi[WL_RPI_REP_BIN_NUM];
+        int8    rpi_max[WL_RPI_REP_BIN_NUM];
+} wl_rm_rpi_rep_t;
+
+typedef struct wl_rm_rep {
+        uint32  token;      
+        uint32  len;        
+        wl_rm_rep_elt_t rep[1]; 
+} wl_rm_rep_t;
+#define WL_RM_REP_FIXED_LEN 8
+
+
+typedef enum sup_auth_status {
+        
+        WLC_SUP_DISCONNECTED = 0,
+        WLC_SUP_CONNECTING,
+        WLC_SUP_IDREQUIRED,
+        WLC_SUP_AUTHENTICATING,
+        WLC_SUP_AUTHENTICATED,
+        WLC_SUP_KEYXCHANGE,
+        WLC_SUP_KEYED,
+        WLC_SUP_TIMEOUT,
+        WLC_SUP_LAST_BASIC_STATE,
+
+        
+        
+        WLC_SUP_KEYXCHANGE_WAIT_M1 = WLC_SUP_AUTHENTICATED,
+        
+        WLC_SUP_KEYXCHANGE_PREP_M2 = WLC_SUP_KEYXCHANGE,
+        
+        WLC_SUP_KEYXCHANGE_WAIT_M3 = WLC_SUP_LAST_BASIC_STATE,
+        WLC_SUP_KEYXCHANGE_PREP_M4, 
+        WLC_SUP_KEYXCHANGE_WAIT_G1, 
+        WLC_SUP_KEYXCHANGE_PREP_G2  
+} sup_auth_status_t;
+
+
+#define CRYPTO_ALGO_OFF         0
+#define CRYPTO_ALGO_WEP1        1
+#define CRYPTO_ALGO_TKIP        2
+#define CRYPTO_ALGO_WEP128      3
+#define CRYPTO_ALGO_AES_CCM     4
+#define CRYPTO_ALGO_AES_OCB_MSDU    5
+#define CRYPTO_ALGO_AES_OCB_MPDU    6
+#define CRYPTO_ALGO_NALG        7
+#define CRYPTO_ALGO_PMK                 12
+
+#define WSEC_GEN_MIC_ERROR  0x0001
+#define WSEC_GEN_REPLAY     0x0002
+#define WSEC_GEN_ICV_ERROR  0x0004
+
+#define WL_SOFT_KEY (1 << 0)    
+#define WL_PRIMARY_KEY  (1 << 1)    
+#define WL_KF_RES_4 (1 << 4)    
+#define WL_KF_RES_5 (1 << 5)    
+#define WL_IBSS_PEER_GROUP_KEY  (1 << 6)    
+
+typedef struct wl_wsec_key {
+        uint32      index;      
+        uint32      len;        
+        uint8       data[DOT11_MAX_KEY_SIZE];   
+        uint32      pad_1[18];
+        uint32      algo;       
+        uint32      flags;      
+        uint32      pad_2[2];
+        int     pad_3;
+        int     iv_initialized; 
+        int     pad_4;
+        
+        struct {
+                uint32  hi;     
+                uint16  lo;     
+        } rxiv;
+        uint32      pad_5[2];
+        struct ether_addr ea;       
+} wl_wsec_key_t;
+
+#define WSEC_MIN_PSK_LEN    8
+#define WSEC_MAX_PSK_LEN    64
+
+
+#define WSEC_PASSPHRASE     (1<<0)
+
+
+typedef struct {
+        ushort  key_len;        
+        ushort  flags;          
+        uint8   key[WSEC_MAX_PSK_LEN];  
+} wsec_pmk_t;
+
+
+#define WEP_ENABLED     0x0001
+#define TKIP_ENABLED        0x0002
+#define AES_ENABLED     0x0004
+#define WSEC_SWFLAG     0x0008
+#define SES_OW_ENABLED      0x0040  
+
+
+#define WPA_AUTH_DISABLED   0x0000  
+#define WPA_AUTH_NONE       0x0001  
+#define WPA_AUTH_UNSPECIFIED    0x0002  
+#define WPA_AUTH_PSK        0x0004  
+ 
+#define WPA2_AUTH_UNSPECIFIED   0x0040  
+#define WPA2_AUTH_PSK       0x0080  
+#define BRCM_AUTH_PSK           0x0100  
+#define BRCM_AUTH_DPT       0x0200  
+#define WPA2_AUTH_MFP           0x1000
+#define WPA2_AUTH_TPK           0x2000
+#define WPA2_AUTH_FT            0x4000
+
+
+#define MAXPMKID        16
+
+typedef struct _pmkid {
+        struct ether_addr   BSSID;
+        uint8           PMKID[WPA2_PMKID_LEN];
+} pmkid_t;
+
+typedef struct _pmkid_list {
+        uint32  npmkid;
+        pmkid_t pmkid[1];
+} pmkid_list_t;
+
+typedef struct _pmkid_cand {
+        struct ether_addr   BSSID;
+        uint8           preauth;
+} pmkid_cand_t;
+
+typedef struct _pmkid_cand_list {
+        uint32  npmkid_cand;
+        pmkid_cand_t    pmkid_cand[1];
+} pmkid_cand_list_t;
+
+typedef struct wl_assoc_info {
+        uint32      req_len;
+        uint32      resp_len;
+        uint32      flags;
+        struct dot11_assoc_req req;
+        struct ether_addr reassoc_bssid;
+        struct dot11_assoc_resp resp;
+} wl_assoc_info_t;
+
+
+#define WLC_ASSOC_REQ_IS_REASSOC 0x01
+
+
+typedef struct {
+        uint16          ver;        
+        uint16          len;        
+        uint16          cap;        
+        uint32          flags;      
+        uint32          idle;       
+        struct ether_addr   ea;     
+        wl_rateset_t        rateset;    
+        uint32          in;     
+        uint32          listen_interval_inms; 
+        uint32          tx_pkts;    
+        uint32          tx_failures;    
+        uint32          rx_ucast_pkts;  
+        uint32          rx_mcast_pkts;  
+        uint32          tx_rate;    
+        uint32          rx_rate;    
+        uint32          rx_decrypt_succeeds;    
+        uint32          rx_decrypt_failures;    
+} sta_info_t;
+
+#define WL_OLD_STAINFO_SIZE OFFSETOF(sta_info_t, tx_pkts)
+
+#define WL_STA_VER      3
+
+
+#define WL_STA_BRCM     0x1     
+#define WL_STA_WME      0x2     
+#define WL_STA_ABCAP        0x4
+#define WL_STA_AUTHE        0x8     
+#define WL_STA_ASSOC        0x10        
+#define WL_STA_AUTHO        0x20        
+#define WL_STA_WDS      0x40        
+#define WL_STA_WDS_LINKUP   0x80        
+#define WL_STA_PS       0x100       
+#define WL_STA_APSD_BE      0x200       
+#define WL_STA_APSD_BK      0x400       
+#define WL_STA_APSD_VI      0x800       
+#define WL_STA_APSD_VO      0x1000      
+#define WL_STA_N_CAP        0x2000      
+#define WL_STA_SCBSTATS     0x4000      
+
+#define WL_WDS_LINKUP       WL_STA_WDS_LINKUP   
+
+
+#define WLC_TXFILTER_OVERRIDE_DISABLED  0
+#define WLC_TXFILTER_OVERRIDE_ENABLED   1
+
+
+typedef struct {
+        uint32  val;
+        struct ether_addr ea;
+} scb_val_t;
+
+
+typedef struct {
+        uint32 code;
+        scb_val_t ioctl_args;
+} authops_t;
+
+
+typedef struct channel_info {
+        int hw_channel;
+        int target_channel;
+        int scan_channel;
+} channel_info_t;
+
+
+struct maclist {
+        uint count;         
+        struct ether_addr ea[1];    
+};
+
+
+typedef struct get_pktcnt {
+        uint rx_good_pkt;
+        uint rx_bad_pkt;
+        uint tx_good_pkt;
+        uint tx_bad_pkt;
+        uint rx_ocast_good_pkt; 
+} get_pktcnt_t;
+
+#define WL_IOCTL_ACTION_GET                             0x0
+#define WL_IOCTL_ACTION_SET                             0x1
+#define WL_IOCTL_ACTION_OVL_IDX_MASK    0x1e
+#define WL_IOCTL_ACTION_OVL_RSV                 0x20
+#define WL_IOCTL_ACTION_OVL                             0x40
+#define WL_IOCTL_ACTION_MASK                    0x7e
+#define WL_IOCTL_ACTION_OVL_SHIFT               1
+
+
+typedef struct wl_ioctl {
+        uint cmd;   
+        void *buf;  
+        uint len;   
+        uint8 set;              
+        uint used;  
+        uint needed;    
+} wl_ioctl_t;
+
+
+#define ioctl_subtype   set     
+#define ioctl_pid   used        
+#define ioctl_status    needed      
+
+
+typedef struct wlc_rev_info {
+        uint        vendorid;   
+        uint        deviceid;   
+        uint        radiorev;   
+        uint        chiprev;    
+        uint        corerev;    
+        uint        boardid;    
+        uint        boardvendor;    
+        uint        boardrev;   
+        uint        driverrev;  
+        uint        ucoderev;   
+        uint        bus;        
+        uint        chipnum;    
+        uint        phytype;    
+        uint        phyrev;     
+        uint        anarev;     
+        uint        chippkg;    
+} wlc_rev_info_t;
+
+#define WL_REV_INFO_LEGACY_LENGTH   48
+
+#define WL_BRAND_MAX 10
+typedef struct wl_instance_info {
+        uint instance;
+        char brand[WL_BRAND_MAX];
+} wl_instance_info_t;
+
+
+typedef struct wl_txfifo_sz {
+        uint16  magic;
+        uint16  fifo;
+        uint16  size;
+} wl_txfifo_sz_t;
+
+#define WL_TXFIFO_SZ_MAGIC  0xa5a5
+
+
+
+#define WLC_IOV_NAME_LEN 30
+typedef struct wlc_iov_trx_s {
+        uint8 module;
+        uint8 type;
+        char name[WLC_IOV_NAME_LEN];
+} wlc_iov_trx_t;
+
+
+#define WLC_IOCTL_MAGIC     0x14e46c77
+
+
+#define WLC_IOCTL_VERSION   1
+
+#define WLC_IOCTL_MAXLEN        8192    
+#define WLC_IOCTL_SMLEN         256 
+#define WLC_IOCTL_MEDLEN        1536    
+#ifdef WLC_HIGH_ONLY
+#define WLC_SAMPLECOLLECT_MAXLEN    1024    
+#else
+#define WLC_SAMPLECOLLECT_MAXLEN    10240   
+#endif 
+
+
+#define WLC_GET_MAGIC               0
+#define WLC_GET_VERSION             1
+#define WLC_UP                  2
+#define WLC_DOWN                3
+#define WLC_GET_LOOP                4
+#define WLC_SET_LOOP                5
+#define WLC_DUMP                6
+#define WLC_GET_MSGLEVEL            7
+#define WLC_SET_MSGLEVEL            8
+#define WLC_GET_PROMISC             9
+#define WLC_SET_PROMISC             10
+#define WLC_OVERLAY_IOCTL           11
+#define WLC_GET_RATE                12
+ 
+#define WLC_GET_INSTANCE            14
+ 
+ 
+ 
+ 
+#define WLC_GET_INFRA               19
+#define WLC_SET_INFRA               20
+#define WLC_GET_AUTH                21
+#define WLC_SET_AUTH                22
+#define WLC_GET_BSSID               23
+#define WLC_SET_BSSID               24
+#define WLC_GET_SSID                25
+#define WLC_SET_SSID                26
+#define WLC_RESTART             27
+ 
+#define WLC_GET_CHANNEL             29
+#define WLC_SET_CHANNEL             30
+#define WLC_GET_SRL             31
+#define WLC_SET_SRL             32
+#define WLC_GET_LRL             33
+#define WLC_SET_LRL             34
+#define WLC_GET_PLCPHDR             35
+#define WLC_SET_PLCPHDR             36
+#define WLC_GET_RADIO               37
+#define WLC_SET_RADIO               38
+#define WLC_GET_PHYTYPE             39
+#define WLC_DUMP_RATE               40
+#define WLC_SET_RATE_PARAMS         41
+#define WLC_GET_FIXRATE             42
+#define WLC_SET_FIXRATE             43
+ 
+ 
+#define WLC_GET_KEY             44
+#define WLC_SET_KEY             45
+#define WLC_GET_REGULATORY          46
+#define WLC_SET_REGULATORY          47
+#define WLC_GET_PASSIVE_SCAN            48
+#define WLC_SET_PASSIVE_SCAN            49
+#define WLC_SCAN                50
+#define WLC_SCAN_RESULTS            51
+#define WLC_DISASSOC                52
+#define WLC_REASSOC             53
+#define WLC_GET_ROAM_TRIGGER            54
+#define WLC_SET_ROAM_TRIGGER            55
+#define WLC_GET_ROAM_DELTA          56
+#define WLC_SET_ROAM_DELTA          57
+#define WLC_GET_ROAM_SCAN_PERIOD        58
+#define WLC_SET_ROAM_SCAN_PERIOD        59
+#define WLC_EVM                 60  
+#define WLC_GET_TXANT               61
+#define WLC_SET_TXANT               62
+#define WLC_GET_ANTDIV              63
+#define WLC_SET_ANTDIV              64
+ 
+ 
+#define WLC_GET_CLOSED              67
+#define WLC_SET_CLOSED              68
+#define WLC_GET_MACLIST             69
+#define WLC_SET_MACLIST             70
+#define WLC_GET_RATESET             71
+#define WLC_SET_RATESET             72
+ 
+#define WLC_LONGTRAIN               74
+#define WLC_GET_BCNPRD              75
+#define WLC_SET_BCNPRD              76
+#define WLC_GET_DTIMPRD             77
+#define WLC_SET_DTIMPRD             78
+#define WLC_GET_SROM                79
+#define WLC_SET_SROM                80
+#define WLC_GET_WEP_RESTRICT            81
+#define WLC_SET_WEP_RESTRICT            82
+#define WLC_GET_COUNTRY             83
+#define WLC_SET_COUNTRY             84
+#define WLC_GET_PM              85
+#define WLC_SET_PM              86
+#define WLC_GET_WAKE                87
+#define WLC_SET_WAKE                88
+ 
+#define WLC_GET_FORCELINK           90  
+#define WLC_SET_FORCELINK           91  
+#define WLC_FREQ_ACCURACY           92  
+#define WLC_CARRIER_SUPPRESS            93  
+#define WLC_GET_PHYREG              94
+#define WLC_SET_PHYREG              95
+#define WLC_GET_RADIOREG            96
+#define WLC_SET_RADIOREG            97
+#define WLC_GET_REVINFO             98
+#define WLC_GET_UCANTDIV            99
+#define WLC_SET_UCANTDIV            100
+#define WLC_R_REG               101
+#define WLC_W_REG               102
+
+ 
+#define WLC_GET_MACMODE             105
+#define WLC_SET_MACMODE             106
+#define WLC_GET_MONITOR             107
+#define WLC_SET_MONITOR             108
+#define WLC_GET_GMODE               109
+#define WLC_SET_GMODE               110
+#define WLC_GET_LEGACY_ERP          111
+#define WLC_SET_LEGACY_ERP          112
+#define WLC_GET_RX_ANT              113
+#define WLC_GET_CURR_RATESET            114 
+#define WLC_GET_SCANSUPPRESS            115
+#define WLC_SET_SCANSUPPRESS            116
+#define WLC_GET_AP              117
+#define WLC_SET_AP              118
+#define WLC_GET_EAP_RESTRICT            119
+#define WLC_SET_EAP_RESTRICT            120
+#define WLC_SCB_AUTHORIZE           121
+#define WLC_SCB_DEAUTHORIZE         122
+#define WLC_GET_WDSLIST             123
+#define WLC_SET_WDSLIST             124
+#define WLC_GET_ATIM                125
+#define WLC_SET_ATIM                126
+#define WLC_GET_RSSI                127
+#define WLC_GET_PHYANTDIV           128
+#define WLC_SET_PHYANTDIV           129
+#define WLC_AP_RX_ONLY              130
+#define WLC_GET_TX_PATH_PWR         131
+#define WLC_SET_TX_PATH_PWR         132
+#define WLC_GET_WSEC                133
+#define WLC_SET_WSEC                134
+#define WLC_GET_PHY_NOISE           135
+#define WLC_GET_BSS_INFO            136
+#define WLC_GET_PKTCNTS             137
+#define WLC_GET_LAZYWDS             138
+#define WLC_SET_LAZYWDS             139
+#define WLC_GET_BANDLIST            140
+#define WLC_GET_BAND                141
+#define WLC_SET_BAND                142
+#define WLC_SCB_DEAUTHENTICATE          143
+#define WLC_GET_SHORTSLOT           144
+#define WLC_GET_SHORTSLOT_OVERRIDE      145
+#define WLC_SET_SHORTSLOT_OVERRIDE      146
+#define WLC_GET_SHORTSLOT_RESTRICT      147
+#define WLC_SET_SHORTSLOT_RESTRICT      148
+#define WLC_GET_GMODE_PROTECTION        149
+#define WLC_GET_GMODE_PROTECTION_OVERRIDE   150
+#define WLC_SET_GMODE_PROTECTION_OVERRIDE   151
+#define WLC_UPGRADE             152
+ 
+ 
+#define WLC_GET_IGNORE_BCNS         155
+#define WLC_SET_IGNORE_BCNS         156
+#define WLC_GET_SCB_TIMEOUT         157
+#define WLC_SET_SCB_TIMEOUT         158
+#define WLC_GET_ASSOCLIST           159
+#define WLC_GET_CLK             160
+#define WLC_SET_CLK             161
+#define WLC_GET_UP              162
+#define WLC_OUT                 163
+#define WLC_GET_WPA_AUTH            164
+#define WLC_SET_WPA_AUTH            165
+#define WLC_GET_UCFLAGS             166
+#define WLC_SET_UCFLAGS             167
+#define WLC_GET_PWRIDX              168
+#define WLC_SET_PWRIDX              169
+#define WLC_GET_TSSI                170
+#define WLC_GET_SUP_RATESET_OVERRIDE        171
+#define WLC_SET_SUP_RATESET_OVERRIDE        172
+ 
+ 
+ 
+ 
+ 
+#define WLC_GET_PROTECTION_CONTROL      178
+#define WLC_SET_PROTECTION_CONTROL      179
+#define WLC_GET_PHYLIST             180
+#define WLC_ENCRYPT_STRENGTH            181 
+#define WLC_DECRYPT_STATUS          182 
+#define WLC_GET_KEY_SEQ             183
+#define WLC_GET_SCAN_CHANNEL_TIME       184
+#define WLC_SET_SCAN_CHANNEL_TIME       185
+#define WLC_GET_SCAN_UNASSOC_TIME       186
+#define WLC_SET_SCAN_UNASSOC_TIME       187
+#define WLC_GET_SCAN_HOME_TIME          188
+#define WLC_SET_SCAN_HOME_TIME          189
+#define WLC_GET_SCAN_NPROBES            190
+#define WLC_SET_SCAN_NPROBES            191
+#define WLC_GET_PRB_RESP_TIMEOUT        192
+#define WLC_SET_PRB_RESP_TIMEOUT        193
+#define WLC_GET_ATTEN               194
+#define WLC_SET_ATTEN               195
+#define WLC_GET_SHMEM               196 
+#define WLC_SET_SHMEM               197 
+ 
+ 
+#define WLC_SET_WSEC_TEST           200
+#define WLC_SCB_DEAUTHENTICATE_FOR_REASON   201
+#define WLC_TKIP_COUNTERMEASURES        202
+#define WLC_GET_PIOMODE             203
+#define WLC_SET_PIOMODE             204
+#define WLC_SET_ASSOC_PREFER            205
+#define WLC_GET_ASSOC_PREFER            206
+#define WLC_SET_ROAM_PREFER         207
+#define WLC_GET_ROAM_PREFER         208
+#define WLC_SET_LED             209
+#define WLC_GET_LED             210
+#define WLC_GET_INTERFERENCE_MODE       211
+#define WLC_SET_INTERFERENCE_MODE       212
+#define WLC_GET_CHANNEL_QA          213
+#define WLC_START_CHANNEL_QA            214
+#define WLC_GET_CHANNEL_SEL         215
+#define WLC_START_CHANNEL_SEL           216
+#define WLC_GET_VALID_CHANNELS          217
+#define WLC_GET_FAKEFRAG            218
+#define WLC_SET_FAKEFRAG            219
+#define WLC_GET_PWROUT_PERCENTAGE       220
+#define WLC_SET_PWROUT_PERCENTAGE       221
+#define WLC_SET_BAD_FRAME_PREEMPT       222
+#define WLC_GET_BAD_FRAME_PREEMPT       223
+#define WLC_SET_LEAP_LIST           224
+#define WLC_GET_LEAP_LIST           225
+#define WLC_GET_CWMIN               226
+#define WLC_SET_CWMIN               227
+#define WLC_GET_CWMAX               228
+#define WLC_SET_CWMAX               229
+#define WLC_GET_WET             230
+#define WLC_SET_WET             231
+#define WLC_GET_PUB             232
+ 
+ 
+#define WLC_GET_KEY_PRIMARY         235
+#define WLC_SET_KEY_PRIMARY         236
+ 
+#define WLC_GET_ACI_ARGS            238
+#define WLC_SET_ACI_ARGS            239
+#define WLC_UNSET_CALLBACK          240
+#define WLC_SET_CALLBACK            241
+#define WLC_GET_RADAR               242
+#define WLC_SET_RADAR               243
+#define WLC_SET_SPECT_MANAGMENT         244
+#define WLC_GET_SPECT_MANAGMENT         245
+#define WLC_WDS_GET_REMOTE_HWADDR       246 
+#define WLC_WDS_GET_WPA_SUP         247
+#define WLC_SET_CS_SCAN_TIMER           248
+#define WLC_GET_CS_SCAN_TIMER           249
+#define WLC_MEASURE_REQUEST         250
+#define WLC_INIT                251
+#define WLC_SEND_QUIET              252
+#define WLC_KEEPALIVE           253
+#define WLC_SEND_PWR_CONSTRAINT         254
+#define WLC_UPGRADE_STATUS          255
+#define WLC_CURRENT_PWR             256
+#define WLC_GET_SCAN_PASSIVE_TIME       257
+#define WLC_SET_SCAN_PASSIVE_TIME       258
+#define WLC_LEGACY_LINK_BEHAVIOR        259
+#define WLC_GET_CHANNELS_IN_COUNTRY     260
+#define WLC_GET_COUNTRY_LIST            261
+#define WLC_GET_VAR             262 
+#define WLC_SET_VAR             263 
+#define WLC_NVRAM_GET               264 
+#define WLC_NVRAM_SET               265
+#define WLC_NVRAM_DUMP              266
+#define WLC_REBOOT              267
+#define WLC_SET_WSEC_PMK            268
+#define WLC_GET_AUTH_MODE           269
+#define WLC_SET_AUTH_MODE           270
+#define WLC_GET_WAKEENTRY           271
+#define WLC_SET_WAKEENTRY           272
+#define WLC_NDCONFIG_ITEM           273 
+#define WLC_NVOTPW              274
+#define WLC_OTPW                275
+#define WLC_IOV_BLOCK_GET           276
+#define WLC_IOV_MODULES_GET         277
+#define WLC_SOFT_RESET              278
+#define WLC_GET_ALLOW_MODE          279
+#define WLC_SET_ALLOW_MODE          280
+#define WLC_GET_DESIRED_BSSID           281
+#define WLC_SET_DESIRED_BSSID           282
+#define WLC_DISASSOC_MYAP           283
+#define WLC_GET_NBANDS              284 
+#define WLC_GET_BANDSTATES          285 
+#define WLC_GET_WLC_BSS_INFO            286 
+#define WLC_GET_ASSOC_INFO          287 
+#define WLC_GET_OID_PHY             288 
+#define WLC_SET_OID_PHY             289 
+#define WLC_SET_ASSOC_TIME          290 
+#define WLC_GET_DESIRED_SSID            291 
+#define WLC_GET_CHANSPEC            292 
+#define WLC_GET_ASSOC_STATE         293 
+#define WLC_SET_PHY_STATE           294 
+#define WLC_GET_SCAN_PENDING            295 
+#define WLC_GET_SCANREQ_PENDING         296 
+#define WLC_GET_PREV_ROAM_REASON        297 
+#define WLC_SET_PREV_ROAM_REASON        298 
+#define WLC_GET_BANDSTATES_PI           299 
+#define WLC_GET_PHY_STATE           300 
+#define WLC_GET_BSS_WPA_RSN         301 
+#define WLC_GET_BSS_WPA2_RSN            302 
+#define WLC_GET_BSS_BCN_TS          303 
+#define WLC_GET_INT_DISASSOC            304 
+#define WLC_SET_NUM_PEERS           305     
+#define WLC_GET_NUM_BSS             306 
+#define WLC_NPHY_SAMPLE_COLLECT         307 
+#define WLC_UM_PRIV             308 
+#define WLC_GET_CMD             309
+  
+#define WLC_SET_INTERFERENCE_OVERRIDE_MODE  311 
+#define WLC_GET_INTERFERENCE_OVERRIDE_MODE  312 
+#define WLC_GET_WAI_RESTRICT            313 
+#define WLC_SET_WAI_RESTRICT            314 
+#define WLC_SET_WAI_REKEY           315 
+#define WLC_SET_PEAKRATE            316 
+#define WLC_GET_PEAKRATE            317
+#define WLC_LAST                318
+
+#ifndef EPICTRL_COOKIE
+#define EPICTRL_COOKIE      0xABADCEDE
+#endif
+
+
+#define CMN_IOCTL_OFF 0x180
+
+
+
+
+#define WL_OID_BASE     0xFFE41420
+
+
+#define OID_WL_GETINSTANCE  (WL_OID_BASE + WLC_GET_INSTANCE)
+#define OID_WL_GET_FORCELINK    (WL_OID_BASE + WLC_GET_FORCELINK)
+#define OID_WL_SET_FORCELINK    (WL_OID_BASE + WLC_SET_FORCELINK)
+#define OID_WL_ENCRYPT_STRENGTH (WL_OID_BASE + WLC_ENCRYPT_STRENGTH)
+#define OID_WL_DECRYPT_STATUS   (WL_OID_BASE + WLC_DECRYPT_STATUS)
+#define OID_LEGACY_LINK_BEHAVIOR (WL_OID_BASE + WLC_LEGACY_LINK_BEHAVIOR)
+#define OID_WL_NDCONFIG_ITEM    (WL_OID_BASE + WLC_NDCONFIG_ITEM)
+
+
+#define OID_STA_CHANSPEC    (WL_OID_BASE + WLC_GET_CHANSPEC)
+#define OID_STA_NBANDS      (WL_OID_BASE + WLC_GET_NBANDS)
+#define OID_STA_GET_PHY     (WL_OID_BASE + WLC_GET_OID_PHY)
+#define OID_STA_SET_PHY     (WL_OID_BASE + WLC_SET_OID_PHY)
+#define OID_STA_ASSOC_TIME  (WL_OID_BASE + WLC_SET_ASSOC_TIME)
+#define OID_STA_DESIRED_SSID    (WL_OID_BASE + WLC_GET_DESIRED_SSID)
+#define OID_STA_SET_PHY_STATE   (WL_OID_BASE + WLC_SET_PHY_STATE)
+#define OID_STA_SCAN_PENDING    (WL_OID_BASE + WLC_GET_SCAN_PENDING)
+#define OID_STA_SCANREQ_PENDING (WL_OID_BASE + WLC_GET_SCANREQ_PENDING)
+#define OID_STA_GET_ROAM_REASON (WL_OID_BASE + WLC_GET_PREV_ROAM_REASON)
+#define OID_STA_SET_ROAM_REASON (WL_OID_BASE + WLC_SET_PREV_ROAM_REASON)
+#define OID_STA_GET_PHY_STATE   (WL_OID_BASE + WLC_GET_PHY_STATE)
+#define OID_STA_INT_DISASSOC    (WL_OID_BASE + WLC_GET_INT_DISASSOC)
+#define OID_STA_SET_NUM_PEERS   (WL_OID_BASE + WLC_SET_NUM_PEERS)
+#define OID_STA_GET_NUM_BSS (WL_OID_BASE + WLC_GET_NUM_BSS)
+
+#define WL_DECRYPT_STATUS_SUCCESS   1
+#define WL_DECRYPT_STATUS_FAILURE   2
+#define WL_DECRYPT_STATUS_UNKNOWN   3
+
+
+#define WLC_UPGRADE_SUCCESS         0
+#define WLC_UPGRADE_PENDING         1
+
+#ifdef CONFIG_USBRNDIS_RETAIL
+
+typedef struct {
+        char *name;
+        void *param;
+} ndconfig_item_t;
+#endif
+
+
+
+#define WL_AUTH_OPEN_SYSTEM     0   
+#define WL_AUTH_SHARED_KEY      1   
+#define WL_AUTH_OPEN_SHARED     2   
+
+
+#define WL_RADIO_SW_DISABLE     (1<<0)
+#define WL_RADIO_HW_DISABLE     (1<<1)
+#define WL_RADIO_MPC_DISABLE        (1<<2)
+#define WL_RADIO_COUNTRY_DISABLE    (1<<3)  
+
+#define WL_SPURAVOID_OFF    0
+#define WL_SPURAVOID_ON1    1
+#define WL_SPURAVOID_ON2    2
+
+
+#define WL_TXPWR_OVERRIDE   (1U<<31)
+#define WL_TXPWR_NEG   (1U<<30)
+
+#define WL_PHY_PAVARS_LEN   6   
+
+#define WL_PHY_PAVARS2_NUM      3       
+#define WL_PHY_PAVAR_VER        1       
+typedef struct wl_pavars2 {
+        uint16 ver;             
+        uint16 len;             
+        uint16 inuse;           
+        uint16 phy_type;        
+        uint16 bandrange;
+        uint16 chain;
+        uint16 inpa[WL_PHY_PAVARS2_NUM];        
+} wl_pavars2_t;
+
+typedef struct wl_po {
+        uint16  phy_type;   
+        uint16  band;
+        uint16  cckpo;
+        uint32  ofdmpo;
+        uint16  mcspo[8];
+} wl_po_t;
+
+
+#define WLC_TXPWR_MAX       (127)   
+
+
+#define WL_DIAG_INTERRUPT           1   
+#define WL_DIAG_LOOPBACK            2   
+#define WL_DIAG_MEMORY              3   
+#define WL_DIAG_LED             4   
+#define WL_DIAG_REG             5   
+#define WL_DIAG_SROM                6   
+#define WL_DIAG_DMA             7   
+
+#define WL_DIAGERR_SUCCESS          0
+#define WL_DIAGERR_FAIL_TO_RUN          1   
+#define WL_DIAGERR_NOT_SUPPORTED        2   
+#define WL_DIAGERR_INTERRUPT_FAIL       3   
+#define WL_DIAGERR_LOOPBACK_FAIL        4   
+#define WL_DIAGERR_SROM_FAIL            5   
+#define WL_DIAGERR_SROM_BADCRC          6   
+#define WL_DIAGERR_REG_FAIL         7   
+#define WL_DIAGERR_MEMORY_FAIL          8   
+#define WL_DIAGERR_NOMEM            9   
+#define WL_DIAGERR_DMA_FAIL         10  
+
+#define WL_DIAGERR_MEMORY_TIMEOUT       11  
+#define WL_DIAGERR_MEMORY_BADPATTERN        12  
+
+
+#define WLC_BAND_AUTO       0   
+#define WLC_BAND_5G     1   
+#define WLC_BAND_2G     2   
+#define WLC_BAND_ALL        3   
+
+
+#define WL_CHAN_FREQ_RANGE_2G      0
+#define WL_CHAN_FREQ_RANGE_5GL     1
+#define WL_CHAN_FREQ_RANGE_5GM     2
+#define WL_CHAN_FREQ_RANGE_5GH     3
+
+#define WL_CHAN_FREQ_RANGE_5GLL_VER2    4
+#define WL_CHAN_FREQ_RANGE_5GLH_VER2    5
+#define WL_CHAN_FREQ_RANGE_5GML_VER2    6
+#define WL_CHAN_FREQ_RANGE_5GMH_VER2    7
+#define WL_CHAN_FREQ_RANGE_5GH_VER2     8
+
+#define WL_CHAN_FREQ_RANGE_5GLL_5BAND    4
+#define WL_CHAN_FREQ_RANGE_5GLH_5BAND    5
+#define WL_CHAN_FREQ_RANGE_5GML_5BAND    6
+#define WL_CHAN_FREQ_RANGE_5GMH_5BAND    7
+#define WL_CHAN_FREQ_RANGE_5GH_5BAND     8
+
+
+#define WLC_PHY_TYPE_A      0
+#define WLC_PHY_TYPE_B      1
+#define WLC_PHY_TYPE_G      2
+#define WLC_PHY_TYPE_N      4
+#define WLC_PHY_TYPE_LP     5
+#define WLC_PHY_TYPE_SSN    6
+#define WLC_PHY_TYPE_HT     7
+#define WLC_PHY_TYPE_LCN    8
+#define WLC_PHY_TYPE_NULL   0xf
+
+
+#define WLC_MACMODE_DISABLED    0   
+#define WLC_MACMODE_DENY    1   
+#define WLC_MACMODE_ALLOW   2   
+
+
+#define GMODE_LEGACY_B      0
+#define GMODE_AUTO      1
+#define GMODE_ONLY      2
+#define GMODE_B_DEFERRED    3
+#define GMODE_PERFORMANCE   4
+#define GMODE_LRS       5
+#define GMODE_MAX       6
+
+
+#define WLC_PLCP_AUTO   -1
+#define WLC_PLCP_SHORT  0
+#define WLC_PLCP_LONG   1
+
+
+#define WLC_PROTECTION_AUTO     -1
+#define WLC_PROTECTION_OFF      0
+#define WLC_PROTECTION_ON       1
+#define WLC_PROTECTION_MMHDR_ONLY   2
+#define WLC_PROTECTION_CTS_ONLY     3
+
+
+#define WLC_PROTECTION_CTL_OFF      0
+#define WLC_PROTECTION_CTL_LOCAL    1
+#define WLC_PROTECTION_CTL_OVERLAP  2
+
+
+#define WLC_N_PROTECTION_OFF        0
+#define WLC_N_PROTECTION_OPTIONAL   1
+#define WLC_N_PROTECTION_20IN40     2
+#define WLC_N_PROTECTION_MIXEDMODE  3
+
+
+#define WLC_N_PREAMBLE_MIXEDMODE    0
+#define WLC_N_PREAMBLE_GF       1
+#define WLC_N_PREAMBLE_GF_BRCM          2
+
+
+#define WLC_N_BW_20ALL          0
+#define WLC_N_BW_40ALL          1
+#define WLC_N_BW_20IN2G_40IN5G      2
+
+
+#define WLC_N_TXRX_CHAIN0       0
+#define WLC_N_TXRX_CHAIN1       1
+
+
+#define WLC_N_SGI_20            0x01
+#define WLC_N_SGI_40            0x02
+
+
+#define PM_OFF  0
+#define PM_MAX  1
+#define PM_FAST 2
+
+#define LISTEN_INTERVAL         10
+
+#define INTERFERE_OVRRIDE_OFF   -1  
+#define INTERFERE_NONE  0   
+#define NON_WLAN    1   
+#define WLAN_MANUAL 2   
+#define WLAN_AUTO   3   
+#define WLAN_AUTO_W_NOISE   4   
+#define AUTO_ACTIVE (1 << 7) 
+
+typedef struct wl_aci_args {
+        int enter_aci_thresh; 
+        int exit_aci_thresh; 
+        int usec_spin; 
+        int glitch_delay; 
+        uint16 nphy_adcpwr_enter_thresh;    
+        uint16 nphy_adcpwr_exit_thresh; 
+        uint16 nphy_repeat_ctr;     
+        uint16 nphy_num_samples;    
+        uint16 nphy_undetect_window_sz; 
+        uint16 nphy_b_energy_lo_aci;    
+        uint16 nphy_b_energy_md_aci;    
+        uint16 nphy_b_energy_hi_aci;    
+        uint16 nphy_noise_noassoc_glitch_th_up; 
+        uint16 nphy_noise_noassoc_glitch_th_dn;
+        uint16 nphy_noise_assoc_glitch_th_up;
+        uint16 nphy_noise_assoc_glitch_th_dn;
+        uint16 nphy_noise_assoc_aci_glitch_th_up;
+        uint16 nphy_noise_assoc_aci_glitch_th_dn;
+        uint16 nphy_noise_assoc_enter_th;
+        uint16 nphy_noise_noassoc_enter_th;
+        uint16 nphy_noise_assoc_rx_glitch_badplcp_enter_th;
+        uint16 nphy_noise_noassoc_crsidx_incr;
+        uint16 nphy_noise_assoc_crsidx_incr;
+        uint16 nphy_noise_crsidx_decr;
+} wl_aci_args_t;
+
+#define TRIGGER_NOW             0
+#define TRIGGER_CRS             0x01
+#define TRIGGER_CRSDEASSERT         0x02
+#define TRIGGER_GOODFCS             0x04
+#define TRIGGER_BADFCS              0x08
+#define TRIGGER_BADPLCP             0x10
+#define TRIGGER_CRSGLITCH           0x20
+#define WL_ACI_ARGS_LEGACY_LENGTH   16  
+#define WL_SAMPLECOLLECT_T_VERSION  1   
+typedef struct wl_samplecollect_args {
+        
+        uint8 coll_us;
+        int cores;
+        
+        uint16 version;     
+        uint16 length;      
+        uint8 trigger;
+        uint16 timeout;
+        uint16 mode;
+        uint32 pre_dur;
+        uint32 post_dur;
+        uint8 gpio_sel;
+        bool downsamp;
+        bool be_deaf;
+        bool agc;       
+        bool filter;        
+} wl_samplecollect_args_t;
+
+#define WL_SAMPLEDATA_HEADER_TYPE   1
+#define WL_SAMPLEDATA_HEADER_SIZE   80  
+#define WL_SAMPLEDATA_TYPE      2
+#define WL_SAMPLEDATA_SEQ       0xff    
+#define WL_SAMPLEDATA_MORE_DATA     0x100   
+#define WL_SAMPLEDATA_T_VERSION     1   
+
+#define WL_SAMPLEDATA_T_VERSION_SPEC_AN 2
+
+typedef struct wl_sampledata {
+        uint16 version; 
+        uint16 size;    
+        uint16 tag; 
+        uint16 length;  
+        uint32 flag;    
+} wl_sampledata_t;
+
+
+
+#define WL_ERROR_VAL        0x00000001
+#define WL_TRACE_VAL        0x00000002
+#define WL_PRHDRS_VAL       0x00000004
+#define WL_PRPKT_VAL        0x00000008
+#define WL_INFORM_VAL       0x00000010
+#define WL_TMP_VAL      0x00000020
+#define WL_OID_VAL      0x00000040
+#define WL_RATE_VAL     0x00000080
+#define WL_ASSOC_VAL        0x00000100
+#define WL_PRUSR_VAL        0x00000200
+#define WL_PS_VAL       0x00000400
+#define WL_TXPWR_VAL        0x00000800  
+#define WL_PORT_VAL     0x00001000
+#define WL_DUAL_VAL     0x00002000
+#define WL_WSEC_VAL     0x00004000
+#define WL_WSEC_DUMP_VAL    0x00008000
+#define WL_LOG_VAL      0x00010000
+#define WL_NRSSI_VAL        0x00020000  
+#define WL_LOFT_VAL     0x00040000  
+#define WL_REGULATORY_VAL   0x00080000
+#define WL_PHYCAL_VAL       0x00100000  
+#define WL_RADAR_VAL        0x00200000  
+#define WL_MPC_VAL      0x00400000
+#define WL_APSTA_VAL        0x00800000
+#define WL_DFS_VAL      0x01000000
+#define WL_BA_VAL       0x02000000
+#define WL_ACI_VAL      0x04000000
+#define WL_MBSS_VAL     0x04000000
+#define WL_CAC_VAL      0x08000000
+#define WL_AMSDU_VAL        0x10000000
+#define WL_AMPDU_VAL        0x20000000
+#define WL_FFPLD_VAL        0x40000000
+
+
+#define WL_DPT_VAL      0x00000001
+#define WL_SCAN_VAL     0x00000002
+#define WL_WOWL_VAL     0x00000004
+#define WL_COEX_VAL     0x00000008
+#define WL_RTDC_VAL     0x00000010
+#define WL_PROTO_VAL        0x00000020
+#define WL_BTA_VAL      0x00000040
+#define WL_CHANINT_VAL      0x00000080
+#define WL_THERMAL_VAL      0x00000100  
+#define WL_P2P_VAL      0x00000200
+#define WL_TXRX_VAL             0x00000400
+#define WL_MCHAN_VAL            0x00000800
+
+
+#define WL_LED_NUMGPIO      16  
+
+
+#define WL_LED_OFF      0       
+#define WL_LED_ON       1       
+#define WL_LED_ACTIVITY     2       
+#define WL_LED_RADIO        3       
+#define WL_LED_ARADIO       4       
+#define WL_LED_BRADIO       5       
+#define WL_LED_BGMODE       6       
+#define WL_LED_WI1      7
+#define WL_LED_WI2      8
+#define WL_LED_WI3      9
+#define WL_LED_ASSOC        10      
+#define WL_LED_INACTIVE     11      
+#define WL_LED_ASSOCACT     12      
+#define WL_LED_WI4      13
+#define WL_LED_WI5      14
+#define WL_LED_BLINKSLOW    15      
+#define WL_LED_BLINKMED     16      
+#define WL_LED_BLINKFAST    17      
+#define WL_LED_BLINKCUSTOM  18      
+#define WL_LED_BLINKPERIODIC    19      
+#define WL_LED_ASSOC_WITH_SEC   20      
+                                                
+#define WL_LED_START_OFF    21      
+#define WL_LED_NUMBEHAVIOR  22
+
+
+#define WL_LED_BEH_MASK     0x7f        
+#define WL_LED_AL_MASK      0x80        
+
+
+#define WL_NUMCHANNELS      64
+#define WL_NUMCHANSPECS     100
+
+
+#define WL_WDS_WPA_ROLE_AUTH    0   
+#define WL_WDS_WPA_ROLE_SUP 1   
+#define WL_WDS_WPA_ROLE_AUTO    255 
+
+
+#define WL_EVENTING_MASK_LEN    16
+
+
+
+
+#define WL_JOIN_PREF_RSSI   1   
+#define WL_JOIN_PREF_WPA    2   
+#define WL_JOIN_PREF_BAND   3   
+#define WL_JOIN_PREF_RSSI_DELTA 4   
+#define WL_JOIN_PREF_TRANS_PREF 5
+
+
+#define WLJP_BAND_ASSOC_PREF    255 
+
+
+#define WL_WPA_ACP_MCS_ANY  "\x00\x00\x00\x00"
+
+struct tsinfo_arg {
+        uint8 octets[3];
+};
+
+#define NFIFO           6   
+
+#define WL_CNT_T_VERSION    6   
+
+typedef struct {
+        uint16  version;    
+        uint16  length;     
+
+        
+        uint32  txframe;    
+        uint32  txbyte;     
+        uint32  txretrans;  
+        uint32  txerror;    
+        uint32  txctl;      
+        uint32  txprshort;  
+        uint32  txserr;     
+        uint32  txnobuf;    
+        uint32  txnoassoc;  
+        uint32  txrunt;     
+        uint32  txchit;     
+        uint32  txcmiss;    
+
+        
+        uint32  txuflo;     
+        uint32  txphyerr;   
+        uint32  txphycrs;
+
+        
+        uint32  rxframe;    
+        uint32  rxbyte;     
+        uint32  rxerror;    
+        uint32  rxctl;      
+        uint32  rxnobuf;    
+        uint32  rxnondata;  
+        uint32  rxbadds;    
+        uint32  rxbadcm;    
+        uint32  rxfragerr;  
+        uint32  rxrunt;     
+        uint32  rxgiant;    
+        uint32  rxnoscb;    
+        uint32  rxbadproto; 
+        uint32  rxbadsrcmac;    
+        uint32  rxbadda;    
+        uint32  rxfilter;   
+
+        
+        uint32  rxoflo;     
+        uint32  rxuflo[NFIFO];  
+
+        uint32  d11cnt_txrts_off;   
+        uint32  d11cnt_rxcrc_off;   
+        uint32  d11cnt_txnocts_off; 
+
+        
+        uint32  dmade;      
+        uint32  dmada;      
+        uint32  dmape;      
+        uint32  reset;      
+        uint32  tbtt;       
+        uint32  txdmawar;
+        uint32  pkt_callback_reg_fail;  
+
+        
+        uint32  txallfrm;   
+        uint32  txrtsfrm;   
+        uint32  txctsfrm;   
+        uint32  txackfrm;   
+        uint32  txdnlfrm;   
+        uint32  txbcnfrm;   
+        uint32  txfunfl[8]; 
+        uint32  txtplunfl;  
+        uint32  txphyerror; 
+        uint32  rxfrmtoolong;   
+        uint32  rxfrmtooshrt;   
+        uint32  rxinvmachdr;    
+        uint32  rxbadfcs;   
+        uint32  rxbadplcp;  
+        uint32  rxcrsglitch;    
+        uint32  rxstrt;     
+        uint32  rxdfrmucastmbss; 
+        uint32  rxmfrmucastmbss; 
+        uint32  rxcfrmucast;    
+        uint32  rxrtsucast; 
+        uint32  rxctsucast; 
+        uint32  rxackucast; 
+        uint32  rxdfrmocast;    
+        uint32  rxmfrmocast;    
+        uint32  rxcfrmocast;    
+        uint32  rxrtsocast; 
+        uint32  rxctsocast; 
+        uint32  rxdfrmmcast;    
+        uint32  rxmfrmmcast;    
+        uint32  rxcfrmmcast;    
+        uint32  rxbeaconmbss;   
+        uint32  rxdfrmucastobss; 
+        uint32  rxbeaconobss;   
+        uint32  rxrsptmout; 
+        uint32  bcntxcancl; 
+        uint32  rxf0ovfl;   
+        uint32  rxf1ovfl;   
+        uint32  rxf2ovfl;   
+        uint32  txsfovfl;   
+        uint32  pmqovfl;    
+        uint32  rxcgprqfrm; 
+        uint32  rxcgprsqovfl;   
+        uint32  txcgprsfail;    
+        uint32  txcgprssuc; 
+        uint32  prs_timeout;    
+        uint32  rxnack;
+        uint32  frmscons;
+        uint32  txnack;
+        uint32  txglitch_nack;  
+        uint32  txburst;    
+
+        
+        uint32  txfrag;     
+        uint32  txmulti;    
+        uint32  txfail;     
+        uint32  txretry;    
+        uint32  txretrie;   
+        uint32  rxdup;      
+        uint32  txrts;      
+        uint32  txnocts;    
+        uint32  txnoack;    
+        uint32  rxfrag;     
+        uint32  rxmulti;    
+        uint32  rxcrc;      
+        uint32  txfrmsnt;   
+        uint32  rxundec;    
+
+        
+        uint32  tkipmicfaill;   
+        uint32  tkipcntrmsr;    
+        uint32  tkipreplay; 
+        uint32  ccmpfmterr; 
+        uint32  ccmpreplay; 
+        uint32  ccmpundec;  
+        uint32  fourwayfail;    
+        uint32  wepundec;   
+        uint32  wepicverr;  
+        uint32  decsuccess; 
+        uint32  tkipicverr; 
+        uint32  wepexcluded;    
+
+        uint32  rxundec_mcst;   
+
+        
+        uint32  tkipmicfaill_mcst;  
+        uint32  tkipcntrmsr_mcst;   
+        uint32  tkipreplay_mcst;    
+        uint32  ccmpfmterr_mcst;    
+        uint32  ccmpreplay_mcst;    
+        uint32  ccmpundec_mcst; 
+        uint32  fourwayfail_mcst;   
+        uint32  wepundec_mcst;  
+        uint32  wepicverr_mcst; 
+        uint32  decsuccess_mcst;    
+        uint32  tkipicverr_mcst;    
+        uint32  wepexcluded_mcst;   
+
+        uint32  txchanrej;  
+        uint32  txexptime;  
+        uint32  psmwds;     
+        uint32  phywatchdog;    
+
+        
+        uint32  prq_entries_handled;    
+        uint32  prq_undirected_entries; 
+        uint32  prq_bad_entries;    
+        uint32  atim_suppress_count;    
+        uint32  bcn_template_not_ready; 
+        uint32  bcn_template_not_ready_done; 
+        uint32  late_tbtt_dpc;  
+
+        
+        uint32  rx1mbps;    
+        uint32  rx2mbps;    
+        uint32  rx5mbps5;   
+        uint32  rx6mbps;    
+        uint32  rx9mbps;    
+        uint32  rx11mbps;   
+        uint32  rx12mbps;   
+        uint32  rx18mbps;   
+        uint32  rx24mbps;   
+        uint32  rx36mbps;   
+        uint32  rx48mbps;   
+        uint32  rx54mbps;   
+        uint32  rx108mbps;  
+        uint32  rx162mbps;  
+        uint32  rx216mbps;  
+        uint32  rx270mbps;  
+        uint32  rx324mbps;  
+        uint32  rx378mbps;  
+        uint32  rx432mbps;  
+        uint32  rx486mbps;  
+        uint32  rx540mbps;  
+
+        
+        uint32  pktengrxducast; 
+        uint32  pktengrxdmcast; 
+
+        uint32  rfdisable;  
+        uint32  bphy_rxcrsglitch;   
+
+        uint32  txmpdu_sgi; 
+        uint32  rxmpdu_sgi; 
+        uint32  txmpdu_stbc;    
+        uint32  rxmpdu_stbc;    
+} wl_cnt_t;
+
+
+#define WL_WME_CNT_VERSION  1   
+
+typedef struct {
+        uint32 packets;
+        uint32 bytes;
+} wl_traffic_stats_t;
+
+typedef struct {
+        uint16  version;    
+        uint16  length;     
+
+        wl_traffic_stats_t tx[AC_COUNT];    
+        wl_traffic_stats_t tx_failed[AC_COUNT]; 
+        wl_traffic_stats_t rx[AC_COUNT];    
+        wl_traffic_stats_t rx_failed[AC_COUNT]; 
+
+        wl_traffic_stats_t forward[AC_COUNT];   
+
+        wl_traffic_stats_t tx_expired[AC_COUNT];    
+
+} wl_wme_cnt_t;
+
+struct wl_msglevel2 {
+        uint32 low;
+        uint32 high;
+};
+
+typedef struct wl_mkeep_alive_pkt {
+        uint16  version;
+        uint16  length;
+        uint32  period_msec;
+        uint16  len_bytes;
+        uint8   keep_alive_id;
+        uint8   data[1];
+} wl_mkeep_alive_pkt_t;
+
+#define WL_MKEEP_ALIVE_VERSION          1
+#define WL_MKEEP_ALIVE_FIXED_LEN        OFFSETOF(wl_mkeep_alive_pkt_t, data)
+#define WL_MKEEP_ALIVE_PRECISION        500
+
+#define WLC_ROAM_TRIGGER_DEFAULT    0 
+#define WLC_ROAM_TRIGGER_BANDWIDTH  1 
+#define WLC_ROAM_TRIGGER_DISTANCE   2 
+#define WLC_ROAM_TRIGGER_AUTO       3 
+#define WLC_ROAM_TRIGGER_MAX_VALUE  3 
+
+
+#define WPA_AUTH_PFN_ANY        0xffffffff      
+
+enum {
+        PFN_LIST_ORDER,
+        PFN_RSSI
+};
+
+enum {
+        DISABLE,
+        ENABLE
+};
+
+enum {
+        OFF_ADAPT,
+        SMART_ADAPT,
+        STRICT_ADAPT,
+        SLOW_ADAPT
+};
+
+#define SORT_CRITERIA_BIT               0
+#define AUTO_NET_SWITCH_BIT             1
+#define ENABLE_BKGRD_SCAN_BIT   2
+#define IMMEDIATE_SCAN_BIT              3
+#define AUTO_CONNECT_BIT                4
+#define ENABLE_BD_SCAN_BIT              5
+#define ENABLE_ADAPTSCAN_BIT    6
+#define IMMEDIATE_EVENT_BIT             8
+
+#define SORT_CRITERIA_MASK              0x0001
+#define AUTO_NET_SWITCH_MASK    0x0002
+#define ENABLE_BKGRD_SCAN_MASK  0x0004
+#define IMMEDIATE_SCAN_MASK             0x0008
+#define AUTO_CONNECT_MASK               0x0010
+#define ENABLE_BD_SCAN_MASK             0x0020
+#define ENABLE_ADAPTSCAN_MASK   0x00c0
+#define IMMEDIATE_EVENT_MASK    0x0100
+
+#define PFN_VERSION                             2
+#define PFN_SCANRESULT_VERSION  1
+#define MAX_PFN_LIST_COUNT      16
+
+#define PFN_COMPLETE                    1
+#define PFN_INCOMPLETE                  0
+
+#define DEFAULT_BESTN                   2
+#define DEFAULT_MSCAN                   0
+#define DEFAULT_REPEAT                  10
+#define DEFAULT_EXP                             2
+
+
+typedef struct wl_pfn_subnet_info {
+        struct ether_addr BSSID;
+        uint8   channel; 
+        uint8   SSID_len;
+        uint8   SSID[32];
+} wl_pfn_subnet_info_t;
+
+typedef struct wl_pfn_net_info {
+        wl_pfn_subnet_info_t pfnsubnet;
+        int16   RSSI; 
+        uint16  timestamp; 
+} wl_pfn_net_info_t;
+
+typedef struct wl_pfn_scanresults {
+        uint32 version;
+        uint32 status;
+        uint32 count;
+        wl_pfn_net_info_t netinfo[1];
+} wl_pfn_scanresults_t;
+
+
+typedef struct wl_pfn_param {
+        int32 version;                  
+        int32 scan_freq;                
+        int32 lost_network_timeout;     
+        int16 flags;                    
+        int16 rssi_margin;              
+        uint8 bestn; 
+        uint8 mscan; 
+        uint8 repeat; 
+        uint8 exp; 
+        int32 slow_freq;
+} wl_pfn_param_t;
+
+typedef struct wl_pfn_bssid {
+        struct ether_addr       macaddr;
+        
+        uint16                          flags;
+} wl_pfn_bssid_t;
+#define WL_PFN_SUPPRESSFOUND_MASK       0x08
+#define WL_PFN_SUPPRESSLOST_MASK        0x10
+
+typedef struct wl_pfn_cfg {
+        uint32                          reporttype;
+        int32                           channel_num;
+        uint16                          channel_list[WL_NUMCHANNELS];
+} wl_pfn_cfg_t;
+#define WL_PFN_REPORT_ALLNET    0
+#define WL_PFN_REPORT_SSIDNET   1
+#define WL_PFN_REPORT_BSSIDNET  2
+
+typedef struct wl_pfn {
+        wlc_ssid_t              ssid;                   
+        int32                   flags;                  
+        int32                   infra;                  
+        int32                   auth;                   
+        int32                   wpa_auth;               
+        int32                   wsec;                   
+} wl_pfn_t;
+#define WL_PFN_HIDDEN_BIT               2
+#define PNO_SCAN_MAX_FW         508*1000        
+#define PNO_SCAN_MAX_FW_SEC     PNO_SCAN_MAX_FW/1000 
+#define PNO_SCAN_MIN_FW_SEC     10                      
+#define WL_PFN_HIDDEN_MASK              0x4
+
+
+#define TOE_TX_CSUM_OL      0x00000001
+#define TOE_RX_CSUM_OL      0x00000002
+
+
+#define TOE_ERRTEST_TX_CSUM 0x00000001
+#define TOE_ERRTEST_RX_CSUM 0x00000002
+#define TOE_ERRTEST_RX_CSUM2    0x00000004
+
+struct toe_ol_stats_t {
+        
+        uint32 tx_summed;
+
+        
+        uint32 tx_iph_fill;
+        uint32 tx_tcp_fill;
+        uint32 tx_udp_fill;
+        uint32 tx_icmp_fill;
+
+        
+        uint32 rx_iph_good;
+        uint32 rx_iph_bad;
+        uint32 rx_tcp_good;
+        uint32 rx_tcp_bad;
+        uint32 rx_udp_good;
+        uint32 rx_udp_bad;
+        uint32 rx_icmp_good;
+        uint32 rx_icmp_bad;
+
+        
+        uint32 tx_tcp_errinj;
+        uint32 tx_udp_errinj;
+        uint32 tx_icmp_errinj;
+
+        
+        uint32 rx_tcp_errinj;
+        uint32 rx_udp_errinj;
+        uint32 rx_icmp_errinj;
+};
+
+
+#define ARP_OL_AGENT        0x00000001
+#define ARP_OL_SNOOP        0x00000002
+#define ARP_OL_HOST_AUTO_REPLY  0x00000004
+#define ARP_OL_PEER_AUTO_REPLY  0x00000008
+
+
+#define ARP_ERRTEST_REPLY_PEER  0x1
+#define ARP_ERRTEST_REPLY_HOST  0x2
+
+#define ARP_MULTIHOMING_MAX 8   
+
+
+struct arp_ol_stats_t {
+        uint32  host_ip_entries;    
+        uint32  host_ip_overflow;   
+
+        uint32  arp_table_entries;  
+        uint32  arp_table_overflow; 
+
+        uint32  host_request;       
+        uint32  host_reply;     
+        uint32  host_service;       
+
+        uint32  peer_request;       
+        uint32  peer_request_drop;  
+        uint32  peer_reply;     
+        uint32  peer_reply_drop;    
+        uint32  peer_service;       
+};
+
+
+
+
+typedef struct wl_keep_alive_pkt {
+        uint32  period_msec;    
+        uint16  len_bytes;  
+        uint8   data[1];    
+} wl_keep_alive_pkt_t;
+
+#define WL_KEEP_ALIVE_FIXED_LEN     OFFSETOF(wl_keep_alive_pkt_t, data)
+
+
+
+
+typedef enum wl_pkt_filter_type {
+        WL_PKT_FILTER_TYPE_PATTERN_MATCH    
+} wl_pkt_filter_type_t;
+
+#define WL_PKT_FILTER_TYPE wl_pkt_filter_type_t
+
+
+typedef struct wl_pkt_filter_pattern {
+        uint32  offset;     
+        uint32  size_bytes; 
+        uint8   mask_and_pattern[1]; 
+} wl_pkt_filter_pattern_t;
+
+
+typedef struct wl_pkt_filter {
+        uint32  id;     
+        uint32  type;       
+        uint32  negate_match;   
+        union {         
+                wl_pkt_filter_pattern_t pattern;    
+        } u;
+} wl_pkt_filter_t;
+
+#define WL_PKT_FILTER_FIXED_LEN       OFFSETOF(wl_pkt_filter_t, u)
+#define WL_PKT_FILTER_PATTERN_FIXED_LEN   OFFSETOF(wl_pkt_filter_pattern_t, mask_and_pattern)
+
+
+typedef struct wl_pkt_filter_enable {
+        uint32  id;     
+        uint32  enable;     
+} wl_pkt_filter_enable_t;
+
+
+typedef struct wl_pkt_filter_list {
+        uint32  num;        
+        wl_pkt_filter_t filter[1];  
+} wl_pkt_filter_list_t;
+
+#define WL_PKT_FILTER_LIST_FIXED_LEN      OFFSETOF(wl_pkt_filter_list_t, filter)
+
+
+typedef struct wl_pkt_filter_stats {
+        uint32  num_pkts_matched;   
+        uint32  num_pkts_forwarded; 
+        uint32  num_pkts_discarded; 
+} wl_pkt_filter_stats_t;
+
+
+typedef struct wl_seq_cmd_ioctl {
+        uint32 cmd;     
+        uint32 len;     
+} wl_seq_cmd_ioctl_t;
+
+#define WL_SEQ_CMD_ALIGN_BYTES  4
+
+
+#define WL_SEQ_CMDS_GET_IOCTL_FILTER(cmd) \
+        (((cmd) == WLC_GET_MAGIC) || \
+         ((cmd) == WLC_GET_VERSION) || \
+         ((cmd) == WLC_GET_AP) || \
+         ((cmd) == WLC_GET_INSTANCE))
+
+
+
+#define WL_PKTENG_PER_TX_START          0x01
+#define WL_PKTENG_PER_TX_STOP           0x02
+#define WL_PKTENG_PER_RX_START          0x04
+#define WL_PKTENG_PER_RX_WITH_ACK_START     0x05
+#define WL_PKTENG_PER_TX_WITH_ACK_START     0x06
+#define WL_PKTENG_PER_RX_STOP           0x08
+#define WL_PKTENG_PER_MASK          0xff
+
+#define WL_PKTENG_SYNCHRONOUS           0x100   
+
+typedef struct wl_pkteng {
+        uint32 flags;
+        uint32 delay;           
+        uint32 nframes;         
+        uint32 length;          
+        uint8  seqno;           
+        struct ether_addr dest;     
+        struct ether_addr src;      
+} wl_pkteng_t;
+
+#define NUM_80211b_RATES    4
+#define NUM_80211ag_RATES   8
+#define NUM_80211n_RATES    32
+#define NUM_80211_RATES     (NUM_80211b_RATES+NUM_80211ag_RATES+NUM_80211n_RATES)
+typedef struct wl_pkteng_stats {
+        uint32 lostfrmcnt;      
+        int32 rssi;         
+        int32 snr;          
+        uint16 rxpktcnt[NUM_80211_RATES+1];
+} wl_pkteng_stats_t;
+
+
+#define WL_WOWL_MAGIC   (1 << 0)    
+#define WL_WOWL_NET (1 << 1)    
+#define WL_WOWL_DIS (1 << 2)    
+#define WL_WOWL_RETR    (1 << 3)    
+#define WL_WOWL_BCN (1 << 4)    
+#define WL_WOWL_TST (1 << 5)    
+#define WL_WOWL_M1      (1 << 6)        
+#define WL_WOWL_EAPID   (1 << 7)        
+#define WL_WOWL_KEYROT  (1 << 14)       
+#define WL_WOWL_BCAST   (1 << 15)   
+
+#define MAGIC_PKT_MINLEN 102    
+
+typedef struct {
+        uint masksize;      
+        uint offset;        
+        uint patternoffset; 
+        uint patternsize;   
+        ulong id;       
+        
+        
+} wl_wowl_pattern_t;
+
+typedef struct {
+        uint            count;
+        wl_wowl_pattern_t   pattern[1];
+} wl_wowl_pattern_list_t;
+
+typedef struct {
+        uint8   pci_wakeind;    
+        uint16  ucode_wakeind;  
+} wl_wowl_wakeind_t;
+
+
+typedef struct wl_txrate_class {
+        uint8       init_rate;
+        uint8       min_rate;
+        uint8       max_rate;
+} wl_txrate_class_t;
+
+
+
+
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_DEFAULT     20  
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MIN         5   
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MAX         1000    
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_DEFAULT      10  
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MIN          10  
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MAX          1000    
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_DEFAULT    300 
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MIN        10  
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MAX        900 
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_DEFAULT  5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MIN  5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MAX  100
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_DEFAULT 200 
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MIN 200 
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MAX 10000   
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_DEFAULT  20  
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MIN  20  
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MAX  10000   
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_DEFAULT    25  
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MIN        0   
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MAX        100 
+
+
+typedef struct wl_obss_scan_arg {
+        int16   passive_dwell;
+        int16   active_dwell;
+        int16   bss_widthscan_interval;
+        int16   passive_total;
+        int16   active_total;
+        int16   chanwidth_transition_delay;
+        int16   activity_threshold;
+} wl_obss_scan_arg_t;
+
+#define WL_OBSS_SCAN_PARAM_LEN  sizeof(wl_obss_scan_arg_t)
+#define WL_MIN_NUM_OBSS_SCAN_ARG 7  
+
+#define WL_COEX_INFO_MASK       0x07
+#define WL_COEX_INFO_REQ        0x01
+#define WL_COEX_40MHZ_INTOLERANT    0x02
+#define WL_COEX_WIDTH20         0x04
+
+#define WLC_RSSI_INVALID     0  
+
+#define MAX_RSSI_LEVELS 8
+
+
+typedef struct wl_rssi_event {
+        uint32 rate_limit_msec;     
+        uint8 num_rssi_levels;      
+        int8 rssi_levels[MAX_RSSI_LEVELS];  
+} wl_rssi_event_t;
+
+typedef struct wl_action_obss_coex_req {
+        uint8 info;
+        uint8 num;
+        uint8 ch_list[1];
+} wl_action_obss_coex_req_t;
+
+
+#define EXTLOG_CUR_VER      0x0100
+
+#define MAX_ARGSTR_LEN      18 
+
+
+#define LOG_MODULE_COMMON   0x0001
+#define LOG_MODULE_ASSOC    0x0002
+#define LOG_MODULE_EVENT    0x0004
+#define LOG_MODULE_MAX      3           
+
+
+#define WL_LOG_LEVEL_DISABLE    0
+#define WL_LOG_LEVEL_ERR    1
+#define WL_LOG_LEVEL_WARN   2
+#define WL_LOG_LEVEL_INFO   3
+#define WL_LOG_LEVEL_MAX    WL_LOG_LEVEL_INFO   
+
+
+#define LOG_FLAG_EVENT      1
+
+
+#define LOG_ARGTYPE_NULL    0
+#define LOG_ARGTYPE_STR     1   
+#define LOG_ARGTYPE_INT     2   
+#define LOG_ARGTYPE_INT_STR 3   
+#define LOG_ARGTYPE_STR_INT 4   
+
+typedef struct wlc_extlog_cfg {
+        int max_number;
+        uint16 module;  
+        uint8 level;
+        uint8 flag;
+        uint16 version;
+} wlc_extlog_cfg_t;
+
+typedef struct log_record {
+        uint32 time;
+        uint16 module;
+        uint16 id;
+        uint8 level;
+        uint8 sub_unit;
+        uint8 seq_num;
+        int32 arg;
+        char str[MAX_ARGSTR_LEN];
+} log_record_t;
+
+typedef struct wlc_extlog_req {
+        uint32 from_last;
+        uint32 num;
+} wlc_extlog_req_t;
+
+typedef struct wlc_extlog_results {
+        uint16 version;
+        uint16 record_len;
+        uint32 num;
+        log_record_t logs[1];
+} wlc_extlog_results_t;
+
+typedef struct log_idstr {
+        uint16  id;
+        uint16  flag;
+        uint8   arg_type;
+        const char  *fmt_str;
+} log_idstr_t;
+
+#define FMTSTRF_USER        1
+
+
+typedef enum {
+        FMTSTR_DRIVER_UP_ID = 0,
+        FMTSTR_DRIVER_DOWN_ID = 1,
+        FMTSTR_SUSPEND_MAC_FAIL_ID = 2,
+        FMTSTR_NO_PROGRESS_ID = 3,
+        FMTSTR_RFDISABLE_ID = 4,
+        FMTSTR_REG_PRINT_ID = 5,
+        FMTSTR_EXPTIME_ID = 6,
+        FMTSTR_JOIN_START_ID = 7,
+        FMTSTR_JOIN_COMPLETE_ID = 8,
+        FMTSTR_NO_NETWORKS_ID = 9,
+        FMTSTR_SECURITY_MISMATCH_ID = 10,
+        FMTSTR_RATE_MISMATCH_ID = 11,
+        FMTSTR_AP_PRUNED_ID = 12,
+        FMTSTR_KEY_INSERTED_ID = 13,
+        FMTSTR_DEAUTH_ID = 14,
+        FMTSTR_DISASSOC_ID = 15,
+        FMTSTR_LINK_UP_ID = 16,
+        FMTSTR_LINK_DOWN_ID = 17,
+        FMTSTR_RADIO_HW_OFF_ID = 18,
+        FMTSTR_RADIO_HW_ON_ID = 19,
+        FMTSTR_EVENT_DESC_ID = 20,
+        FMTSTR_PNP_SET_POWER_ID = 21,
+        FMTSTR_RADIO_SW_OFF_ID = 22,
+        FMTSTR_RADIO_SW_ON_ID = 23,
+        FMTSTR_PWD_MISMATCH_ID = 24,
+        FMTSTR_FATAL_ERROR_ID = 25,
+        FMTSTR_AUTH_FAIL_ID = 26,
+        FMTSTR_ASSOC_FAIL_ID = 27,
+        FMTSTR_IBSS_FAIL_ID = 28,
+        FMTSTR_EXTAP_FAIL_ID = 29,
+        FMTSTR_MAX_ID
+} log_fmtstr_id_t;
+
+#ifdef DONGLEOVERLAYS
+typedef struct {
+        uint32 flags_idx;       
+        uint32 offset;          
+        uint32 len;                     
+        
+} wl_ioctl_overlay_t;
+
+#define OVERLAY_IDX_MASK                0x000000ff
+#define OVERLAY_IDX_SHIFT               0
+#define OVERLAY_FLAGS_MASK              0xffffff00
+#define OVERLAY_FLAGS_SHIFT             8
+
+#define OVERLAY_FLAG_POSTLOAD   0x100
+
+#define OVERLAY_FLAG_DEFER_DL   0x200
+
+#define OVERLAY_FLAG_PRESLEEP   0x400
+
+#define OVERLAY_DOWNLOAD_CHUNKSIZE      1024
+#endif 
+
+
+#include <packed_section_end.h>
+
+
+#include <packed_section_start.h>
+
+#define VNDR_IE_CMD_LEN     4   
+
+
+#define VNDR_IE_BEACON_FLAG 0x1
+#define VNDR_IE_PRBRSP_FLAG 0x2
+#define VNDR_IE_ASSOCRSP_FLAG   0x4
+#define VNDR_IE_AUTHRSP_FLAG    0x8
+#define VNDR_IE_PRBREQ_FLAG 0x10
+#define VNDR_IE_ASSOCREQ_FLAG   0x20
+#define VNDR_IE_CUSTOM_FLAG 0x100 
+
+#define VNDR_IE_INFO_HDR_LEN    (sizeof(uint32))
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+        uint32 pktflag;         
+        vndr_ie_t vndr_ie_data;     
+} BWL_POST_PACKED_STRUCT vndr_ie_info_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+        int iecount;            
+        vndr_ie_info_t vndr_ie_list[1]; 
+} BWL_POST_PACKED_STRUCT vndr_ie_buf_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+        char cmd[VNDR_IE_CMD_LEN];  
+        vndr_ie_buf_t vndr_ie_buffer;   
+} BWL_POST_PACKED_STRUCT vndr_ie_setbuf_t;
+
+
+
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_hdr {
+        struct ether_addr staAddr;
+        uint16 ieLen;
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_hdr_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_data {
+        sta_prbreq_wps_ie_hdr_t hdr;
+        uint8 ieData[1];
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_list {
+        uint32 totLen;
+        uint8 ieDataList[1];
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_list_t;
+
+
+#ifdef WLMEDIA_TXFAILEVENT
+typedef BWL_PRE_PACKED_STRUCT struct {
+        char   dest[ETHER_ADDR_LEN]; 
+        uint8  prio;            
+        uint8  flags;           
+        uint32 tsf_l;           
+        uint32 tsf_h;           
+        uint16 rates;           
+        uint16 txstatus;        
+} BWL_POST_PACKED_STRUCT txfailinfo_t;
+#endif 
+
+#include <packed_section_end.h>
+
+
+#define ASSERTLOG_CUR_VER   0x0100
+#define MAX_ASSRTSTR_LEN    64
+
+typedef struct assert_record {
+        uint32 time;
+        uint8 seq_num;
+        char str[MAX_ASSRTSTR_LEN];
+} assert_record_t;
+
+typedef struct assertlog_results {
+        uint16 version;
+        uint16 record_len;
+        uint32 num;
+        assert_record_t logs[1];
+} assertlog_results_t;
+
+#define LOGRRC_FIX_LEN  8
+#define IOBUF_ALLOWED_NUM_OF_LOGREC(type, len) ((len - LOGRRC_FIX_LEN)/sizeof(type))
+
+
+
+
+
+#define CHANIM_DISABLE  0   
+#define CHANIM_DETECT   1   
+#define CHANIM_ACT  2   
+#define CHANIM_MODE_MAX 2
+
+
+#define APCS_IOCTL      1
+#define APCS_CHANIM     2
+#define APCS_CSTIMER    3
+#define APCS_BTA        4
+
+
+#define CHANIM_ACS_RECORD           10
+
+
+typedef struct {
+        bool valid;
+        uint8 trigger;
+        chanspec_t selected_chspc;
+        uint32 glitch_cnt;
+        uint8 ccastats;
+        uint timestamp;
+} chanim_acs_record_t;
+
+typedef struct {
+        chanim_acs_record_t acs_record[CHANIM_ACS_RECORD];
+        uint8 count;
+        uint timestamp;
+} wl_acs_record_t;
+
+
+
+#define SMFS_VERSION 1
+
+typedef struct wl_smfs_elem {
+        uint32 count;
+        uint16 code;  
+} wl_smfs_elem_t;
+
+typedef struct wl_smf_stats {
+        uint32 version;
+        uint16 length;  
+        uint8 type;
+        uint8 codetype;
+        uint32 ignored_cnt;
+        uint32 malformed_cnt;
+        uint32 count_total; 
+        wl_smfs_elem_t elem[1];
+} wl_smf_stats_t;
+
+#define WL_SMFSTATS_FIXED_LEN OFFSETOF(wl_smf_stats_t, elem);
+
+enum {
+        SMFS_CODETYPE_SC,
+        SMFS_CODETYPE_RC
+};
+
+
+#define SMFS_CODE_MALFORMED 0xFFFE
+#define SMFS_CODE_IGNORED   0xFFFD
+
+typedef enum smfs_type {
+        SMFS_TYPE_AUTH,
+        SMFS_TYPE_ASSOC,
+        SMFS_TYPE_REASSOC,
+        SMFS_TYPE_DISASSOC_TX,
+        SMFS_TYPE_DISASSOC_RX,
+        SMFS_TYPE_DEAUTH_TX,
+        SMFS_TYPE_DEAUTH_RX,
+        SMFS_TYPE_MAX
+} smfs_type_t;
+
+#ifdef PHYMON
+
+#define PHYMON_VERSION 1
+
+typedef struct wl_phycal_core_state {
+        
+        int16 tx_iqlocal_a;
+        int16 tx_iqlocal_b;
+        int8 tx_iqlocal_ci;
+        int8 tx_iqlocal_cq;
+        int8 tx_iqlocal_di;
+        int8 tx_iqlocal_dq;
+        int8 tx_iqlocal_ei;
+        int8 tx_iqlocal_eq;
+        int8 tx_iqlocal_fi;
+        int8 tx_iqlocal_fq;
+
+        
+        int16 rx_iqcal_a;
+        int16 rx_iqcal_b;
+
+        uint8 tx_iqlocal_pwridx; 
+        uint32 papd_epsilon_table[64]; 
+        int16 papd_epsilon_offset; 
+        uint8 curr_tx_pwrindex; 
+        int8 idle_tssi; 
+        int8 est_tx_pwr; 
+        int8 est_rx_pwr; 
+        uint16 rx_gaininfo; 
+        uint16 init_gaincode; 
+        int8 estirr_tx;
+        int8 estirr_rx;
+
+} wl_phycal_core_state_t;
+
+typedef struct wl_phycal_state {
+        int version;
+        int8 num_phy_cores; 
+        int8 curr_temperature; 
+        chanspec_t chspec; 
+        bool aci_state; 
+        uint16 crsminpower; 
+        uint16 crsminpowerl; 
+        uint16 crsminpoweru; 
+        wl_phycal_core_state_t phycal_core[1];
+} wl_phycal_state_t;
+
+#define WL_PHYCAL_STAT_FIXED_LEN OFFSETOF(wl_phycal_state_t, phycal_core)
+#endif 
+
+#ifdef WLP2P
+
+typedef struct wl_p2p_disc_st {
+        uint8 state;    
+        chanspec_t chspec;  
+        uint16 dwell;   
+} wl_p2p_disc_st_t;
+
+
+#define WL_P2P_DISC_ST_SCAN 0
+#define WL_P2P_DISC_ST_LISTEN   1
+#define WL_P2P_DISC_ST_SEARCH   2
+
+
+typedef struct wl_p2p_scan {
+        uint8 type;     
+        uint8 reserved[3];
+        
+} wl_p2p_scan_t;
+
+
+typedef struct wl_p2p_if {
+        struct ether_addr addr;
+        uint8 type; 
+        chanspec_t chspec;  
+} wl_p2p_if_t;
+
+
+#define WL_P2P_IF_CLIENT    0
+#define WL_P2P_IF_GO        1
+#define WL_P2P_IF_DYNBCN_GO     2
+#define WL_P2P_IF_DEV       3
+
+
+typedef struct wl_p2p_ifq {
+        uint bsscfgidx;
+        char ifname[BCM_MSG_IFNAME_MAX];
+} wl_p2p_ifq_t;
+
+
+typedef struct wl_p2p_ops {
+        uint8 ops;  
+        uint8 ctw;  
+} wl_p2p_ops_t;
+
+
+typedef struct wl_p2p_sched_desc {
+        uint32 start;
+        uint32 interval;
+        uint32 duration;
+        uint32 count;   
+} wl_p2p_sched_desc_t;
+
+
+#define WL_P2P_SCHED_RSVD   0
+#define WL_P2P_SCHED_REPEAT 255 
+
+typedef struct wl_p2p_sched {
+        uint8 type; 
+        uint8 action;   
+        uint8 option;   
+        wl_p2p_sched_desc_t desc[1];
+} wl_p2p_sched_t;
+#define WL_P2P_SCHED_FIXED_LEN      3
+
+
+#define WL_P2P_SCHED_TYPE_ABS       0   
+#define WL_P2P_SCHED_TYPE_REQ_ABS   1   
+
+
+#define WL_P2P_SCHED_ACTION_NONE    0   
+#define WL_P2P_SCHED_ACTION_DOZE    1   
+
+#define WL_P2P_SCHED_ACTION_GOOFF   2   
+
+#define WL_P2P_SCHED_ACTION_RESET   255 
+
+
+#define WL_P2P_SCHED_OPTION_NORMAL  0   
+#define WL_P2P_SCHED_OPTION_BCNPCT  1   
+
+#define WL_P2P_SCHED_OPTION_TSFOFS  2   
+
+
+#define WL_P2P_FEAT_GO_CSA      (1 << 0)        
+#define WL_P2P_FEAT_GO_NOLEGACY (1 << 1)        
+#define WL_P2P_FEAT_RESTRICT_DEV_RESP (1 << 2)  
+#endif 
+
+
+#define BCM_ACTION_RFAWARE      0x77
+#define BCM_ACTION_RFAWARE_DCS  0x01
+
+
+
+#define WL_11N_2x2          1
+#define WL_11N_3x3          3
+#define WL_11N_4x4          4
+
+
+#define WLFEATURE_DISABLE_11N       0x00000001
+#define WLFEATURE_DISABLE_11N_STBC_TX   0x00000002
+#define WLFEATURE_DISABLE_11N_STBC_RX   0x00000004
+#define WLFEATURE_DISABLE_11N_SGI_TX    0x00000008
+#define WLFEATURE_DISABLE_11N_SGI_RX    0x00000010
+#define WLFEATURE_DISABLE_11N_AMPDU_TX  0x00000020
+#define WLFEATURE_DISABLE_11N_AMPDU_RX  0x00000040
+#define WLFEATURE_DISABLE_11N_GF    0x00000080
+
+
+#define LQ_IDX_LAST             3
+#define MCS_INDEX_SIZE          33
+
+#define LQ_IDX_MIN              0
+#define LQ_IDX_MAX              1
+#define LQ_IDX_AVG              2
+#define LQ_IDX_SUM              2
+#define LQ_IDX_LAST             3
+#define LQ_STOP_MONITOR         0
+#define LQ_START_MONITOR        1
+
+#define LINKQUAL_V1     0x01
+
+struct  wl_lq {
+        int32 enable;
+        int32 rssi[LQ_IDX_LAST];    
+        int32 rssicnt;
+        int32 snr[LQ_IDX_LAST];     
+        uint32 nsamples;            
+        uint8 isvalid;              
+        uint8 version;
+}; 
+
+typedef struct wl_lq wl_lq_t;
+typedef struct wl_lq  wl_lq_stats_t;
+
+typedef struct {
+        struct  ether_addr ea;  
+        uint8   ac_cat; 
+        uint8   num_pkts;   
+} wl_mac_ratehisto_cmd_t;   
+
+
+typedef struct {
+        uint32  rate[WLC_MAXRATE + 1];  
+        uint32  mcs_index[MCS_INDEX_SIZE];  
+        uint32  tsf_timer[2][2];    
+} wl_mac_ratehisto_res_t;   
+
+#ifdef PROP_TXSTATUS
+
+
+#define WLFC_FLAGS_RSSI_SIGNALS                         1
+
+
+#define WLFC_FLAGS_XONXOFF_SIGNALS                      2
+
+
+#define WLFC_FLAGS_CREDIT_STATUS_SIGNALS        4
+
+#define WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE     8
+#define WLFC_FLAGS_PSQ_GENERATIONFSM_ENABLE     16
+#define WLFC_FLAGS_PSQ_ZERO_BUFFER_ENABLE       32
+#endif 
+
+#define BTA_STATE_LOG_SZ    64
+
+
+enum {
+        HCIReset = 1,
+        HCIReadLocalAMPInfo,
+        HCIReadLocalAMPASSOC,
+        HCIWriteRemoteAMPASSOC,
+        HCICreatePhysicalLink,
+        HCIAcceptPhysicalLinkRequest,
+        HCIDisconnectPhysicalLink,
+        HCICreateLogicalLink,
+        HCIAcceptLogicalLink,
+        HCIDisconnectLogicalLink,
+        HCILogicalLinkCancel,
+        HCIAmpStateChange,
+        HCIWriteLogicalLinkAcceptTimeout
+};
+
+typedef struct flush_txfifo {
+        uint32 txfifobmp;
+        uint32 hwtxfifoflush;
+        struct ether_addr ea;
+} flush_txfifo_t;
+
+#define CHANNEL_5G_LOW_START    36      
+#define CHANNEL_5G_MID_START    52      
+#define CHANNEL_5G_HIGH_START   100     
+#define CHANNEL_5G_UPPER_START  149     
+
+enum {
+        SPATIAL_MODE_2G_IDX = 0,
+        SPATIAL_MODE_5G_LOW_IDX,
+        SPATIAL_MODE_5G_MID_IDX,
+        SPATIAL_MODE_5G_HIGH_IDX,
+        SPATIAL_MODE_5G_UPPER_IDX,
+        SPATIAL_MODE_MAX_IDX
+};
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/linux_osl.c b/drivers/net/wireless/bcmdhd/linux_osl.c
new file mode 100644
index 00000000000..1a544378c1e
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/linux_osl.c
@@ -0,0 +1,919 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: linux_osl.c,v 1.168.2.7 2011-01-27 17:01:13 Exp $
+ */
+
+
+#define LINUX_PORT
+
+#include <typedefs.h>
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <linux/delay.h>
+#include <pcicfg.h>
+
+#ifdef BCMASSERT_LOG
+#include <bcm_assert_log.h>
+#endif
+
+#include <linux/fs.h>
+
+#define PCI_CFG_RETRY           10
+
+#define OS_HANDLE_MAGIC         0x1234abcd      
+#define BCM_MEM_FILENAME_LEN    24              
+
+#ifdef DHD_USE_STATIC_BUF
+#define STATIC_BUF_MAX_NUM      16
+#define STATIC_BUF_SIZE         (PAGE_SIZE * 2)
+#define STATIC_BUF_TOTAL_LEN    (STATIC_BUF_MAX_NUM * STATIC_BUF_SIZE)
+
+typedef struct bcm_static_buf {
+        struct semaphore static_sem;
+        unsigned char *buf_ptr;
+        unsigned char buf_use[STATIC_BUF_MAX_NUM];
+} bcm_static_buf_t;
+
+static bcm_static_buf_t *bcm_static_buf = 0;
+
+#define STATIC_PKT_MAX_NUM      8
+
+typedef struct bcm_static_pkt {
+        struct sk_buff *skb_4k[STATIC_PKT_MAX_NUM];
+        struct sk_buff *skb_8k[STATIC_PKT_MAX_NUM];
+        struct semaphore osl_pkt_sem;
+        unsigned char pkt_use[STATIC_PKT_MAX_NUM * 2];
+} bcm_static_pkt_t;
+
+static bcm_static_pkt_t *bcm_static_skb = 0;
+#endif 
+
+typedef struct bcm_mem_link {
+        struct bcm_mem_link *prev;
+        struct bcm_mem_link *next;
+        uint    size;
+        int     line;
+        char    file[BCM_MEM_FILENAME_LEN];
+} bcm_mem_link_t;
+
+struct osl_info {
+        osl_pubinfo_t pub;
+#ifdef CTFPOOL
+        ctfpool_t *ctfpool;
+#endif 
+        uint magic;
+        void *pdev;
+        atomic_t malloced;
+        uint failed;
+        uint bustype;
+        bcm_mem_link_t *dbgmem_list;
+};
+
+
+
+
+uint32 g_assert_type = FALSE;
+
+static int16 linuxbcmerrormap[] =
+{       0,                      
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -E2BIG,                 
+        -E2BIG,                 
+        -EBUSY,                 
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EFAULT,                
+        -ENOMEM,                
+        -EOPNOTSUPP,            
+        -EMSGSIZE,              
+        -EINVAL,                
+        -EPERM,                 
+        -ENOMEM,                
+        -EINVAL,                
+        -ERANGE,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EINVAL,                
+        -EIO,                   
+        -ENODEV,                
+        -EINVAL,                
+        -EIO,                   
+        -EIO,                   
+        -ENODEV,                
+        -EINVAL,                
+        -ENODATA,               
+
+
+
+#if BCME_LAST != -42
+#error "You need to add a OS error translation in the linuxbcmerrormap \
+        for new error code defined in bcmutils.h"
+#endif
+};
+
+
+int
+osl_error(int bcmerror)
+{
+        if (bcmerror > 0)
+                bcmerror = 0;
+        else if (bcmerror < BCME_LAST)
+                bcmerror = BCME_ERROR;
+
+        
+        return linuxbcmerrormap[-bcmerror];
+}
+
+extern uint8* dhd_os_prealloc(void *osh, int section, int size);
+
+osl_t *
+osl_attach(void *pdev, uint bustype, bool pkttag)
+{
+        osl_t *osh;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+        gfp_t flags;
+
+        flags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+        osh = kmalloc(sizeof(osl_t), flags);
+#else
+        osh = kmalloc(sizeof(osl_t), GFP_ATOMIC);
+#endif 
+        ASSERT(osh);
+
+        bzero(osh, sizeof(osl_t));
+
+        
+        ASSERT(ABS(BCME_LAST) == (ARRAYSIZE(linuxbcmerrormap) - 1));
+
+        osh->magic = OS_HANDLE_MAGIC;
+        atomic_set(&osh->malloced, 0);
+        osh->failed = 0;
+        osh->dbgmem_list = NULL;
+        osh->pdev = pdev;
+        osh->pub.pkttag = pkttag;
+        osh->bustype = bustype;
+
+        switch (bustype) {
+                case PCI_BUS:
+                case SI_BUS:
+                case PCMCIA_BUS:
+                        osh->pub.mmbus = TRUE;
+                        break;
+                case JTAG_BUS:
+                case SDIO_BUS:
+                case USB_BUS:
+                case SPI_BUS:
+                case RPC_BUS:
+                        osh->pub.mmbus = FALSE;
+                        break;
+                default:
+                        ASSERT(FALSE);
+                        break;
+        }
+
+#if defined(DHD_USE_STATIC_BUF)
+        if (!bcm_static_buf) {
+                if (!(bcm_static_buf = (bcm_static_buf_t *)dhd_os_prealloc(osh, 3, STATIC_BUF_SIZE+
+                        STATIC_BUF_TOTAL_LEN))) {
+                        printk("can not alloc static buf!\n");
+                }
+                else
+                        printk("alloc static buf at %x!\n", (unsigned int)bcm_static_buf);
+
+
+                sema_init(&bcm_static_buf->static_sem, 1);
+
+                bcm_static_buf->buf_ptr = (unsigned char *)bcm_static_buf + STATIC_BUF_SIZE;
+        }
+
+        if (!bcm_static_skb) {
+                int i;
+                void *skb_buff_ptr = 0;
+                bcm_static_skb = (bcm_static_pkt_t *)((char *)bcm_static_buf + 2048);
+                skb_buff_ptr = dhd_os_prealloc(osh, 4, 0);
+
+                bcopy(skb_buff_ptr, bcm_static_skb, sizeof(struct sk_buff *) * 16);
+                for (i = 0; i < STATIC_PKT_MAX_NUM * 2; i++)
+                        bcm_static_skb->pkt_use[i] = 0;
+
+                sema_init(&bcm_static_skb->osl_pkt_sem, 1);
+        }
+#endif 
+
+        return osh;
+}
+
+void
+osl_detach(osl_t *osh)
+{
+        if (osh == NULL)
+                return;
+
+        ASSERT(osh->magic == OS_HANDLE_MAGIC);
+        kfree(osh);
+}
+
+static struct sk_buff *osl_alloc_skb(unsigned int len)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+        gfp_t flags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+
+        return __dev_alloc_skb(len, flags);
+#else
+        return dev_alloc_skb(len);
+#endif
+}
+
+#ifdef CTFPOOL
+
+void *
+osl_ctfpool_add(osl_t *osh)
+{
+        struct sk_buff *skb;
+
+        if ((osh == NULL) || (osh->ctfpool == NULL))
+                return NULL;
+
+        spin_lock_bh(&osh->ctfpool->lock);
+        ASSERT(osh->ctfpool->curr_obj <= osh->ctfpool->max_obj);
+
+        
+        if (osh->ctfpool->curr_obj == osh->ctfpool->max_obj) {
+                spin_unlock_bh(&osh->ctfpool->lock);
+                return NULL;
+        }
+
+        
+        skb = osl_alloc_skb(osh->ctfpool->obj_size);
+        if (skb == NULL) {
+                printf("%s: skb alloc of len %d failed\n", __FUNCTION__,
+                       osh->ctfpool->obj_size);
+                spin_unlock_bh(&osh->ctfpool->lock);
+                return NULL;
+        }
+
+        
+        skb->next = (struct sk_buff *)osh->ctfpool->head;
+        osh->ctfpool->head = skb;
+        osh->ctfpool->fast_frees++;
+        osh->ctfpool->curr_obj++;
+
+        
+        CTFPOOLPTR(osh, skb) = (void *)osh->ctfpool;
+
+        
+        PKTFAST(osh, skb) = FASTBUF;
+
+        spin_unlock_bh(&osh->ctfpool->lock);
+
+        return skb;
+}
+
+
+void
+osl_ctfpool_replenish(osl_t *osh, uint thresh)
+{
+        if ((osh == NULL) || (osh->ctfpool == NULL))
+                return;
+
+        
+        while ((osh->ctfpool->refills > 0) && (thresh--)) {
+                osl_ctfpool_add(osh);
+                osh->ctfpool->refills--;
+        }
+}
+
+
+int32
+osl_ctfpool_init(osl_t *osh, uint numobj, uint size)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+        gfp_t flags;
+
+        flags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+        osh->ctfpool = kmalloc(sizeof(ctfpool_t), flags);
+#else
+        osh->ctfpool = kmalloc(sizeof(ctfpool_t), GFP_ATOMIC);
+#endif 
+        ASSERT(osh->ctfpool);
+        bzero(osh->ctfpool, sizeof(ctfpool_t));
+
+        osh->ctfpool->max_obj = numobj;
+        osh->ctfpool->obj_size = size;
+
+        spin_lock_init(&osh->ctfpool->lock);
+
+        while (numobj--) {
+                if (!osl_ctfpool_add(osh))
+                        return -1;
+                osh->ctfpool->fast_frees--;
+        }
+
+        return 0;
+}
+
+
+void
+osl_ctfpool_cleanup(osl_t *osh)
+{
+        struct sk_buff *skb, *nskb;
+
+        if ((osh == NULL) || (osh->ctfpool == NULL))
+                return;
+
+        spin_lock_bh(&osh->ctfpool->lock);
+
+        skb = osh->ctfpool->head;
+
+        while (skb != NULL) {
+                nskb = skb->next;
+                dev_kfree_skb(skb);
+                skb = nskb;
+                osh->ctfpool->curr_obj--;
+        }
+
+        ASSERT(osh->ctfpool->curr_obj == 0);
+        osh->ctfpool->head = NULL;
+        spin_unlock_bh(&osh->ctfpool->lock);
+
+        kfree(osh->ctfpool);
+        osh->ctfpool = NULL;
+}
+
+void
+osl_ctfpool_stats(osl_t *osh, void *b)
+{
+        struct bcmstrbuf *bb;
+
+        if ((osh == NULL) || (osh->ctfpool == NULL))
+                return;
+
+#ifdef DHD_USE_STATIC_BUF
+        if (bcm_static_buf) {
+                bcm_static_buf = 0;
+        }
+        if (bcm_static_skb) {
+                bcm_static_skb = 0;
+        }
+#endif 
+
+        bb = b;
+
+        ASSERT((osh != NULL) && (bb != NULL));
+
+        bcm_bprintf(bb, "max_obj %d obj_size %d curr_obj %d refills %d\n",
+                    osh->ctfpool->max_obj, osh->ctfpool->obj_size,
+                    osh->ctfpool->curr_obj, osh->ctfpool->refills);
+        bcm_bprintf(bb, "fast_allocs %d fast_frees %d slow_allocs %d\n",
+                    osh->ctfpool->fast_allocs, osh->ctfpool->fast_frees,
+                    osh->ctfpool->slow_allocs);
+}
+
+static inline struct sk_buff *
+osl_pktfastget(osl_t *osh, uint len)
+{
+        struct sk_buff *skb;
+
+        
+        if (osh->ctfpool == NULL)
+                return NULL;
+
+        spin_lock_bh(&osh->ctfpool->lock);
+        if (osh->ctfpool->head == NULL) {
+                ASSERT(osh->ctfpool->curr_obj == 0);
+                osh->ctfpool->slow_allocs++;
+                spin_unlock_bh(&osh->ctfpool->lock);
+                return NULL;
+        }
+
+        ASSERT(len <= osh->ctfpool->obj_size);
+
+        
+        skb = (struct sk_buff *)osh->ctfpool->head;
+        osh->ctfpool->head = (void *)skb->next;
+
+        osh->ctfpool->fast_allocs++;
+        osh->ctfpool->curr_obj--;
+        ASSERT(CTFPOOLHEAD(osh, skb) == (struct sock *)osh->ctfpool->head);
+        spin_unlock_bh(&osh->ctfpool->lock);
+
+        
+        skb->next = skb->prev = NULL;
+        skb->data = skb->head + 16;
+        skb->tail = skb->head + 16;
+
+        skb->len = 0;
+        skb->cloned = 0;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
+        skb->list = NULL;
+#endif
+        atomic_set(&skb->users, 1);
+
+        return skb;
+}
+#endif
+
+
+void * BCMFASTPATH
+osl_pktget(osl_t *osh, uint len)
+{
+        struct sk_buff *skb;
+
+#ifdef CTFPOOL
+        skb = osl_pktfastget(osh, len);
+        if ((skb != NULL) || ((skb = osl_alloc_skb(len)) != NULL)) {
+#else
+        if ((skb = osl_alloc_skb(len))) {
+#endif
+                skb_put(skb, len);
+                skb->priority = 0;
+
+                osh->pub.pktalloced++;
+        }
+
+        return ((void*) skb);
+}
+
+#ifdef CTFPOOL
+static inline void
+osl_pktfastfree(osl_t *osh, struct sk_buff *skb)
+{
+        ctfpool_t *ctfpool;
+
+        ctfpool = (ctfpool_t *)CTFPOOLPTR(osh, skb);
+        ASSERT(ctfpool != NULL);
+
+        
+        spin_lock_bh(&ctfpool->lock);
+        skb->next = (struct sk_buff *)ctfpool->head;
+        ctfpool->head = (void *)skb;
+
+        ctfpool->fast_frees++;
+        ctfpool->curr_obj++;
+
+        ASSERT(ctfpool->curr_obj <= ctfpool->max_obj);
+        spin_unlock_bh(&ctfpool->lock);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+        skb->tstamp.tv.sec = 0;
+#else
+        skb->stamp.tv_sec = 0;
+#endif
+
+        
+        skb->dev = NULL;
+        skb->dst = NULL;
+        memset(skb->cb, 0, sizeof(skb->cb));
+        skb->ip_summed = 0;
+        skb->destructor = NULL;
+}
+#endif 
+
+
+void BCMFASTPATH
+osl_pktfree(osl_t *osh, void *p, bool send)
+{
+        struct sk_buff *skb, *nskb;
+
+        skb = (struct sk_buff*) p;
+
+        if (send && osh->pub.tx_fn)
+                osh->pub.tx_fn(osh->pub.tx_ctx, p, 0);
+
+        
+        while (skb) {
+                nskb = skb->next;
+                skb->next = NULL;
+
+
+#ifdef CTFPOOL
+                if (PKTISFAST(osh, skb))
+                        osl_pktfastfree(osh, skb);
+                else {
+#else 
+                {
+#endif 
+
+                        if (skb->destructor)
+                                
+                                dev_kfree_skb_any(skb);
+                        else
+                                
+                                dev_kfree_skb(skb);
+                }
+
+                osh->pub.pktalloced--;
+
+                skb = nskb;
+        }
+}
+
+#ifdef DHD_USE_STATIC_BUF
+void *
+osl_pktget_static(osl_t *osh, uint len)
+{
+        int i;
+        struct sk_buff *skb;
+
+        if (len > (PAGE_SIZE * 2)) {
+                printk("%s: attempt to allocate huge packet (0x%x)\n", __FUNCTION__, len);
+                return osl_pktget(osh, len);
+        }
+
+        down(&bcm_static_skb->osl_pkt_sem);
+
+        if (len <= PAGE_SIZE) {
+                for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+                        if (bcm_static_skb->pkt_use[i] == 0)
+                                break;
+                }
+
+                if (i != STATIC_PKT_MAX_NUM) {
+                        bcm_static_skb->pkt_use[i] = 1;
+                        up(&bcm_static_skb->osl_pkt_sem);
+                        skb = bcm_static_skb->skb_4k[i];
+                        skb->tail = skb->data + len;
+                        skb->len = len;
+                        return skb;
+                }
+        }
+
+
+        for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+                if (bcm_static_skb->pkt_use[i+STATIC_PKT_MAX_NUM] == 0)
+                        break;
+        }
+
+        if (i != STATIC_PKT_MAX_NUM) {
+                bcm_static_skb->pkt_use[i+STATIC_PKT_MAX_NUM] = 1;
+                up(&bcm_static_skb->osl_pkt_sem);
+                skb = bcm_static_skb->skb_8k[i];
+                skb->tail = skb->data + len;
+                skb->len = len;
+                return skb;
+        }
+
+        up(&bcm_static_skb->osl_pkt_sem);
+        printk("%s: all static pkt in use!\n", __FUNCTION__);
+        return osl_pktget(osh, len);
+}
+
+void
+osl_pktfree_static(osl_t *osh, void *p, bool send)
+{
+        int i;
+
+        for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+                if (p == bcm_static_skb->skb_4k[i]) {
+                        down(&bcm_static_skb->osl_pkt_sem);
+                        bcm_static_skb->pkt_use[i] = 0;
+                        up(&bcm_static_skb->osl_pkt_sem);
+                        return;
+                }
+        }
+
+        for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+                if (p == bcm_static_skb->skb_8k[i]) {
+                        down(&bcm_static_skb->osl_pkt_sem);
+                        bcm_static_skb->pkt_use[i + STATIC_PKT_MAX_NUM] = 0;
+                        up(&bcm_static_skb->osl_pkt_sem);
+                        return;
+                }
+        }
+
+        return osl_pktfree(osh, p, send);
+}
+#endif 
+
+uint32
+osl_pci_read_config(osl_t *osh, uint offset, uint size)
+{
+        uint val = 0;
+        uint retry = PCI_CFG_RETRY;
+
+        ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+        
+        ASSERT(size == 4);
+
+        do {
+                pci_read_config_dword(osh->pdev, offset, &val);
+                if (val != 0xffffffff)
+                        break;
+        } while (retry--);
+
+
+        return (val);
+}
+
+void
+osl_pci_write_config(osl_t *osh, uint offset, uint size, uint val)
+{
+        uint retry = PCI_CFG_RETRY;
+
+        ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+        
+        ASSERT(size == 4);
+
+        do {
+                pci_write_config_dword(osh->pdev, offset, val);
+                if (offset != PCI_BAR0_WIN)
+                        break;
+                if (osl_pci_read_config(osh, offset, size) == val)
+                        break;
+        } while (retry--);
+
+}
+
+
+uint
+osl_pci_bus(osl_t *osh)
+{
+        ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+        return ((struct pci_dev *)osh->pdev)->bus->number;
+}
+
+
+uint
+osl_pci_slot(osl_t *osh)
+{
+        ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+        return PCI_SLOT(((struct pci_dev *)osh->pdev)->devfn);
+}
+
+static void
+osl_pcmcia_attr(osl_t *osh, uint offset, char *buf, int size, bool write)
+{
+}
+
+void
+osl_pcmcia_read_attr(osl_t *osh, uint offset, void *buf, int size)
+{
+        osl_pcmcia_attr(osh, offset, (char *) buf, size, FALSE);
+}
+
+void
+osl_pcmcia_write_attr(osl_t *osh, uint offset, void *buf, int size)
+{
+        osl_pcmcia_attr(osh, offset, (char *) buf, size, TRUE);
+}
+
+void *
+osl_malloc(osl_t *osh, uint size)
+{
+        void *addr;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+        gfp_t flags;
+
+        
+        if (osh)
+                ASSERT(osh->magic == OS_HANDLE_MAGIC);
+
+        flags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+        if ((addr = kmalloc(size, flags)) == NULL) {
+#else
+        if ((addr = kmalloc(size, GFP_ATOMIC)) == NULL) {
+#endif 
+                if (osh)
+                        osh->failed++;
+                return (NULL);
+        }
+        if (osh)
+                atomic_add(size, &osh->malloced);
+
+        return (addr);
+}
+
+void
+osl_mfree(osl_t *osh, void *addr, uint size)
+{
+        if (osh) {
+                ASSERT(osh->magic == OS_HANDLE_MAGIC);
+                atomic_sub(size, &osh->malloced);
+        }
+        kfree(addr);
+}
+
+uint
+osl_malloced(osl_t *osh)
+{
+        ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+        return (atomic_read(&osh->malloced));
+}
+
+uint
+osl_malloc_failed(osl_t *osh)
+{
+        ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+        return (osh->failed);
+}
+
+
+
+uint
+osl_dma_consistent_align(void)
+{
+        return (PAGE_SIZE);
+}
+
+void*
+osl_dma_alloc_consistent(osl_t *osh, uint size, uint16 align_bits, uint *alloced, ulong *pap)
+{
+        uint16 align = (1 << align_bits);
+        ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+        if (!ISALIGNED(DMA_CONSISTENT_ALIGN, align))
+                size += align;
+        *alloced = size;
+
+        return (pci_alloc_consistent(osh->pdev, size, (dma_addr_t*)pap));
+}
+
+void
+osl_dma_free_consistent(osl_t *osh, void *va, uint size, ulong pa)
+{
+        ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+        pci_free_consistent(osh->pdev, size, va, (dma_addr_t)pa);
+}
+
+uint BCMFASTPATH
+osl_dma_map(osl_t *osh, void *va, uint size, int direction)
+{
+        int dir;
+
+        ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+        dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+        return (pci_map_single(osh->pdev, va, size, dir));
+}
+
+void BCMFASTPATH
+osl_dma_unmap(osl_t *osh, uint pa, uint size, int direction)
+{
+        int dir;
+
+        ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+        dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+        pci_unmap_single(osh->pdev, (uint32)pa, size, dir);
+}
+
+#if defined(BCMASSERT_LOG)
+void
+osl_assert(char *exp, char *file, int line)
+{
+        char tempbuf[256];
+        char *basename;
+
+        basename = strrchr(file, '/');
+        
+        if (basename)
+                basename++;
+
+        if (!basename)
+                basename = file;
+
+#ifdef BCMASSERT_LOG
+        snprintf(tempbuf, 64, "\"%s\": file \"%s\", line %d\n",
+                exp, basename, line);
+
+        bcm_assert_log(tempbuf);
+#endif 
+
+
+}
+#endif 
+
+void
+osl_delay(uint usec)
+{
+        uint d;
+
+        while (usec > 0) {
+                d = MIN(usec, 1000);
+                udelay(d);
+                usec -= d;
+        }
+}
+
+
+
+void *
+osl_pktdup(osl_t *osh, void *skb)
+{
+        void * p;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+        gfp_t flags;
+
+        flags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+        if ((p = skb_clone((struct sk_buff *)skb, flags)) == NULL)
+#else
+        if ((p = skb_clone((struct sk_buff*)skb, GFP_ATOMIC)) == NULL)
+#endif 
+                return NULL;
+
+#ifdef CTFPOOL
+        if (PKTISFAST(osh, skb)) {
+                ctfpool_t *ctfpool;
+
+                
+                ctfpool = (ctfpool_t *)CTFPOOLPTR(osh, skb);
+                ASSERT(ctfpool != NULL);
+                PKTCLRFAST(osh, p);
+                PKTCLRFAST(osh, skb);
+                ctfpool->refills++;
+        }
+#endif 
+
+        
+        if (osh->pub.pkttag)
+                bzero((void*)((struct sk_buff *)p)->cb, OSL_PKTTAG_SZ);
+
+        
+        osh->pub.pktalloced++;
+        return (p);
+}
+
+
+
+
+
+
+
+void *
+osl_os_open_image(char *filename)
+{
+        struct file *fp;
+
+        fp = filp_open(filename, O_RDONLY, 0);
+        
+         if (IS_ERR(fp))
+                 fp = NULL;
+
+         return fp;
+}
+
+int
+osl_os_get_image_block(char *buf, int len, void *image)
+{
+        struct file *fp = (struct file *)image;
+        int rdlen;
+
+        if (!image)
+                return 0;
+
+        rdlen = kernel_read(fp, fp->f_pos, buf, len);
+        if (rdlen > 0)
+                fp->f_pos += rdlen;
+
+        return rdlen;
+}
+
+void
+osl_os_close_image(void *image)
+{
+        if (image)
+                filp_close((struct file *)image, NULL);
+}
diff --git a/drivers/net/wireless/bcmdhd/sbutils.c b/drivers/net/wireless/bcmdhd/sbutils.c
new file mode 100644
index 00000000000..02d1bc0a79d
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/sbutils.c
@@ -0,0 +1,992 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: sbutils.c,v 1.687.2.1 2010-11-29 20:21:56 Exp $
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+#include <sbpcmcia.h>
+
+#include "siutils_priv.h"
+
+
+/* local prototypes */
+static uint _sb_coreidx(si_info_t *sii, uint32 sba);
+static uint _sb_scan(si_info_t *sii, uint32 sba, void *regs, uint bus, uint32 sbba,
+                     uint ncores);
+static uint32 _sb_coresba(si_info_t *sii);
+static void *_sb_setcoreidx(si_info_t *sii, uint coreidx);
+
+#define SET_SBREG(sii, r, mask, val)    \
+                W_SBREG((sii), (r), ((R_SBREG((sii), (r)) & ~(mask)) | (val)))
+#define REGS2SB(va)     (sbconfig_t*) ((int8*)(va) + SBCONFIGOFF)
+
+/* sonicsrev */
+#define SONICS_2_2      (SBIDL_RV_2_2 >> SBIDL_RV_SHIFT)
+#define SONICS_2_3      (SBIDL_RV_2_3 >> SBIDL_RV_SHIFT)
+
+#define R_SBREG(sii, sbr)       sb_read_sbreg((sii), (sbr))
+#define W_SBREG(sii, sbr, v)    sb_write_sbreg((sii), (sbr), (v))
+#define AND_SBREG(sii, sbr, v)  W_SBREG((sii), (sbr), (R_SBREG((sii), (sbr)) & (v)))
+#define OR_SBREG(sii, sbr, v)   W_SBREG((sii), (sbr), (R_SBREG((sii), (sbr)) | (v)))
+
+static uint32
+sb_read_sbreg(si_info_t *sii, volatile uint32 *sbr)
+{
+        uint8 tmp;
+        uint32 val, intr_val = 0;
+
+
+        /*
+         * compact flash only has 11 bits address, while we needs 12 bits address.
+         * MEM_SEG will be OR'd with other 11 bits address in hardware,
+         * so we program MEM_SEG with 12th bit when necessary(access sb regsiters).
+         * For normal PCMCIA bus(CFTable_regwinsz > 2k), do nothing special
+         */
+        if (PCMCIA(sii)) {
+                INTR_OFF(sii, intr_val);
+                tmp = 1;
+                OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+                sbr = (volatile uint32 *)((uintptr)sbr & ~(1 << 11)); /* mask out bit 11 */
+        }
+
+        val = R_REG(sii->osh, sbr);
+
+        if (PCMCIA(sii)) {
+                tmp = 0;
+                OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+                INTR_RESTORE(sii, intr_val);
+        }
+
+        return (val);
+}
+
+static void
+sb_write_sbreg(si_info_t *sii, volatile uint32 *sbr, uint32 v)
+{
+        uint8 tmp;
+        volatile uint32 dummy;
+        uint32 intr_val = 0;
+
+
+        /*
+         * compact flash only has 11 bits address, while we needs 12 bits address.
+         * MEM_SEG will be OR'd with other 11 bits address in hardware,
+         * so we program MEM_SEG with 12th bit when necessary(access sb regsiters).
+         * For normal PCMCIA bus(CFTable_regwinsz > 2k), do nothing special
+         */
+        if (PCMCIA(sii)) {
+                INTR_OFF(sii, intr_val);
+                tmp = 1;
+                OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+                sbr = (volatile uint32 *)((uintptr)sbr & ~(1 << 11)); /* mask out bit 11 */
+        }
+
+        if (BUSTYPE(sii->pub.bustype) == PCMCIA_BUS) {
+                dummy = R_REG(sii->osh, sbr);
+                W_REG(sii->osh, (volatile uint16 *)sbr, (uint16)(v & 0xffff));
+                dummy = R_REG(sii->osh, sbr);
+                W_REG(sii->osh, ((volatile uint16 *)sbr + 1), (uint16)((v >> 16) & 0xffff));
+        } else
+                W_REG(sii->osh, sbr, v);
+
+        if (PCMCIA(sii)) {
+                tmp = 0;
+                OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+                INTR_RESTORE(sii, intr_val);
+        }
+}
+
+uint
+sb_coreid(si_t *sih)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        return ((R_SBREG(sii, &sb->sbidhigh) & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT);
+}
+
+uint
+sb_intflag(si_t *sih)
+{
+        si_info_t *sii;
+        void *corereg;
+        sbconfig_t *sb;
+        uint origidx, intflag, intr_val = 0;
+
+        sii = SI_INFO(sih);
+
+        INTR_OFF(sii, intr_val);
+        origidx = si_coreidx(sih);
+        corereg = si_setcore(sih, CC_CORE_ID, 0);
+        ASSERT(corereg != NULL);
+        sb = REGS2SB(corereg);
+        intflag = R_SBREG(sii, &sb->sbflagst);
+        sb_setcoreidx(sih, origidx);
+        INTR_RESTORE(sii, intr_val);
+
+        return intflag;
+}
+
+uint
+sb_flag(si_t *sih)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        return R_SBREG(sii, &sb->sbtpsflag) & SBTPS_NUM0_MASK;
+}
+
+void
+sb_setint(si_t *sih, int siflag)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+        uint32 vec;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        if (siflag == -1)
+                vec = 0;
+        else
+                vec = 1 << siflag;
+        W_SBREG(sii, &sb->sbintvec, vec);
+}
+
+/* return core index of the core with address 'sba' */
+static uint
+_sb_coreidx(si_info_t *sii, uint32 sba)
+{
+        uint i;
+
+        for (i = 0; i < sii->numcores; i ++)
+                if (sba == sii->coresba[i])
+                        return i;
+        return BADIDX;
+}
+
+/* return core address of the current core */
+static uint32
+_sb_coresba(si_info_t *sii)
+{
+        uint32 sbaddr;
+
+
+        switch (BUSTYPE(sii->pub.bustype)) {
+        case SI_BUS: {
+                sbconfig_t *sb = REGS2SB(sii->curmap);
+                sbaddr = sb_base(R_SBREG(sii, &sb->sbadmatch0));
+                break;
+        }
+
+        case PCI_BUS:
+                sbaddr = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+                break;
+
+        case PCMCIA_BUS: {
+                uint8 tmp = 0;
+                OSL_PCMCIA_READ_ATTR(sii->osh, PCMCIA_ADDR0, &tmp, 1);
+                sbaddr  = (uint32)tmp << 12;
+                OSL_PCMCIA_READ_ATTR(sii->osh, PCMCIA_ADDR1, &tmp, 1);
+                sbaddr |= (uint32)tmp << 16;
+                OSL_PCMCIA_READ_ATTR(sii->osh, PCMCIA_ADDR2, &tmp, 1);
+                sbaddr |= (uint32)tmp << 24;
+                break;
+        }
+
+        case SPI_BUS:
+        case SDIO_BUS:
+                sbaddr = (uint32)(uintptr)sii->curmap;
+                break;
+
+
+        default:
+                sbaddr = BADCOREADDR;
+                break;
+        }
+
+        return sbaddr;
+}
+
+uint
+sb_corevendor(si_t *sih)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        return ((R_SBREG(sii, &sb->sbidhigh) & SBIDH_VC_MASK) >> SBIDH_VC_SHIFT);
+}
+
+uint
+sb_corerev(si_t *sih)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+        uint sbidh;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+        sbidh = R_SBREG(sii, &sb->sbidhigh);
+
+        return (SBCOREREV(sbidh));
+}
+
+/* set core-specific control flags */
+void
+sb_core_cflags_wo(si_t *sih, uint32 mask, uint32 val)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+        uint32 w;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        ASSERT((val & ~mask) == 0);
+
+        /* mask and set */
+        w = (R_SBREG(sii, &sb->sbtmstatelow) & ~(mask << SBTML_SICF_SHIFT)) |
+                (val << SBTML_SICF_SHIFT);
+        W_SBREG(sii, &sb->sbtmstatelow, w);
+}
+
+/* set/clear core-specific control flags */
+uint32
+sb_core_cflags(si_t *sih, uint32 mask, uint32 val)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+        uint32 w;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        ASSERT((val & ~mask) == 0);
+
+        /* mask and set */
+        if (mask || val) {
+                w = (R_SBREG(sii, &sb->sbtmstatelow) & ~(mask << SBTML_SICF_SHIFT)) |
+                        (val << SBTML_SICF_SHIFT);
+                W_SBREG(sii, &sb->sbtmstatelow, w);
+        }
+
+        /* return the new value
+         * for write operation, the following readback ensures the completion of write opration.
+         */
+        return (R_SBREG(sii, &sb->sbtmstatelow) >> SBTML_SICF_SHIFT);
+}
+
+/* set/clear core-specific status flags */
+uint32
+sb_core_sflags(si_t *sih, uint32 mask, uint32 val)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+        uint32 w;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        ASSERT((val & ~mask) == 0);
+        ASSERT((mask & ~SISF_CORE_BITS) == 0);
+
+        /* mask and set */
+        if (mask || val) {
+                w = (R_SBREG(sii, &sb->sbtmstatehigh) & ~(mask << SBTMH_SISF_SHIFT)) |
+                        (val << SBTMH_SISF_SHIFT);
+                W_SBREG(sii, &sb->sbtmstatehigh, w);
+        }
+
+        /* return the new value */
+        return (R_SBREG(sii, &sb->sbtmstatehigh) >> SBTMH_SISF_SHIFT);
+}
+
+bool
+sb_iscoreup(si_t *sih)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        return ((R_SBREG(sii, &sb->sbtmstatelow) &
+                 (SBTML_RESET | SBTML_REJ_MASK | (SICF_CLOCK_EN << SBTML_SICF_SHIFT))) ==
+                (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
+}
+
+/*
+ * Switch to 'coreidx', issue a single arbitrary 32bit register mask&set operation,
+ * switch back to the original core, and return the new value.
+ *
+ * When using the silicon backplane, no fidleing with interrupts or core switches are needed.
+ *
+ * Also, when using pci/pcie, we can optimize away the core switching for pci registers
+ * and (on newer pci cores) chipcommon registers.
+ */
+uint
+sb_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+        uint origidx = 0;
+        uint32 *r = NULL;
+        uint w;
+        uint intr_val = 0;
+        bool fast = FALSE;
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        ASSERT(GOODIDX(coreidx));
+        ASSERT(regoff < SI_CORE_SIZE);
+        ASSERT((val & ~mask) == 0);
+
+        if (coreidx >= SI_MAXCORES)
+                return 0;
+
+        if (BUSTYPE(sii->pub.bustype) == SI_BUS) {
+                /* If internal bus, we can always get at everything */
+                fast = TRUE;
+                /* map if does not exist */
+                if (!sii->regs[coreidx]) {
+                        sii->regs[coreidx] = REG_MAP(sii->coresba[coreidx],
+                                                    SI_CORE_SIZE);
+                        ASSERT(GOODREGS(sii->regs[coreidx]));
+                }
+                r = (uint32 *)((uchar *)sii->regs[coreidx] + regoff);
+        } else if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+                /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+                if ((sii->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                        /* Chipc registers are mapped at 12KB */
+
+                        fast = TRUE;
+                        r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+                } else if (sii->pub.buscoreidx == coreidx) {
+                        /* pci registers are at either in the last 2KB of an 8KB window
+                         * or, in pcie and pci rev 13 at 8KB
+                         */
+                        fast = TRUE;
+                        if (SI_FAST(sii))
+                                r = (uint32 *)((char *)sii->curmap +
+                                               PCI_16KB0_PCIREGS_OFFSET + regoff);
+                        else
+                                r = (uint32 *)((char *)sii->curmap +
+                                               ((regoff >= SBCONFIGOFF) ?
+                                                PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                               regoff);
+                }
+        }
+
+        if (!fast) {
+                INTR_OFF(sii, intr_val);
+
+                /* save current core index */
+                origidx = si_coreidx(&sii->pub);
+
+                /* switch core */
+                r = (uint32*) ((uchar*)sb_setcoreidx(&sii->pub, coreidx) + regoff);
+        }
+        ASSERT(r != NULL);
+
+        /* mask and set */
+        if (mask || val) {
+                if (regoff >= SBCONFIGOFF) {
+                        w = (R_SBREG(sii, r) & ~mask) | val;
+                        W_SBREG(sii, r, w);
+                } else {
+                        w = (R_REG(sii->osh, r) & ~mask) | val;
+                        W_REG(sii->osh, r, w);
+                }
+        }
+
+        /* readback */
+        if (regoff >= SBCONFIGOFF)
+                w = R_SBREG(sii, r);
+        else {
+                if ((CHIPID(sii->pub.chip) == BCM5354_CHIP_ID) &&
+                    (coreidx == SI_CC_IDX) &&
+                    (regoff == OFFSETOF(chipcregs_t, watchdog))) {
+                        w = val;
+                } else
+                        w = R_REG(sii->osh, r);
+        }
+
+        if (!fast) {
+                /* restore core index */
+                if (origidx != coreidx)
+                        sb_setcoreidx(&sii->pub, origidx);
+
+                INTR_RESTORE(sii, intr_val);
+        }
+
+        return (w);
+}
+
+/* Scan the enumeration space to find all cores starting from the given
+ * bus 'sbba'. Append coreid and other info to the lists in 'si'. 'sba'
+ * is the default core address at chip POR time and 'regs' is the virtual
+ * address that the default core is mapped at. 'ncores' is the number of
+ * cores expected on bus 'sbba'. It returns the total number of cores
+ * starting from bus 'sbba', inclusive.
+ */
+#define SB_MAXBUSES     2
+static uint
+_sb_scan(si_info_t *sii, uint32 sba, void *regs, uint bus, uint32 sbba, uint numcores)
+{
+        uint next;
+        uint ncc = 0;
+        uint i;
+
+        if (bus >= SB_MAXBUSES) {
+                SI_ERROR(("_sb_scan: bus 0x%08x at level %d is too deep to scan\n", sbba, bus));
+                return 0;
+        }
+        SI_MSG(("_sb_scan: scan bus 0x%08x assume %u cores\n", sbba, numcores));
+
+        /* Scan all cores on the bus starting from core 0.
+         * Core addresses must be contiguous on each bus.
+         */
+        for (i = 0, next = sii->numcores; i < numcores && next < SB_BUS_MAXCORES; i++, next++) {
+                sii->coresba[next] = sbba + (i * SI_CORE_SIZE);
+
+                /* keep and reuse the initial register mapping */
+                if ((BUSTYPE(sii->pub.bustype) == SI_BUS) && (sii->coresba[next] == sba)) {
+                        SI_VMSG(("_sb_scan: reuse mapped regs %p for core %u\n", regs, next));
+                        sii->regs[next] = regs;
+                }
+
+                /* change core to 'next' and read its coreid */
+                sii->curmap = _sb_setcoreidx(sii, next);
+                sii->curidx = next;
+
+                sii->coreid[next] = sb_coreid(&sii->pub);
+
+                /* core specific processing... */
+                /* chipc provides # cores */
+                if (sii->coreid[next] == CC_CORE_ID) {
+                        chipcregs_t *cc = (chipcregs_t *)sii->curmap;
+                        uint32 ccrev = sb_corerev(&sii->pub);
+
+                        /* determine numcores - this is the total # cores in the chip */
+                        if (((ccrev == 4) || (ccrev >= 6)))
+                                numcores = (R_REG(sii->osh, &cc->chipid) & CID_CC_MASK) >>
+                                        CID_CC_SHIFT;
+                        else {
+                                /* Older chips */
+                                uint chip = CHIPID(sii->pub.chip);
+
+                                if (chip == BCM4306_CHIP_ID)    /* < 4306c0 */
+                                        numcores = 6;
+                                else if (chip == BCM4704_CHIP_ID)
+                                        numcores = 9;
+                                else if (chip == BCM5365_CHIP_ID)
+                                        numcores = 7;
+                                else {
+                                        SI_ERROR(("sb_chip2numcores: unsupported chip 0x%x\n",
+                                                  chip));
+                                        ASSERT(0);
+                                        numcores = 1;
+                                }
+                        }
+                        SI_VMSG(("_sb_scan: there are %u cores in the chip %s\n", numcores,
+                                sii->pub.issim ? "QT" : ""));
+                }
+                /* scan bridged SB(s) and add results to the end of the list */
+                else if (sii->coreid[next] == OCP_CORE_ID) {
+                        sbconfig_t *sb = REGS2SB(sii->curmap);
+                        uint32 nsbba = R_SBREG(sii, &sb->sbadmatch1);
+                        uint nsbcc;
+
+                        sii->numcores = next + 1;
+
+                        if ((nsbba & 0xfff00000) != SI_ENUM_BASE)
+                                continue;
+                        nsbba &= 0xfffff000;
+                        if (_sb_coreidx(sii, nsbba) != BADIDX)
+                                continue;
+
+                        nsbcc = (R_SBREG(sii, &sb->sbtmstatehigh) & 0x000f0000) >> 16;
+                        nsbcc = _sb_scan(sii, sba, regs, bus + 1, nsbba, nsbcc);
+                        if (sbba == SI_ENUM_BASE)
+                                numcores -= nsbcc;
+                        ncc += nsbcc;
+                }
+        }
+
+        SI_MSG(("_sb_scan: found %u cores on bus 0x%08x\n", i, sbba));
+
+        sii->numcores = i + ncc;
+        return sii->numcores;
+}
+
+/* scan the sb enumerated space to identify all cores */
+void
+sb_scan(si_t *sih, void *regs, uint devid)
+{
+        si_info_t *sii;
+        uint32 origsba;
+        sbconfig_t *sb;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        sii->pub.socirev = (R_SBREG(sii, &sb->sbidlow) & SBIDL_RV_MASK) >> SBIDL_RV_SHIFT;
+
+        /* Save the current core info and validate it later till we know
+         * for sure what is good and what is bad.
+         */
+        origsba = _sb_coresba(sii);
+
+        /* scan all SB(s) starting from SI_ENUM_BASE */
+        sii->numcores = _sb_scan(sii, origsba, regs, 0, SI_ENUM_BASE, 1);
+}
+
+/*
+ * This function changes logical "focus" to the indicated core;
+ * must be called with interrupts off.
+ * Moreover, callers should keep interrupts off during switching out of and back to d11 core
+ */
+void *
+sb_setcoreidx(si_t *sih, uint coreidx)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        if (coreidx >= sii->numcores)
+                return (NULL);
+
+        /*
+         * If the user has provided an interrupt mask enabled function,
+         * then assert interrupts are disabled before switching the core.
+         */
+        ASSERT((sii->intrsenabled_fn == NULL) || !(*(sii)->intrsenabled_fn)((sii)->intr_arg));
+
+        sii->curmap = _sb_setcoreidx(sii, coreidx);
+        sii->curidx = coreidx;
+
+        return (sii->curmap);
+}
+
+/* This function changes the logical "focus" to the indicated core.
+ * Return the current core's virtual address.
+ */
+static void *
+_sb_setcoreidx(si_info_t *sii, uint coreidx)
+{
+        uint32 sbaddr = sii->coresba[coreidx];
+        void *regs;
+
+        switch (BUSTYPE(sii->pub.bustype)) {
+        case SI_BUS:
+                /* map new one */
+                if (!sii->regs[coreidx]) {
+                        sii->regs[coreidx] = REG_MAP(sbaddr, SI_CORE_SIZE);
+                        ASSERT(GOODREGS(sii->regs[coreidx]));
+                }
+                regs = sii->regs[coreidx];
+                break;
+
+        case PCI_BUS:
+                /* point bar0 window */
+                OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, sbaddr);
+                regs = sii->curmap;
+                break;
+
+        case PCMCIA_BUS: {
+                uint8 tmp = (sbaddr >> 12) & 0x0f;
+                OSL_PCMCIA_WRITE_ATTR(sii->osh, PCMCIA_ADDR0, &tmp, 1);
+                tmp = (sbaddr >> 16) & 0xff;
+                OSL_PCMCIA_WRITE_ATTR(sii->osh, PCMCIA_ADDR1, &tmp, 1);
+                tmp = (sbaddr >> 24) & 0xff;
+                OSL_PCMCIA_WRITE_ATTR(sii->osh, PCMCIA_ADDR2, &tmp, 1);
+                regs = sii->curmap;
+                break;
+        }
+        case SPI_BUS:
+        case SDIO_BUS:
+                /* map new one */
+                if (!sii->regs[coreidx]) {
+                        sii->regs[coreidx] = (void *)(uintptr)sbaddr;
+                        ASSERT(GOODREGS(sii->regs[coreidx]));
+                }
+                regs = sii->regs[coreidx];
+                break;
+
+
+        default:
+                ASSERT(0);
+                regs = NULL;
+                break;
+        }
+
+        return regs;
+}
+
+/* Return the address of sbadmatch0/1/2/3 register */
+static volatile uint32 *
+sb_admatch(si_info_t *sii, uint asidx)
+{
+        sbconfig_t *sb;
+        volatile uint32 *addrm;
+
+        sb = REGS2SB(sii->curmap);
+
+        switch (asidx) {
+        case 0:
+                addrm =  &sb->sbadmatch0;
+                break;
+
+        case 1:
+                addrm =  &sb->sbadmatch1;
+                break;
+
+        case 2:
+                addrm =  &sb->sbadmatch2;
+                break;
+
+        case 3:
+                addrm =  &sb->sbadmatch3;
+                break;
+
+        default:
+                SI_ERROR(("%s: Address space index (%d) out of range\n", __FUNCTION__, asidx));
+                return 0;
+        }
+
+        return (addrm);
+}
+
+/* Return the number of address spaces in current core */
+int
+sb_numaddrspaces(si_t *sih)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+
+        sii = SI_INFO(sih);
+        sb = REGS2SB(sii->curmap);
+
+        /* + 1 because of enumeration space */
+        return ((R_SBREG(sii, &sb->sbidlow) & SBIDL_AR_MASK) >> SBIDL_AR_SHIFT) + 1;
+}
+
+/* Return the address of the nth address space in the current core */
+uint32
+sb_addrspace(si_t *sih, uint asidx)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        return (sb_base(R_SBREG(sii, sb_admatch(sii, asidx))));
+}
+
+/* Return the size of the nth address space in the current core */
+uint32
+sb_addrspacesize(si_t *sih, uint asidx)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        return (sb_size(R_SBREG(sii, sb_admatch(sii, asidx))));
+}
+
+
+/* do buffered registers update */
+void
+sb_commit(si_t *sih)
+{
+        si_info_t *sii;
+        uint origidx;
+        uint intr_val = 0;
+
+        sii = SI_INFO(sih);
+
+        origidx = sii->curidx;
+        ASSERT(GOODIDX(origidx));
+
+        INTR_OFF(sii, intr_val);
+
+        /* switch over to chipcommon core if there is one, else use pci */
+        if (sii->pub.ccrev != NOREV) {
+                chipcregs_t *ccregs = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+                ASSERT(ccregs != NULL);
+
+                /* do the buffer registers update */
+                W_REG(sii->osh, &ccregs->broadcastaddress, SB_COMMIT);
+                W_REG(sii->osh, &ccregs->broadcastdata, 0x0);
+        } else
+                ASSERT(0);
+
+        /* restore core index */
+        sb_setcoreidx(sih, origidx);
+        INTR_RESTORE(sii, intr_val);
+}
+
+void
+sb_core_disable(si_t *sih, uint32 bits)
+{
+        si_info_t *sii;
+        volatile uint32 dummy;
+        sbconfig_t *sb;
+
+        sii = SI_INFO(sih);
+
+        ASSERT(GOODREGS(sii->curmap));
+        sb = REGS2SB(sii->curmap);
+
+        /* if core is already in reset, just return */
+        if (R_SBREG(sii, &sb->sbtmstatelow) & SBTML_RESET)
+                return;
+
+        /* if clocks are not enabled, put into reset and return */
+        if ((R_SBREG(sii, &sb->sbtmstatelow) & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) == 0)
+                goto disable;
+
+        /* set target reject and spin until busy is clear (preserve core-specific bits) */
+        OR_SBREG(sii, &sb->sbtmstatelow, SBTML_REJ);
+        dummy = R_SBREG(sii, &sb->sbtmstatelow);
+        OSL_DELAY(1);
+        SPINWAIT((R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_BUSY), 100000);
+        if (R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_BUSY)
+                SI_ERROR(("%s: target state still busy\n", __FUNCTION__));
+
+        if (R_SBREG(sii, &sb->sbidlow) & SBIDL_INIT) {
+                OR_SBREG(sii, &sb->sbimstate, SBIM_RJ);
+                dummy = R_SBREG(sii, &sb->sbimstate);
+                OSL_DELAY(1);
+                SPINWAIT((R_SBREG(sii, &sb->sbimstate) & SBIM_BY), 100000);
+        }
+
+        /* set reset and reject while enabling the clocks */
+        W_SBREG(sii, &sb->sbtmstatelow,
+                (((bits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+                 SBTML_REJ | SBTML_RESET));
+        dummy = R_SBREG(sii, &sb->sbtmstatelow);
+        OSL_DELAY(10);
+
+        /* don't forget to clear the initiator reject bit */
+        if (R_SBREG(sii, &sb->sbidlow) & SBIDL_INIT)
+                AND_SBREG(sii, &sb->sbimstate, ~SBIM_RJ);
+
+disable:
+        /* leave reset and reject asserted */
+        W_SBREG(sii, &sb->sbtmstatelow, ((bits << SBTML_SICF_SHIFT) | SBTML_REJ | SBTML_RESET));
+        OSL_DELAY(1);
+}
+
+/* reset and re-enable a core
+ * inputs:
+ * bits - core specific bits that are set during and after reset sequence
+ * resetbits - core specific bits that are set only during reset sequence
+ */
+void
+sb_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+        si_info_t *sii;
+        sbconfig_t *sb;
+        volatile uint32 dummy;
+
+        sii = SI_INFO(sih);
+        ASSERT(GOODREGS(sii->curmap));
+        sb = REGS2SB(sii->curmap);
+
+        /*
+         * Must do the disable sequence first to work for arbitrary current core state.
+         */
+        sb_core_disable(sih, (bits | resetbits));
+
+        /*
+         * Now do the initialization sequence.
+         */
+
+        /* set reset while enabling the clock and forcing them on throughout the core */
+        W_SBREG(sii, &sb->sbtmstatelow,
+                (((bits | resetbits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+                 SBTML_RESET));
+        dummy = R_SBREG(sii, &sb->sbtmstatelow);
+        OSL_DELAY(1);
+
+        if (R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_SERR) {
+                W_SBREG(sii, &sb->sbtmstatehigh, 0);
+        }
+        if ((dummy = R_SBREG(sii, &sb->sbimstate)) & (SBIM_IBE | SBIM_TO)) {
+                AND_SBREG(sii, &sb->sbimstate, ~(SBIM_IBE | SBIM_TO));
+        }
+
+        /* clear reset and allow it to propagate throughout the core */
+        W_SBREG(sii, &sb->sbtmstatelow,
+                ((bits | resetbits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT));
+        dummy = R_SBREG(sii, &sb->sbtmstatelow);
+        OSL_DELAY(1);
+
+        /* leave clock enabled */
+        W_SBREG(sii, &sb->sbtmstatelow, ((bits | SICF_CLOCK_EN) << SBTML_SICF_SHIFT));
+        dummy = R_SBREG(sii, &sb->sbtmstatelow);
+        OSL_DELAY(1);
+}
+
+/*
+ * Set the initiator timeout for the "master core".
+ * The master core is defined to be the core in control
+ * of the chip and so it issues accesses to non-memory
+ * locations (Because of dma *any* core can access memeory).
+ *
+ * The routine uses the bus to decide who is the master:
+ *      SI_BUS => mips
+ *      JTAG_BUS => chipc
+ *      PCI_BUS => pci or pcie
+ *      PCMCIA_BUS => pcmcia
+ *      SDIO_BUS => pcmcia
+ *
+ * This routine exists so callers can disable initiator
+ * timeouts so accesses to very slow devices like otp
+ * won't cause an abort. The routine allows arbitrary
+ * settings of the service and request timeouts, though.
+ *
+ * Returns the timeout state before changing it or -1
+ * on error.
+ */
+
+#define TO_MASK (SBIMCL_RTO_MASK | SBIMCL_STO_MASK)
+
+uint32
+sb_set_initiator_to(si_t *sih, uint32 to, uint idx)
+{
+        si_info_t *sii;
+        uint origidx;
+        uint intr_val = 0;
+        uint32 tmp, ret = 0xffffffff;
+        sbconfig_t *sb;
+
+        sii = SI_INFO(sih);
+
+        if ((to & ~TO_MASK) != 0)
+                return ret;
+
+        /* Figure out the master core */
+        if (idx == BADIDX) {
+                switch (BUSTYPE(sii->pub.bustype)) {
+                case PCI_BUS:
+                        idx = sii->pub.buscoreidx;
+                        break;
+                case JTAG_BUS:
+                        idx = SI_CC_IDX;
+                        break;
+                case PCMCIA_BUS:
+                case SDIO_BUS:
+                        idx = si_findcoreidx(sih, PCMCIA_CORE_ID, 0);
+                        break;
+                case SI_BUS:
+                        idx = si_findcoreidx(sih, MIPS33_CORE_ID, 0);
+                        break;
+                default:
+                        ASSERT(0);
+                }
+                if (idx == BADIDX)
+                        return ret;
+        }
+
+        INTR_OFF(sii, intr_val);
+        origidx = si_coreidx(sih);
+
+        sb = REGS2SB(sb_setcoreidx(sih, idx));
+
+        tmp = R_SBREG(sii, &sb->sbimconfiglow);
+        ret = tmp & TO_MASK;
+        W_SBREG(sii, &sb->sbimconfiglow, (tmp & ~TO_MASK) | to);
+
+        sb_commit(sih);
+        sb_setcoreidx(sih, origidx);
+        INTR_RESTORE(sii, intr_val);
+        return ret;
+}
+
+uint32
+sb_base(uint32 admatch)
+{
+        uint32 base;
+        uint type;
+
+        type = admatch & SBAM_TYPE_MASK;
+        ASSERT(type < 3);
+
+        base = 0;
+
+        if (type == 0) {
+                base = admatch & SBAM_BASE0_MASK;
+        } else if (type == 1) {
+                ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+                base = admatch & SBAM_BASE1_MASK;
+        } else if (type == 2) {
+                ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+                base = admatch & SBAM_BASE2_MASK;
+        }
+
+        return (base);
+}
+
+uint32
+sb_size(uint32 admatch)
+{
+        uint32 size;
+        uint type;
+
+        type = admatch & SBAM_TYPE_MASK;
+        ASSERT(type < 3);
+
+        size = 0;
+
+        if (type == 0) {
+                size = 1 << (((admatch & SBAM_ADINT0_MASK) >> SBAM_ADINT0_SHIFT) + 1);
+        } else if (type == 1) {
+                ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+                size = 1 << (((admatch & SBAM_ADINT1_MASK) >> SBAM_ADINT1_SHIFT) + 1);
+        } else if (type == 2) {
+                ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+                size = 1 << (((admatch & SBAM_ADINT2_MASK) >> SBAM_ADINT2_SHIFT) + 1);
+        }
+
+        return (size);
+}
diff --git a/drivers/net/wireless/bcmdhd/siutils.c b/drivers/net/wireless/bcmdhd/siutils.c
new file mode 100644
index 00000000000..22aa4126576
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/siutils.c
@@ -0,0 +1,1720 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: siutils.c,v 1.813.2.36 2011-02-10 23:43:55 Exp $
+ */
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+#include <sbpcmcia.h>
+#include <sbsocram.h>
+#include <bcmsdh.h>
+#include <sdio.h>
+#include <sbsdio.h>
+#include <sbhnddma.h>
+#include <sbsdpcmdev.h>
+#include <bcmsdpcm.h>
+#include <hndpmu.h>
+
+#include "siutils_priv.h"
+
+/* local prototypes */
+static si_info_t *si_doattach(si_info_t *sii, uint devid, osl_t *osh, void *regs,
+                              uint bustype, void *sdh, char **vars, uint *varsz);
+static bool si_buscore_prep(si_info_t *sii, uint bustype, uint devid, void *sdh);
+static bool si_buscore_setup(si_info_t *sii, chipcregs_t *cc, uint bustype, uint32 savewin,
+        uint *origidx, void *regs);
+
+
+/* global variable to indicate reservation/release of gpio's */
+static uint32 si_gpioreservation = 0;
+
+/* global flag to prevent shared resources from being initialized multiple times in si_attach() */
+
+/*
+ * Allocate a si handle.
+ * devid - pci device id (used to determine chip#)
+ * osh - opaque OS handle
+ * regs - virtual address of initial core registers
+ * bustype - pci/pcmcia/sb/sdio/etc
+ * vars - pointer to a pointer area for "environment" variables
+ * varsz - pointer to int to return the size of the vars
+ */
+si_t *
+si_attach(uint devid, osl_t *osh, void *regs,
+                       uint bustype, void *sdh, char **vars, uint *varsz)
+{
+        si_info_t *sii;
+
+        /* alloc si_info_t */
+        if ((sii = MALLOC(osh, sizeof (si_info_t))) == NULL) {
+                SI_ERROR(("si_attach: malloc failed! malloced %d bytes\n", MALLOCED(osh)));
+                return (NULL);
+        }
+
+        if (si_doattach(sii, devid, osh, regs, bustype, sdh, vars, varsz) == NULL) {
+                MFREE(osh, sii, sizeof(si_info_t));
+                return (NULL);
+        }
+        sii->vars = vars ? *vars : NULL;
+        sii->varsz = varsz ? *varsz : 0;
+
+        return (si_t *)sii;
+}
+
+/* global kernel resource */
+static si_info_t ksii;
+
+static uint32   wd_msticks;             /* watchdog timer ticks normalized to ms */
+
+/* generic kernel variant of si_attach() */
+si_t *
+si_kattach(osl_t *osh)
+{
+        static bool ksii_attached = FALSE;
+
+        if (!ksii_attached) {
+                void *regs;
+                regs = REG_MAP(SI_ENUM_BASE, SI_CORE_SIZE);
+
+                if (si_doattach(&ksii, BCM4710_DEVICE_ID, osh, regs,
+                                SI_BUS, NULL,
+                                osh != SI_OSH ? &ksii.vars : NULL,
+                                osh != SI_OSH ? &ksii.varsz : NULL) == NULL) {
+                        SI_ERROR(("si_kattach: si_doattach failed\n"));
+                        REG_UNMAP(regs);
+                        return NULL;
+                }
+                REG_UNMAP(regs);
+
+                /* save ticks normalized to ms for si_watchdog_ms() */
+                if (PMUCTL_ENAB(&ksii.pub)) {
+                        /* based on 32KHz ILP clock */
+                        wd_msticks = 32;
+                } else {
+                        wd_msticks = ALP_CLOCK / 1000;
+                }
+
+                ksii_attached = TRUE;
+                SI_MSG(("si_kattach done. ccrev = %d, wd_msticks = %d\n",
+                        ksii.pub.ccrev, wd_msticks));
+        }
+
+        return &ksii.pub;
+}
+
+
+static bool
+si_buscore_prep(si_info_t *sii, uint bustype, uint devid, void *sdh)
+{
+        /* need to set memseg flag for CF card first before any sb registers access */
+        if (BUSTYPE(bustype) == PCMCIA_BUS)
+                sii->memseg = TRUE;
+
+
+        if (BUSTYPE(bustype) == SDIO_BUS) {
+                int err;
+                uint8 clkset;
+
+                /* Try forcing SDIO core to do ALPAvail request only */
+                clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
+                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+                if (!err) {
+                        uint8 clkval;
+
+                        /* If register supported, wait for ALPAvail and then force ALP */
+                        clkval = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
+                        if ((clkval & ~SBSDIO_AVBITS) == clkset) {
+                                SPINWAIT(((clkval = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                        SBSDIO_FUNC1_CHIPCLKCSR, NULL)), !SBSDIO_ALPAV(clkval)),
+                                        PMU_MAX_TRANSITION_DLY);
+                                if (!SBSDIO_ALPAV(clkval)) {
+                                        SI_ERROR(("timeout on ALPAV wait, clkval 0x%02x\n",
+                                                clkval));
+                                        return FALSE;
+                                }
+                                clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
+                                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                        clkset, &err);
+                                OSL_DELAY(65);
+                        }
+                }
+
+                /* Also, disable the extra SDIO pull-ups */
+                bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
+        }
+
+
+        return TRUE;
+}
+
+static bool
+si_buscore_setup(si_info_t *sii, chipcregs_t *cc, uint bustype, uint32 savewin,
+        uint *origidx, void *regs)
+{
+        bool pci, pcie;
+        uint i;
+        uint pciidx, pcieidx, pcirev, pcierev;
+
+        cc = si_setcoreidx(&sii->pub, SI_CC_IDX);
+        ASSERT((uintptr)cc);
+
+        /* get chipcommon rev */
+        sii->pub.ccrev = (int)si_corerev(&sii->pub);
+
+        /* get chipcommon chipstatus */
+        if (sii->pub.ccrev >= 11)
+                sii->pub.chipst = R_REG(sii->osh, &cc->chipstatus);
+
+        /* get chipcommon capabilites */
+        sii->pub.cccaps = R_REG(sii->osh, &cc->capabilities);
+        /* get chipcommon extended capabilities */
+
+        if (sii->pub.ccrev >= 35)
+                sii->pub.cccaps_ext = R_REG(sii->osh, &cc->capabilities_ext);
+
+        /* get pmu rev and caps */
+        if (sii->pub.cccaps & CC_CAP_PMU) {
+                sii->pub.pmucaps = R_REG(sii->osh, &cc->pmucapabilities);
+                sii->pub.pmurev = sii->pub.pmucaps & PCAP_REV_MASK;
+        }
+
+        SI_MSG(("Chipc: rev %d, caps 0x%x, chipst 0x%x pmurev %d, pmucaps 0x%x\n",
+                sii->pub.ccrev, sii->pub.cccaps, sii->pub.chipst, sii->pub.pmurev,
+                sii->pub.pmucaps));
+
+        /* figure out bus/orignal core idx */
+        sii->pub.buscoretype = NODEV_CORE_ID;
+        sii->pub.buscorerev = NOREV;
+        sii->pub.buscoreidx = BADIDX;
+
+        pci = pcie = FALSE;
+        pcirev = pcierev = NOREV;
+        pciidx = pcieidx = BADIDX;
+
+        for (i = 0; i < sii->numcores; i++) {
+                uint cid, crev;
+
+                si_setcoreidx(&sii->pub, i);
+                cid = si_coreid(&sii->pub);
+                crev = si_corerev(&sii->pub);
+
+                /* Display cores found */
+                SI_VMSG(("CORE[%d]: id 0x%x rev %d base 0x%x regs 0x%p\n",
+                        i, cid, crev, sii->coresba[i], sii->regs[i]));
+
+                if (BUSTYPE(bustype) == PCI_BUS) {
+                        if (cid == PCI_CORE_ID) {
+                                pciidx = i;
+                                pcirev = crev;
+                                pci = TRUE;
+                        } else if (cid == PCIE_CORE_ID) {
+                                pcieidx = i;
+                                pcierev = crev;
+                                pcie = TRUE;
+                        }
+                } else if ((BUSTYPE(bustype) == PCMCIA_BUS) &&
+                           (cid == PCMCIA_CORE_ID)) {
+                        sii->pub.buscorerev = crev;
+                        sii->pub.buscoretype = cid;
+                        sii->pub.buscoreidx = i;
+                }
+                else if (((BUSTYPE(bustype) == SDIO_BUS) ||
+                          (BUSTYPE(bustype) == SPI_BUS)) &&
+                         ((cid == PCMCIA_CORE_ID) ||
+                          (cid == SDIOD_CORE_ID))) {
+                        sii->pub.buscorerev = crev;
+                        sii->pub.buscoretype = cid;
+                        sii->pub.buscoreidx = i;
+                }
+
+                /* find the core idx before entering this func. */
+                if ((savewin && (savewin == sii->coresba[i])) ||
+                    (regs == sii->regs[i]))
+                        *origidx = i;
+        }
+
+        if (pci) {
+                sii->pub.buscoretype = PCI_CORE_ID;
+                sii->pub.buscorerev = pcirev;
+                sii->pub.buscoreidx = pciidx;
+        } else if (pcie) {
+                sii->pub.buscoretype = PCIE_CORE_ID;
+                sii->pub.buscorerev = pcierev;
+                sii->pub.buscoreidx = pcieidx;
+        }
+
+        SI_VMSG(("Buscore id/type/rev %d/0x%x/%d\n", sii->pub.buscoreidx, sii->pub.buscoretype,
+                 sii->pub.buscorerev));
+
+        if (BUSTYPE(sii->pub.bustype) == SI_BUS && (CHIPID(sii->pub.chip) == BCM4712_CHIP_ID) &&
+            (sii->pub.chippkg != BCM4712LARGE_PKG_ID) && (CHIPREV(sii->pub.chiprev) <= 3))
+                OR_REG(sii->osh, &cc->slow_clk_ctl, SCC_SS_XTAL);
+
+
+        /* Make sure any on-chip ARM is off (in case strapping is wrong), or downloaded code was
+         * already running.
+         */
+        if ((BUSTYPE(bustype) == SDIO_BUS) || (BUSTYPE(bustype) == SPI_BUS)) {
+                if (si_setcore(&sii->pub, ARM7S_CORE_ID, 0) ||
+                    si_setcore(&sii->pub, ARMCM3_CORE_ID, 0))
+                        si_core_disable(&sii->pub, 0);
+        }
+
+        /* return to the original core */
+        si_setcoreidx(&sii->pub, *origidx);
+
+        return TRUE;
+}
+
+
+
+static si_info_t *
+si_doattach(si_info_t *sii, uint devid, osl_t *osh, void *regs,
+                       uint bustype, void *sdh, char **vars, uint *varsz)
+{
+        struct si_pub *sih = &sii->pub;
+        uint32 w, savewin;
+        chipcregs_t *cc;
+        char *pvars = NULL;
+        uint origidx;
+
+        ASSERT(GOODREGS(regs));
+
+        bzero((uchar*)sii, sizeof(si_info_t));
+
+        savewin = 0;
+
+        sih->buscoreidx = BADIDX;
+
+        sii->curmap = regs;
+        sii->sdh = sdh;
+        sii->osh = osh;
+
+
+
+        /* find Chipcommon address */
+        if (bustype == PCI_BUS) {
+                savewin = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+                if (!GOODCOREADDR(savewin, SI_ENUM_BASE))
+                        savewin = SI_ENUM_BASE;
+                OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, SI_ENUM_BASE);
+                cc = (chipcregs_t *)regs;
+        } else if ((bustype == SDIO_BUS) || (bustype == SPI_BUS)) {
+                cc = (chipcregs_t *)sii->curmap;
+        } else {
+                cc = (chipcregs_t *)REG_MAP(SI_ENUM_BASE, SI_CORE_SIZE);
+        }
+
+        sih->bustype = bustype;
+        if (bustype != BUSTYPE(bustype)) {
+                SI_ERROR(("si_doattach: bus type %d does not match configured bus type %d\n",
+                        bustype, BUSTYPE(bustype)));
+                return NULL;
+        }
+
+        /* bus/core/clk setup for register access */
+        if (!si_buscore_prep(sii, bustype, devid, sdh)) {
+                SI_ERROR(("si_doattach: si_core_clk_prep failed %d\n", bustype));
+                return NULL;
+        }
+
+        /* ChipID recognition.
+         *   We assume we can read chipid at offset 0 from the regs arg.
+         *   If we add other chiptypes (or if we need to support old sdio hosts w/o chipcommon),
+         *   some way of recognizing them needs to be added here.
+         */
+        w = R_REG(osh, &cc->chipid);
+        sih->socitype = (w & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
+        /* Might as wll fill in chip id rev & pkg */
+        sih->chip = w & CID_ID_MASK;
+        sih->chiprev = (w & CID_REV_MASK) >> CID_REV_SHIFT;
+        sih->chippkg = (w & CID_PKG_MASK) >> CID_PKG_SHIFT;
+        if (CHIPID(sih->chip) == BCM4322_CHIP_ID && (((sih->chipst & CST4322_SPROM_OTP_SEL_MASK)
+                >> CST4322_SPROM_OTP_SEL_SHIFT) == (CST4322_OTP_PRESENT |
+                CST4322_SPROM_PRESENT))) {
+                SI_ERROR(("%s: Invalid setting: both SPROM and OTP strapped.\n", __FUNCTION__));
+                return NULL;
+        }
+
+        if ((CHIPID(sih->chip) == BCM4329_CHIP_ID) && (sih->chiprev == 0) &&
+                (sih->chippkg != BCM4329_289PIN_PKG_ID)) {
+                sih->chippkg = BCM4329_182PIN_PKG_ID;
+        }
+
+        sih->issim = IS_SIM(sih->chippkg);
+
+        /* scan for cores */
+        if (CHIPTYPE(sii->pub.socitype) == SOCI_SB) {
+                SI_MSG(("Found chip type SB (0x%08x)\n", w));
+                sb_scan(&sii->pub, regs, devid);
+        } else if (CHIPTYPE(sii->pub.socitype) == SOCI_AI) {
+                SI_MSG(("Found chip type AI (0x%08x)\n", w));
+                /* pass chipc address instead of original core base */
+                ai_scan(&sii->pub, (void *)(uintptr)cc, devid);
+        } else if (CHIPTYPE(sii->pub.socitype) == SOCI_UBUS) {
+                SI_MSG(("Found chip type UBUS (0x%08x), chip id = 0x%4x\n", w, sih->chip));
+                /* pass chipc address instead of original core base */
+                ub_scan(&sii->pub, (void *)(uintptr)cc, devid);
+        } else {
+                SI_ERROR(("Found chip of unknown type (0x%08x)\n", w));
+                return NULL;
+        }
+        /* no cores found, bail out */
+        if (sii->numcores == 0) {
+                SI_ERROR(("si_doattach: could not find any cores\n"));
+                return NULL;
+        }
+        /* bus/core/clk setup */
+        origidx = SI_CC_IDX;
+        if (!si_buscore_setup(sii, cc, bustype, savewin, &origidx, regs)) {
+                SI_ERROR(("si_doattach: si_buscore_setup failed\n"));
+                goto exit;
+        }
+
+        /* assume current core is CC */
+        if ((sii->pub.ccrev == 0x25) && ((CHIPID(sih->chip) == BCM43236_CHIP_ID ||
+                                          CHIPID(sih->chip) == BCM43235_CHIP_ID ||
+                                          CHIPID(sih->chip) == BCM43238_CHIP_ID) &&
+                                         (CHIPREV(sii->pub.chiprev) == 0))) {
+
+                if ((cc->chipstatus & CST43236_BP_CLK) != 0) {
+                        uint clkdiv;
+                        clkdiv = R_REG(osh, &cc->clkdiv);
+                        /* otp_clk_div is even number, 120/14 < 9mhz */
+                        clkdiv = (clkdiv & ~CLKD_OTP) | (14 << CLKD_OTP_SHIFT);
+                        W_REG(osh, &cc->clkdiv, clkdiv);
+                        SI_ERROR(("%s: set clkdiv to %x\n", __FUNCTION__, clkdiv));
+                }
+                OSL_DELAY(10);
+        }
+
+
+        pvars = NULL;
+
+
+
+                if (sii->pub.ccrev >= 20) {
+                        cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+                        ASSERT(cc != NULL);
+                        W_REG(osh, &cc->gpiopullup, 0);
+                        W_REG(osh, &cc->gpiopulldown, 0);
+                        si_setcoreidx(sih, origidx);
+                }
+
+
+
+
+        return (sii);
+
+exit:
+
+        return NULL;
+}
+
+/* may be called with core in reset */
+void
+si_detach(si_t *sih)
+{
+        si_info_t *sii;
+        uint idx;
+
+
+        sii = SI_INFO(sih);
+
+        if (sii == NULL)
+                return;
+
+        if (BUSTYPE(sih->bustype) == SI_BUS)
+                for (idx = 0; idx < SI_MAXCORES; idx++)
+                        if (sii->regs[idx]) {
+                                REG_UNMAP(sii->regs[idx]);
+                                sii->regs[idx] = NULL;
+                        }
+
+
+
+#if !defined(BCMBUSTYPE) || (BCMBUSTYPE == SI_BUS)
+        if (sii != &ksii)
+#endif  /* !BCMBUSTYPE || (BCMBUSTYPE == SI_BUS) */
+                MFREE(sii->osh, sii, sizeof(si_info_t));
+}
+
+void *
+si_osh(si_t *sih)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+        return sii->osh;
+}
+
+void
+si_setosh(si_t *sih, osl_t *osh)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+        if (sii->osh != NULL) {
+                SI_ERROR(("osh is already set....\n"));
+                ASSERT(!sii->osh);
+        }
+        sii->osh = osh;
+}
+
+/* register driver interrupt disabling and restoring callback functions */
+void
+si_register_intr_callback(si_t *sih, void *intrsoff_fn, void *intrsrestore_fn,
+                          void *intrsenabled_fn, void *intr_arg)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+        sii->intr_arg = intr_arg;
+        sii->intrsoff_fn = (si_intrsoff_t)intrsoff_fn;
+        sii->intrsrestore_fn = (si_intrsrestore_t)intrsrestore_fn;
+        sii->intrsenabled_fn = (si_intrsenabled_t)intrsenabled_fn;
+        /* save current core id.  when this function called, the current core
+         * must be the core which provides driver functions(il, et, wl, etc.)
+         */
+        sii->dev_coreid = sii->coreid[sii->curidx];
+}
+
+void
+si_deregister_intr_callback(si_t *sih)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+        sii->intrsoff_fn = NULL;
+}
+
+uint
+si_intflag(si_t *sih)
+{
+        si_info_t *sii = SI_INFO(sih);
+
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_intflag(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return R_REG(sii->osh, ((uint32 *)(uintptr)
+                            (sii->oob_router + OOB_STATUSA)));
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+uint
+si_flag(si_t *sih)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_flag(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_flag(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_flag(sih);
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+void
+si_setint(si_t *sih, int siflag)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                sb_setint(sih, siflag);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                ai_setint(sih, siflag);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                ub_setint(sih, siflag);
+        else
+                ASSERT(0);
+}
+
+uint
+si_coreid(si_t *sih)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+        return sii->coreid[sii->curidx];
+}
+
+uint
+si_coreidx(si_t *sih)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+        return sii->curidx;
+}
+
+/* return the core-type instantiation # of the current core */
+uint
+si_coreunit(si_t *sih)
+{
+        si_info_t *sii;
+        uint idx;
+        uint coreid;
+        uint coreunit;
+        uint i;
+
+        sii = SI_INFO(sih);
+        coreunit = 0;
+
+        idx = sii->curidx;
+
+        ASSERT(GOODREGS(sii->curmap));
+        coreid = si_coreid(sih);
+
+        /* count the cores of our type */
+        for (i = 0; i < idx; i++)
+                if (sii->coreid[i] == coreid)
+                        coreunit++;
+
+        return (coreunit);
+}
+
+uint
+si_corevendor(si_t *sih)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_corevendor(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_corevendor(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_corevendor(sih);
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+bool
+si_backplane64(si_t *sih)
+{
+        return ((sih->cccaps & CC_CAP_BKPLN64) != 0);
+}
+
+uint
+si_corerev(si_t *sih)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_corerev(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_corerev(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_corerev(sih);
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+/* return index of coreid or BADIDX if not found */
+uint
+si_findcoreidx(si_t *sih, uint coreid, uint coreunit)
+{
+        si_info_t *sii;
+        uint found;
+        uint i;
+
+        sii = SI_INFO(sih);
+
+        found = 0;
+
+        for (i = 0; i < sii->numcores; i++)
+                if (sii->coreid[i] == coreid) {
+                        if (found == coreunit)
+                                return (i);
+                        found++;
+                }
+
+        return (BADIDX);
+}
+
+/* return list of found cores */
+uint
+si_corelist(si_t *sih, uint coreid[])
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        bcopy((uchar*)sii->coreid, (uchar*)coreid, (sii->numcores * sizeof(uint)));
+        return (sii->numcores);
+}
+
+/* return current register mapping */
+void *
+si_coreregs(si_t *sih)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+        ASSERT(GOODREGS(sii->curmap));
+
+        return (sii->curmap);
+}
+
+/*
+ * This function changes logical "focus" to the indicated core;
+ * must be called with interrupts off.
+ * Moreover, callers should keep interrupts off during switching out of and back to d11 core
+ */
+void *
+si_setcore(si_t *sih, uint coreid, uint coreunit)
+{
+        uint idx;
+
+        idx = si_findcoreidx(sih, coreid, coreunit);
+        if (!GOODIDX(idx))
+                return (NULL);
+
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_setcoreidx(sih, idx);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_setcoreidx(sih, idx);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_setcoreidx(sih, idx);
+        else {
+                ASSERT(0);
+                return NULL;
+        }
+}
+
+void *
+si_setcoreidx(si_t *sih, uint coreidx)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_setcoreidx(sih, coreidx);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_setcoreidx(sih, coreidx);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_setcoreidx(sih, coreidx);
+        else {
+                ASSERT(0);
+                return NULL;
+        }
+}
+
+/* Turn off interrupt as required by sb_setcore, before switch core */
+void *
+si_switch_core(si_t *sih, uint coreid, uint *origidx, uint *intr_val)
+{
+        void *cc;
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        if (SI_FAST(sii)) {
+                /* Overloading the origidx variable to remember the coreid,
+                 * this works because the core ids cannot be confused with
+                 * core indices.
+                 */
+                *origidx = coreid;
+                if (coreid == CC_CORE_ID)
+                        return (void *)CCREGS_FAST(sii);
+                else if (coreid == sih->buscoretype)
+                        return (void *)PCIEREGS(sii);
+        }
+        INTR_OFF(sii, *intr_val);
+        *origidx = sii->curidx;
+        cc = si_setcore(sih, coreid, 0);
+        ASSERT(cc != NULL);
+
+        return cc;
+}
+
+/* restore coreidx and restore interrupt */
+void
+si_restore_core(si_t *sih, uint coreid, uint intr_val)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+        if (SI_FAST(sii) && ((coreid == CC_CORE_ID) || (coreid == sih->buscoretype)))
+                return;
+
+        si_setcoreidx(sih, coreid);
+        INTR_RESTORE(sii, intr_val);
+}
+
+int
+si_numaddrspaces(si_t *sih)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_numaddrspaces(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_numaddrspaces(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_numaddrspaces(sih);
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+uint32
+si_addrspace(si_t *sih, uint asidx)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_addrspace(sih, asidx);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_addrspace(sih, asidx);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_addrspace(sih, asidx);
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+uint32
+si_addrspacesize(si_t *sih, uint asidx)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_addrspacesize(sih, asidx);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_addrspacesize(sih, asidx);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_addrspacesize(sih, asidx);
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+uint32
+si_core_cflags(si_t *sih, uint32 mask, uint32 val)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_core_cflags(sih, mask, val);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_core_cflags(sih, mask, val);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_core_cflags(sih, mask, val);
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+void
+si_core_cflags_wo(si_t *sih, uint32 mask, uint32 val)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                sb_core_cflags_wo(sih, mask, val);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                ai_core_cflags_wo(sih, mask, val);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                ub_core_cflags_wo(sih, mask, val);
+        else
+                ASSERT(0);
+}
+
+uint32
+si_core_sflags(si_t *sih, uint32 mask, uint32 val)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_core_sflags(sih, mask, val);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_core_sflags(sih, mask, val);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_core_sflags(sih, mask, val);
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+bool
+si_iscoreup(si_t *sih)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_iscoreup(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_iscoreup(sih);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_iscoreup(sih);
+        else {
+                ASSERT(0);
+                return FALSE;
+        }
+}
+
+uint
+si_wrapperreg(si_t *sih, uint32 offset, uint32 mask, uint32 val)
+{
+        /* only for AI back plane chips */
+        if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return (ai_wrap_reg(sih, offset, mask, val));
+        return 0;
+}
+
+uint
+si_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                return sb_corereg(sih, coreidx, regoff, mask, val);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                return ai_corereg(sih, coreidx, regoff, mask, val);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                return ub_corereg(sih, coreidx, regoff, mask, val);
+        else {
+                ASSERT(0);
+                return 0;
+        }
+}
+
+void
+si_core_disable(si_t *sih, uint32 bits)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                sb_core_disable(sih, bits);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                ai_core_disable(sih, bits);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                ub_core_disable(sih, bits);
+}
+
+void
+si_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+        if (CHIPTYPE(sih->socitype) == SOCI_SB)
+                sb_core_reset(sih, bits, resetbits);
+        else if (CHIPTYPE(sih->socitype) == SOCI_AI)
+                ai_core_reset(sih, bits, resetbits);
+        else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+                ub_core_reset(sih, bits, resetbits);
+}
+
+/* Run bist on current core. Caller needs to take care of core-specific bist hazards */
+int
+si_corebist(si_t *sih)
+{
+        uint32 cflags;
+        int result = 0;
+
+        /* Read core control flags */
+        cflags = si_core_cflags(sih, 0, 0);
+
+        /* Set bist & fgc */
+        si_core_cflags(sih, ~0, (SICF_BIST_EN | SICF_FGC));
+
+        /* Wait for bist done */
+        SPINWAIT(((si_core_sflags(sih, 0, 0) & SISF_BIST_DONE) == 0), 100000);
+
+        if (si_core_sflags(sih, 0, 0) & SISF_BIST_ERROR)
+                result = BCME_ERROR;
+
+        /* Reset core control flags */
+        si_core_cflags(sih, 0xffff, cflags);
+
+        return result;
+}
+
+static uint32
+factor6(uint32 x)
+{
+        switch (x) {
+        case CC_F6_2:   return 2;
+        case CC_F6_3:   return 3;
+        case CC_F6_4:   return 4;
+        case CC_F6_5:   return 5;
+        case CC_F6_6:   return 6;
+        case CC_F6_7:   return 7;
+        default:        return 0;
+        }
+}
+
+/* calculate the speed the SI would run at given a set of clockcontrol values */
+uint32
+si_clock_rate(uint32 pll_type, uint32 n, uint32 m)
+{
+        uint32 n1, n2, clock, m1, m2, m3, mc;
+
+        n1 = n & CN_N1_MASK;
+        n2 = (n & CN_N2_MASK) >> CN_N2_SHIFT;
+
+        if (pll_type == PLL_TYPE6) {
+                if (m & CC_T6_MMASK)
+                        return CC_T6_M1;
+                else
+                        return CC_T6_M0;
+        } else if ((pll_type == PLL_TYPE1) ||
+                   (pll_type == PLL_TYPE3) ||
+                   (pll_type == PLL_TYPE4) ||
+                   (pll_type == PLL_TYPE7)) {
+                n1 = factor6(n1);
+                n2 += CC_F5_BIAS;
+        } else if (pll_type == PLL_TYPE2) {
+                n1 += CC_T2_BIAS;
+                n2 += CC_T2_BIAS;
+                ASSERT((n1 >= 2) && (n1 <= 7));
+                ASSERT((n2 >= 5) && (n2 <= 23));
+        } else if (pll_type == PLL_TYPE5) {
+                return (100000000);
+        } else
+                ASSERT(0);
+        /* PLL types 3 and 7 use BASE2 (25Mhz) */
+        if ((pll_type == PLL_TYPE3) ||
+            (pll_type == PLL_TYPE7)) {
+                clock = CC_CLOCK_BASE2 * n1 * n2;
+        } else
+                clock = CC_CLOCK_BASE1 * n1 * n2;
+
+        if (clock == 0)
+                return 0;
+
+        m1 = m & CC_M1_MASK;
+        m2 = (m & CC_M2_MASK) >> CC_M2_SHIFT;
+        m3 = (m & CC_M3_MASK) >> CC_M3_SHIFT;
+        mc = (m & CC_MC_MASK) >> CC_MC_SHIFT;
+
+        if ((pll_type == PLL_TYPE1) ||
+            (pll_type == PLL_TYPE3) ||
+            (pll_type == PLL_TYPE4) ||
+            (pll_type == PLL_TYPE7)) {
+                m1 = factor6(m1);
+                if ((pll_type == PLL_TYPE1) || (pll_type == PLL_TYPE3))
+                        m2 += CC_F5_BIAS;
+                else
+                        m2 = factor6(m2);
+                m3 = factor6(m3);
+
+                switch (mc) {
+                case CC_MC_BYPASS:      return (clock);
+                case CC_MC_M1:          return (clock / m1);
+                case CC_MC_M1M2:        return (clock / (m1 * m2));
+                case CC_MC_M1M2M3:      return (clock / (m1 * m2 * m3));
+                case CC_MC_M1M3:        return (clock / (m1 * m3));
+                default:                return (0);
+                }
+        } else {
+                ASSERT(pll_type == PLL_TYPE2);
+
+                m1 += CC_T2_BIAS;
+                m2 += CC_T2M2_BIAS;
+                m3 += CC_T2_BIAS;
+                ASSERT((m1 >= 2) && (m1 <= 7));
+                ASSERT((m2 >= 3) && (m2 <= 10));
+                ASSERT((m3 >= 2) && (m3 <= 7));
+
+                if ((mc & CC_T2MC_M1BYP) == 0)
+                        clock /= m1;
+                if ((mc & CC_T2MC_M2BYP) == 0)
+                        clock /= m2;
+                if ((mc & CC_T2MC_M3BYP) == 0)
+                        clock /= m3;
+
+                return (clock);
+        }
+}
+
+
+/* set chip watchdog reset timer to fire in 'ticks' */
+void
+si_watchdog(si_t *sih, uint ticks)
+{
+        uint nb, maxt;
+
+        if (PMUCTL_ENAB(sih)) {
+
+                if ((CHIPID(sih->chip) == BCM4319_CHIP_ID) &&
+                    (CHIPREV(sih->chiprev) == 0) && (ticks != 0)) {
+                        si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, clk_ctl_st), ~0, 0x2);
+                        si_setcore(sih, USB20D_CORE_ID, 0);
+                        si_core_disable(sih, 1);
+                        si_setcore(sih, CC_CORE_ID, 0);
+                }
+
+                nb = (sih->ccrev < 26) ? 16 : ((sih->ccrev >= 37) ? 32 : 24);
+                /* The mips compiler uses the sllv instruction,
+                 * so we specially handle the 32-bit case.
+                 */
+                if (nb == 32)
+                        maxt = 0xffffffff;
+                else
+                        maxt = ((1 << nb) - 1);
+
+                if (ticks == 1)
+                        ticks = 2;
+                else if (ticks > maxt)
+                        ticks = maxt;
+
+                si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, pmuwatchdog), ~0, ticks);
+        } else {
+                maxt = (1 << 28) - 1;
+                if (ticks > maxt)
+                        ticks = maxt;
+
+                si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), ~0, ticks);
+        }
+}
+
+/* trigger watchdog reset after ms milliseconds */
+void
+si_watchdog_ms(si_t *sih, uint32 ms)
+{
+        si_watchdog(sih, wd_msticks * ms);
+}
+
+
+
+
+/* change logical "focus" to the gpio core for optimized access */
+void *
+si_gpiosetcore(si_t *sih)
+{
+        return (si_setcoreidx(sih, SI_CC_IDX));
+}
+
+/* mask&set gpiocontrol bits */
+uint32
+si_gpiocontrol(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+        uint regoff;
+
+        regoff = 0;
+
+        /* gpios could be shared on router platforms
+         * ignore reservation if it's high priority (e.g., test apps)
+         */
+        if ((priority != GPIO_HI_PRIORITY) &&
+            (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+                mask = priority ? (si_gpioreservation & mask) :
+                        ((si_gpioreservation | mask) & ~(si_gpioreservation));
+                val &= mask;
+        }
+
+        regoff = OFFSETOF(chipcregs_t, gpiocontrol);
+        return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* mask&set gpio output enable bits */
+uint32
+si_gpioouten(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+        uint regoff;
+
+        regoff = 0;
+
+        /* gpios could be shared on router platforms
+         * ignore reservation if it's high priority (e.g., test apps)
+         */
+        if ((priority != GPIO_HI_PRIORITY) &&
+            (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+                mask = priority ? (si_gpioreservation & mask) :
+                        ((si_gpioreservation | mask) & ~(si_gpioreservation));
+                val &= mask;
+        }
+
+        regoff = OFFSETOF(chipcregs_t, gpioouten);
+        return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* mask&set gpio output bits */
+uint32
+si_gpioout(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+        uint regoff;
+
+        regoff = 0;
+
+        /* gpios could be shared on router platforms
+         * ignore reservation if it's high priority (e.g., test apps)
+         */
+        if ((priority != GPIO_HI_PRIORITY) &&
+            (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+                mask = priority ? (si_gpioreservation & mask) :
+                        ((si_gpioreservation | mask) & ~(si_gpioreservation));
+                val &= mask;
+        }
+
+        regoff = OFFSETOF(chipcregs_t, gpioout);
+        return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* reserve one gpio */
+uint32
+si_gpioreserve(si_t *sih, uint32 gpio_bitmask, uint8 priority)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        /* only cores on SI_BUS share GPIO's and only applcation users need to
+         * reserve/release GPIO
+         */
+        if ((BUSTYPE(sih->bustype) != SI_BUS) || (!priority)) {
+                ASSERT((BUSTYPE(sih->bustype) == SI_BUS) && (priority));
+                return 0xffffffff;
+        }
+        /* make sure only one bit is set */
+        if ((!gpio_bitmask) || ((gpio_bitmask) & (gpio_bitmask - 1))) {
+                ASSERT((gpio_bitmask) && !((gpio_bitmask) & (gpio_bitmask - 1)));
+                return 0xffffffff;
+        }
+
+        /* already reserved */
+        if (si_gpioreservation & gpio_bitmask)
+                return 0xffffffff;
+        /* set reservation */
+        si_gpioreservation |= gpio_bitmask;
+
+        return si_gpioreservation;
+}
+
+/* release one gpio */
+/*
+ * releasing the gpio doesn't change the current value on the GPIO last write value
+ * persists till some one overwrites it
+ */
+
+uint32
+si_gpiorelease(si_t *sih, uint32 gpio_bitmask, uint8 priority)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        /* only cores on SI_BUS share GPIO's and only applcation users need to
+         * reserve/release GPIO
+         */
+        if ((BUSTYPE(sih->bustype) != SI_BUS) || (!priority)) {
+                ASSERT((BUSTYPE(sih->bustype) == SI_BUS) && (priority));
+                return 0xffffffff;
+        }
+        /* make sure only one bit is set */
+        if ((!gpio_bitmask) || ((gpio_bitmask) & (gpio_bitmask - 1))) {
+                ASSERT((gpio_bitmask) && !((gpio_bitmask) & (gpio_bitmask - 1)));
+                return 0xffffffff;
+        }
+
+        /* already released */
+        if (!(si_gpioreservation & gpio_bitmask))
+                return 0xffffffff;
+
+        /* clear reservation */
+        si_gpioreservation &= ~gpio_bitmask;
+
+        return si_gpioreservation;
+}
+
+/* return the current gpioin register value */
+uint32
+si_gpioin(si_t *sih)
+{
+        si_info_t *sii;
+        uint regoff;
+
+        sii = SI_INFO(sih);
+        regoff = 0;
+
+        regoff = OFFSETOF(chipcregs_t, gpioin);
+        return (si_corereg(sih, SI_CC_IDX, regoff, 0, 0));
+}
+
+/* mask&set gpio interrupt polarity bits */
+uint32
+si_gpiointpolarity(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+        si_info_t *sii;
+        uint regoff;
+
+        sii = SI_INFO(sih);
+        regoff = 0;
+
+        /* gpios could be shared on router platforms */
+        if ((BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+                mask = priority ? (si_gpioreservation & mask) :
+                        ((si_gpioreservation | mask) & ~(si_gpioreservation));
+                val &= mask;
+        }
+
+        regoff = OFFSETOF(chipcregs_t, gpiointpolarity);
+        return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* mask&set gpio interrupt mask bits */
+uint32
+si_gpiointmask(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+        si_info_t *sii;
+        uint regoff;
+
+        sii = SI_INFO(sih);
+        regoff = 0;
+
+        /* gpios could be shared on router platforms */
+        if ((BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+                mask = priority ? (si_gpioreservation & mask) :
+                        ((si_gpioreservation | mask) & ~(si_gpioreservation));
+                val &= mask;
+        }
+
+        regoff = OFFSETOF(chipcregs_t, gpiointmask);
+        return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* assign the gpio to an led */
+uint32
+si_gpioled(si_t *sih, uint32 mask, uint32 val)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+        if (sih->ccrev < 16)
+                return 0xffffffff;
+
+        /* gpio led powersave reg */
+        return (si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, gpiotimeroutmask), mask, val));
+}
+
+/* mask&set gpio timer val */
+uint32
+si_gpiotimerval(si_t *sih, uint32 mask, uint32 gpiotimerval)
+{
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        if (sih->ccrev < 16)
+                return 0xffffffff;
+
+        return (si_corereg(sih, SI_CC_IDX,
+                OFFSETOF(chipcregs_t, gpiotimerval), mask, gpiotimerval));
+}
+
+uint32
+si_gpiopull(si_t *sih, bool updown, uint32 mask, uint32 val)
+{
+        si_info_t *sii;
+        uint offs;
+
+        sii = SI_INFO(sih);
+        if (sih->ccrev < 20)
+                return 0xffffffff;
+
+        offs = (updown ? OFFSETOF(chipcregs_t, gpiopulldown) : OFFSETOF(chipcregs_t, gpiopullup));
+        return (si_corereg(sih, SI_CC_IDX, offs, mask, val));
+}
+
+uint32
+si_gpioevent(si_t *sih, uint regtype, uint32 mask, uint32 val)
+{
+        si_info_t *sii;
+        uint offs;
+
+        sii = SI_INFO(sih);
+        if (sih->ccrev < 11)
+                return 0xffffffff;
+
+        if (regtype == GPIO_REGEVT)
+                offs = OFFSETOF(chipcregs_t, gpioevent);
+        else if (regtype == GPIO_REGEVT_INTMSK)
+                offs = OFFSETOF(chipcregs_t, gpioeventintmask);
+        else if (regtype == GPIO_REGEVT_INTPOL)
+                offs = OFFSETOF(chipcregs_t, gpioeventintpolarity);
+        else
+                return 0xffffffff;
+
+        return (si_corereg(sih, SI_CC_IDX, offs, mask, val));
+}
+
+void *
+si_gpio_handler_register(si_t *sih, uint32 event,
+        bool level, gpio_handler_t cb, void *arg)
+{
+        si_info_t *sii;
+        gpioh_item_t *gi;
+
+        ASSERT(event);
+        ASSERT(cb != NULL);
+
+        sii = SI_INFO(sih);
+        if (sih->ccrev < 11)
+                return NULL;
+
+        if ((gi = MALLOC(sii->osh, sizeof(gpioh_item_t))) == NULL)
+                return NULL;
+
+        bzero(gi, sizeof(gpioh_item_t));
+        gi->event = event;
+        gi->handler = cb;
+        gi->arg = arg;
+        gi->level = level;
+
+        gi->next = sii->gpioh_head;
+        sii->gpioh_head = gi;
+
+        return (void *)(gi);
+}
+
+void
+si_gpio_handler_unregister(si_t *sih, void *gpioh)
+{
+        si_info_t *sii;
+        gpioh_item_t *p, *n;
+
+        sii = SI_INFO(sih);
+        if (sih->ccrev < 11)
+                return;
+
+        ASSERT(sii->gpioh_head != NULL);
+        if ((void*)sii->gpioh_head == gpioh) {
+                sii->gpioh_head = sii->gpioh_head->next;
+                MFREE(sii->osh, gpioh, sizeof(gpioh_item_t));
+                return;
+        } else {
+                p = sii->gpioh_head;
+                n = p->next;
+                while (n) {
+                        if ((void*)n == gpioh) {
+                                p->next = n->next;
+                                MFREE(sii->osh, gpioh, sizeof(gpioh_item_t));
+                                return;
+                        }
+                        p = n;
+                        n = n->next;
+                }
+        }
+
+        ASSERT(0); /* Not found in list */
+}
+
+void
+si_gpio_handler_process(si_t *sih)
+{
+        si_info_t *sii;
+        gpioh_item_t *h;
+        uint32 level = si_gpioin(sih);
+        uint32 levelp = si_gpiointpolarity(sih, 0, 0, 0);
+        uint32 edge = si_gpioevent(sih, GPIO_REGEVT, 0, 0);
+        uint32 edgep = si_gpioevent(sih, GPIO_REGEVT_INTPOL, 0, 0);
+
+        sii = SI_INFO(sih);
+        for (h = sii->gpioh_head; h != NULL; h = h->next) {
+                if (h->handler) {
+                        uint32 status = (h->level ? level : edge) & h->event;
+                        uint32 polarity = (h->level ? levelp : edgep) & h->event;
+
+                        /* polarity bitval is opposite of status bitval */
+                        if (status ^ polarity)
+                                h->handler(status, h->arg);
+                }
+        }
+
+        si_gpioevent(sih, GPIO_REGEVT, edge, edge); /* clear edge-trigger status */
+}
+
+uint32
+si_gpio_int_enable(si_t *sih, bool enable)
+{
+        si_info_t *sii;
+        uint offs;
+
+        sii = SI_INFO(sih);
+        if (sih->ccrev < 11)
+                return 0xffffffff;
+
+        offs = OFFSETOF(chipcregs_t, intmask);
+        return (si_corereg(sih, SI_CC_IDX, offs, CI_GPIO, (enable ? CI_GPIO : 0)));
+}
+
+
+/* Return the size of the specified SOCRAM bank */
+static uint
+socram_banksize(si_info_t *sii, sbsocramregs_t *regs, uint8 index, uint8 mem_type)
+{
+        uint banksize, bankinfo;
+        uint bankidx = index | (mem_type << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+
+        ASSERT(mem_type <= SOCRAM_MEMTYPE_DEVRAM);
+
+        W_REG(sii->osh, &regs->bankidx, bankidx);
+        bankinfo = R_REG(sii->osh, &regs->bankinfo);
+        banksize = SOCRAM_BANKINFO_SZBASE * ((bankinfo & SOCRAM_BANKINFO_SZMASK) + 1);
+        return banksize;
+}
+
+void
+si_socdevram(si_t *sih, bool set, uint8 *enable, uint8 *protect)
+{
+        si_info_t *sii;
+        uint origidx;
+        uint intr_val = 0;
+        sbsocramregs_t *regs;
+        bool wasup;
+        uint corerev;
+
+        sii = SI_INFO(sih);
+
+        /* Block ints and save current core */
+        INTR_OFF(sii, intr_val);
+        origidx = si_coreidx(sih);
+
+        if (!set)
+                *enable = *protect = 0;
+
+        /* Switch to SOCRAM core */
+        if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+                goto done;
+
+        /* Get info for determining size */
+        if (!(wasup = si_iscoreup(sih)))
+                si_core_reset(sih, 0, 0);
+
+        corerev = si_corerev(sih);
+        if (corerev >= 10) {
+                uint32 extcinfo;
+                uint8 nb;
+                uint8 i;
+                uint32 bankidx, bankinfo;
+
+                extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+                nb = ((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT);
+                for (i = 0; i < nb; i++) {
+                        bankidx = i | (SOCRAM_MEMTYPE_DEVRAM << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+                        W_REG(sii->osh, &regs->bankidx, bankidx);
+                        bankinfo = R_REG(sii->osh, &regs->bankinfo);
+                        if (set) {
+                                bankinfo &= ~SOCRAM_BANKINFO_DEVRAMSEL_MASK;
+                                bankinfo &= ~SOCRAM_BANKINFO_DEVRAMPRO_MASK;
+                                if (*enable) {
+                                        bankinfo |= (1 << SOCRAM_BANKINFO_DEVRAMSEL_SHIFT);
+                                        if (*protect)
+                                                bankinfo |= (1 << SOCRAM_BANKINFO_DEVRAMPRO_SHIFT);
+                                }
+                                W_REG(sii->osh, &regs->bankinfo, bankinfo);
+                        }
+                        else if (i == 0) {
+                                if (bankinfo & SOCRAM_BANKINFO_DEVRAMSEL_MASK) {
+                                        *enable = 1;
+                                        if (bankinfo & SOCRAM_BANKINFO_DEVRAMPRO_MASK)
+                                                *protect = 1;
+                                }
+                        }
+                }
+        }
+
+        /* Return to previous state and core */
+        if (!wasup)
+                si_core_disable(sih, 0);
+        si_setcoreidx(sih, origidx);
+
+done:
+        INTR_RESTORE(sii, intr_val);
+}
+
+bool
+si_socdevram_pkg(si_t *sih)
+{
+        if (si_socdevram_size(sih) > 0)
+                return TRUE;
+        else
+                return FALSE;
+}
+
+uint32
+si_socdevram_size(si_t *sih)
+{
+        si_info_t *sii;
+        uint origidx;
+        uint intr_val = 0;
+        uint32 memsize = 0;
+        sbsocramregs_t *regs;
+        bool wasup;
+        uint corerev;
+
+        sii = SI_INFO(sih);
+
+        /* Block ints and save current core */
+        INTR_OFF(sii, intr_val);
+        origidx = si_coreidx(sih);
+
+        /* Switch to SOCRAM core */
+        if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+                goto done;
+
+        /* Get info for determining size */
+        if (!(wasup = si_iscoreup(sih)))
+                si_core_reset(sih, 0, 0);
+
+        corerev = si_corerev(sih);
+        if (corerev >= 10) {
+                uint32 extcinfo;
+                uint8 nb;
+                uint8 i;
+
+                extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+                nb = (((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT));
+                for (i = 0; i < nb; i++)
+                        memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_DEVRAM);
+        }
+
+        /* Return to previous state and core */
+        if (!wasup)
+                si_core_disable(sih, 0);
+        si_setcoreidx(sih, origidx);
+
+done:
+        INTR_RESTORE(sii, intr_val);
+
+        return memsize;
+}
+
+/* Return the RAM size of the SOCRAM core */
+uint32
+si_socram_size(si_t *sih)
+{
+        si_info_t *sii;
+        uint origidx;
+        uint intr_val = 0;
+
+        sbsocramregs_t *regs;
+        bool wasup;
+        uint corerev;
+        uint32 coreinfo;
+        uint memsize = 0;
+
+        sii = SI_INFO(sih);
+
+        /* Block ints and save current core */
+        INTR_OFF(sii, intr_val);
+        origidx = si_coreidx(sih);
+
+        /* Switch to SOCRAM core */
+        if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+                goto done;
+
+        /* Get info for determining size */
+        if (!(wasup = si_iscoreup(sih)))
+                si_core_reset(sih, 0, 0);
+        corerev = si_corerev(sih);
+        coreinfo = R_REG(sii->osh, &regs->coreinfo);
+
+        /* Calculate size from coreinfo based on rev */
+        if (corerev == 0)
+                memsize = 1 << (16 + (coreinfo & SRCI_MS0_MASK));
+        else if (corerev < 3) {
+                memsize = 1 << (SR_BSZ_BASE + (coreinfo & SRCI_SRBSZ_MASK));
+                memsize *= (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+        } else if ((corerev <= 7) || (corerev == 12)) {
+                uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+                uint bsz = (coreinfo & SRCI_SRBSZ_MASK);
+                uint lss = (coreinfo & SRCI_LSS_MASK) >> SRCI_LSS_SHIFT;
+                if (lss != 0)
+                        nb --;
+                memsize = nb * (1 << (bsz + SR_BSZ_BASE));
+                if (lss != 0)
+                        memsize += (1 << ((lss - 1) + SR_BSZ_BASE));
+        } else {
+                uint8 i;
+                uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+                for (i = 0; i < nb; i++)
+                        memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_RAM);
+        }
+
+        /* Return to previous state and core */
+        if (!wasup)
+                si_core_disable(sih, 0);
+        si_setcoreidx(sih, origidx);
+
+done:
+        INTR_RESTORE(sii, intr_val);
+
+        return memsize;
+}
+
+
+void
+si_btcgpiowar(si_t *sih)
+{
+        si_info_t *sii;
+        uint origidx;
+        uint intr_val = 0;
+        chipcregs_t *cc;
+
+        sii = SI_INFO(sih);
+
+        /* Make sure that there is ChipCommon core present &&
+         * UART_TX is strapped to 1
+         */
+        if (!(sih->cccaps & CC_CAP_UARTGPIO))
+                return;
+
+        /* si_corereg cannot be used as we have to guarantee 8-bit read/writes */
+        INTR_OFF(sii, intr_val);
+
+        origidx = si_coreidx(sih);
+
+        cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+        ASSERT(cc != NULL);
+
+        W_REG(sii->osh, &cc->uart0mcr, R_REG(sii->osh, &cc->uart0mcr) | 0x04);
+
+        /* restore the original index */
+        si_setcoreidx(sih, origidx);
+
+        INTR_RESTORE(sii, intr_val);
+}
+
+uint
+si_pll_reset(si_t *sih)
+{
+        uint err = 0;
+
+        return (err);
+}
+
+/* check if the device is removed */
+bool
+si_deviceremoved(si_t *sih)
+{
+        uint32 w;
+        si_info_t *sii;
+
+        sii = SI_INFO(sih);
+
+        switch (BUSTYPE(sih->bustype)) {
+        case PCI_BUS:
+                ASSERT(sii->osh != NULL);
+                w = OSL_PCI_READ_CONFIG(sii->osh, PCI_CFG_VID, sizeof(uint32));
+                if ((w & 0xFFFF) != VENDOR_BROADCOM)
+                        return TRUE;
+                break;
+        }
+        return FALSE;
+}
diff --git a/drivers/net/wireless/bcmdhd/siutils_priv.h b/drivers/net/wireless/bcmdhd/siutils_priv.h
new file mode 100644
index 00000000000..d80246e01d1
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/siutils_priv.h
@@ -0,0 +1,235 @@
+/*
+ * Include file private to the SOC Interconnect support files.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: siutils_priv.h,v 1.17.4.3 2010-10-25 16:56:56 Exp $
+ */
+
+#ifndef _siutils_priv_h_
+#define _siutils_priv_h_
+
+#define SI_ERROR(args)
+
+#define SI_MSG(args)
+
+/* Define SI_VMSG to printf for verbose debugging, but don't check it in */
+#define SI_VMSG(args)
+
+#define IS_SIM(chippkg) ((chippkg == HDLSIM_PKG_ID) || (chippkg == HWSIM_PKG_ID))
+
+typedef uint32 (*si_intrsoff_t)(void *intr_arg);
+typedef void (*si_intrsrestore_t)(void *intr_arg, uint32 arg);
+typedef bool (*si_intrsenabled_t)(void *intr_arg);
+
+typedef struct gpioh_item {
+        void                    *arg;
+        bool                    level;
+        gpio_handler_t          handler;
+        uint32                  event;
+        struct gpioh_item       *next;
+} gpioh_item_t;
+
+/* misc si info needed by some of the routines */
+typedef struct si_info {
+        struct si_pub pub;              /* back plane public state (must be first field) */
+
+        void    *osh;                   /* osl os handle */
+        void    *sdh;                   /* bcmsdh handle */
+
+        uint    dev_coreid;             /* the core provides driver functions */
+        void    *intr_arg;              /* interrupt callback function arg */
+        si_intrsoff_t intrsoff_fn;      /* turns chip interrupts off */
+        si_intrsrestore_t intrsrestore_fn; /* restore chip interrupts */
+        si_intrsenabled_t intrsenabled_fn; /* check if interrupts are enabled */
+
+        void *pch;                      /* PCI/E core handle */
+
+        gpioh_item_t *gpioh_head;       /* GPIO event handlers list */
+
+        bool    memseg;                 /* flag to toggle MEM_SEG register */
+
+        char *vars;
+        uint varsz;
+
+        void    *curmap;                /* current regs va */
+        void    *regs[SI_MAXCORES];     /* other regs va */
+
+        uint    curidx;                 /* current core index */
+        uint    numcores;               /* # discovered cores */
+        uint    coreid[SI_MAXCORES];    /* id of each core */
+        uint32  coresba[SI_MAXCORES];   /* backplane address of each core */
+        void    *regs2[SI_MAXCORES];    /* va of each core second register set (usbh20) */
+        uint32  coresba2[SI_MAXCORES];  /* address of each core second register set (usbh20) */
+        uint32  coresba_size[SI_MAXCORES]; /* backplane address space size */
+        uint32  coresba2_size[SI_MAXCORES]; /* second address space size */
+
+        void    *curwrap;               /* current wrapper va */
+        void    *wrappers[SI_MAXCORES]; /* other cores wrapper va */
+        uint32  wrapba[SI_MAXCORES];    /* address of controlling wrapper */
+
+        uint32  cia[SI_MAXCORES];       /* erom cia entry for each core */
+        uint32  cib[SI_MAXCORES];       /* erom cia entry for each core */
+        uint32  oob_router;             /* oob router registers for axi */
+} si_info_t;
+
+#define SI_INFO(sih)    (si_info_t *)(uintptr)sih
+
+#define GOODCOREADDR(x, b) (((x) >= (b)) && ((x) < ((b) + SI_MAXCORES * SI_CORE_SIZE)) && \
+                ISALIGNED((x), SI_CORE_SIZE))
+#define GOODREGS(regs)  ((regs) != NULL && ISALIGNED((uintptr)(regs), SI_CORE_SIZE))
+#define BADCOREADDR     0
+#define GOODIDX(idx)    (((uint)idx) < SI_MAXCORES)
+#define NOREV           -1              /* Invalid rev */
+
+#define PCI(si)         ((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&     \
+                         ((si)->pub.buscoretype == PCI_CORE_ID))
+#define PCIE(si)        ((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&     \
+                         ((si)->pub.buscoretype == PCIE_CORE_ID))
+#define PCMCIA(si)      ((BUSTYPE((si)->pub.bustype) == PCMCIA_BUS) && ((si)->memseg == TRUE))
+
+/* Newer chips can access PCI/PCIE and CC core without requiring to change
+ * PCI BAR0 WIN
+ */
+#define SI_FAST(si) (((si)->pub.buscoretype == PCIE_CORE_ID) || \
+                     (((si)->pub.buscoretype == PCI_CORE_ID) && (si)->pub.buscorerev >= 13))
+
+#define PCIEREGS(si) (((char *)((si)->curmap) + PCI_16KB0_PCIREGS_OFFSET))
+#define CCREGS_FAST(si) (((char *)((si)->curmap) + PCI_16KB0_CCREGS_OFFSET))
+
+/*
+ * Macros to disable/restore function core(D11, ENET, ILINE20, etc) interrupts before/
+ * after core switching to avoid invalid register accesss inside ISR.
+ */
+#define INTR_OFF(si, intr_val) \
+        if ((si)->intrsoff_fn && (si)->coreid[(si)->curidx] == (si)->dev_coreid) {      \
+                intr_val = (*(si)->intrsoff_fn)((si)->intr_arg); }
+#define INTR_RESTORE(si, intr_val) \
+        if ((si)->intrsrestore_fn && (si)->coreid[(si)->curidx] == (si)->dev_coreid) {  \
+                (*(si)->intrsrestore_fn)((si)->intr_arg, intr_val); }
+
+/* dynamic clock control defines */
+#define LPOMINFREQ              25000           /* low power oscillator min */
+#define LPOMAXFREQ              43000           /* low power oscillator max */
+#define XTALMINFREQ             19800000        /* 20 MHz - 1% */
+#define XTALMAXFREQ             20200000        /* 20 MHz + 1% */
+#define PCIMINFREQ              25000000        /* 25 MHz */
+#define PCIMAXFREQ              34000000        /* 33 MHz + fudge */
+
+#define ILP_DIV_5MHZ            0               /* ILP = 5 MHz */
+#define ILP_DIV_1MHZ            4               /* ILP = 1 MHz */
+
+#define PCI_FORCEHT(si) \
+        (((PCIE(si)) && (si->pub.chip == BCM4311_CHIP_ID) && ((si->pub.chiprev <= 1))) || \
+        ((PCI(si) || PCIE(si)) && (si->pub.chip == BCM4321_CHIP_ID)) || \
+        (PCIE(si) && (si->pub.chip == BCM4716_CHIP_ID)))
+
+/* GPIO Based LED powersave defines */
+#define DEFAULT_GPIO_ONTIME     10              /* Default: 10% on */
+#define DEFAULT_GPIO_OFFTIME    90              /* Default: 10% on */
+
+#ifndef DEFAULT_GPIOTIMERVAL
+#define DEFAULT_GPIOTIMERVAL  ((DEFAULT_GPIO_ONTIME << GPIO_ONTIME_SHIFT) | DEFAULT_GPIO_OFFTIME)
+#endif
+
+/* Silicon Backplane externs */
+extern void sb_scan(si_t *sih, void *regs, uint devid);
+extern uint sb_coreid(si_t *sih);
+extern uint sb_intflag(si_t *sih);
+extern uint sb_flag(si_t *sih);
+extern void sb_setint(si_t *sih, int siflag);
+extern uint sb_corevendor(si_t *sih);
+extern uint sb_corerev(si_t *sih);
+extern uint sb_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern bool sb_iscoreup(si_t *sih);
+extern void *sb_setcoreidx(si_t *sih, uint coreidx);
+extern uint32 sb_core_cflags(si_t *sih, uint32 mask, uint32 val);
+extern void sb_core_cflags_wo(si_t *sih, uint32 mask, uint32 val);
+extern uint32 sb_core_sflags(si_t *sih, uint32 mask, uint32 val);
+extern void sb_commit(si_t *sih);
+extern uint32 sb_base(uint32 admatch);
+extern uint32 sb_size(uint32 admatch);
+extern void sb_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void sb_core_disable(si_t *sih, uint32 bits);
+extern uint32 sb_addrspace(si_t *sih, uint asidx);
+extern uint32 sb_addrspacesize(si_t *sih, uint asidx);
+extern int sb_numaddrspaces(si_t *sih);
+
+extern uint32 sb_set_initiator_to(si_t *sih, uint32 to, uint idx);
+
+extern bool sb_taclear(si_t *sih, bool details);
+
+
+/* Wake-on-wireless-LAN (WOWL) */
+extern bool sb_pci_pmecap(si_t *sih);
+struct osl_info;
+extern bool sb_pci_fastpmecap(struct osl_info *osh);
+extern bool sb_pci_pmeclr(si_t *sih);
+extern void sb_pci_pmeen(si_t *sih);
+extern uint sb_pcie_readreg(void *sih, uint addrtype, uint offset);
+
+/* AMBA Interconnect exported externs */
+extern si_t *ai_attach(uint pcidev, osl_t *osh, void *regs, uint bustype,
+                       void *sdh, char **vars, uint *varsz);
+extern si_t *ai_kattach(osl_t *osh);
+extern void ai_scan(si_t *sih, void *regs, uint devid);
+
+extern uint ai_flag(si_t *sih);
+extern void ai_setint(si_t *sih, int siflag);
+extern uint ai_coreidx(si_t *sih);
+extern uint ai_corevendor(si_t *sih);
+extern uint ai_corerev(si_t *sih);
+extern bool ai_iscoreup(si_t *sih);
+extern void *ai_setcoreidx(si_t *sih, uint coreidx);
+extern uint32 ai_core_cflags(si_t *sih, uint32 mask, uint32 val);
+extern void ai_core_cflags_wo(si_t *sih, uint32 mask, uint32 val);
+extern uint32 ai_core_sflags(si_t *sih, uint32 mask, uint32 val);
+extern uint ai_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern void ai_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void ai_core_disable(si_t *sih, uint32 bits);
+extern int ai_numaddrspaces(si_t *sih);
+extern uint32 ai_addrspace(si_t *sih, uint asidx);
+extern uint32 ai_addrspacesize(si_t *sih, uint asidx);
+extern uint ai_wrap_reg(si_t *sih, uint32 offset, uint32 mask, uint32 val);
+
+
+
+#define ub_scan(a, b, c) do {} while (0)
+#define ub_flag(a) (0)
+#define ub_setint(a, b) do {} while (0)
+#define ub_coreidx(a) (0)
+#define ub_corevendor(a) (0)
+#define ub_corerev(a) (0)
+#define ub_iscoreup(a) (0)
+#define ub_setcoreidx(a, b) (0)
+#define ub_core_cflags(a, b, c) (0)
+#define ub_core_cflags_wo(a, b, c) do {} while (0)
+#define ub_core_sflags(a, b, c) (0)
+#define ub_corereg(a, b, c, d, e) (0)
+#define ub_core_reset(a, b, c) do {} while (0)
+#define ub_core_disable(a, b) do {} while (0)
+#define ub_numaddrspaces(a) (0)
+#define ub_addrspace(a, b)  (0)
+#define ub_addrspacesize(a, b) (0)
+#define ub_view(a, b) do {} while (0)
+#define ub_dumpregs(a, b) do {} while (0)
+
+#endif  /* _siutils_priv_h_ */
diff --git a/drivers/net/wireless/bcmdhd/uamp_api.h b/drivers/net/wireless/bcmdhd/uamp_api.h
new file mode 100644
index 00000000000..c51c68cd0ee
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/uamp_api.h
@@ -0,0 +1,176 @@
+/*
+ *  Name:       uamp_api.h
+ *
+ *  Description: Universal AMP API
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: uamp_api.h,v 1.2.8.1 2011-02-05 00:16:14 Exp $
+ *
+ */
+#ifndef UAMP_API_H
+#define UAMP_API_H
+
+
+#include "typedefs.h"
+
+
+/*****************************************************************************
+**  Constant and Type Definitions
+******************************************************************************
+*/
+
+#define BT_API
+
+/* Types. */
+typedef bool    BOOLEAN;
+typedef uint8   UINT8;
+typedef uint16  UINT16;
+
+
+/* UAMP identifiers */
+#define UAMP_ID_1   1
+#define UAMP_ID_2   2
+typedef UINT8 tUAMP_ID;
+
+/* UAMP event ids (used by UAMP_CBACK) */
+#define UAMP_EVT_RX_READY           0   /* Data from AMP controller is ready to be read */
+#define UAMP_EVT_CTLR_REMOVED       1   /* Controller removed */
+#define UAMP_EVT_CTLR_READY         2   /* Controller added/ready */
+typedef UINT8 tUAMP_EVT;
+
+
+/* UAMP Channels */
+#define UAMP_CH_HCI_CMD            0   /* HCI Command channel */
+#define UAMP_CH_HCI_EVT            1   /* HCI Event channel */
+#define UAMP_CH_HCI_DATA           2   /* HCI ACL Data channel */
+typedef UINT8 tUAMP_CH;
+
+/* tUAMP_EVT_DATA: union for event-specific data, used by UAMP_CBACK */
+typedef union {
+    tUAMP_CH channel;       /* UAMP_EVT_RX_READY: channel for which rx occured */
+} tUAMP_EVT_DATA;
+
+
+/*****************************************************************************
+**
+** Function:    UAMP_CBACK
+**
+** Description: Callback for events. Register callback using UAMP_Init.
+**
+** Parameters   amp_id:         AMP device identifier that generated the event
+**              amp_evt:        event id
+**              p_amp_evt_data: pointer to event-specific data
+**
+******************************************************************************
+*/
+typedef void (*tUAMP_CBACK)(tUAMP_ID amp_id, tUAMP_EVT amp_evt, tUAMP_EVT_DATA *p_amp_evt_data);
+
+/*****************************************************************************
+**  external function declarations
+******************************************************************************
+*/
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+/*****************************************************************************
+**
+** Function:    UAMP_Init
+**
+** Description: Initialize UAMP driver
+**
+** Parameters   p_cback:    Callback function for UAMP event notification
+**
+******************************************************************************
+*/
+BT_API BOOLEAN UAMP_Init(tUAMP_CBACK p_cback);
+
+
+/*****************************************************************************
+**
+** Function:    UAMP_Open
+**
+** Description: Open connection to local AMP device.
+**
+** Parameters   app_id: Application specific AMP identifer. This value
+**                      will be included in AMP messages sent to the
+**                      BTU task, to identify source of the message
+**
+******************************************************************************
+*/
+BT_API BOOLEAN UAMP_Open(tUAMP_ID amp_id);
+
+/*****************************************************************************
+**
+** Function:    UAMP_Close
+**
+** Description: Close connection to local AMP device.
+**
+** Parameters   app_id: Application specific AMP identifer.
+**
+******************************************************************************
+*/
+BT_API void UAMP_Close(tUAMP_ID amp_id);
+
+
+/*****************************************************************************
+**
+** Function:    UAMP_Write
+**
+** Description: Send buffer to AMP device. Frees GKI buffer when done.
+**
+**
+** Parameters:  app_id:     AMP identifer.
+**              p_buf:      pointer to buffer to write
+**              num_bytes:  number of bytes to write
+**              channel:    UAMP_CH_HCI_ACL, or UAMP_CH_HCI_CMD
+**
+** Returns:     number of bytes written
+**
+******************************************************************************
+*/
+BT_API UINT16 UAMP_Write(tUAMP_ID amp_id, UINT8 *p_buf, UINT16 num_bytes, tUAMP_CH channel);
+
+/*****************************************************************************
+**
+** Function:    UAMP_Read
+**
+** Description: Read incoming data from AMP. Call after receiving a
+**              UAMP_EVT_RX_READY callback event.
+**
+** Parameters:  app_id:     AMP identifer.
+**              p_buf:      pointer to buffer for holding incoming AMP data
+**              buf_size:   size of p_buf
+**              channel:    UAMP_CH_HCI_ACL, or UAMP_CH_HCI_EVT
+**
+** Returns:     number of bytes read
+**
+******************************************************************************
+*/
+BT_API UINT16 UAMP_Read(tUAMP_ID amp_id, UINT8 *p_buf, UINT16 buf_size, tUAMP_CH channel);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* UAMP_API_H */
diff --git a/drivers/net/wireless/bcmdhd/wl_android.c b/drivers/net/wireless/bcmdhd/wl_android.c
new file mode 100644
index 00000000000..9ca3d602023
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wl_android.c
@@ -0,0 +1,840 @@
+/*
+ * Linux cfg80211 driver - Android related functions
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ *
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wl_android.c,v 1.1.4.1.2.14 2011/02/09 01:40:07 Exp $
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+#include <wl_android.h>
+#include <wldev_common.h>
+#include <wlioctl.h>
+#include <bcmutils.h>
+#include <linux_osl.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <bcmsdbus.h>
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+#include <linux/platform_device.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
+#include <linux/wlan_plat.h>
+#else
+#include <linux/wifi_tiwlan.h>
+#endif
+#endif /* CONFIG_WIFI_CONTROL_FUNC */
+
+/*
+ * Android private command strings, PLEASE define new private commands here
+ * so they can be updated easily in the future (if needed)
+ */
+
+#define CMD_START                               "START"
+#define CMD_STOP                                "STOP"
+#define CMD_SCAN_ACTIVE                 "SCAN-ACTIVE"
+#define CMD_SCAN_PASSIVE                "SCAN-PASSIVE"
+#define CMD_RSSI                                "RSSI"
+#define CMD_LINKSPEED                   "LINKSPEED"
+#define CMD_RXFILTER_START              "RXFILTER-START"
+#define CMD_RXFILTER_STOP               "RXFILTER-STOP"
+#define CMD_RXFILTER_ADD                "RXFILTER-ADD"
+#define CMD_RXFILTER_REMOVE             "RXFILTER-REMOVE"
+#define CMD_BTCOEXSCAN_START    "BTCOEXSCAN-START"
+#define CMD_BTCOEXSCAN_STOP             "BTCOEXSCAN-STOP"
+#define CMD_BTCOEXMODE                  "BTCOEXMODE"
+#define CMD_SETSUSPENDOPT               "SETSUSPENDOPT"
+#define CMD_P2P_DEV_ADDR                "P2P_DEV_ADDR"
+#define CMD_SETFWPATH                   "SETFWPATH"
+#define CMD_SETBAND                             "SETBAND"
+#define CMD_GETBAND                             "GETBAND"
+#define CMD_COUNTRY                             "COUNTRY"
+#define CMD_P2P_SET_NOA                 "P2P_SET_NOA"
+#define CMD_P2P_GET_NOA                 "P2P_GET_NOA"
+#define CMD_P2P_SET_PS                  "P2P_SET_PS"
+#define CMD_SET_AP_WPS_P2P_IE   "SET_AP_WPS_P2P_IE"
+
+
+#ifdef PNO_SUPPORT
+#define CMD_PNOSSIDCLR_SET      "PNOSSIDCLR"
+#define CMD_PNOSETUP_SET        "PNOSETUP "
+#define CMD_PNOENABLE_SET       "PNOFORCE"
+#define CMD_PNODEBUG_SET        "PNODEBUG"
+
+#define PNO_TLV_PREFIX                  'S'
+#define PNO_TLV_VERSION                 '1'
+#define PNO_TLV_SUBVERSION              '2'
+#define PNO_TLV_RESERVED                '0'
+#define PNO_TLV_TYPE_SSID_IE            'S'
+#define PNO_TLV_TYPE_TIME               'T'
+#define PNO_TLV_FREQ_REPEAT             'R'
+#define PNO_TLV_FREQ_EXPO_MAX           'M'
+
+typedef struct cmd_tlv {
+        char prefix;
+        char version;
+        char subver;
+        char reserved;
+} cmd_tlv_t;
+#endif /* PNO_SUPPORT */
+
+typedef struct android_wifi_priv_cmd {
+        char *buf;
+        int used_len;
+        int total_len;
+} android_wifi_priv_cmd;
+
+/**
+ * Extern function declarations (TODO: move them to dhd_linux.h)
+ */
+void dhd_customer_gpio_wlan_ctrl(int onoff);
+uint dhd_dev_reset(struct net_device *dev, uint8 flag);
+void dhd_dev_init_ioctl(struct net_device *dev);
+#ifdef WL_CFG80211
+int wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr);
+int wl_cfg80211_set_btcoex_dhcp(struct net_device *dev, char *command);
+#else
+int wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr)
+{ return 0; }
+int wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len)
+{ return 0; }
+#endif
+extern int dhd_os_check_if_up(void *dhdp);
+extern void *bcmsdh_get_drvdata(void);
+
+extern bool ap_fw_loaded;
+#ifdef CUSTOMER_HW2
+extern char iface_name[IFNAMSIZ];
+#endif
+
+/**
+ * Local (static) functions and variables
+ */
+
+/* Initialize g_wifi_on to 1 so dhd_bus_start will be called for the first
+ * time (only) in dhd_open, subsequential wifi on will be handled by
+ * wl_android_wifi_on
+ */
+static int g_wifi_on = TRUE;
+
+/**
+ * Local (static) function definitions
+ */
+static int wl_android_get_link_speed(struct net_device *net, char *command, int total_len)
+{
+        int link_speed;
+        int bytes_written;
+        int error;
+
+        error = wldev_get_link_speed(net, &link_speed);
+        if (error)
+                return -1;
+
+        /* Convert Kbps to Android Mbps */
+        link_speed = link_speed / 1000;
+        bytes_written = snprintf(command, total_len, "LinkSpeed %d", link_speed);
+        DHD_INFO(("%s: command result is %s\n", __FUNCTION__, command));
+        return bytes_written;
+}
+
+static int wl_android_get_rssi(struct net_device *net, char *command, int total_len)
+{
+        wlc_ssid_t ssid = {0};
+        int rssi;
+        int bytes_written = 0;
+        int error;
+
+        error = wldev_get_rssi(net, &rssi);
+        if (error)
+                return -1;
+
+        error = wldev_get_ssid(net, &ssid);
+        if (error)
+                return -1;
+        if ((ssid.SSID_len == 0) || (ssid.SSID_len > DOT11_MAX_SSID_LEN)) {
+                DHD_ERROR(("%s: wldev_get_ssid failed\n", __FUNCTION__));
+        } else {
+                memcpy(command, ssid.SSID, ssid.SSID_len);
+                bytes_written = ssid.SSID_len;
+        }
+        bytes_written += snprintf(&command[bytes_written], total_len, " rssi %d", rssi);
+        DHD_INFO(("%s: command result is %s (%d)\n", __FUNCTION__, command, bytes_written));
+        return bytes_written;
+}
+
+static int wl_android_set_suspendopt(struct net_device *dev, char *command, int total_len)
+{
+        int suspend_flag;
+        int ret_now;
+        int ret = 0;
+
+        suspend_flag = *(command + strlen(CMD_SETSUSPENDOPT) + 1) - '0';
+
+        if (suspend_flag != 0)
+                suspend_flag = 1;
+        ret_now = net_os_set_suspend_disable(dev, suspend_flag);
+
+        if (ret_now != suspend_flag) {
+                if (!(ret = net_os_set_suspend(dev, ret_now)))
+                        DHD_INFO(("%s: Suspend Flag %d -> %d\n",
+                                __FUNCTION__, ret_now, suspend_flag));
+                else
+                        DHD_ERROR(("%s: failed %d\n", __FUNCTION__, ret));
+        }
+        return ret;
+}
+
+static int wl_android_get_band(struct net_device *dev, char *command, int total_len)
+{
+        uint band;
+        int bytes_written;
+        int error;
+
+        error = wldev_get_band(dev, &band);
+        if (error)
+                return -1;
+        bytes_written = snprintf(command, total_len, "Band %d", band);
+        return bytes_written;
+}
+
+#ifdef PNO_SUPPORT
+static int wl_android_set_pno_setup(struct net_device *dev, char *command, int total_len)
+{
+        wlc_ssid_t ssids_local[MAX_PFN_LIST_COUNT];
+        int res = -1;
+        int nssid = 0;
+        cmd_tlv_t *cmd_tlv_temp;
+        char *str_ptr;
+        int tlv_size_left;
+        int pno_time = 0;
+        int pno_repeat = 0;
+        int pno_freq_expo_max = 0;
+
+#ifdef PNO_SET_DEBUG
+        int i;
+        char pno_in_example[] = {
+                'P', 'N', 'O', 'S', 'E', 'T', 'U', 'P', ' ',
+                'S', '1', '2', '0',
+                'S',
+                0x05,
+                'd', 'l', 'i', 'n', 'k',
+                'S',
+                0x04,
+                'G', 'O', 'O', 'G',
+                'T',
+                '0', 'B',
+                'R',
+                '2',
+                'M',
+                '2',
+                0x00
+                };
+#endif /* PNO_SET_DEBUG */
+
+        DHD_INFO(("%s: command=%s, len=%d\n", __FUNCTION__, command, total_len));
+
+        if (total_len < (strlen(CMD_PNOSETUP_SET) + sizeof(cmd_tlv_t))) {
+                DHD_ERROR(("%s argument=%d less min size\n", __FUNCTION__, total_len));
+                goto exit_proc;
+        }
+
+#ifdef PNO_SET_DEBUG
+        memcpy(command, pno_in_example, sizeof(pno_in_example));
+        for (i = 0; i < sizeof(pno_in_example); i++)
+                printf("%02X ", command[i]);
+        printf("\n");
+        total_len = sizeof(pno_in_example);
+#endif
+
+        str_ptr = command + strlen(CMD_PNOSETUP_SET);
+        tlv_size_left = total_len - strlen(CMD_PNOSETUP_SET);
+
+        cmd_tlv_temp = (cmd_tlv_t *)str_ptr;
+        memset(ssids_local, 0, sizeof(ssids_local));
+
+        if ((cmd_tlv_temp->prefix == PNO_TLV_PREFIX) &&
+                (cmd_tlv_temp->version == PNO_TLV_VERSION) &&
+                (cmd_tlv_temp->subver == PNO_TLV_SUBVERSION)) {
+
+                str_ptr += sizeof(cmd_tlv_t);
+                tlv_size_left -= sizeof(cmd_tlv_t);
+
+                if ((nssid = wl_iw_parse_ssid_list_tlv(&str_ptr, ssids_local,
+                        MAX_PFN_LIST_COUNT, &tlv_size_left)) <= 0) {
+                        DHD_ERROR(("SSID is not presented or corrupted ret=%d\n", nssid));
+                        goto exit_proc;
+                } else {
+                        if ((str_ptr[0] != PNO_TLV_TYPE_TIME) || (tlv_size_left <= 1)) {
+                                DHD_ERROR(("%s scan duration corrupted field size %d\n",
+                                        __FUNCTION__, tlv_size_left));
+                                goto exit_proc;
+                        }
+                        str_ptr++;
+                        pno_time = simple_strtoul(str_ptr, &str_ptr, 16);
+                        DHD_INFO(("%s: pno_time=%d\n", __FUNCTION__, pno_time));
+
+                        if (str_ptr[0] != 0) {
+                                if ((str_ptr[0] != PNO_TLV_FREQ_REPEAT)) {
+                                        DHD_ERROR(("%s pno repeat : corrupted field\n",
+                                                __FUNCTION__));
+                                        goto exit_proc;
+                                }
+                                str_ptr++;
+                                pno_repeat = simple_strtoul(str_ptr, &str_ptr, 16);
+                                DHD_INFO(("%s :got pno_repeat=%d\n", __FUNCTION__, pno_repeat));
+                                if (str_ptr[0] != PNO_TLV_FREQ_EXPO_MAX) {
+                                        DHD_ERROR(("%s FREQ_EXPO_MAX corrupted field size\n",
+                                                __FUNCTION__));
+                                        goto exit_proc;
+                                }
+                                str_ptr++;
+                                pno_freq_expo_max = simple_strtoul(str_ptr, &str_ptr, 16);
+                                DHD_INFO(("%s: pno_freq_expo_max=%d\n",
+                                        __FUNCTION__, pno_freq_expo_max));
+                        }
+                }
+        } else {
+                DHD_ERROR(("%s get wrong TLV command\n", __FUNCTION__));
+                goto exit_proc;
+        }
+
+        res = dhd_dev_pno_set(dev, ssids_local, nssid, pno_time, pno_repeat, pno_freq_expo_max);
+
+exit_proc:
+        return res;
+}
+#endif /* PNO_SUPPORT */
+
+static int wl_android_get_p2p_dev_addr(struct net_device *ndev, char *command, int total_len)
+{
+        int ret;
+        int bytes_written = 0;
+
+        ret = wl_cfg80211_get_p2p_dev_addr(ndev, (struct ether_addr*)command);
+        if (ret)
+                return 0;
+        bytes_written = sizeof(struct ether_addr);
+        return bytes_written;
+}
+
+/**
+ * Global function definitions (declared in wl_android.h)
+ */
+
+int wl_android_wifi_on(struct net_device *dev)
+{
+        int ret = 0;
+
+        printk("%s in\n", __FUNCTION__);
+        if (!dev) {
+                DHD_ERROR(("%s: dev is null\n", __FUNCTION__));
+                return -EINVAL;
+        }
+
+        dhd_net_if_lock(dev);
+        if (!g_wifi_on) {
+                dhd_customer_gpio_wlan_ctrl(WLAN_RESET_ON);
+                sdioh_start(NULL, 0);
+                ret = dhd_dev_reset(dev, FALSE);
+                sdioh_start(NULL, 1);
+                if (!ret)
+                        dhd_dev_init_ioctl(dev);
+                g_wifi_on = 1;
+        }
+        dhd_net_if_unlock(dev);
+
+        return ret;
+}
+
+int wl_android_wifi_off(struct net_device *dev)
+{
+        int ret = 0;
+
+        printk("%s in\n", __FUNCTION__);
+        if (!dev) {
+                DHD_TRACE(("%s: dev is null\n", __FUNCTION__));
+                return -EINVAL;
+        }
+
+        dhd_net_if_lock(dev);
+        if (g_wifi_on) {
+                ret = dhd_dev_reset(dev, TRUE);
+                sdioh_stop(NULL);
+                dhd_customer_gpio_wlan_ctrl(WLAN_RESET_OFF);
+                g_wifi_on = 0;
+        }
+        dhd_net_if_unlock(dev);
+
+        return ret;
+}
+
+static int wl_android_set_fwpath(struct net_device *net, char *command, int total_len)
+{
+        if ((strlen(command) - strlen(CMD_SETFWPATH)) > MOD_PARAM_PATHLEN)
+                return -1;
+        bcm_strncpy_s(fw_path, sizeof(fw_path),
+                command + strlen(CMD_SETFWPATH) + 1, MOD_PARAM_PATHLEN - 1);
+        if (strstr(fw_path, "apsta") != NULL) {
+                DHD_INFO(("GOT APSTA FIRMWARE\n"));
+                ap_fw_loaded = TRUE;
+        } else {
+                DHD_INFO(("GOT STA FIRMWARE\n"));
+                ap_fw_loaded = FALSE;
+        }
+        return 0;
+}
+
+int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+        int ret = 0;
+        char *command = NULL;
+        int bytes_written = 0;
+        android_wifi_priv_cmd priv_cmd;
+
+        net_os_wake_lock(net);
+
+        if (!ifr->ifr_data) {
+                ret = -EINVAL;
+                goto exit;
+        }
+        if (copy_from_user(&priv_cmd, ifr->ifr_data, sizeof(android_wifi_priv_cmd))) {
+                ret = -EFAULT;
+                goto exit;
+        }
+        command = kmalloc(priv_cmd.total_len, GFP_KERNEL);
+        if (!command)
+        {
+                DHD_ERROR(("%s: failed to allocate memory\n", __FUNCTION__));
+                ret = -ENOMEM;
+                goto exit;
+        }
+        if (copy_from_user(command, priv_cmd.buf, priv_cmd.total_len)) {
+                ret = -EFAULT;
+                goto exit;
+        }
+
+        DHD_INFO(("%s: Android private cmd \"%s\" on %s\n", __FUNCTION__, command, ifr->ifr_name));
+
+        if (strnicmp(command, CMD_START, strlen(CMD_START)) == 0) {
+                DHD_INFO(("%s, Received regular START command\n", __FUNCTION__));
+                bytes_written = wl_android_wifi_on(net);
+        }
+        else if (strnicmp(command, CMD_SETFWPATH, strlen(CMD_SETFWPATH)) == 0) {
+                bytes_written = wl_android_set_fwpath(net, command, priv_cmd.total_len);
+        }
+
+        if (!g_wifi_on) {
+                DHD_ERROR(("%s: Ignore private cmd \"%s\" - iface %s is down\n",
+                        __FUNCTION__, command, ifr->ifr_name));
+                ret = 0;
+                goto exit;
+        }
+
+        if (strnicmp(command, CMD_STOP, strlen(CMD_STOP)) == 0) {
+                bytes_written = wl_android_wifi_off(net);
+        }
+        else if (strnicmp(command, CMD_SCAN_ACTIVE, strlen(CMD_SCAN_ACTIVE)) == 0) {
+                /* TBD: SCAN-ACTIVE */
+        }
+        else if (strnicmp(command, CMD_SCAN_PASSIVE, strlen(CMD_SCAN_PASSIVE)) == 0) {
+                /* TBD: SCAN-PASSIVE */
+        }
+        else if (strnicmp(command, CMD_RSSI, strlen(CMD_RSSI)) == 0) {
+                bytes_written = wl_android_get_rssi(net, command, priv_cmd.total_len);
+        }
+        else if (strnicmp(command, CMD_LINKSPEED, strlen(CMD_LINKSPEED)) == 0) {
+                bytes_written = wl_android_get_link_speed(net, command, priv_cmd.total_len);
+        }
+        else if (strnicmp(command, CMD_RXFILTER_START, strlen(CMD_RXFILTER_START)) == 0) {
+                bytes_written = net_os_set_packet_filter(net, 1);
+        }
+        else if (strnicmp(command, CMD_RXFILTER_STOP, strlen(CMD_RXFILTER_STOP)) == 0) {
+                bytes_written = net_os_set_packet_filter(net, 0);
+        }
+        else if (strnicmp(command, CMD_RXFILTER_ADD, strlen(CMD_RXFILTER_ADD)) == 0) {
+                int filter_num = *(command + strlen(CMD_RXFILTER_ADD) + 1) - '0';
+                bytes_written = net_os_rxfilter_add_remove(net, TRUE, filter_num);
+        }
+        else if (strnicmp(command, CMD_RXFILTER_REMOVE, strlen(CMD_RXFILTER_REMOVE)) == 0) {
+                int filter_num = *(command + strlen(CMD_RXFILTER_REMOVE) + 1) - '0';
+                bytes_written = net_os_rxfilter_add_remove(net, FALSE, filter_num);
+        }
+        else if (strnicmp(command, CMD_BTCOEXSCAN_START, strlen(CMD_BTCOEXSCAN_START)) == 0) {
+                /* TBD: BTCOEXSCAN-START */
+        }
+        else if (strnicmp(command, CMD_BTCOEXSCAN_STOP, strlen(CMD_BTCOEXSCAN_STOP)) == 0) {
+                /* TBD: BTCOEXSCAN-STOP */
+        }
+        else if (strnicmp(command, CMD_BTCOEXMODE, strlen(CMD_BTCOEXMODE)) == 0) {
+                uint mode = *(command + strlen(CMD_BTCOEXMODE) + 1) - '0';
+
+                if (mode == 1)
+                        net_os_set_packet_filter(net, 0); /* DHCP starts */
+                else
+                        net_os_set_packet_filter(net, 1); /* DHCP ends */
+#ifdef WL_CFG80211
+                bytes_written = wl_cfg80211_set_btcoex_dhcp(net, command);
+#endif
+        }
+        else if (strnicmp(command, CMD_SETSUSPENDOPT, strlen(CMD_SETSUSPENDOPT)) == 0) {
+                bytes_written = wl_android_set_suspendopt(net, command, priv_cmd.total_len);
+        }
+        else if (strnicmp(command, CMD_SETBAND, strlen(CMD_SETBAND)) == 0) {
+                uint band = *(command + strlen(CMD_SETBAND) + 1) - '0';
+                bytes_written = wldev_set_band(net, band);
+        }
+        else if (strnicmp(command, CMD_GETBAND, strlen(CMD_GETBAND)) == 0) {
+                bytes_written = wl_android_get_band(net, command, priv_cmd.total_len);
+        }
+        else if (strnicmp(command, CMD_COUNTRY, strlen(CMD_COUNTRY)) == 0) {
+                char *country_code = command + strlen(CMD_COUNTRY) + 1;
+                bytes_written = wldev_set_country(net, country_code);
+        }
+#ifdef PNO_SUPPORT
+        else if (strnicmp(command, CMD_PNOSSIDCLR_SET, strlen(CMD_PNOSSIDCLR_SET)) == 0) {
+                bytes_written = dhd_dev_pno_reset(net);
+        }
+        else if (strnicmp(command, CMD_PNOSETUP_SET, strlen(CMD_PNOSETUP_SET)) == 0) {
+                bytes_written = wl_android_set_pno_setup(net, command, priv_cmd.total_len);
+        }
+        else if (strnicmp(command, CMD_PNOENABLE_SET, strlen(CMD_PNOENABLE_SET)) == 0) {
+                uint pfn_enabled = *(command + strlen(CMD_PNOENABLE_SET) + 1) - '0';
+                bytes_written = dhd_dev_pno_enable(net, pfn_enabled);
+        }
+#endif
+        else if (strnicmp(command, CMD_P2P_DEV_ADDR, strlen(CMD_P2P_DEV_ADDR)) == 0) {
+                bytes_written = wl_android_get_p2p_dev_addr(net, command, priv_cmd.total_len);
+        }
+        else if (strnicmp(command, CMD_P2P_SET_NOA, strlen(CMD_P2P_SET_NOA)) == 0) {
+                int skip = strlen(CMD_P2P_SET_NOA) + 1;
+                bytes_written = wl_cfg80211_set_p2p_noa(net, command + skip,
+                        priv_cmd.total_len - skip);
+        }
+        else if (strnicmp(command, CMD_P2P_GET_NOA, strlen(CMD_P2P_GET_NOA)) == 0) {
+                bytes_written = wl_cfg80211_get_p2p_noa(net, command, priv_cmd.total_len);
+        }
+        else if (strnicmp(command, CMD_P2P_SET_PS, strlen(CMD_P2P_SET_PS)) == 0) {
+                int skip = strlen(CMD_P2P_SET_PS) + 1;
+                bytes_written = wl_cfg80211_set_p2p_ps(net, command + skip,
+                        priv_cmd.total_len - skip);
+        }
+#ifdef WL_CFG80211
+        else if (strnicmp(command, CMD_SET_AP_WPS_P2P_IE,
+                strlen(CMD_SET_AP_WPS_P2P_IE)) == 0) {
+                int skip = strlen(CMD_SET_AP_WPS_P2P_IE) + 3;
+                bytes_written = wl_cfg80211_set_wps_p2p_ie(net, command + skip,
+                        priv_cmd.total_len - skip, *(command + skip - 2) - '0');
+        }
+#endif /* WL_CFG80211 */
+        else {
+                DHD_ERROR(("Unknown PRIVATE command %s - ignored\n", command));
+                snprintf(command, 3, "OK");
+                bytes_written = strlen("OK");
+        }
+
+        if (bytes_written > 0) {
+                if (bytes_written > priv_cmd.total_len) {
+                        DHD_ERROR(("%s: bytes_written = %d\n", __FUNCTION__, bytes_written));
+                        bytes_written = priv_cmd.total_len;
+                } else {
+                        bytes_written++;
+                }
+                priv_cmd.used_len = bytes_written;
+                if (copy_to_user(priv_cmd.buf, command, bytes_written)) {
+                        DHD_ERROR(("%s: failed to copy data to user buffer\n", __FUNCTION__));
+                        ret = -EFAULT;
+                }
+        } else {
+                ret = bytes_written;
+        }
+
+exit:
+        net_os_wake_unlock(net);
+        if (command) {
+                kfree(command);
+        }
+
+        return ret;
+}
+
+int wl_android_init(void)
+{
+        int ret = 0;
+
+        dhd_msg_level = DHD_ERROR_VAL;
+#ifdef ENABLE_INSMOD_NO_FW_LOAD
+        dhd_download_fw_on_driverload = FALSE;
+#endif /* ENABLE_INSMOD_NO_FW_LOAD */
+#ifdef CUSTOMER_HW2
+        if (!iface_name[0]) {
+                memset(iface_name, 0, IFNAMSIZ);
+                bcm_strncpy_s(iface_name, IFNAMSIZ, "wlan", IFNAMSIZ);
+        }
+#endif /* CUSTOMER_HW2 */
+        return ret;
+}
+
+int wl_android_exit(void)
+{
+        int ret = 0;
+
+        return ret;
+}
+
+int wl_android_post_init(void)
+{
+        struct net_device *ndev;
+        int ret = 0;
+        char buf[IFNAMSIZ];
+        if (!dhd_download_fw_on_driverload) {
+                /* Call customer gpio to turn off power with WL_REG_ON signal */
+                dhd_customer_gpio_wlan_ctrl(WLAN_RESET_OFF);
+                g_wifi_on = 0;
+        } else {
+                memset(buf, 0, IFNAMSIZ);
+#ifdef CUSTOMER_HW2
+                snprintf(buf, IFNAMSIZ, "%s%d", iface_name, 0);
+#else
+                snprintf(buf, IFNAMSIZ, "%s%d", "eth", 0);
+#endif
+                if ((ndev = dev_get_by_name (&init_net, buf)) != NULL) {
+                        dhd_dev_init_ioctl(ndev);
+                        dev_put(ndev);
+                }
+        }
+        return ret;
+}
+
+/**
+ * Functions for Android WiFi card detection
+ */
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+
+static int g_wifidev_registered = 0;
+static struct semaphore wifi_control_sem;
+static struct wifi_platform_data *wifi_control_data = NULL;
+static struct resource *wifi_irqres = NULL;
+
+static int wifi_add_dev(void);
+static void wifi_del_dev(void);
+
+int wl_android_wifictrl_func_add(void)
+{
+        int ret = 0;
+        sema_init(&wifi_control_sem, 0);
+
+        ret = wifi_add_dev();
+        if (ret) {
+                DHD_ERROR(("%s: platform_driver_register failed\n", __FUNCTION__));
+                return ret;
+        }
+        g_wifidev_registered = 1;
+
+        /* Waiting callback after platform_driver_register is done or exit with error */
+        if (down_timeout(&wifi_control_sem,  msecs_to_jiffies(1000)) != 0) {
+                ret = -EINVAL;
+                DHD_ERROR(("%s: platform_driver_register timeout\n", __FUNCTION__));
+        }
+
+        return ret;
+}
+
+void wl_android_wifictrl_func_del(void)
+{
+        if (g_wifidev_registered)
+        {
+                wifi_del_dev();
+                g_wifidev_registered = 0;
+        }
+}
+
+void* wl_android_prealloc(int section, unsigned long size)
+{
+        void *alloc_ptr = NULL;
+        if (wifi_control_data && wifi_control_data->mem_prealloc) {
+                alloc_ptr = wifi_control_data->mem_prealloc(section, size);
+                if (alloc_ptr) {
+                        DHD_INFO(("success alloc section %d\n", section));
+                        bzero(alloc_ptr, size);
+                        return alloc_ptr;
+                }
+        }
+
+        DHD_ERROR(("can't alloc section %d\n", section));
+        return 0;
+}
+
+int wifi_get_irq_number(unsigned long *irq_flags_ptr)
+{
+        if (wifi_irqres) {
+                *irq_flags_ptr = wifi_irqres->flags & IRQF_TRIGGER_MASK;
+                return (int)wifi_irqres->start;
+        }
+#ifdef CUSTOM_OOB_GPIO_NUM
+        return CUSTOM_OOB_GPIO_NUM;
+#else
+        return -1;
+#endif
+}
+
+int wifi_set_power(int on, unsigned long msec)
+{
+        DHD_ERROR(("%s = %d\n", __FUNCTION__, on));
+        if (wifi_control_data && wifi_control_data->set_power) {
+                wifi_control_data->set_power(on);
+        }
+        if (msec)
+                msleep(msec);
+        return 0;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
+int wifi_get_mac_addr(unsigned char *buf)
+{
+        DHD_ERROR(("%s\n", __FUNCTION__));
+        if (!buf)
+                return -EINVAL;
+        if (wifi_control_data && wifi_control_data->get_mac_addr) {
+                return wifi_control_data->get_mac_addr(buf);
+        }
+        return -EOPNOTSUPP;
+}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+void *wifi_get_country_code(char *ccode)
+{
+        DHD_TRACE(("%s\n", __FUNCTION__));
+        if (!ccode)
+                return NULL;
+        if (wifi_control_data && wifi_control_data->get_country_code) {
+                return wifi_control_data->get_country_code(ccode);
+        }
+        return NULL;
+}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)) */
+
+static int wifi_set_carddetect(int on)
+{
+        DHD_ERROR(("%s = %d\n", __FUNCTION__, on));
+        if (wifi_control_data && wifi_control_data->set_carddetect) {
+                wifi_control_data->set_carddetect(on);
+        }
+        return 0;
+}
+
+static int wifi_probe(struct platform_device *pdev)
+{
+        struct wifi_platform_data *wifi_ctrl =
+                (struct wifi_platform_data *)(pdev->dev.platform_data);
+
+        DHD_ERROR(("## %s\n", __FUNCTION__));
+        wifi_irqres = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "bcmdhd_wlan_irq");
+        if (wifi_irqres == NULL)
+                wifi_irqres = platform_get_resource_byname(pdev,
+                        IORESOURCE_IRQ, "bcm4329_wlan_irq");
+        wifi_control_data = wifi_ctrl;
+
+        wifi_set_power(1, 0);   /* Power On */
+        wifi_set_carddetect(1); /* CardDetect (0->1) */
+
+        up(&wifi_control_sem);
+        return 0;
+}
+
+static int wifi_remove(struct platform_device *pdev)
+{
+        struct wifi_platform_data *wifi_ctrl =
+                (struct wifi_platform_data *)(pdev->dev.platform_data);
+
+        DHD_ERROR(("## %s\n", __FUNCTION__));
+        wifi_control_data = wifi_ctrl;
+
+        wifi_set_power(0, 0);   /* Power Off */
+        wifi_set_carddetect(0); /* CardDetect (1->0) */
+
+        up(&wifi_control_sem);
+        return 0;
+}
+
+static int wifi_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        DHD_TRACE(("##> %s\n", __FUNCTION__));
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY)
+        bcmsdh_oob_intr_set(0);
+#endif
+        return 0;
+}
+
+static int wifi_resume(struct platform_device *pdev)
+{
+        DHD_TRACE(("##> %s\n", __FUNCTION__));
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY)
+        if (dhd_os_check_if_up(bcmsdh_get_drvdata()))
+                bcmsdh_oob_intr_set(1);
+#endif
+        return 0;
+}
+
+static struct platform_driver wifi_device = {
+        .probe          = wifi_probe,
+        .remove         = wifi_remove,
+        .suspend        = wifi_suspend,
+        .resume         = wifi_resume,
+        .driver         = {
+        .name   = "bcmdhd_wlan",
+        }
+};
+
+static struct platform_driver wifi_device_legacy = {
+        .probe          = wifi_probe,
+        .remove         = wifi_remove,
+        .suspend        = wifi_suspend,
+        .resume         = wifi_resume,
+        .driver         = {
+        .name   = "bcm4329_wlan",
+        }
+};
+
+static int wifi_add_dev(void)
+{
+        DHD_TRACE(("## Calling platform_driver_register\n"));
+        platform_driver_register(&wifi_device);
+        platform_driver_register(&wifi_device_legacy);
+        return 0;
+}
+
+static void wifi_del_dev(void)
+{
+        DHD_TRACE(("## Unregister platform_driver_register\n"));
+        platform_driver_unregister(&wifi_device);
+        platform_driver_unregister(&wifi_device_legacy);
+}
+#endif /* defined(CONFIG_WIFI_CONTROL_FUNC) */
diff --git a/drivers/net/wireless/bcmdhd/wl_android.h b/drivers/net/wireless/bcmdhd/wl_android.h
new file mode 100644
index 00000000000..17373b7f6d5
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wl_android.h
@@ -0,0 +1,57 @@
+/*
+ * Linux cfg80211 driver - Android related functions
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ *
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wl_android.c,v 1.1.4.1.2.14 2011/02/09 01:40:07 Exp $
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <wldev_common.h>
+
+/**
+ * Android platform dependent functions, feel free to add Android specific functions here
+ * (save the macros in dhd). Please do NOT declare functions that are NOT exposed to dhd
+ * or cfg, define them as static in wl_android.c
+ */
+
+/**
+ * wl_android_init will be called from module init function (dhd_module_init now), similarly
+ * wl_android_exit will be called from module exit function (dhd_module_cleanup now)
+ */
+int wl_android_init(void);
+int wl_android_exit(void);
+int wl_android_post_init(void);
+int wl_android_wifi_on(struct net_device *dev);
+int wl_android_wifi_off(struct net_device *dev);
+int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd);
+
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+int wl_android_wifictrl_func_add(void);
+void wl_android_wifictrl_func_del(void);
+void* wl_android_prealloc(int section, unsigned long size);
+
+int wifi_get_irq_number(unsigned long *irq_flags_ptr);
+int wifi_set_power(int on, unsigned long msec);
+int wifi_get_mac_addr(unsigned char *buf);
+void *wifi_get_country_code(char *ccode);
+#endif /* CONFIG_WIFI_CONTROL_FUNC */
diff --git a/drivers/net/wireless/bcmdhd/wl_cfg80211.c b/drivers/net/wireless/bcmdhd/wl_cfg80211.c
new file mode 100644
index 00000000000..daa7d2605aa
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wl_cfg80211.c
@@ -0,0 +1,7330 @@
+/*
+ * Linux cfg80211 driver
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ *
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wl_cfg80211.c,v 1.1.4.1.2.14 2011/02/09 01:40:07 Exp $
+ */
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+
+#include <bcmutils.h>
+#include <bcmwifi.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+#include <proto/802.11.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+
+#include <proto/ethernet.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/wait.h>
+#include <net/cfg80211.h>
+
+#include <net/rtnetlink.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/firmware.h>
+#include <bcmsdbus.h>
+
+#include <wlioctl.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+
+static struct sdio_func *cfg80211_sdio_func;
+static struct wl_priv *wlcfg_drv_priv;
+
+u32 wl_dbg_level = WL_DBG_ERR;
+
+#define WL_4329_FW_FILE "brcm/bcm4329-fullmac-4-218-248-5.bin"
+#define WL_4329_NVRAM_FILE "brcm/bcm4329-fullmac-4-218-248-5.txt"
+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
+#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAX_WAIT_TIME 1500
+static s8 ioctlbuf[WLC_IOCTL_MAXLEN];
+
+#define COEX_DHCP
+
+#if defined(COEX_DHCP)
+#define BT_DHCP_eSCO_FIX                /* use New SCO/eSCO smart YG
+                                         * suppression
+                                         */
+#define BT_DHCP_USE_FLAGS               /* this flag boost wifi pkt priority
+                                         * to max, caution: -not fair to sco
+                                         */
+#define BT_DHCP_OPPR_WIN_TIME   2500    /* T1 start SCO/ESCo priority
+                                         * suppression
+                                         */
+#define BT_DHCP_FLAG_FORCE_TIME 5500    /* T2 turn off SCO/SCO supperesion
+                                         * is (timeout)
+                                         */
+enum wl_cfg80211_btcoex_status {
+        BT_DHCP_IDLE,
+        BT_DHCP_START,
+        BT_DHCP_OPPR_WIN,
+        BT_DHCP_FLAG_FORCE_TIMEOUT
+};
+
+static int wl_cfg80211_btcoex_init(struct wl_priv *wl);
+static void wl_cfg80211_btcoex_deinit(struct wl_priv *wl);
+#endif
+
+/* This is to override regulatory domains defined in cfg80211 module (reg.c)
+ * By default world regulatory domain defined in reg.c puts the flags NL80211_RRF_PASSIVE_SCAN
+ * and NL80211_RRF_NO_IBSS for 5GHz channels (for 36..48 and 149..165).
+ * With respect to these flags, wpa_supplicant doesn't start p2p operations on 5GHz channels.
+ * All the chnages in world regulatory domain are to be done here.
+ */
+static const struct ieee80211_regdomain brcm_regdom = {
+        .n_reg_rules = 5,
+        .alpha2 =  "99",
+        .reg_rules = {
+                /* IEEE 802.11b/g, channels 1..11 */
+                REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
+                /* IEEE 802.11b/g, channels 12..13. No HT40
+                 * channel fits here.
+                 */
+                REG_RULE(2467-10, 2472+10, 20, 6, 20,
+                NL80211_RRF_PASSIVE_SCAN |
+                NL80211_RRF_NO_IBSS),
+                /* IEEE 802.11 channel 14 - Only JP enables
+                 * this and for 802.11b only
+                 */
+                REG_RULE(2484-10, 2484+10, 20, 6, 20,
+                NL80211_RRF_PASSIVE_SCAN |
+                NL80211_RRF_NO_IBSS |
+                NL80211_RRF_NO_OFDM),
+                /* IEEE 802.11a, channel 36..64 */
+                REG_RULE(5150-10, 5350+10, 40, 6, 20, 0),
+                /* IEEE 802.11a, channel 100..165 */
+                REG_RULE(5470-10, 5850+10, 40, 6, 20, 0), }
+};
+
+
+/* Data Element Definitions */
+#define WPS_ID_CONFIG_METHODS     0x1008
+#define WPS_ID_REQ_TYPE           0x103A
+#define WPS_ID_DEVICE_NAME        0x1011
+#define WPS_ID_VERSION            0x104A
+#define WPS_ID_DEVICE_PWD_ID      0x1012
+#define WPS_ID_REQ_DEV_TYPE       0x106A
+#define WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS 0x1053
+#define WPS_ID_PRIM_DEV_TYPE      0x1054
+
+/* Device Password ID */
+#define DEV_PW_DEFAULT 0x0000
+#define DEV_PW_USER_SPECIFIED 0x0001,
+#define DEV_PW_MACHINE_SPECIFIED 0x0002
+#define DEV_PW_REKEY 0x0003
+#define DEV_PW_PUSHBUTTON 0x0004
+#define DEV_PW_REGISTRAR_SPECIFIED 0x0005
+
+/* Config Methods */
+#define WPS_CONFIG_USBA 0x0001
+#define WPS_CONFIG_ETHERNET 0x0002
+#define WPS_CONFIG_LABEL 0x0004
+#define WPS_CONFIG_DISPLAY 0x0008
+#define WPS_CONFIG_EXT_NFC_TOKEN 0x0010
+#define WPS_CONFIG_INT_NFC_TOKEN 0x0020
+#define WPS_CONFIG_NFC_INTERFACE 0x0040
+#define WPS_CONFIG_PUSHBUTTON 0x0080
+#define WPS_CONFIG_KEYPAD 0x0100
+#define WPS_CONFIG_VIRT_PUSHBUTTON 0x0280
+#define WPS_CONFIG_PHY_PUSHBUTTON 0x0480
+#define WPS_CONFIG_VIRT_DISPLAY 0x2008
+#define WPS_CONFIG_PHY_DISPLAY 0x4008
+
+/*
+ * cfg80211_ops api/callback list
+ */
+static s32 wl_frame_get_mgmt(u16 fc, const struct ether_addr *da,
+        const struct ether_addr *sa, const struct ether_addr *bssid,
+        u8 **pheader, u32 *body_len, u8 *pbody);
+static s32 __wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+        struct cfg80211_scan_request *request,
+        struct cfg80211_ssid *this_ssid);
+static s32 wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+        struct cfg80211_scan_request *request);
+static s32 wl_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed);
+static s32 wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+        struct cfg80211_ibss_params *params);
+static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy,
+        struct net_device *dev);
+static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
+        struct net_device *dev, u8 *mac,
+        struct station_info *sinfo);
+static s32 wl_cfg80211_set_power_mgmt(struct wiphy *wiphy,
+        struct net_device *dev, bool enabled,
+        s32 timeout);
+static int wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+        struct cfg80211_connect_params *sme);
+static s32 wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+        u16 reason_code);
+static s32 wl_cfg80211_set_tx_power(struct wiphy *wiphy,
+        enum nl80211_tx_power_setting type,
+        s32 dbm);
+static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm);
+static s32 wl_cfg80211_config_default_key(struct wiphy *wiphy,
+        struct net_device *dev,
+        u8 key_idx, bool unicast, bool multicast);
+static s32 wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+        u8 key_idx, bool pairwise, const u8 *mac_addr,
+        struct key_params *params);
+static s32 wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+        u8 key_idx, bool pairwise, const u8 *mac_addr);
+static s32 wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+        u8 key_idx, bool pairwise, const u8 *mac_addr,
+        void *cookie, void (*callback) (void *cookie,
+        struct key_params *params));
+static s32 wl_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+        struct net_device *dev, u8 key_idx);
+static s32 wl_cfg80211_resume(struct wiphy *wiphy);
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)
+static s32 wl_cfg80211_suspend(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
+#else
+static s32 wl_cfg80211_suspend(struct wiphy *wiphy);
+#endif
+static s32 wl_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+        struct cfg80211_pmksa *pmksa);
+static s32 wl_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+        struct cfg80211_pmksa *pmksa);
+static s32 wl_cfg80211_flush_pmksa(struct wiphy *wiphy,
+        struct net_device *dev);
+static void wl_notify_escan_complete(struct wl_priv *wl, bool aborted);
+/*
+ * event & event Q handlers for cfg80211 interfaces
+ */
+static s32 wl_create_event_handler(struct wl_priv *wl);
+static void wl_destroy_event_handler(struct wl_priv *wl);
+static s32 wl_event_handler(void *data);
+static void wl_init_eq(struct wl_priv *wl);
+static void wl_flush_eq(struct wl_priv *wl);
+static unsigned long wl_lock_eq(struct wl_priv *wl);
+static void wl_unlock_eq(struct wl_priv *wl, unsigned long flags);
+static void wl_init_eq_lock(struct wl_priv *wl);
+static void wl_init_event_handler(struct wl_priv *wl);
+static struct wl_event_q *wl_deq_event(struct wl_priv *wl);
+static s32 wl_enq_event(struct wl_priv *wl, struct net_device *ndev, u32 type,
+        const wl_event_msg_t *msg, void *data);
+static void wl_put_event(struct wl_event_q *e);
+static void wl_wakeup_event(struct wl_priv *wl);
+static s32 wl_notify_connect_status(struct wl_priv *wl,
+        struct net_device *ndev,
+        const wl_event_msg_t *e, void *data);
+static s32 wl_notify_roaming_status(struct wl_priv *wl,
+        struct net_device *ndev,
+        const wl_event_msg_t *e, void *data);
+static s32 wl_notify_scan_status(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data);
+static s32 wl_bss_connect_done(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data, bool completed);
+static s32 wl_bss_roaming_done(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data);
+static s32 wl_notify_mic_status(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data);
+/*
+ * register/deregister sdio function
+ */
+struct sdio_func *wl_cfg80211_get_sdio_func(void);
+static void wl_clear_sdio_func(void);
+
+/*
+ * ioctl utilites
+ */
+static s32 wl_dev_bufvar_get(struct net_device *dev, s8 *name, s8 *buf,
+        s32 buf_len);
+static __used s32 wl_dev_bufvar_set(struct net_device *dev, s8 *name,
+        s8 *buf, s32 len);
+static s32 wl_dev_intvar_set(struct net_device *dev, s8 *name, s32 val);
+static s32 wl_dev_intvar_get(struct net_device *dev, s8 *name,
+        s32 *retval);
+
+/*
+ * cfg80211 set_wiphy_params utilities
+ */
+static s32 wl_set_frag(struct net_device *dev, u32 frag_threshold);
+static s32 wl_set_rts(struct net_device *dev, u32 frag_threshold);
+static s32 wl_set_retry(struct net_device *dev, u32 retry, bool l);
+
+/*
+ * wl profile utilities
+ */
+static s32 wl_update_prof(struct wl_priv *wl, const wl_event_msg_t *e,
+        void *data, s32 item);
+static void *wl_read_prof(struct wl_priv *wl, s32 item);
+static void wl_init_prof(struct wl_priv *wl);
+
+/*
+ * cfg80211 connect utilites
+ */
+static s32 wl_set_wpa_version(struct net_device *dev,
+        struct cfg80211_connect_params *sme);
+static s32 wl_set_auth_type(struct net_device *dev,
+        struct cfg80211_connect_params *sme);
+static s32 wl_set_set_cipher(struct net_device *dev,
+        struct cfg80211_connect_params *sme);
+static s32 wl_set_key_mgmt(struct net_device *dev,
+        struct cfg80211_connect_params *sme);
+static s32 wl_set_set_sharedkey(struct net_device *dev,
+        struct cfg80211_connect_params *sme);
+static s32 wl_get_assoc_ies(struct wl_priv *wl, struct net_device *ndev);
+static void wl_ch_to_chanspec(int ch,
+        struct wl_join_params *join_params, size_t *join_params_size);
+
+/*
+ * information element utilities
+ */
+static void wl_rst_ie(struct wl_priv *wl);
+static __used s32 wl_add_ie(struct wl_priv *wl, u8 t, u8 l, u8 *v);
+static s32 wl_mrg_ie(struct wl_priv *wl, u8 *ie_stream, u16 ie_size);
+static s32 wl_cp_ie(struct wl_priv *wl, u8 *dst, u16 dst_size);
+static u32 wl_get_ielen(struct wl_priv *wl);
+
+static s32 wl_mode_to_nl80211_iftype(s32 mode);
+
+static struct wireless_dev *wl_alloc_wdev(struct device *sdiofunc_dev);
+static void wl_free_wdev(struct wl_priv *wl);
+
+static s32 wl_inform_bss(struct wl_priv *wl);
+static s32 wl_inform_single_bss(struct wl_priv *wl, struct wl_bss_info *bi);
+static s32 wl_update_bss_info(struct wl_priv *wl, struct net_device *ndev);
+
+static s32 wl_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+        u8 key_idx, const u8 *mac_addr,
+        struct key_params *params);
+/*
+ * key indianess swap utilities
+ */
+static void swap_key_from_BE(struct wl_wsec_key *key);
+static void swap_key_to_BE(struct wl_wsec_key *key);
+
+/*
+ * wl_priv memory init/deinit utilities
+ */
+static s32 wl_init_priv_mem(struct wl_priv *wl);
+static void wl_deinit_priv_mem(struct wl_priv *wl);
+
+static void wl_delay(u32 ms);
+
+/*
+ * ibss mode utilities
+ */
+static bool wl_is_ibssmode(struct wl_priv *wl, struct net_device *ndev);
+static __used bool wl_is_ibssstarter(struct wl_priv *wl);
+
+/*
+ * dongle up/down , default configuration utilities
+ */
+static bool wl_is_linkdown(struct wl_priv *wl, const wl_event_msg_t *e);
+static bool wl_is_linkup(struct wl_priv *wl, const wl_event_msg_t *e, struct net_device *ndev);
+static bool wl_is_nonetwork(struct wl_priv *wl, const wl_event_msg_t *e);
+static void wl_link_up(struct wl_priv *wl);
+static void wl_link_down(struct wl_priv *wl);
+static s32 wl_dongle_mode(struct wl_priv *wl, struct net_device *ndev, s32 iftype);
+static s32 __wl_cfg80211_up(struct wl_priv *wl);
+static s32 __wl_cfg80211_down(struct wl_priv *wl);
+static s32 wl_dongle_probecap(struct wl_priv *wl);
+static void wl_init_conf(struct wl_conf *conf);
+static s32 wl_dongle_add_remove_eventmsg(struct net_device *ndev, u16 event, bool add);
+
+/*
+ * dongle configuration utilities
+ */
+#ifndef EMBEDDED_PLATFORM
+static s32 wl_dongle_country(struct net_device *ndev, u8 ccode);
+static s32 wl_dongle_up(struct net_device *ndev, u32 up);
+static s32 wl_dongle_power(struct net_device *ndev, u32 power_mode);
+static s32 wl_dongle_glom(struct net_device *ndev, u32 glom,
+        u32 dongle_align);
+static s32 wl_dongle_roam(struct net_device *ndev, u32 roamvar,
+        u32 bcn_timeout);
+static s32 wl_dongle_scantime(struct net_device *ndev, s32 scan_assoc_time,
+        s32 scan_unassoc_time);
+static s32 wl_dongle_offload(struct net_device *ndev, s32 arpoe,
+        s32 arp_ol);
+static s32 wl_pattern_atoh(s8 *src, s8 *dst);
+static s32 wl_dongle_filter(struct net_device *ndev, u32 filter_mode);
+static s32 wl_update_wiphybands(struct wl_priv *wl);
+#endif                          /* !EMBEDDED_PLATFORM */
+static __used void wl_dongle_poweron(struct wl_priv *wl);
+static __used void wl_dongle_poweroff(struct wl_priv *wl);
+static s32 wl_config_dongle(struct wl_priv *wl, bool need_lock);
+
+/*
+ * iscan handler
+ */
+static void wl_iscan_timer(unsigned long data);
+static void wl_term_iscan(struct wl_priv *wl);
+static s32 wl_init_scan(struct wl_priv *wl);
+static s32 wl_iscan_thread(void *data);
+static s32 wl_run_iscan(struct wl_iscan_ctrl *iscan, struct cfg80211_scan_request *request,
+        u16 action);
+static s32 wl_do_iscan(struct wl_priv *wl,  struct cfg80211_scan_request *request);
+static s32 wl_wakeup_iscan(struct wl_iscan_ctrl *iscan);
+static s32 wl_invoke_iscan(struct wl_priv *wl);
+static s32 wl_get_iscan_results(struct wl_iscan_ctrl *iscan, u32 *status,
+        struct wl_scan_results **bss_list);
+static void wl_notify_iscan_complete(struct wl_iscan_ctrl *iscan, bool aborted);
+static void wl_init_iscan_handler(struct wl_iscan_ctrl *iscan);
+static s32 wl_iscan_done(struct wl_priv *wl);
+static s32 wl_iscan_pending(struct wl_priv *wl);
+static s32 wl_iscan_inprogress(struct wl_priv *wl);
+static s32 wl_iscan_aborted(struct wl_priv *wl);
+
+/*
+ * fw/nvram downloading handler
+ */
+static void wl_init_fw(struct wl_fw_ctrl *fw);
+
+/*
+ * find most significant bit set
+ */
+static __used u32 wl_find_msb(u16 bit16);
+
+/*
+ * update pmklist to dongle
+ */
+static __used s32 wl_update_pmklist(struct net_device *dev,
+        struct wl_pmk_list *pmk_list, s32 err);
+
+/*
+ * debufs support
+ */
+static int wl_debugfs_add_netdev_params(struct wl_priv *wl);
+static void wl_debugfs_remove_netdev(struct wl_priv *wl);
+
+/*
+ * rfkill support
+ */
+static int wl_setup_rfkill(struct wl_priv *wl, bool setup);
+static int wl_rfkill_set(void *data, bool blocked);
+
+/*
+ * Some external functions, TODO: move them to dhd_linux.h
+ */
+int dhd_add_monitor(char *name, struct net_device **new_ndev);
+int dhd_del_monitor(struct net_device *ndev);
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+int dhd_start_xmit(struct sk_buff *skb, struct net_device *net);
+
+#define CHECK_SYS_UP(wlpriv)                                                    \
+do {                                                                    \
+        if (unlikely(!wl_get_drv_status(wlpriv, READY))) {      \
+                WL_INFO(("device is not ready : status (%d)\n",         \
+                        (int)wlpriv->status));                  \
+                return -EIO;                                            \
+        }                                                               \
+} while (0)
+
+
+#define IS_WPA_AKM(akm) ((akm) == RSN_AKM_NONE || \
+                                 (akm) == RSN_AKM_UNSPECIFIED || \
+                                 (akm) == RSN_AKM_PSK)
+
+
+extern int dhd_wait_pend8021x(struct net_device *dev);
+
+#if (WL_DBG_LEVEL > 0)
+#define WL_DBG_ESTR_MAX 50
+static s8 wl_dbg_estr[][WL_DBG_ESTR_MAX] = {
+        "SET_SSID", "JOIN", "START", "AUTH", "AUTH_IND",
+        "DEAUTH", "DEAUTH_IND", "ASSOC", "ASSOC_IND", "REASSOC",
+        "REASSOC_IND", "DISASSOC", "DISASSOC_IND", "QUIET_START", "QUIET_END",
+        "BEACON_RX", "LINK", "MIC_ERROR", "NDIS_LINK", "ROAM",
+        "TXFAIL", "PMKID_CACHE", "RETROGRADE_TSF", "PRUNE", "AUTOAUTH",
+        "EAPOL_MSG", "SCAN_COMPLETE", "ADDTS_IND", "DELTS_IND", "BCNSENT_IND",
+        "BCNRX_MSG", "BCNLOST_MSG", "ROAM_PREP", "PFN_NET_FOUND",
+        "PFN_NET_LOST",
+        "RESET_COMPLETE", "JOIN_START", "ROAM_START", "ASSOC_START",
+        "IBSS_ASSOC",
+        "RADIO", "PSM_WATCHDOG", "WLC_E_CCX_ASSOC_START", "WLC_E_CCX_ASSOC_ABORT",
+        "PROBREQ_MSG",
+        "SCAN_CONFIRM_IND", "PSK_SUP", "COUNTRY_CODE_CHANGED",
+        "EXCEEDED_MEDIUM_TIME", "ICV_ERROR",
+        "UNICAST_DECODE_ERROR", "MULTICAST_DECODE_ERROR", "TRACE",
+        "WLC_E_BTA_HCI_EVENT", "IF", "WLC_E_P2P_DISC_LISTEN_COMPLETE",
+        "RSSI", "PFN_SCAN_COMPLETE", "WLC_E_EXTLOG_MSG",
+        "ACTION_FRAME", "ACTION_FRAME_COMPLETE", "WLC_E_PRE_ASSOC_IND",
+        "WLC_E_PRE_REASSOC_IND", "WLC_E_CHANNEL_ADOPTED", "WLC_E_AP_STARTED",
+        "WLC_E_DFS_AP_STOP", "WLC_E_DFS_AP_RESUME", "WLC_E_WAI_STA_EVENT",
+        "WLC_E_WAI_MSG", "WLC_E_ESCAN_RESULT", "WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE",
+        "WLC_E_PROBRESP_MSG", "WLC_E_P2P_PROBREQ_MSG", "WLC_E_DCS_REQUEST", "WLC_E_FIFO_CREDIT_MAP",
+        "WLC_E_ACTION_FRAME_RX", "WLC_E_WAKE_EVENT", "WLC_E_RM_COMPLETE"
+};
+#endif                          /* WL_DBG_LEVEL */
+
+#define CHAN2G(_channel, _freq, _flags) {                       \
+        .band                   = IEEE80211_BAND_2GHZ,          \
+        .center_freq            = (_freq),                      \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
+
+#define CHAN5G(_channel, _flags) {                              \
+        .band                   = IEEE80211_BAND_5GHZ,          \
+        .center_freq            = 5000 + (5 * (_channel)),      \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
+
+#define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
+#define RATETAB_ENT(_rateid, _flags) \
+        {                                                               \
+                .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
+                .hw_value       = (_rateid),                        \
+                .flags    = (_flags),                        \
+        }
+
+static struct ieee80211_rate __wl_rates[] = {
+        RATETAB_ENT(WLC_RATE_1M, 0),
+        RATETAB_ENT(WLC_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(WLC_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(WLC_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(WLC_RATE_6M, 0),
+        RATETAB_ENT(WLC_RATE_9M, 0),
+        RATETAB_ENT(WLC_RATE_12M, 0),
+        RATETAB_ENT(WLC_RATE_18M, 0),
+        RATETAB_ENT(WLC_RATE_24M, 0),
+        RATETAB_ENT(WLC_RATE_36M, 0),
+        RATETAB_ENT(WLC_RATE_48M, 0),
+        RATETAB_ENT(WLC_RATE_54M, 0)
+};
+
+#define wl_a_rates              (__wl_rates + 4)
+#define wl_a_rates_size 8
+#define wl_g_rates              (__wl_rates + 0)
+#define wl_g_rates_size 12
+
+static struct ieee80211_channel __wl_2ghz_channels[] = {
+        CHAN2G(1, 2412, 0),
+        CHAN2G(2, 2417, 0),
+        CHAN2G(3, 2422, 0),
+        CHAN2G(4, 2427, 0),
+        CHAN2G(5, 2432, 0),
+        CHAN2G(6, 2437, 0),
+        CHAN2G(7, 2442, 0),
+        CHAN2G(8, 2447, 0),
+        CHAN2G(9, 2452, 0),
+        CHAN2G(10, 2457, 0),
+        CHAN2G(11, 2462, 0),
+        CHAN2G(12, 2467, 0),
+        CHAN2G(13, 2472, 0),
+        CHAN2G(14, 2484, 0)
+};
+
+static struct ieee80211_channel __wl_5ghz_a_channels[] = {
+        CHAN5G(34, 0), CHAN5G(36, 0),
+        CHAN5G(38, 0), CHAN5G(40, 0),
+        CHAN5G(42, 0), CHAN5G(44, 0),
+        CHAN5G(46, 0), CHAN5G(48, 0),
+        CHAN5G(52, 0), CHAN5G(56, 0),
+        CHAN5G(60, 0), CHAN5G(64, 0),
+        CHAN5G(100, 0), CHAN5G(104, 0),
+        CHAN5G(108, 0), CHAN5G(112, 0),
+        CHAN5G(116, 0), CHAN5G(120, 0),
+        CHAN5G(124, 0), CHAN5G(128, 0),
+        CHAN5G(132, 0), CHAN5G(136, 0),
+        CHAN5G(140, 0), CHAN5G(149, 0),
+        CHAN5G(153, 0), CHAN5G(157, 0),
+        CHAN5G(161, 0), CHAN5G(165, 0)
+};
+
+static struct ieee80211_supported_band __wl_band_2ghz = {
+        .band = IEEE80211_BAND_2GHZ,
+        .channels = __wl_2ghz_channels,
+        .n_channels = ARRAY_SIZE(__wl_2ghz_channels),
+        .bitrates = wl_g_rates,
+        .n_bitrates = wl_g_rates_size
+};
+
+static struct ieee80211_supported_band __wl_band_5ghz_a = {
+        .band = IEEE80211_BAND_5GHZ,
+        .channels = __wl_5ghz_a_channels,
+        .n_channels = ARRAY_SIZE(__wl_5ghz_a_channels),
+        .bitrates = wl_a_rates,
+        .n_bitrates = wl_a_rates_size
+};
+
+static const u32 __wl_cipher_suites[] = {
+        WLAN_CIPHER_SUITE_WEP40,
+        WLAN_CIPHER_SUITE_WEP104,
+        WLAN_CIPHER_SUITE_TKIP,
+        WLAN_CIPHER_SUITE_CCMP,
+        WLAN_CIPHER_SUITE_AES_CMAC,
+};
+
+/* There isn't a lot of sense in it, but you can transmit anything you like */
+static const struct ieee80211_txrx_stypes
+wl_cfg80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+        [NL80211_IFTYPE_ADHOC] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4)
+        },
+        [NL80211_IFTYPE_STATION] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_AP] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+                BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+                BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+                BIT(IEEE80211_STYPE_AUTH >> 4) |
+                BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+                BIT(IEEE80211_STYPE_ACTION >> 4)
+        },
+        [NL80211_IFTYPE_AP_VLAN] = {
+                /* copy AP */
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+                BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+                BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+                BIT(IEEE80211_STYPE_AUTH >> 4) |
+                BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+                BIT(IEEE80211_STYPE_ACTION >> 4)
+        },
+        [NL80211_IFTYPE_P2P_CLIENT] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_P2P_GO] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+                BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+                BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+                BIT(IEEE80211_STYPE_AUTH >> 4) |
+                BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+                BIT(IEEE80211_STYPE_ACTION >> 4)
+        }
+};
+
+static void swap_key_from_BE(struct wl_wsec_key *key)
+{
+        key->index = htod32(key->index);
+        key->len = htod32(key->len);
+        key->algo = htod32(key->algo);
+        key->flags = htod32(key->flags);
+        key->rxiv.hi = htod32(key->rxiv.hi);
+        key->rxiv.lo = htod16(key->rxiv.lo);
+        key->iv_initialized = htod32(key->iv_initialized);
+}
+
+static void swap_key_to_BE(struct wl_wsec_key *key)
+{
+        key->index = dtoh32(key->index);
+        key->len = dtoh32(key->len);
+        key->algo = dtoh32(key->algo);
+        key->flags = dtoh32(key->flags);
+        key->rxiv.hi = dtoh32(key->rxiv.hi);
+        key->rxiv.lo = dtoh16(key->rxiv.lo);
+        key->iv_initialized = dtoh32(key->iv_initialized);
+}
+
+/* For debug: Dump the contents of the encoded wps ie buffe */
+static void
+wl_validate_wps_ie(char *wps_ie, bool *pbc)
+{
+        #define WPS_IE_FIXED_LEN 6
+        u16 len = (u16) wps_ie[TLV_LEN_OFF];
+        u8 *subel = wps_ie+  WPS_IE_FIXED_LEN;
+        u16 subelt_id;
+        u16 subelt_len;
+        u16 val;
+        u8 *valptr = (uint8*) &val;
+
+        WL_DBG(("wps_ie len=%d\n", len));
+
+        len -= 4;       /* for the WPS IE's OUI, oui_type fields */
+
+        while (len >= 4) {              /* must have attr id, attr len fields */
+                valptr[0] = *subel++;
+                valptr[1] = *subel++;
+                subelt_id = HTON16(val);
+
+                valptr[0] = *subel++;
+                valptr[1] = *subel++;
+                subelt_len = HTON16(val);
+
+                len -= 4;                       /* for the attr id, attr len fields */
+                len -= subelt_len;      /* for the remaining fields in this attribute */
+                WL_DBG((" subel=%p, subelt_id=0x%x subelt_len=%u\n",
+                        subel, subelt_id, subelt_len));
+
+                if (subelt_id == WPS_ID_VERSION) {
+                        WL_DBG(("  attr WPS_ID_VERSION: %u\n", *subel));
+                } else if (subelt_id == WPS_ID_REQ_TYPE) {
+                        WL_DBG(("  attr WPS_ID_REQ_TYPE: %u\n", *subel));
+                } else if (subelt_id == WPS_ID_CONFIG_METHODS) {
+                        valptr[0] = *subel;
+                        valptr[1] = *(subel + 1);
+                        WL_DBG(("  attr WPS_ID_CONFIG_METHODS: %x\n", HTON16(val)));
+                } else if (subelt_id == WPS_ID_DEVICE_NAME) {
+                        char devname[100];
+                        memcpy(devname, subel, subelt_len);
+                        devname[subelt_len] = '\0';
+                        WL_DBG(("  attr WPS_ID_DEVICE_NAME: %s (len %u)\n",
+                                devname, subelt_len));
+                } else if (subelt_id == WPS_ID_DEVICE_PWD_ID) {
+                        valptr[0] = *subel;
+                        valptr[1] = *(subel + 1);
+                        WL_DBG(("  attr WPS_ID_DEVICE_PWD_ID: %u\n", HTON16(val)));
+                        *pbc = (HTON16(val) == DEV_PW_PUSHBUTTON) ? true : false;
+                } else if (subelt_id == WPS_ID_PRIM_DEV_TYPE) {
+                        valptr[0] = *subel;
+                        valptr[1] = *(subel + 1);
+                        WL_DBG(("  attr WPS_ID_PRIM_DEV_TYPE: cat=%u \n", HTON16(val)));
+                        valptr[0] = *(subel + 6);
+                        valptr[1] = *(subel + 7);
+                        WL_DBG(("  attr WPS_ID_PRIM_DEV_TYPE: subcat=%u\n", HTON16(val)));
+                } else if (subelt_id == WPS_ID_REQ_DEV_TYPE) {
+                        valptr[0] = *subel;
+                        valptr[1] = *(subel + 1);
+                        WL_DBG(("  attr WPS_ID_REQ_DEV_TYPE: cat=%u\n", HTON16(val)));
+                        valptr[0] = *(subel + 6);
+                        valptr[1] = *(subel + 7);
+                        WL_DBG(("  attr WPS_ID_REQ_DEV_TYPE: subcat=%u\n", HTON16(val)));
+                } else if (subelt_id == WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS) {
+                        valptr[0] = *subel;
+                        valptr[1] = *(subel + 1);
+                        WL_DBG(("  attr WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS"
+                                ": cat=%u\n", HTON16(val)));
+                } else {
+                        WL_DBG(("  unknown attr 0x%x\n", subelt_id));
+                }
+
+                subel += subelt_len;
+        }
+}
+
+static struct net_device* wl_cfg80211_add_monitor_if(char *name)
+{
+        int ret = 0;
+        struct net_device* ndev = NULL;
+
+        ret = dhd_add_monitor(name, &ndev);
+        WL_INFO(("wl_cfg80211_add_monitor_if net device returned: 0x%p\n", ndev));
+        return ndev;
+}
+
+static struct net_device *
+wl_cfg80211_add_virtual_iface(struct wiphy *wiphy, char *name,
+        enum nl80211_iftype type, u32 *flags,
+        struct vif_params *params)
+{
+        s32 err;
+        s32 timeout = -1;
+        s32 wlif_type = -1;
+        s32 index = 0;
+        s32 mode = 0;
+        chanspec_t chspec;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct net_device *_ndev;
+        dhd_pub_t *dhd = (dhd_pub_t *)(wl->pub);
+        int (*net_attach)(dhd_pub_t *dhdp, int ifidx);
+        bool rollback_lock = false;
+
+        WL_DBG(("if name: %s, type: %d\n", name, type));
+        switch (type) {
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_WDS:
+        case NL80211_IFTYPE_MESH_POINT:
+                WL_ERR(("Unsupported interface type\n"));
+                mode = WL_MODE_IBSS;
+                return NULL;
+        case NL80211_IFTYPE_MONITOR:
+                return wl_cfg80211_add_monitor_if(name);
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_STATION:
+                wlif_type = WL_P2P_IF_CLIENT;
+                mode = WL_MODE_BSS;
+                break;
+        case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_AP:
+                wlif_type = WL_P2P_IF_GO;
+                mode = WL_MODE_AP;
+                break;
+        default:
+                WL_ERR(("Unsupported interface type\n"));
+                return NULL;
+                break;
+        }
+
+        if (!name) {
+                WL_ERR(("name is NULL\n"));
+                return NULL;
+        }
+        if (wl->p2p_supported && (wlif_type != -1)) {
+                if (wl_get_p2p_status(wl, IF_DELETING)) {
+                        /* wait till IF_DEL is complete
+                         * release the lock for the unregister to proceed
+                         */
+                        if (rtnl_is_locked()) {
+                                rtnl_unlock();
+                                rollback_lock = true;
+                        }
+                        WL_INFO(("%s: Released the lock and wait till IF_DEL is complete\n",
+                                __func__));
+                        timeout = wait_event_interruptible_timeout(wl->dongle_event_wait,
+                                (wl_get_p2p_status(wl, IF_DELETING) == false),
+                                msecs_to_jiffies(MAX_WAIT_TIME));
+
+                        /* put back the rtnl_lock again */
+                        if (rollback_lock) {
+                                rtnl_lock();
+                                rollback_lock = false;
+                        }
+                        if (timeout > 0) {
+                                WL_ERR(("IF DEL is Success\n"));
+
+                        } else {
+                                WL_ERR(("timeount < 0, return -EAGAIN\n"));
+                                return ERR_PTR(-EAGAIN);
+                        }
+                }
+                if (!p2p_on(wl) && strstr(name, WL_P2P_INTERFACE_PREFIX)) {
+                        p2p_on(wl) = true;
+                        wl_cfgp2p_set_firm_p2p(wl);
+                        wl_cfgp2p_init_discovery(wl);
+                }
+                memset(wl->p2p->vir_ifname, 0, IFNAMSIZ);
+                strncpy(wl->p2p->vir_ifname, name, IFNAMSIZ - 1);
+                wl_cfgp2p_generate_bss_mac(&dhd->mac, &wl->p2p->dev_addr, &wl->p2p->int_addr);
+
+                /* Temporary use channel 11, in case GO will be changed with set_channel API  */
+                chspec = wf_chspec_aton(WL_P2P_TEMP_CHAN);
+
+                /* For P2P mode, use P2P-specific driver features to create the
+                 * bss: "wl p2p_ifadd"
+                 */
+                wl_set_p2p_status(wl, IF_ADD);
+                err = wl_cfgp2p_ifadd(wl, &wl->p2p->int_addr, htod32(wlif_type), chspec);
+
+                if (unlikely(err))
+                        return ERR_PTR(-ENOMEM);
+
+                timeout = wait_event_interruptible_timeout(wl->dongle_event_wait,
+                        (wl_get_p2p_status(wl, IF_ADD) == false),
+                        msecs_to_jiffies(MAX_WAIT_TIME));
+                if (timeout > 0 && (!wl_get_p2p_status(wl, IF_ADD))) {
+
+                        struct wireless_dev *vwdev;
+                        vwdev = kzalloc(sizeof(*vwdev), GFP_KERNEL);
+                        if (unlikely(!vwdev)) {
+                                WL_ERR(("Could not allocate wireless device\n"));
+                                return ERR_PTR(-ENOMEM);
+                        }
+                        vwdev->wiphy = wl->wdev->wiphy;
+                        WL_INFO((" virtual interface(%s) is created memalloc done \n",
+                        wl->p2p->vir_ifname));
+                        index = alloc_idx_vwdev(wl);
+                        wl->vwdev[index] = vwdev;
+                        vwdev->iftype =
+                                (wlif_type == WL_P2P_IF_CLIENT) ? NL80211_IFTYPE_STATION
+                                : NL80211_IFTYPE_AP;
+                        _ndev =  wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_CONNECTION);
+                        _ndev->ieee80211_ptr = vwdev;
+                        SET_NETDEV_DEV(_ndev, wiphy_dev(vwdev->wiphy));
+                        vwdev->netdev = _ndev;
+                        wl_set_drv_status(wl, READY);
+                        wl->p2p->vif_created = true;
+                        set_mode_by_netdev(wl, _ndev, mode);
+                        net_attach =  wl_to_p2p_bss_private(wl, P2PAPI_BSSCFG_CONNECTION);
+                        if (rtnl_is_locked()) {
+                                rtnl_unlock();
+                                rollback_lock = true;
+                        }
+                        if (net_attach && !net_attach(dhd, _ndev->ifindex)) {
+                                WL_DBG((" virtual interface(%s) is "
+                                        "created net attach done\n", wl->p2p->vir_ifname));
+                        } else {
+                                /* put back the rtnl_lock again */
+                                if (rollback_lock)
+                                        rtnl_lock();
+                                goto fail;
+                        }
+                        /* put back the rtnl_lock again */
+                        if (rollback_lock)
+                                rtnl_lock();
+                        return _ndev;
+
+                } else {
+                        wl_clr_p2p_status(wl, IF_ADD);
+                        WL_ERR((" virtual interface(%s) is not created \n", wl->p2p->vir_ifname));
+                        memset(wl->p2p->vir_ifname, '\0', IFNAMSIZ);
+                        wl->p2p->vif_created = false;
+                }
+        }
+fail:
+        return ERR_PTR(-ENODEV);
+}
+
+static s32
+wl_cfg80211_del_virtual_iface(struct wiphy *wiphy, struct net_device *dev)
+{
+        struct ether_addr p2p_mac;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        s32 timeout = -1;
+        s32 ret = 0;
+        WL_DBG(("Enter\n"));
+        if (wl->p2p_supported) {
+                memcpy(p2p_mac.octet, wl->p2p->int_addr.octet, ETHER_ADDR_LEN);
+                if (wl->p2p->vif_created) {
+                        if (wl_get_drv_status(wl, SCANNING)) {
+                                wl_cfg80211_scan_abort(wl, dev);
+                        }
+                        wldev_iovar_setint(dev, "mpc", 1);
+                        wl_set_p2p_status(wl, IF_DELETING);
+                        ret = wl_cfgp2p_ifdel(wl, &p2p_mac);
+                        if (ret) {
+                        /* Firmware could not delete the interface so we will not get WLC_E_IF
+                        * event for cleaning the dhd virtual nw interace
+                        * So lets do it here. Failures from fw will ensure the application to do
+                        * ifconfig <inter> down and up sequnce, which will reload the fw
+                        * however we should cleanup the linux network virtual interfaces
+                        */
+                                dhd_pub_t *dhd = (dhd_pub_t *)(wl->pub);
+                                WL_ERR(("Firmware returned an error from p2p_ifdel\n"));
+                                WL_ERR(("try to remove linux virtual interface %s\n", dev->name));
+                                dhd_del_if(dhd->info, dhd_net2idx(dhd->info, dev));
+                        }
+
+                        /* Wait for any pending scan req to get aborted from the sysioc context */
+                        timeout = wait_event_interruptible_timeout(wl->dongle_event_wait,
+                                (wl_get_p2p_status(wl, IF_DELETING) == false),
+                                msecs_to_jiffies(MAX_WAIT_TIME));
+                        if (timeout > 0 && !wl_get_p2p_status(wl, IF_DELETING)) {
+                                WL_DBG(("IFDEL operation done\n"));
+                        } else {
+                                WL_ERR(("IFDEL didn't complete properly\n"));
+                        }
+                        ret = dhd_del_monitor(dev);
+                }
+        }
+        return ret;
+}
+
+static s32
+wl_cfg80211_change_virtual_iface(struct wiphy *wiphy, struct net_device *ndev,
+        enum nl80211_iftype type, u32 *flags,
+        struct vif_params *params)
+{
+        s32 ap = 0;
+        s32 infra = 0;
+        s32 err = BCME_OK;
+        s32 timeout = -1;
+        s32 wlif_type;
+        s32 mode = 0;
+        chanspec_t chspec;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        WL_DBG(("Enter \n"));
+        switch (type) {
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_WDS:
+        case NL80211_IFTYPE_MESH_POINT:
+                ap = 1;
+                WL_ERR(("type (%d) : currently we do not support this type\n",
+                        type));
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                mode = WL_MODE_IBSS;
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+                mode = WL_MODE_BSS;
+                infra = 1;
+                break;
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_P2P_GO:
+                mode = WL_MODE_AP;
+                ap = 1;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+
+        if (ap) {
+                set_mode_by_netdev(wl, ndev, mode);
+                if (wl->p2p_supported && wl->p2p->vif_created) {
+                        WL_DBG(("p2p_vif_created (%d) p2p_on (%d)\n", wl->p2p->vif_created,
+                        p2p_on(wl)));
+                        chspec = wf_chspec_aton(WL_P2P_TEMP_CHAN);
+                        wlif_type = ap ? WL_P2P_IF_GO : WL_P2P_IF_CLIENT;
+                        WL_ERR(("%s : ap (%d), infra (%d), iftype: (%d)\n",
+                                ndev->name, ap, infra, type));
+                        wl_set_p2p_status(wl, IF_CHANGING);
+                        wl_clr_p2p_status(wl, IF_CHANGED);
+                        err = wl_cfgp2p_ifchange(wl, &wl->p2p->int_addr, htod32(wlif_type), chspec);
+                        timeout = wait_event_interruptible_timeout(wl->dongle_event_wait,
+                                (wl_get_p2p_status(wl, IF_CHANGED) == true),
+                                msecs_to_jiffies(MAX_WAIT_TIME));
+                        set_mode_by_netdev(wl, ndev, mode);
+                        wl_clr_p2p_status(wl, IF_CHANGING);
+                        wl_clr_p2p_status(wl, IF_CHANGED);
+                } else if (ndev == wl_to_prmry_ndev(wl) &&
+                        !wl_get_drv_status(wl, AP_CREATED)) {
+                        wl_set_drv_status(wl, AP_CREATING);
+                        if (!wl->ap_info &&
+                                !(wl->ap_info = kzalloc(sizeof(struct ap_info), GFP_KERNEL))) {
+                                WL_ERR(("struct ap_saved_ie allocation failed\n"));
+                                return -ENOMEM;
+                        }
+                } else {
+                        WL_ERR(("Cannot change the interface for GO or SOFTAP\n"));
+                        return -EINVAL;
+                }
+        }
+
+        ndev->ieee80211_ptr->iftype = type;
+        return 0;
+}
+
+s32
+wl_cfg80211_notify_ifadd(struct net_device *ndev, s32 idx, s32 bssidx,
+int (*_net_attach)(dhd_pub_t *dhdp, int ifidx))
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        s32 ret = BCME_OK;
+        if (!ndev) {
+                WL_ERR(("net is NULL\n"));
+                return 0;
+        }
+        if (wl->p2p_supported) {
+                WL_DBG(("IF_ADD event called from dongle, old interface name: %s,"
+                        "new name: %s\n", ndev->name, wl->p2p->vir_ifname));
+                /* Assign the net device to CONNECT BSSCFG */
+                strncpy(ndev->name, wl->p2p->vir_ifname, IFNAMSIZ - 1);
+                wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_CONNECTION) = ndev;
+                wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_CONNECTION) = bssidx;
+                wl_to_p2p_bss_private(wl, P2PAPI_BSSCFG_CONNECTION) = _net_attach;
+                ndev->ifindex = idx;
+                wl_clr_p2p_status(wl, IF_ADD);
+
+                wake_up_interruptible(&wl->dongle_event_wait);
+        }
+        return ret;
+}
+
+s32
+wl_cfg80211_notify_ifdel(struct net_device *ndev)
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        bool rollback_lock = false;
+        s32 index = 0;
+
+        if (!ndev || !ndev->name) {
+                WL_ERR(("net is NULL\n"));
+                return 0;
+        }
+
+        if (p2p_is_on(wl) && wl->p2p->vif_created) {
+                if (wl->scan_request) {
+                        /* Abort any pending scan requests */
+                        wl->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+                        if (!rtnl_is_locked()) {
+                                rtnl_lock();
+                                rollback_lock = true;
+                        }
+                        WL_DBG(("ESCAN COMPLETED\n"));
+                        wl_notify_escan_complete(wl, true);
+                        if (rollback_lock)
+                                rtnl_unlock();
+                }
+                WL_ERR(("IF_DEL event called from dongle, net %x, vif name: %s\n",
+                        (unsigned int)ndev, wl->p2p->vir_ifname));
+
+                memset(wl->p2p->vir_ifname, '\0', IFNAMSIZ);
+                index = wl_cfgp2p_find_idx(wl, ndev);
+                wl_to_p2p_bss_ndev(wl, index) = NULL;
+                wl_to_p2p_bss_bssidx(wl, index) = 0;
+                wl->p2p->vif_created = false;
+                wl_cfgp2p_clear_management_ie(wl,
+                        index);
+                wl_clr_p2p_status(wl, IF_DELETING);
+                WL_DBG(("index : %d\n", index));
+
+        }
+        /* Wake up any waiting thread */
+        wake_up_interruptible(&wl->dongle_event_wait);
+
+        return 0;
+}
+
+s32
+wl_cfg80211_is_progress_ifadd(void)
+{
+        s32 is_progress = 0;
+        struct wl_priv *wl = wlcfg_drv_priv;
+        if (wl_get_p2p_status(wl, IF_ADD))
+                is_progress = 1;
+        return is_progress;
+}
+
+s32
+wl_cfg80211_is_progress_ifchange(void)
+{
+        s32 is_progress = 0;
+        struct wl_priv *wl = wlcfg_drv_priv;
+        if (wl_get_p2p_status(wl, IF_CHANGING))
+                is_progress = 1;
+        return is_progress;
+}
+
+
+s32
+wl_cfg80211_notify_ifchange(void)
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        if (wl_get_p2p_status(wl, IF_CHANGING)) {
+                wl_set_p2p_status(wl, IF_CHANGED);
+                wake_up_interruptible(&wl->dongle_event_wait);
+        }
+        return 0;
+}
+
+static void wl_scan_prep(struct wl_scan_params *params, struct cfg80211_scan_request *request)
+{
+        u32 n_ssids = request->n_ssids;
+        u32 n_channels = request->n_channels;
+        u16 channel;
+        chanspec_t chanspec;
+        s32 i, offset;
+        char *ptr;
+        wlc_ssid_t ssid;
+
+        memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+        params->bss_type = DOT11_BSSTYPE_ANY;
+        params->scan_type = 0;
+        params->nprobes = -1;
+        params->active_time = -1;
+        params->passive_time = -1;
+        params->home_time = -1;
+        params->channel_num = 0;
+        memset(&params->ssid, 0, sizeof(wlc_ssid_t));
+
+        WL_SCAN(("Preparing Scan request\n"));
+        WL_SCAN(("nprobes=%d\n", params->nprobes));
+        WL_SCAN(("active_time=%d\n", params->active_time));
+        WL_SCAN(("passive_time=%d\n", params->passive_time));
+        WL_SCAN(("home_time=%d\n", params->home_time));
+        WL_SCAN(("scan_type=%d\n", params->scan_type));
+
+        params->nprobes = htod32(params->nprobes);
+        params->active_time = htod32(params->active_time);
+        params->passive_time = htod32(params->passive_time);
+        params->home_time = htod32(params->home_time);
+
+        /* Copy channel array if applicable */
+        WL_SCAN(("### List of channelspecs to scan ###\n"));
+        if (n_channels > 0) {
+                for (i = 0; i < n_channels; i++) {
+                        chanspec = 0;
+                        channel = ieee80211_frequency_to_channel(request->channels[i]->center_freq);
+                        if (request->channels[i]->band == IEEE80211_BAND_2GHZ)
+                                chanspec |= WL_CHANSPEC_BAND_2G;
+                        else
+                                chanspec |= WL_CHANSPEC_BAND_5G;
+
+                        if (request->channels[i]->flags & IEEE80211_CHAN_NO_HT40) {
+                                chanspec |= WL_CHANSPEC_BW_20;
+                                chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+                        } else {
+                                chanspec |= WL_CHANSPEC_BW_40;
+                                if (request->channels[i]->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                                        chanspec |= WL_CHANSPEC_CTL_SB_LOWER;
+                                else
+                                        chanspec |= WL_CHANSPEC_CTL_SB_UPPER;
+                        }
+
+                        params->channel_list[i] = channel;
+                        params->channel_list[i] &= WL_CHANSPEC_CHAN_MASK;
+                        params->channel_list[i] |= chanspec;
+                        WL_SCAN(("Chan : %d, Channel spec: %x \n",
+                        channel, params->channel_list[i]));
+                        params->channel_list[i] = htod16(params->channel_list[i]);
+                }
+        } else {
+                WL_SCAN(("Scanning all channels\n"));
+        }
+
+        /* Copy ssid array if applicable */
+        WL_SCAN(("### List of SSIDs to scan ###\n"));
+        if (n_ssids > 0) {
+                offset = offsetof(wl_scan_params_t, channel_list) + n_channels * sizeof(u16);
+                offset = roundup(offset, sizeof(u32));
+                ptr = (char*)params + offset;
+                for (i = 0; i < n_ssids; i++) {
+                        memset(&ssid, 0, sizeof(wlc_ssid_t));
+                        ssid.SSID_len = request->ssids[i].ssid_len;
+                        memcpy(ssid.SSID, request->ssids[i].ssid, ssid.SSID_len);
+                        if (!ssid.SSID_len)
+                                WL_SCAN(("%d: Broadcast scan\n", i));
+                        else
+                                WL_SCAN(("%d: scan  for  %s size =%d\n", i,
+                                ssid.SSID, ssid.SSID_len));
+                        memcpy(ptr, &ssid, sizeof(wlc_ssid_t));
+                        ptr += sizeof(wlc_ssid_t);
+                }
+        } else {
+                WL_SCAN(("Broadcast scan\n"));
+        }
+        /* Adding mask to channel numbers */
+        params->channel_num =
+                htod32((n_ssids << WL_SCAN_PARAMS_NSSID_SHIFT) |
+                       (n_channels & WL_SCAN_PARAMS_COUNT_MASK));
+}
+
+static s32
+wl_run_iscan(struct wl_iscan_ctrl *iscan, struct cfg80211_scan_request *request, u16 action)
+{
+        u32 n_channels;
+        u32 n_ssids;
+        s32 params_size =
+            (WL_SCAN_PARAMS_FIXED_SIZE + offsetof(wl_iscan_params_t, params));
+        struct wl_iscan_params *params;
+        s32 err = 0;
+
+        if (request != NULL) {
+                n_channels = request->n_channels;
+                n_ssids = request->n_ssids;
+                /* Allocate space for populating ssids in wl_iscan_params struct */
+                if (n_channels % 2)
+                        /* If n_channels is odd, add a padd of u16 */
+                        params_size += sizeof(u16) * (n_channels + 1);
+                else
+                        params_size += sizeof(u16) * n_channels;
+
+                /* Allocate space for populating ssids in wl_iscan_params struct */
+                params_size += sizeof(struct wlc_ssid) * n_ssids;
+        }
+        params = (struct wl_iscan_params *)kzalloc(params_size, GFP_KERNEL);
+        if (!params) {
+                return -ENOMEM;
+        }
+
+        if (request != NULL)
+                wl_scan_prep(&params->params, request);
+
+        params->version = htod32(ISCAN_REQ_VERSION);
+        params->action = htod16(action);
+        params->scan_duration = htod16(0);
+
+        if (params_size + sizeof("iscan") >= WLC_IOCTL_MEDLEN) {
+                WL_ERR(("ioctl buffer length is not sufficient\n"));
+                err = -ENOMEM;
+                goto done;
+        }
+        err = wldev_iovar_setbuf(iscan->dev, "iscan", params, params_size,
+                iscan->ioctl_buf, WLC_IOCTL_MEDLEN);
+        if (unlikely(err)) {
+                if (err == -EBUSY) {
+                        WL_ERR(("system busy : iscan canceled\n"));
+                } else {
+                        WL_ERR(("error (%d)\n", err));
+                }
+        }
+done:
+        kfree(params);
+        return err;
+}
+
+static s32 wl_do_iscan(struct wl_priv *wl, struct cfg80211_scan_request *request)
+{
+        struct wl_iscan_ctrl *iscan = wl_to_iscan(wl);
+        struct net_device *ndev = wl_to_prmry_ndev(wl);
+        s32 passive_scan;
+        s32 err = 0;
+
+        iscan->state = WL_ISCAN_STATE_SCANING;
+
+        passive_scan = wl->active_scan ? 0 : 1;
+        err = wldev_ioctl(ndev, WLC_SET_PASSIVE_SCAN,
+                &passive_scan, sizeof(passive_scan), false);
+        if (unlikely(err)) {
+                WL_DBG(("error (%d)\n", err));
+                return err;
+        }
+        wl->iscan_kickstart = true;
+        wl_run_iscan(iscan, request, WL_SCAN_ACTION_START);
+        mod_timer(&iscan->timer, jiffies + iscan->timer_ms * HZ / 1000);
+        iscan->timer_on = 1;
+
+        return err;
+}
+
+static s32
+wl_run_escan(struct wl_priv *wl, struct net_device *ndev,
+        struct cfg80211_scan_request *request, uint16 action)
+{
+        s32 err = BCME_OK;
+        u32 n_channels;
+        u32 n_ssids;
+        s32 params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_escan_params_t, params));
+        wl_escan_params_t *params;
+        struct cfg80211_scan_request *scan_request = wl->scan_request;
+        u32 num_chans = 0;
+        s32 search_state = WL_P2P_DISC_ST_SCAN;
+        u32 i;
+        u16 *default_chan_list = NULL;
+        struct net_device *dev = NULL;
+        WL_DBG(("Enter \n"));
+
+
+        if (!wl->p2p_supported || ((ndev == wl_to_prmry_ndev(wl)) &&
+                !p2p_scan(wl))) {
+                /* LEGACY SCAN TRIGGER */
+                WL_SCAN((" LEGACY E-SCAN START\n"));
+
+                if (request != NULL) {
+                        n_channels = request->n_channels;
+                        n_ssids = request->n_ssids;
+                        /* Allocate space for populating ssids in wl_iscan_params struct */
+                        if (n_channels % 2)
+                                /* If n_channels is odd, add a padd of u16 */
+                                params_size += sizeof(u16) * (n_channels + 1);
+                        else
+                                params_size += sizeof(u16) * n_channels;
+
+                        /* Allocate space for populating ssids in wl_iscan_params struct */
+                        params_size += sizeof(struct wlc_ssid) * n_ssids;
+                }
+                params = (wl_escan_params_t *) kzalloc(params_size, GFP_KERNEL);
+                if (params == NULL) {
+                        err = -ENOMEM;
+                        goto exit;
+                }
+
+                if (request != NULL)
+                        wl_scan_prep(&params->params, request);
+                params->version = htod32(ESCAN_REQ_VERSION);
+                params->action =  htod16(action);
+                params->sync_id = htod16(0x1234);
+                if (params_size + sizeof("escan") >= WLC_IOCTL_MEDLEN) {
+                        WL_ERR(("ioctl buffer length not sufficient\n"));
+                        kfree(params);
+                        err = -ENOMEM;
+                        goto exit;
+                }
+                err = wldev_iovar_setbuf(ndev, "escan", params, params_size,
+                        wl->escan_ioctl_buf, WLC_IOCTL_MEDLEN);
+                if (unlikely(err))
+                        WL_ERR((" Escan set error (%d)\n", err));
+                kfree(params);
+        }
+        else if (p2p_on(wl) && p2p_scan(wl)) {
+                /* P2P SCAN TRIGGER */
+                if (scan_request && scan_request->n_channels) {
+                        num_chans = scan_request->n_channels;
+                        WL_SCAN((" chann number : %d\n", num_chans));
+                        default_chan_list = kzalloc(num_chans * sizeof(*default_chan_list),
+                                GFP_KERNEL);
+                        if (default_chan_list == NULL) {
+                                WL_ERR(("channel list allocation failed \n"));
+                                err = -ENOMEM;
+                                goto exit;
+                        }
+                        for (i = 0; i < num_chans; i++)
+                        {
+                                default_chan_list[i] =
+                                ieee80211_frequency_to_channel(
+                                        scan_request->channels[i]->center_freq);
+                        }
+                        if (num_chans == 3 && (
+                                                (default_chan_list[0] == SOCIAL_CHAN_1) &&
+                                                (default_chan_list[1] == SOCIAL_CHAN_2) &&
+                                                (default_chan_list[2] == SOCIAL_CHAN_3))) {
+                                /* SOCIAL CHANNELS 1, 6, 11 */
+                                search_state = WL_P2P_DISC_ST_SEARCH;
+                                WL_INFO(("P2P SEARCH PHASE START \n"));
+                        } else if ((dev = wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_CONNECTION)) &&
+                                (get_mode_by_netdev(wl, dev) == WL_MODE_AP)) {
+                                /* If you are already a GO, then do SEARCH only */
+                                WL_INFO(("Already a GO. Do SEARCH Only"));
+                                search_state = WL_P2P_DISC_ST_SEARCH;
+                        } else {
+                                WL_INFO(("P2P SCAN STATE START \n"));
+                        }
+
+                }
+                err = wl_cfgp2p_escan(wl, ndev, wl->active_scan, num_chans, default_chan_list,
+                        search_state, action,
+                        wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE));
+                kfree(default_chan_list);
+        }
+exit:
+        if (unlikely(err)) {
+                WL_ERR(("error (%d)\n", err));
+        }
+        return err;
+}
+
+
+static s32
+wl_do_escan(struct wl_priv *wl, struct wiphy *wiphy, struct net_device *ndev,
+        struct cfg80211_scan_request *request)
+{
+        s32 err = BCME_OK;
+        s32 passive_scan;
+        wl_scan_results_t *results;
+        WL_SCAN(("Enter \n"));
+
+        wl->escan_info.wiphy = wiphy;
+        wl->escan_info.escan_state = WL_ESCAN_STATE_SCANING;
+        passive_scan = wl->active_scan ? 0 : 1;
+        err = wldev_ioctl(ndev, WLC_SET_PASSIVE_SCAN,
+                &passive_scan, sizeof(passive_scan), false);
+        if (unlikely(err)) {
+                WL_ERR(("error (%d)\n", err));
+                return err;
+        }
+        results = (wl_scan_results_t *) wl->escan_info.escan_buf;
+        results->version = 0;
+        results->count = 0;
+        results->buflen = WL_SCAN_RESULTS_FIXED_SIZE;
+
+        err = wl_run_escan(wl, ndev, request, WL_SCAN_ACTION_START);
+        return err;
+}
+
+static s32
+__wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+        struct cfg80211_scan_request *request,
+        struct cfg80211_ssid *this_ssid)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct cfg80211_ssid *ssids;
+        struct wl_scan_req *sr = wl_to_sr(wl);
+        wpa_ie_fixed_t *wps_ie;
+        s32 passive_scan;
+        bool iscan_req;
+        bool escan_req;
+        bool spec_scan;
+        bool p2p_ssid;
+        s32 err = 0;
+        s32 i;
+        u32 wpsie_len = 0;
+        u8 wpsie[IE_MAX_LEN];
+
+        WL_DBG(("Enter wiphy (%p)\n", wiphy));
+        if (unlikely(wl_get_drv_status(wl, SCANNING))) {
+                WL_ERR(("Scanning already : status (%d)\n", (int)wl->status));
+                return -EAGAIN;
+        }
+        if (unlikely(wl_get_drv_status(wl, SCAN_ABORTING))) {
+                WL_ERR(("Scanning being aborted : status (%d)\n",
+                        (int)wl->status));
+                return -EAGAIN;
+        }
+        if (request->n_ssids > WL_SCAN_PARAMS_SSID_MAX) {
+                WL_ERR(("n_ssids > WL_SCAN_PARAMS_SSID_MAX\n"));
+                return -EOPNOTSUPP;
+        }
+
+        /* Arm scan timeout timer */
+        mod_timer(&wl->scan_timeout, jiffies + WL_SCAN_TIMER_INTERVAL_MS * HZ / 1000);
+        iscan_req = false;
+        spec_scan = false;
+        if (request) {          /* scan bss */
+                ssids = request->ssids;
+                if (wl->iscan_on && (!ssids || !ssids->ssid_len || request->n_ssids != 1)) {
+                        iscan_req = true;
+                } else if (wl->escan_on) {
+                        escan_req = true;
+                        p2p_ssid = false;
+                        for (i = 0; i < request->n_ssids; i++) {
+                                if (ssids[i].ssid_len && IS_P2P_SSID(ssids[i].ssid)) {
+                                        p2p_ssid = true;
+                                        break;
+                                }
+                        }
+                        if (p2p_ssid) {
+                                if (wl->p2p_supported) {
+                                        /* p2p scan trigger */
+                                        if (p2p_on(wl) == false) {
+                                                /* p2p on at the first time */
+                                                p2p_on(wl) = true;
+                                                wl_cfgp2p_set_firm_p2p(wl);
+                                        }
+                                        p2p_scan(wl) = true;
+                                }
+                        } else {
+                                /* legacy scan trigger
+                                 * So, we have to disable p2p discovery if p2p discovery is on
+                                 */
+                                if (wl->p2p_supported) {
+                                        p2p_scan(wl) = false;
+                                        /* If Netdevice is not equals to primary and p2p is on
+                                        *  , we will do p2p scan using P2PAPI_BSSCFG_DEVICE.
+                                        */
+                                        if (p2p_on(wl) && (ndev != wl_to_prmry_ndev(wl)))
+                                                p2p_scan(wl) = true;
+
+                                        if (p2p_scan(wl) == false) {
+                                                if (wl_get_p2p_status(wl, DISCOVERY_ON)) {
+                                                        err = wl_cfgp2p_discover_enable_search(wl,
+                                                        false);
+                                                        if (unlikely(err)) {
+                                                                goto scan_out;
+                                                        }
+
+                                                }
+                                        }
+                                }
+                                if (!wl->p2p_supported || !p2p_scan(wl)) {
+                                        if (ndev == wl_to_prmry_ndev(wl)) {
+                                                /* find the WPSIE */
+                                                memset(wpsie, 0, sizeof(wpsie));
+                                                if ((wps_ie = wl_cfgp2p_find_wpsie(
+                                                        (u8 *)request->ie,
+                                                        request->ie_len)) != NULL) {
+                                                        wpsie_len =
+                                                        wps_ie->length + WPA_RSN_IE_TAG_FIXED_LEN;
+                                                        memcpy(wpsie, wps_ie, wpsie_len);
+                                                } else {
+                                                        wpsie_len = 0;
+                                                }
+                                                err = wl_cfgp2p_set_management_ie(wl, ndev, -1,
+                                                        VNDR_IE_PRBREQ_FLAG, wpsie, wpsie_len);
+                                                if (unlikely(err)) {
+                                                        goto scan_out;
+                                                }
+                                        }
+                                }
+                        }
+                }
+        } else {                /* scan in ibss */
+                /* we don't do iscan in ibss */
+                ssids = this_ssid;
+        }
+        wl->scan_request = request;
+        wl_set_drv_status(wl, SCANNING);
+        if (iscan_req) {
+                err = wl_do_iscan(wl, request);
+                if (likely(!err))
+                        return err;
+                else
+                        goto scan_out;
+        } else if (escan_req) {
+                if (wl->p2p_supported) {
+                        if (p2p_on(wl) && p2p_scan(wl)) {
+
+                                err = wl_cfgp2p_enable_discovery(wl, ndev,
+                                request->ie, request->ie_len);
+
+                                if (unlikely(err)) {
+                                        goto scan_out;
+                                }
+                        }
+                }
+                err = wl_do_escan(wl, wiphy, ndev, request);
+                if (likely(!err))
+                        return err;
+                else
+                        goto scan_out;
+
+
+        } else {
+                memset(&sr->ssid, 0, sizeof(sr->ssid));
+                sr->ssid.SSID_len =
+                        min_t(u8, sizeof(sr->ssid.SSID), ssids->ssid_len);
+                if (sr->ssid.SSID_len) {
+                        memcpy(sr->ssid.SSID, ssids->ssid, sr->ssid.SSID_len);
+                        sr->ssid.SSID_len = htod32(sr->ssid.SSID_len);
+                        WL_SCAN(("Specific scan ssid=\"%s\" len=%d\n",
+                                sr->ssid.SSID, sr->ssid.SSID_len));
+                        spec_scan = true;
+                } else {
+                        WL_SCAN(("Broadcast scan\n"));
+                }
+                WL_SCAN(("sr->ssid.SSID_len (%d)\n", sr->ssid.SSID_len));
+                passive_scan = wl->active_scan ? 0 : 1;
+                err = wldev_ioctl(ndev, WLC_SET_PASSIVE_SCAN,
+                        &passive_scan, sizeof(passive_scan), false);
+                if (unlikely(err)) {
+                        WL_SCAN(("WLC_SET_PASSIVE_SCAN error (%d)\n", err));
+                        goto scan_out;
+                }
+                err = wldev_ioctl(ndev, WLC_SCAN, &sr->ssid,
+                        sizeof(sr->ssid), false);
+                if (err) {
+                        if (err == -EBUSY) {
+                                WL_ERR(("system busy : scan for \"%s\" "
+                                        "canceled\n", sr->ssid.SSID));
+                        } else {
+                                WL_ERR(("WLC_SCAN error (%d)\n", err));
+                        }
+                        goto scan_out;
+                }
+        }
+
+        return 0;
+
+scan_out:
+        wl_clr_drv_status(wl, SCANNING);
+        wl->scan_request = NULL;
+        return err;
+}
+
+static s32
+wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+        struct cfg80211_scan_request *request)
+{
+        s32 err = 0;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+
+        WL_DBG(("Enter \n"));
+        CHECK_SYS_UP(wl);
+
+        err = __wl_cfg80211_scan(wiphy, ndev, request, NULL);
+        if (unlikely(err)) {
+                WL_ERR(("scan error (%d)\n", err));
+                return err;
+        }
+
+        return err;
+}
+
+static s32 wl_dev_intvar_set(struct net_device *dev, s8 *name, s32 val)
+{
+        s8 buf[WLC_IOCTL_SMLEN];
+        u32 len;
+        s32 err = 0;
+
+        val = htod32(val);
+        len = bcm_mkiovar(name, (char *)(&val), sizeof(val), buf, sizeof(buf));
+        BUG_ON(unlikely(!len));
+
+        err = wldev_ioctl(dev, WLC_SET_VAR, buf, len, false);
+        if (unlikely(err)) {
+                WL_ERR(("error (%d)\n", err));
+        }
+
+        return err;
+}
+
+static s32
+wl_dev_intvar_get(struct net_device *dev, s8 *name, s32 *retval)
+{
+        union {
+                s8 buf[WLC_IOCTL_SMLEN];
+                s32 val;
+        } var;
+        u32 len;
+        u32 data_null;
+        s32 err = 0;
+
+        len = bcm_mkiovar(name, (char *)(&data_null), 0,
+                (char *)(&var), sizeof(var.buf));
+        BUG_ON(unlikely(!len));
+        err = wldev_ioctl(dev, WLC_GET_VAR, &var, len, false);
+        if (unlikely(err)) {
+                WL_ERR(("error (%d)\n", err));
+        }
+        *retval = dtoh32(var.val);
+
+        return err;
+}
+
+static s32 wl_set_rts(struct net_device *dev, u32 rts_threshold)
+{
+        s32 err = 0;
+
+        err = wl_dev_intvar_set(dev, "rtsthresh", rts_threshold);
+        if (unlikely(err)) {
+                WL_ERR(("Error (%d)\n", err));
+                return err;
+        }
+        return err;
+}
+
+static s32 wl_set_frag(struct net_device *dev, u32 frag_threshold)
+{
+        s32 err = 0;
+
+        err = wl_dev_intvar_set(dev, "fragthresh", frag_threshold);
+        if (unlikely(err)) {
+                WL_ERR(("Error (%d)\n", err));
+                return err;
+        }
+        return err;
+}
+
+static s32 wl_set_retry(struct net_device *dev, u32 retry, bool l)
+{
+        s32 err = 0;
+        u32 cmd = (l ? WLC_SET_LRL : WLC_SET_SRL);
+
+        retry = htod32(retry);
+        err = wldev_ioctl(dev, cmd, &retry, sizeof(retry), false);
+        if (unlikely(err)) {
+                WL_ERR(("cmd (%d) , error (%d)\n", cmd, err));
+                return err;
+        }
+        return err;
+}
+
+static s32 wl_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+        struct wl_priv *wl = (struct wl_priv *)wiphy_priv(wiphy);
+        struct net_device *ndev = wl_to_prmry_ndev(wl);
+        s32 err = 0;
+
+        CHECK_SYS_UP(wl);
+        if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
+                (wl->conf->rts_threshold != wiphy->rts_threshold)) {
+                wl->conf->rts_threshold = wiphy->rts_threshold;
+                err = wl_set_rts(ndev, wl->conf->rts_threshold);
+                if (!err)
+                        return err;
+        }
+        if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
+                (wl->conf->frag_threshold != wiphy->frag_threshold)) {
+                wl->conf->frag_threshold = wiphy->frag_threshold;
+                err = wl_set_frag(ndev, wl->conf->frag_threshold);
+                if (!err)
+                        return err;
+        }
+        if (changed & WIPHY_PARAM_RETRY_LONG &&
+                (wl->conf->retry_long != wiphy->retry_long)) {
+                wl->conf->retry_long = wiphy->retry_long;
+                err = wl_set_retry(ndev, wl->conf->retry_long, true);
+                if (!err)
+                        return err;
+        }
+        if (changed & WIPHY_PARAM_RETRY_SHORT &&
+                (wl->conf->retry_short != wiphy->retry_short)) {
+                wl->conf->retry_short = wiphy->retry_short;
+                err = wl_set_retry(ndev, wl->conf->retry_short, false);
+                if (!err) {
+                        return err;
+                }
+        }
+
+        return err;
+}
+
+static s32
+wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+        struct cfg80211_ibss_params *params)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct cfg80211_bss *bss;
+        struct ieee80211_channel *chan;
+        struct wl_join_params join_params;
+        struct cfg80211_ssid ssid;
+        s32 scan_retry = 0;
+        s32 err = 0;
+        bool rollback_lock = false;
+
+        WL_TRACE(("In\n"));
+        CHECK_SYS_UP(wl);
+        if (params->bssid) {
+                WL_ERR(("Invalid bssid\n"));
+                return -EOPNOTSUPP;
+        }
+        bss = cfg80211_get_ibss(wiphy, NULL, params->ssid, params->ssid_len);
+        if (!bss) {
+                memcpy(ssid.ssid, params->ssid, params->ssid_len);
+                ssid.ssid_len = params->ssid_len;
+                do {
+                        if (unlikely
+                                (__wl_cfg80211_scan(wiphy, dev, NULL, &ssid) ==
+                                 -EBUSY)) {
+                                wl_delay(150);
+                        } else {
+                                break;
+                        }
+                } while (++scan_retry < WL_SCAN_RETRY_MAX);
+                /* to allow scan_inform to propagate to cfg80211 plane */
+                if (rtnl_is_locked()) {
+                        rtnl_unlock();
+                        rollback_lock = true;
+                }
+
+                /* wait 4 secons till scan done.... */
+                schedule_timeout_interruptible(4 * HZ);
+                if (rollback_lock)
+                        rtnl_lock();
+                bss = cfg80211_get_ibss(wiphy, NULL,
+                        params->ssid, params->ssid_len);
+        }
+        if (bss) {
+                wl->ibss_starter = false;
+                WL_DBG(("Found IBSS\n"));
+        } else {
+                wl->ibss_starter = true;
+        }
+        chan = params->channel;
+        if (chan)
+                wl->channel = ieee80211_frequency_to_channel(chan->center_freq);
+        /*
+         * Join with specific BSSID and cached SSID
+         * If SSID is zero join based on BSSID only
+         */
+        memset(&join_params, 0, sizeof(join_params));
+        memcpy((void *)join_params.ssid.SSID, (void *)params->ssid,
+                params->ssid_len);
+        join_params.ssid.SSID_len = htod32(params->ssid_len);
+        if (params->bssid)
+                memcpy(&join_params.params.bssid, params->bssid,
+                        ETHER_ADDR_LEN);
+        else
+                memset(&join_params.params.bssid, 0, ETHER_ADDR_LEN);
+
+        err = wldev_ioctl(dev, WLC_SET_SSID, &join_params,
+                sizeof(join_params), false);
+        if (unlikely(err)) {
+                WL_ERR(("Error (%d)\n", err));
+                return err;
+        }
+        return err;
+}
+
+static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        s32 err = 0;
+
+        CHECK_SYS_UP(wl);
+        wl_link_down(wl);
+
+        return err;
+}
+
+static s32
+wl_set_wpa_version(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        struct wl_security *sec;
+        s32 val = 0;
+        s32 err = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+
+        if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
+                val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
+        else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
+                val = WPA2_AUTH_PSK| WPA2_AUTH_UNSPECIFIED;
+        else
+                val = WPA_AUTH_DISABLED;
+
+        if (is_wps_conn(sme))
+                val = WPA_AUTH_DISABLED;
+
+        WL_DBG(("setting wpa_auth to 0x%0x\n", val));
+        err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", val, bssidx);
+        if (unlikely(err)) {
+                WL_ERR(("set wpa_auth failed (%d)\n", err));
+                return err;
+        }
+        sec = wl_read_prof(wl, WL_PROF_SEC);
+        sec->wpa_versions = sme->crypto.wpa_versions;
+        return err;
+}
+
+static s32
+wl_set_auth_type(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        struct wl_security *sec;
+        s32 val = 0;
+        s32 err = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+        switch (sme->auth_type) {
+        case NL80211_AUTHTYPE_OPEN_SYSTEM:
+                val = 0;
+                WL_DBG(("open system\n"));
+                break;
+        case NL80211_AUTHTYPE_SHARED_KEY:
+                val = 1;
+                WL_DBG(("shared key\n"));
+                break;
+        case NL80211_AUTHTYPE_AUTOMATIC:
+                val = 2;
+                WL_DBG(("automatic\n"));
+                break;
+        case NL80211_AUTHTYPE_NETWORK_EAP:
+                WL_DBG(("network eap\n"));
+        default:
+                val = 2;
+                WL_ERR(("invalid auth type (%d)\n", sme->auth_type));
+                break;
+        }
+
+        err = wldev_iovar_setint_bsscfg(dev, "auth", val, bssidx);
+        if (unlikely(err)) {
+                WL_ERR(("set auth failed (%d)\n", err));
+                return err;
+        }
+        sec = wl_read_prof(wl, WL_PROF_SEC);
+        sec->auth_type = sme->auth_type;
+        return err;
+}
+
+static s32
+wl_set_set_cipher(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        struct wl_security *sec;
+        s32 pval = 0;
+        s32 gval = 0;
+        s32 err = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+
+        if (sme->crypto.n_ciphers_pairwise) {
+                switch (sme->crypto.ciphers_pairwise[0]) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                        pval = WEP_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_TKIP:
+                        pval = TKIP_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_CCMP:
+                        pval = AES_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        pval = AES_ENABLED;
+                        break;
+                default:
+                        WL_ERR(("invalid cipher pairwise (%d)\n",
+                                sme->crypto.ciphers_pairwise[0]));
+                        return -EINVAL;
+                }
+        }
+        if (sme->crypto.cipher_group) {
+                switch (sme->crypto.cipher_group) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                        gval = WEP_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_TKIP:
+                        gval = TKIP_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_CCMP:
+                        gval = AES_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        gval = AES_ENABLED;
+                        break;
+                default:
+                        WL_ERR(("invalid cipher group (%d)\n",
+                                sme->crypto.cipher_group));
+                        return -EINVAL;
+                }
+        }
+
+        WL_DBG(("pval (%d) gval (%d)\n", pval, gval));
+
+        if (is_wps_conn(sme)) {
+                err = wldev_iovar_setint_bsscfg(dev, "wsec", 4, bssidx);
+        } else {
+                WL_DBG((" NO, is_wps_conn, Set pval | gval to WSEC"));
+                err = wldev_iovar_setint_bsscfg(dev, "wsec",
+                                pval | gval, bssidx);
+        }
+        if (unlikely(err)) {
+                WL_ERR(("error (%d)\n", err));
+                return err;
+        }
+
+        sec = wl_read_prof(wl, WL_PROF_SEC);
+        sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
+        sec->cipher_group = sme->crypto.cipher_group;
+
+        return err;
+}
+
+static s32
+wl_set_key_mgmt(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        struct wl_security *sec;
+        s32 val = 0;
+        s32 err = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+
+        if (sme->crypto.n_akm_suites) {
+                err = wl_dev_intvar_get(dev, "wpa_auth", &val);
+                if (unlikely(err)) {
+                        WL_ERR(("could not get wpa_auth (%d)\n", err));
+                        return err;
+                }
+                if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
+                        switch (sme->crypto.akm_suites[0]) {
+                        case WLAN_AKM_SUITE_8021X:
+                                val = WPA_AUTH_UNSPECIFIED;
+                                break;
+                        case WLAN_AKM_SUITE_PSK:
+                                val = WPA_AUTH_PSK;
+                                break;
+                        default:
+                                WL_ERR(("invalid cipher group (%d)\n",
+                                        sme->crypto.cipher_group));
+                                return -EINVAL;
+                        }
+                } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
+                        switch (sme->crypto.akm_suites[0]) {
+                        case WLAN_AKM_SUITE_8021X:
+                                val = WPA2_AUTH_UNSPECIFIED;
+                                break;
+                        case WLAN_AKM_SUITE_PSK:
+                                val = WPA2_AUTH_PSK;
+                                break;
+                        default:
+                                WL_ERR(("invalid cipher group (%d)\n",
+                                        sme->crypto.cipher_group));
+                                return -EINVAL;
+                        }
+                }
+                WL_DBG(("setting wpa_auth to %d\n", val));
+
+                err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", val, bssidx);
+                if (unlikely(err)) {
+                        WL_ERR(("could not set wpa_auth (%d)\n", err));
+                        return err;
+                }
+        }
+        sec = wl_read_prof(wl, WL_PROF_SEC);
+        sec->wpa_auth = sme->crypto.akm_suites[0];
+
+        return err;
+}
+
+static s32
+wl_set_set_sharedkey(struct net_device *dev,
+        struct cfg80211_connect_params *sme)
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        struct wl_security *sec;
+        struct wl_wsec_key key;
+        s32 val;
+        s32 err = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+
+        WL_DBG(("key len (%d)\n", sme->key_len));
+        if (sme->key_len) {
+                sec = wl_read_prof(wl, WL_PROF_SEC);
+                WL_DBG(("wpa_versions 0x%x cipher_pairwise 0x%x\n",
+                        sec->wpa_versions, sec->cipher_pairwise));
+                if (!(sec->wpa_versions & (NL80211_WPA_VERSION_1 |
+                        NL80211_WPA_VERSION_2)) &&
+                        (sec->cipher_pairwise & (WLAN_CIPHER_SUITE_WEP40 |
+                        WLAN_CIPHER_SUITE_WEP104))) {
+                        memset(&key, 0, sizeof(key));
+                        key.len = (u32) sme->key_len;
+                        key.index = (u32) sme->key_idx;
+                        if (unlikely(key.len > sizeof(key.data))) {
+                                WL_ERR(("Too long key length (%u)\n", key.len));
+                                return -EINVAL;
+                        }
+                        memcpy(key.data, sme->key, key.len);
+                        key.flags = WL_PRIMARY_KEY;
+                        switch (sec->cipher_pairwise) {
+                        case WLAN_CIPHER_SUITE_WEP40:
+                                key.algo = CRYPTO_ALGO_WEP1;
+                                break;
+                        case WLAN_CIPHER_SUITE_WEP104:
+                                key.algo = CRYPTO_ALGO_WEP128;
+                                break;
+                        default:
+                                WL_ERR(("Invalid algorithm (%d)\n",
+                                        sme->crypto.ciphers_pairwise[0]));
+                                return -EINVAL;
+                        }
+                        /* Set the new key/index */
+                        WL_DBG(("key length (%d) key index (%d) algo (%d)\n",
+                                key.len, key.index, key.algo));
+                        WL_DBG(("key \"%s\"\n", key.data));
+                        swap_key_from_BE(&key);
+                        err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+                                ioctlbuf, sizeof(ioctlbuf), bssidx);
+                        if (unlikely(err)) {
+                                WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                                return err;
+                        }
+                        if (sec->auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM) {
+                                WL_DBG(("set auth_type to shared key\n"));
+                                val = 1;        /* shared key */
+                                err = wldev_iovar_setint_bsscfg(dev, "auth", val, bssidx);
+                                if (unlikely(err)) {
+                                        WL_ERR(("set auth failed (%d)\n", err));
+                                        return err;
+                                }
+                        }
+                }
+        }
+        return err;
+}
+
+static s32
+wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+        struct cfg80211_connect_params *sme)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct ieee80211_channel *chan = sme->channel;
+        wl_extjoin_params_t *ext_join_params;
+        struct wl_join_params join_params;
+        size_t join_params_size;
+        s32 err = 0;
+        wpa_ie_fixed_t *wpa_ie;
+        wpa_ie_fixed_t *wps_ie;
+        bcm_tlv_t *wpa2_ie;
+        u8* wpaie  = 0;
+        u32 wpaie_len = 0;
+        u32 wpsie_len = 0;
+        u32 chan_cnt = 0;
+        u8 wpsie[IE_MAX_LEN];
+        struct ether_addr bssid;
+
+        WL_DBG(("In\n"));
+        CHECK_SYS_UP(wl);
+
+        /*
+         * Cancel ongoing scan to sync up with sme state machine of cfg80211.
+         */
+        if (wl->scan_request) {
+                wl_cfg80211_scan_abort(wl, dev);
+        }
+        /* Clean BSSID */
+        bzero(&bssid, sizeof(bssid));
+        wl_update_prof(wl, NULL, (void *)&bssid, WL_PROF_BSSID);
+
+        if (IS_P2P_SSID(sme->ssid) && (dev != wl_to_prmry_ndev(wl))) {
+                /* we only allow to connect using virtual interface in case of P2P */
+                if (p2p_on(wl) && is_wps_conn(sme)) {
+                        WL_DBG(("ASSOC1 p2p index : %d sme->ie_len %d\n",
+                                wl_cfgp2p_find_idx(wl, dev), sme->ie_len));
+                        /* Have to apply WPS IE + P2P IE in assoc req frame */
+                        wl_cfgp2p_set_management_ie(wl, dev,
+                                wl_cfgp2p_find_idx(wl, dev), VNDR_IE_PRBREQ_FLAG,
+                                wl_to_p2p_bss_saved_ie(wl, P2PAPI_BSSCFG_DEVICE).p2p_probe_req_ie,
+                                wl_to_p2p_bss_saved_ie(wl,
+                                P2PAPI_BSSCFG_DEVICE).p2p_probe_req_ie_len);
+                        wl_cfgp2p_set_management_ie(wl, dev, wl_cfgp2p_find_idx(wl, dev),
+                                VNDR_IE_ASSOCREQ_FLAG, sme->ie, sme->ie_len);
+                } else if (p2p_on(wl) && (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)) {
+                        /* This is the connect req after WPS is done [credentials exchanged]
+                         * currently identified with WPA_VERSION_2 .
+                         * Update the previously set IEs with
+                         * the newly received IEs from Supplicant. This will remove the WPS IE from
+                         * the Assoc Req.
+                         */
+                        WL_DBG(("ASSOC2 p2p index : %d sme->ie_len %d\n",
+                                wl_cfgp2p_find_idx(wl, dev), sme->ie_len));
+                        wl_cfgp2p_set_management_ie(wl, dev, wl_cfgp2p_find_idx(wl, dev),
+                                VNDR_IE_ASSOCREQ_FLAG, sme->ie, sme->ie_len);
+                }
+
+        } else if (dev == wl_to_prmry_ndev(wl)) {
+                        /* find the RSN_IE */
+                        if ((wpa2_ie = bcm_parse_tlvs((u8 *)sme->ie, sme->ie_len,
+                                DOT11_MNG_RSN_ID)) != NULL) {
+                                WL_DBG((" WPA2 IE is found\n"));
+                        }
+                        /* find the WPA_IE */
+                        if ((wpa_ie = wl_cfgp2p_find_wpaie((u8 *)sme->ie,
+                                sme->ie_len)) != NULL) {
+                                WL_DBG((" WPA IE is found\n"));
+                        }
+                        if (wpa_ie != NULL || wpa2_ie != NULL) {
+                                wpaie = (wpa_ie != NULL) ? (u8 *)wpa_ie : (u8 *)wpa2_ie;
+                                wpaie_len = (wpa_ie != NULL) ? wpa_ie->length : wpa2_ie->len;
+                                wpaie_len += WPA_RSN_IE_TAG_FIXED_LEN;
+                                wldev_iovar_setbuf(dev, "wpaie", wpaie, wpaie_len,
+                                ioctlbuf, sizeof(ioctlbuf));
+                        } else {
+                                wldev_iovar_setbuf(dev, "wpaie", NULL, 0,
+                                ioctlbuf, sizeof(ioctlbuf));
+                        }
+
+                        /* find the WPSIE */
+                        memset(wpsie, 0, sizeof(wpsie));
+                        if ((wps_ie = wl_cfgp2p_find_wpsie((u8 *)sme->ie,
+                                sme->ie_len)) != NULL) {
+                                wpsie_len = wps_ie->length +WPA_RSN_IE_TAG_FIXED_LEN;
+                                memcpy(wpsie, wps_ie, wpsie_len);
+                        } else {
+                                wpsie_len = 0;
+                        }
+                        err = wl_cfgp2p_set_management_ie(wl, dev, -1,
+                                VNDR_IE_ASSOCREQ_FLAG, wpsie, wpsie_len);
+                        if (unlikely(err)) {
+                                return err;
+                        }
+        }
+        if (unlikely(!sme->ssid)) {
+                WL_ERR(("Invalid ssid\n"));
+                return -EOPNOTSUPP;
+        }
+        if (chan) {
+                wl->channel = ieee80211_frequency_to_channel(chan->center_freq);
+                chan_cnt = 1;
+                WL_DBG(("channel (%d), center_req (%d)\n", wl->channel,
+                        chan->center_freq));
+        } else
+                wl->channel = 0;
+        WL_DBG(("ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len));
+        err = wl_set_wpa_version(dev, sme);
+        if (unlikely(err)) {
+                WL_ERR(("Invalid wpa_version\n"));
+                return err;
+        }
+
+        err = wl_set_auth_type(dev, sme);
+        if (unlikely(err)) {
+                WL_ERR(("Invalid auth type\n"));
+                return err;
+        }
+
+        err = wl_set_set_cipher(dev, sme);
+        if (unlikely(err)) {
+                WL_ERR(("Invalid ciper\n"));
+                return err;
+        }
+
+        err = wl_set_key_mgmt(dev, sme);
+        if (unlikely(err)) {
+                WL_ERR(("Invalid key mgmt\n"));
+                return err;
+        }
+
+        err = wl_set_set_sharedkey(dev, sme);
+        if (unlikely(err)) {
+                WL_ERR(("Invalid shared key\n"));
+                return err;
+        }
+
+        /*
+         *  Join with specific BSSID and cached SSID
+         *  If SSID is zero join based on BSSID only
+         */
+        join_params_size = WL_EXTJOIN_PARAMS_FIXED_SIZE +
+                chan_cnt * sizeof(chanspec_t);
+        ext_join_params =  (wl_extjoin_params_t*)kzalloc(join_params_size, GFP_KERNEL);
+        if (ext_join_params == NULL) {
+                err = -ENOMEM;
+                wl_clr_drv_status(wl, CONNECTING);
+                goto exit;
+        }
+        ext_join_params->ssid.SSID_len = min(sizeof(ext_join_params->ssid.SSID), sme->ssid_len);
+        memcpy(&ext_join_params->ssid.SSID, sme->ssid, ext_join_params->ssid.SSID_len);
+        ext_join_params->ssid.SSID_len = htod32(ext_join_params->ssid.SSID_len);
+        /* Set up join scan parameters */
+        ext_join_params->scan.scan_type = -1;
+        ext_join_params->scan.nprobes = 2;
+        /* increate dwell time to receive probe response
+        * from target AP at a noisy air
+        */
+        ext_join_params->scan.active_time = 150;
+        ext_join_params->scan.passive_time = 300;
+        ext_join_params->scan.home_time = -1;
+        if (sme->bssid)
+                memcpy(&ext_join_params->assoc.bssid, sme->bssid, ETH_ALEN);
+        else
+                memcpy(&ext_join_params->assoc.bssid, &ether_bcast, ETH_ALEN);
+        ext_join_params->assoc.chanspec_num = chan_cnt;
+        if (chan_cnt) {
+                u16 channel, band, bw, ctl_sb;
+                chanspec_t chspec;
+                channel = wl->channel;
+                band = (channel <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G
+                        : WL_CHANSPEC_BAND_5G;
+                bw = WL_CHANSPEC_BW_20;
+                ctl_sb = WL_CHANSPEC_CTL_SB_NONE;
+                chspec = (channel | band | bw | ctl_sb);
+                ext_join_params->assoc.chanspec_list[0]  &= WL_CHANSPEC_CHAN_MASK;
+                ext_join_params->assoc.chanspec_list[0] |= chspec;
+                ext_join_params->assoc.chanspec_list[0] =
+                        htodchanspec(ext_join_params->assoc.chanspec_list[0]);
+        }
+        ext_join_params->assoc.chanspec_num = htod32(ext_join_params->assoc.chanspec_num);
+        if (ext_join_params->ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+                WL_INFO(("ssid \"%s\", len (%d)\n", ext_join_params->ssid.SSID,
+                        ext_join_params->ssid.SSID_len));
+        }
+        wl_set_drv_status(wl, CONNECTING);
+        err = wldev_iovar_setbuf_bsscfg(dev, "join", ext_join_params, join_params_size, ioctlbuf,
+                sizeof(ioctlbuf), wl_cfgp2p_find_idx(wl, dev));
+        kfree(ext_join_params);
+        if (err) {
+                wl_clr_drv_status(wl, CONNECTING);
+                if (err == BCME_UNSUPPORTED) {
+                        WL_DBG(("join iovar is not supported\n"));
+                        goto set_ssid;
+                } else
+                        WL_ERR(("error (%d)\n", err));
+        } else
+                goto exit;
+
+set_ssid:
+        memset(&join_params, 0, sizeof(join_params));
+        join_params_size = sizeof(join_params.ssid);
+
+        join_params.ssid.SSID_len = min(sizeof(join_params.ssid.SSID), sme->ssid_len);
+        memcpy(&join_params.ssid.SSID, sme->ssid, join_params.ssid.SSID_len);
+        join_params.ssid.SSID_len = htod32(join_params.ssid.SSID_len);
+        wl_update_prof(wl, NULL, &join_params.ssid, WL_PROF_SSID);
+        if (sme->bssid)
+                memcpy(&join_params.params.bssid, sme->bssid, ETH_ALEN);
+        else
+                memcpy(&join_params.params.bssid, &ether_bcast, ETH_ALEN);
+
+        wl_ch_to_chanspec(wl->channel, &join_params, &join_params_size);
+        WL_DBG(("join_param_size %d\n", join_params_size));
+
+        if (join_params.ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+                WL_INFO(("ssid \"%s\", len (%d)\n", join_params.ssid.SSID,
+                        join_params.ssid.SSID_len));
+        }
+        wl_set_drv_status(wl, CONNECTING);
+        err = wldev_ioctl(dev, WLC_SET_SSID, &join_params, join_params_size, true);
+        if (err) {
+                WL_ERR(("error (%d)\n", err));
+                wl_clr_drv_status(wl, CONNECTING);
+        }
+exit:
+        return err;
+}
+
+static s32
+wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+        u16 reason_code)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        scb_val_t scbval;
+        bool act = false;
+        s32 err = 0;
+        u8 *curbssid;
+        WL_ERR(("Reason %d\n", reason_code));
+        CHECK_SYS_UP(wl);
+        act = *(bool *) wl_read_prof(wl, WL_PROF_ACT);
+        curbssid = wl_read_prof(wl, WL_PROF_BSSID);
+        if (likely(act)) {
+                /*
+                * Cancel ongoing scan to sync up with sme state machine of cfg80211.
+                */
+                if (wl->scan_request) {
+                        wl_cfg80211_scan_abort(wl, dev);
+                }
+                wl_set_drv_status(wl, DISCONNECTING);
+                scbval.val = reason_code;
+                memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+                scbval.val = htod32(scbval.val);
+                err = wldev_ioctl(dev, WLC_DISASSOC, &scbval,
+                        sizeof(scb_val_t), true);
+                if (unlikely(err)) {
+                        wl_clr_drv_status(wl, DISCONNECTING);
+                        WL_ERR(("error (%d)\n", err));
+                        return err;
+                }
+        }
+
+        return err;
+}
+
+static s32
+wl_cfg80211_set_tx_power(struct wiphy *wiphy,
+        enum nl80211_tx_power_setting type, s32 dbm)
+{
+
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct net_device *ndev = wl_to_prmry_ndev(wl);
+        u16 txpwrmw;
+        s32 err = 0;
+        s32 disable = 0;
+
+        CHECK_SYS_UP(wl);
+        switch (type) {
+        case NL80211_TX_POWER_AUTOMATIC:
+                break;
+        case NL80211_TX_POWER_LIMITED:
+                if (dbm < 0) {
+                        WL_ERR(("TX_POWER_LIMITTED - dbm is negative\n"));
+                        return -EINVAL;
+                }
+                break;
+        case NL80211_TX_POWER_FIXED:
+                if (dbm < 0) {
+                        WL_ERR(("TX_POWER_FIXED - dbm is negative..\n"));
+                        return -EINVAL;
+                }
+                break;
+        }
+        /* Make sure radio is off or on as far as software is concerned */
+        disable = WL_RADIO_SW_DISABLE << 16;
+        disable = htod32(disable);
+        err = wldev_ioctl(ndev, WLC_SET_RADIO, &disable, sizeof(disable), true);
+        if (unlikely(err)) {
+                WL_ERR(("WLC_SET_RADIO error (%d)\n", err));
+                return err;
+        }
+
+        if (dbm > 0xffff)
+                txpwrmw = 0xffff;
+        else
+                txpwrmw = (u16) dbm;
+        err = wl_dev_intvar_set(ndev, "qtxpower",
+                (s32) (bcm_mw_to_qdbm(txpwrmw)));
+        if (unlikely(err)) {
+                WL_ERR(("qtxpower error (%d)\n", err));
+                return err;
+        }
+        wl->conf->tx_power = dbm;
+
+        return err;
+}
+
+static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct net_device *ndev = wl_to_prmry_ndev(wl);
+        s32 txpwrdbm;
+        u8 result;
+        s32 err = 0;
+
+        CHECK_SYS_UP(wl);
+        err = wl_dev_intvar_get(ndev, "qtxpower", &txpwrdbm);
+        if (unlikely(err)) {
+                WL_ERR(("error (%d)\n", err));
+                return err;
+        }
+        result = (u8) (txpwrdbm & ~WL_TXPWR_OVERRIDE);
+        *dbm = (s32) bcm_qdbm_to_mw(result);
+
+        return err;
+}
+
+static s32
+wl_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *dev,
+        u8 key_idx, bool unicast, bool multicast)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        u32 index;
+        s32 wsec;
+        s32 err = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+
+        WL_DBG(("key index (%d)\n", key_idx));
+        CHECK_SYS_UP(wl);
+        err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+        if (unlikely(err)) {
+                WL_ERR(("WLC_GET_WSEC error (%d)\n", err));
+                return err;
+        }
+        if (wsec & WEP_ENABLED) {
+                /* Just select a new current key */
+                index = (u32) key_idx;
+                index = htod32(index);
+                err = wldev_ioctl(dev, WLC_SET_KEY_PRIMARY, &index,
+                        sizeof(index), true);
+                if (unlikely(err)) {
+                        WL_ERR(("error (%d)\n", err));
+                }
+        }
+        return err;
+}
+
+static s32
+wl_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+        u8 key_idx, const u8 *mac_addr, struct key_params *params)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct wl_wsec_key key;
+        s32 err = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+        s32 mode = get_mode_by_netdev(wl, dev);
+        memset(&key, 0, sizeof(key));
+        key.index = (u32) key_idx;
+
+        if (!ETHER_ISMULTI(mac_addr))
+                memcpy((char *)&key.ea, (void *)mac_addr, ETHER_ADDR_LEN);
+        key.len = (u32) params->key_len;
+
+        /* check for key index change */
+        if (key.len == 0) {
+                /* key delete */
+                swap_key_from_BE(&key);
+                wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), ioctlbuf,
+                        sizeof(ioctlbuf), bssidx);
+                if (unlikely(err)) {
+                        WL_ERR(("key delete error (%d)\n", err));
+                        return err;
+                }
+        } else {
+                if (key.len > sizeof(key.data)) {
+                        WL_ERR(("Invalid key length (%d)\n", key.len));
+                        return -EINVAL;
+                }
+                WL_DBG(("Setting the key index %d\n", key.index));
+                memcpy(key.data, params->key, key.len);
+
+                if ((mode == WL_MODE_BSS) &&
+                        (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
+                        u8 keybuf[8];
+                        memcpy(keybuf, &key.data[24], sizeof(keybuf));
+                        memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
+                        memcpy(&key.data[16], keybuf, sizeof(keybuf));
+                }
+
+                /* if IW_ENCODE_EXT_RX_SEQ_VALID set */
+                if (params->seq && params->seq_len == 6) {
+                        /* rx iv */
+                        u8 *ivptr;
+                        ivptr = (u8 *) params->seq;
+                        key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
+                                (ivptr[3] << 8) | ivptr[2];
+                        key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
+                        key.iv_initialized = true;
+                }
+
+                switch (params->cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                        key.algo = CRYPTO_ALGO_WEP1;
+                        WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+                        break;
+                case WLAN_CIPHER_SUITE_WEP104:
+                        key.algo = CRYPTO_ALGO_WEP128;
+                        WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+                        break;
+                case WLAN_CIPHER_SUITE_TKIP:
+                        key.algo = CRYPTO_ALGO_TKIP;
+                        WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+                        break;
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        key.algo = CRYPTO_ALGO_AES_CCM;
+                        WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+                        break;
+                case WLAN_CIPHER_SUITE_CCMP:
+                        key.algo = CRYPTO_ALGO_AES_CCM;
+                        WL_DBG(("WLAN_CIPHER_SUITE_CCMP\n"));
+                        break;
+                default:
+                        WL_ERR(("Invalid cipher (0x%x)\n", params->cipher));
+                        return -EINVAL;
+                }
+                swap_key_from_BE(&key);
+#ifdef CONFIG_WIRELESS_EXT
+                dhd_wait_pend8021x(dev);
+#endif
+                wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), ioctlbuf,
+                        sizeof(ioctlbuf), bssidx);
+                if (unlikely(err)) {
+                        WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                        return err;
+                }
+        }
+        return err;
+}
+
+static s32
+wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+        u8 key_idx, bool pairwise, const u8 *mac_addr,
+        struct key_params *params)
+{
+        struct wl_wsec_key key;
+        s32 val = 0;
+        s32 wsec = 0;
+        s32 err = 0;
+        u8 keybuf[8];
+        s32 bssidx = 0;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        s32 mode = get_mode_by_netdev(wl, dev);
+        WL_DBG(("key index (%d)\n", key_idx));
+        CHECK_SYS_UP(wl);
+
+        bssidx = wl_cfgp2p_find_idx(wl, dev);
+
+        if (mac_addr) {
+                wl_add_keyext(wiphy, dev, key_idx, mac_addr, params);
+                goto exit;
+        }
+        memset(&key, 0, sizeof(key));
+
+        key.len = (u32) params->key_len;
+        key.index = (u32) key_idx;
+
+        if (unlikely(key.len > sizeof(key.data))) {
+                WL_ERR(("Too long key length (%u)\n", key.len));
+                return -EINVAL;
+        }
+        memcpy(key.data, params->key, key.len);
+
+        key.flags = WL_PRIMARY_KEY;
+        switch (params->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                key.algo = CRYPTO_ALGO_WEP1;
+                val = WEP_ENABLED;
+                WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                key.algo = CRYPTO_ALGO_WEP128;
+                val = WEP_ENABLED;
+                WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                key.algo = CRYPTO_ALGO_TKIP;
+                val = TKIP_ENABLED;
+                /* wpa_supplicant switches the third and fourth quarters of the TKIP key */
+                if (mode == WL_MODE_BSS) {
+                        bcopy(&key.data[24], keybuf, sizeof(keybuf));
+                        bcopy(&key.data[16], &key.data[24], sizeof(keybuf));
+                        bcopy(keybuf, &key.data[16], sizeof(keybuf));
+                }
+                WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                key.algo = CRYPTO_ALGO_AES_CCM;
+                val = AES_ENABLED;
+                WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                key.algo = CRYPTO_ALGO_AES_CCM;
+                val = AES_ENABLED;
+                WL_DBG(("WLAN_CIPHER_SUITE_CCMP\n"));
+                break;
+        default:
+                WL_ERR(("Invalid cipher (0x%x)\n", params->cipher));
+                return -EINVAL;
+        }
+
+        /* Set the new key/index */
+        swap_key_from_BE(&key);
+        err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), ioctlbuf,
+                sizeof(ioctlbuf), bssidx);
+        if (unlikely(err)) {
+                WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                return err;
+        }
+
+exit:
+        err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+        if (unlikely(err)) {
+                WL_ERR(("get wsec error (%d)\n", err));
+                return err;
+        }
+
+        wsec |= val;
+        err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+        if (unlikely(err)) {
+                WL_ERR(("set wsec error (%d)\n", err));
+                return err;
+        }
+
+        return err;
+}
+
+static s32
+wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+        u8 key_idx, bool pairwise, const u8 *mac_addr)
+{
+        struct wl_wsec_key key;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        s32 err = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+
+        WL_DBG(("Enter\n"));
+        CHECK_SYS_UP(wl);
+        memset(&key, 0, sizeof(key));
+
+        key.index = (u32) key_idx;
+        key.flags = WL_PRIMARY_KEY;
+        key.algo = CRYPTO_ALGO_OFF;
+
+        WL_DBG(("key index (%d)\n", key_idx));
+        /* Set the new key/index */
+        swap_key_from_BE(&key);
+        wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), ioctlbuf,
+                sizeof(ioctlbuf), bssidx);
+        if (unlikely(err)) {
+                if (err == -EINVAL) {
+                        if (key.index >= DOT11_MAX_DEFAULT_KEYS) {
+                                /* we ignore this key index in this case */
+                                WL_DBG(("invalid key index (%d)\n", key_idx));
+                        }
+                } else {
+                        WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                }
+                return err;
+        }
+        return err;
+}
+
+static s32
+wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+        u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
+        void (*callback) (void *cookie, struct key_params * params))
+{
+        struct key_params params;
+        struct wl_wsec_key key;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct wl_security *sec;
+        s32 wsec;
+        s32 err = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+
+        WL_DBG(("key index (%d)\n", key_idx));
+        CHECK_SYS_UP(wl);
+        memset(&key, 0, sizeof(key));
+        key.index = key_idx;
+        swap_key_to_BE(&key);
+        memset(&params, 0, sizeof(params));
+        params.key_len = (u8) min_t(u8, DOT11_MAX_KEY_SIZE, key.len);
+        memcpy(params.key, key.data, params.key_len);
+
+        wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+        if (unlikely(err)) {
+                WL_ERR(("WLC_GET_WSEC error (%d)\n", err));
+                return err;
+        }
+        switch (wsec & ~SES_OW_ENABLED) {
+                case WEP_ENABLED:
+                        sec = wl_read_prof(wl, WL_PROF_SEC);
+                        if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
+                                params.cipher = WLAN_CIPHER_SUITE_WEP40;
+                                WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+                        } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
+                                params.cipher = WLAN_CIPHER_SUITE_WEP104;
+                                WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+                        }
+                        break;
+                case TKIP_ENABLED:
+                        params.cipher = WLAN_CIPHER_SUITE_TKIP;
+                        WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+                        break;
+                case AES_ENABLED:
+                        params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+                        WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+                        break;
+                default:
+                        WL_ERR(("Invalid algo (0x%x)\n", wsec));
+                        return -EINVAL;
+        }
+
+        callback(cookie, &params);
+        return err;
+}
+
+static s32
+wl_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+        struct net_device *dev, u8 key_idx)
+{
+        WL_INFO(("Not supported\n"));
+        return -EOPNOTSUPP;
+}
+
+static s32
+wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
+        u8 *mac, struct station_info *sinfo)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        scb_val_t scb_val;
+        s32 rssi;
+        s32 rate;
+        s32 err = 0;
+        sta_info_t *sta;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+        s8 eabuf[ETHER_ADDR_STR_LEN];
+#endif
+        dhd_pub_t *dhd =  (dhd_pub_t *)(wl->pub);
+
+        CHECK_SYS_UP(wl);
+        if (get_mode_by_netdev(wl, dev) == WL_MODE_AP) {
+                err = wldev_iovar_getbuf(dev, "sta_info", (struct ether_addr *)mac,
+                        ETHER_ADDR_LEN, ioctlbuf, sizeof(ioctlbuf));
+                if (err < 0) {
+                        WL_ERR(("GET STA INFO failed, %d\n", err));
+                        return err;
+                }
+                sinfo->filled = STATION_INFO_INACTIVE_TIME;
+                sta = (sta_info_t *)ioctlbuf;
+                sta->len = dtoh16(sta->len);
+                sta->cap = dtoh16(sta->cap);
+                sta->flags = dtoh32(sta->flags);
+                sta->idle = dtoh32(sta->idle);
+                sta->in = dtoh32(sta->in);
+                sinfo->inactive_time = sta->idle * 1000;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
+                if (sta->flags & WL_STA_ASSOC) {
+                        sinfo->filled |= STATION_INFO_CONNECTED_TIME;
+                        sinfo->connected_time = sta->in;
+                }
+                WL_INFO(("STA %s : idle time : %d sec, connected time :%d ms\n",
+                        bcm_ether_ntoa((const struct ether_addr *)mac, eabuf), sinfo->inactive_time,
+                        sta->idle * 1000));
+#endif
+        } else if (get_mode_by_netdev(wl, dev) == WL_MODE_BSS) {
+                        u8 *curmacp = wl_read_prof(wl, WL_PROF_BSSID);
+
+                        if (!wl_get_drv_status(wl, CONNECTED) ||
+                            (dhd_is_associated(dhd, NULL) == FALSE)) {
+                                WL_ERR(("NOT assoc\n"));
+                                err = -ENODEV;
+                                goto get_station_err;
+                        }
+                        if (memcmp(mac, curmacp, ETHER_ADDR_LEN)) {
+                                WL_ERR(("Wrong Mac address: "MACSTR" != "MACSTR"\n",
+                                        MAC2STR(mac), MAC2STR(curmacp)));
+                        }
+
+                        /* Report the current tx rate */
+                        err = wldev_ioctl(dev, WLC_GET_RATE, &rate, sizeof(rate), false);
+                        if (err) {
+                                WL_ERR(("Could not get rate (%d)\n", err));
+                        } else {
+                                rate = dtoh32(rate);
+                                sinfo->filled |= STATION_INFO_TX_BITRATE;
+                                sinfo->txrate.legacy = rate * 5;
+                                WL_DBG(("Rate %d Mbps\n", (rate / 2)));
+                        }
+
+                        memset(&scb_val, 0, sizeof(scb_val));
+                        scb_val.val = 0;
+                        err = wldev_ioctl(dev, WLC_GET_RSSI, &scb_val,
+                                        sizeof(scb_val_t), false);
+                        if (err) {
+                                WL_ERR(("Could not get rssi (%d)\n", err));
+                                goto get_station_err;
+                        }
+
+                        rssi = dtoh32(scb_val.val);
+                        sinfo->filled |= STATION_INFO_SIGNAL;
+                        sinfo->signal = rssi;
+                        WL_DBG(("RSSI %d dBm\n", rssi));
+
+get_station_err:
+                if (err) {
+                        /* Disconnect due to zero BSSID or error to get RSSI */
+                        WL_ERR(("force cfg80211_disconnected\n"));
+                        wl_clr_drv_status(wl, CONNECTED);
+                        cfg80211_disconnected(dev, 0, NULL, 0, GFP_KERNEL);
+                        wl_link_down(wl);
+                }
+        }
+
+        return err;
+}
+
+static s32
+wl_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
+        bool enabled, s32 timeout)
+{
+        s32 pm;
+        s32 err = 0;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+
+        CHECK_SYS_UP(wl);
+        pm = enabled ? PM_FAST : PM_OFF;
+        /* Do not enable the power save after assoc if it is p2p interface */
+        if (wl->p2p && wl->p2p->vif_created) {
+                WL_DBG(("Do not enable the power save for p2p interfaces even after assoc\n"));
+                pm = PM_OFF;
+        }
+        pm = htod32(pm);
+        WL_DBG(("power save %s\n", (pm ? "enabled" : "disabled")));
+        err = wldev_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm), true);
+        if (unlikely(err)) {
+                if (err == -ENODEV)
+                        WL_DBG(("net_device is not ready yet\n"));
+                else
+                        WL_ERR(("error (%d)\n", err));
+                return err;
+        }
+        return err;
+}
+
+static __used u32 wl_find_msb(u16 bit16)
+{
+        u32 ret = 0;
+
+        if (bit16 & 0xff00) {
+                ret += 8;
+                bit16 >>= 8;
+        }
+
+        if (bit16 & 0xf0) {
+                ret += 4;
+                bit16 >>= 4;
+        }
+
+        if (bit16 & 0xc) {
+                ret += 2;
+                bit16 >>= 2;
+        }
+
+        if (bit16 & 2)
+                ret += bit16 & 2;
+        else if (bit16)
+                ret += bit16;
+
+        return ret;
+}
+
+static s32 wl_cfg80211_resume(struct wiphy *wiphy)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        s32 err = 0;
+
+        if (unlikely(!wl_get_drv_status(wl, READY))) {
+                WL_INFO(("device is not ready : status (%d)\n",
+                        (int)wl->status));
+                return 0;
+        }
+
+        wl_invoke_iscan(wl);
+
+        return err;
+}
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)
+static s32 wl_cfg80211_suspend(struct wiphy *wiphy, struct cfg80211_wowlan *wow)
+#else
+static s32 wl_cfg80211_suspend(struct wiphy *wiphy)
+#endif
+{
+#ifdef DHD_CLEAR_ON_SUSPEND
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct net_device *ndev = wl_to_prmry_ndev(wl);
+        unsigned long flags;
+
+        if (unlikely(!wl_get_drv_status(wl, READY))) {
+                WL_INFO(("device is not ready : status (%d)\n",
+                        (int)wl->status));
+                return 0;
+        }
+
+        wl_set_drv_status(wl, SCAN_ABORTING);
+        wl_term_iscan(wl);
+        flags = dhd_os_spin_lock((dhd_pub_t *)(wl->pub));
+        if (wl->scan_request) {
+                cfg80211_scan_done(wl->scan_request, true);
+                wl->scan_request = NULL;
+        }
+        wl_clr_drv_status(wl, SCANNING);
+        wl_clr_drv_status(wl, SCAN_ABORTING);
+        dhd_os_spin_unlock((dhd_pub_t *)(wl->pub), flags);
+        if (wl_get_drv_status(wl, CONNECTING)) {
+                wl_bss_connect_done(wl, ndev, NULL, NULL, false);
+        }
+#endif
+        return 0;
+}
+
+static __used s32
+wl_update_pmklist(struct net_device *dev, struct wl_pmk_list *pmk_list,
+        s32 err)
+{
+        int i, j;
+        struct wl_priv *wl = wlcfg_drv_priv;
+        struct net_device *primary_dev = wl_to_prmry_ndev(wl);
+
+        /* Firmware is supporting pmk list only for STA interface i.e. primary interface
+          * Refer code wlc_bsscfg.c->wlc_bsscfg_sta_init
+          * Do we really need to support PMK cache in P2P in firmware?
+        */
+        if (primary_dev != dev) {
+                WL_INFO(("Not supporting Flushing pmklist on virtual"
+                        " interfaces than primary interface\n"));
+                return err;
+        }
+
+        WL_DBG(("No of elements %d\n", pmk_list->pmkids.npmkid));
+        for (i = 0; i < pmk_list->pmkids.npmkid; i++) {
+                WL_DBG(("PMKID[%d]: %pM =\n", i,
+                        &pmk_list->pmkids.pmkid[i].BSSID));
+                for (j = 0; j < WPA2_PMKID_LEN; j++) {
+                        WL_DBG(("%02x\n", pmk_list->pmkids.pmkid[i].PMKID[j]));
+                }
+        }
+        if (likely(!err)) {
+                err = wl_dev_bufvar_set(dev, "pmkid_info", (char *)pmk_list,
+                        sizeof(*pmk_list));
+        }
+
+        return err;
+}
+
+static s32
+wl_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+        struct cfg80211_pmksa *pmksa)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        s32 err = 0;
+        int i;
+
+        CHECK_SYS_UP(wl);
+        for (i = 0; i < wl->pmk_list->pmkids.npmkid; i++)
+                if (!memcmp(pmksa->bssid, &wl->pmk_list->pmkids.pmkid[i].BSSID,
+                        ETHER_ADDR_LEN))
+                        break;
+        if (i < WL_NUM_PMKIDS_MAX) {
+                memcpy(&wl->pmk_list->pmkids.pmkid[i].BSSID, pmksa->bssid,
+                        ETHER_ADDR_LEN);
+                memcpy(&wl->pmk_list->pmkids.pmkid[i].PMKID, pmksa->pmkid,
+                        WPA2_PMKID_LEN);
+                if (i == wl->pmk_list->pmkids.npmkid)
+                        wl->pmk_list->pmkids.npmkid++;
+        } else {
+                err = -EINVAL;
+        }
+        WL_DBG(("set_pmksa,IW_PMKSA_ADD - PMKID: %pM =\n",
+                &wl->pmk_list->pmkids.pmkid[wl->pmk_list->pmkids.npmkid - 1].BSSID));
+        for (i = 0; i < WPA2_PMKID_LEN; i++) {
+                WL_DBG(("%02x\n",
+                        wl->pmk_list->pmkids.pmkid[wl->pmk_list->pmkids.npmkid - 1].
+                        PMKID[i]));
+        }
+
+        err = wl_update_pmklist(dev, wl->pmk_list, err);
+
+        return err;
+}
+
+static s32
+wl_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+        struct cfg80211_pmksa *pmksa)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct _pmkid_list pmkid;
+        s32 err = 0;
+        int i;
+
+        CHECK_SYS_UP(wl);
+        memcpy(&pmkid.pmkid[0].BSSID, pmksa->bssid, ETHER_ADDR_LEN);
+        memcpy(&pmkid.pmkid[0].PMKID, pmksa->pmkid, WPA2_PMKID_LEN);
+
+        WL_DBG(("del_pmksa,IW_PMKSA_REMOVE - PMKID: %pM =\n",
+                &pmkid.pmkid[0].BSSID));
+        for (i = 0; i < WPA2_PMKID_LEN; i++) {
+                WL_DBG(("%02x\n", pmkid.pmkid[0].PMKID[i]));
+        }
+
+        for (i = 0; i < wl->pmk_list->pmkids.npmkid; i++)
+                if (!memcmp
+                    (pmksa->bssid, &wl->pmk_list->pmkids.pmkid[i].BSSID,
+                     ETHER_ADDR_LEN))
+                        break;
+
+        if ((wl->pmk_list->pmkids.npmkid > 0) &&
+                (i < wl->pmk_list->pmkids.npmkid)) {
+                memset(&wl->pmk_list->pmkids.pmkid[i], 0, sizeof(pmkid_t));
+                for (; i < (wl->pmk_list->pmkids.npmkid - 1); i++) {
+                        memcpy(&wl->pmk_list->pmkids.pmkid[i].BSSID,
+                                &wl->pmk_list->pmkids.pmkid[i + 1].BSSID,
+                                ETHER_ADDR_LEN);
+                        memcpy(&wl->pmk_list->pmkids.pmkid[i].PMKID,
+                                &wl->pmk_list->pmkids.pmkid[i + 1].PMKID,
+                                WPA2_PMKID_LEN);
+                }
+                wl->pmk_list->pmkids.npmkid--;
+        } else {
+                err = -EINVAL;
+        }
+
+        err = wl_update_pmklist(dev, wl->pmk_list, err);
+
+        return err;
+
+}
+
+static s32
+wl_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *dev)
+{
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        s32 err = 0;
+        CHECK_SYS_UP(wl);
+        memset(wl->pmk_list, 0, sizeof(*wl->pmk_list));
+        err = wl_update_pmklist(dev, wl->pmk_list, err);
+        return err;
+
+}
+
+wl_scan_params_t *
+wl_cfg80211_scan_alloc_params(int channel, int nprobes, int *out_params_size)
+{
+        wl_scan_params_t *params;
+        int params_size;
+        int num_chans;
+
+        *out_params_size = 0;
+
+        /* Our scan params only need space for 1 channel and 0 ssids */
+        params_size = WL_SCAN_PARAMS_FIXED_SIZE + 1 * sizeof(uint16);
+        params = (wl_scan_params_t*) kzalloc(params_size, GFP_KERNEL);
+        if (params == NULL) {
+                WL_ERR(("%s: mem alloc failed (%d bytes)\n", __func__, params_size));
+                return params;
+        }
+        memset(params, 0, params_size);
+        params->nprobes = nprobes;
+
+        num_chans = (channel == 0) ? 0 : 1;
+
+        memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+        params->bss_type = DOT11_BSSTYPE_ANY;
+        params->scan_type = DOT11_SCANTYPE_ACTIVE;
+        params->nprobes = htod32(1);
+        params->active_time = htod32(-1);
+        params->passive_time = htod32(-1);
+        params->home_time = htod32(10);
+        params->channel_list[0] = htodchanspec(channel);
+
+        /* Our scan params have 1 channel and 0 ssids */
+        params->channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+        (num_chans & WL_SCAN_PARAMS_COUNT_MASK));
+
+        *out_params_size = params_size; /* rtn size to the caller */
+        return params;
+}
+
+s32
+wl_cfg80211_scan_abort(struct wl_priv *wl, struct net_device *ndev)
+{
+        wl_scan_params_t *params = NULL;
+        s32 params_size = 0;
+        s32 err = BCME_OK;
+        unsigned long flags;
+
+        WL_DBG(("Enter\n"));
+
+        /* Our scan params only need space for 1 channel and 0 ssids */
+        params = wl_cfg80211_scan_alloc_params(-1, 0, &params_size);
+        if (params == NULL) {
+                WL_ERR(("scan params allocation failed \n"));
+                err = -ENOMEM;
+        } else {
+                /* Do a scan abort to stop the driver's scan engine */
+                err = wldev_ioctl(ndev, WLC_SCAN, params, params_size, true);
+                if (err < 0) {
+                        WL_ERR(("scan abort  failed \n"));
+                }
+        }
+        del_timer_sync(&wl->scan_timeout);
+        flags = dhd_os_spin_lock((dhd_pub_t *)(wl->pub));
+        if (wl->scan_request) {
+                cfg80211_scan_done(wl->scan_request, true);
+                wl->scan_request = NULL;
+        }
+        wl_clr_drv_status(wl, SCANNING);
+        dhd_os_spin_unlock((dhd_pub_t *)(wl->pub), flags);
+        if (params)
+                kfree(params);
+        return err;
+}
+
+static s32
+wl_cfg80211_remain_on_channel(struct wiphy *wiphy, struct net_device *dev,
+        struct ieee80211_channel * channel,
+        enum nl80211_channel_type channel_type,
+        unsigned int duration, u64 *cookie)
+{
+        s32 target_channel;
+
+        s32 err = BCME_OK;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        dhd_pub_t *dhd = (dhd_pub_t *)(wl->pub);
+        WL_DBG(("Enter, netdev_ifidx: %d \n", dev->ifindex));
+        if (likely(wl_get_drv_status(wl, SCANNING))) {
+                wl_cfg80211_scan_abort(wl, dev);
+        }
+
+        target_channel = ieee80211_frequency_to_channel(channel->center_freq);
+        memcpy(&wl->remain_on_chan, channel, sizeof(struct ieee80211_channel));
+        wl->remain_on_chan_type = channel_type;
+        wl->cache_cookie = *cookie;
+        cfg80211_ready_on_channel(dev, *cookie, channel,
+                channel_type, duration, GFP_KERNEL);
+        if (!p2p_on(wl)) {
+                wl_cfgp2p_generate_bss_mac(&dhd->mac, &wl->p2p->dev_addr, &wl->p2p->int_addr);
+
+                /* In case of p2p_listen command, supplicant send remain_on_channel
+                 * without turning on P2P
+                 */
+
+                p2p_on(wl) = true;
+                err = wl_cfgp2p_enable_discovery(wl, dev, NULL, 0);
+
+                if (unlikely(err)) {
+                        goto exit;
+                }
+        }
+        if (p2p_on(wl))
+                wl_cfgp2p_discover_listen(wl, target_channel, duration);
+
+
+exit:
+        return err;
+}
+
+static s32
+wl_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy, struct net_device *dev,
+        u64 cookie)
+{
+        s32 err = 0;
+        WL_DBG((" enter ) netdev_ifidx: %d \n", dev->ifindex));
+        return err;
+}
+
+static s32
+wl_cfg80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
+        struct ieee80211_channel *channel, bool offchan,
+        enum nl80211_channel_type channel_type,
+        bool channel_type_valid, unsigned int wait,
+        const u8* buf, size_t len, u64 *cookie)
+{
+        wl_action_frame_t *action_frame;
+        wl_af_params_t *af_params;
+        wifi_p2p_ie_t *p2p_ie;
+        wpa_ie_fixed_t *wps_ie;
+        const struct ieee80211_mgmt *mgmt;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        dhd_pub_t *dhd = (dhd_pub_t *)(wl->pub);
+        s32 err = BCME_OK;
+        s32 bssidx = 0;
+        u32 p2pie_len = 0;
+        u32 wpsie_len = 0;
+        u16 fc;
+        bool ack = false;
+        wifi_p2p_pub_act_frame_t *act_frm;
+        WL_DBG(("Enter \n"));
+        /* find bssidx based on ndev */
+        bssidx = wl_cfgp2p_find_idx(wl, dev);
+        /* cookie generation */
+        *cookie = (unsigned long) buf;
+
+        if (bssidx == -1) {
+
+                WL_ERR(("Can not find the bssidx for dev( %p )\n", dev));
+                return -ENODEV;
+        }
+        if (wl->p2p_supported && p2p_on(wl)) {
+                wl_cfgp2p_generate_bss_mac(&dhd->mac, &wl->p2p->dev_addr, &wl->p2p->int_addr);
+                /* Suspend P2P discovery search-listen to prevent it from changing the
+                 * channel.
+                 */
+                if ((err = wl_cfgp2p_discover_enable_search(wl, false)) < 0) {
+                        WL_ERR(("Can not disable discovery mode\n"));
+                        return -EFAULT;
+                }
+        }
+
+        mgmt = (const struct ieee80211_mgmt *) buf;
+        fc = mgmt->frame_control;
+        if (fc != IEEE80211_STYPE_ACTION) {
+                if (fc == IEEE80211_STYPE_PROBE_RESP) {
+                        s32 ie_offset =  DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
+                        s32 ie_len = len - ie_offset;
+                        if ((p2p_ie = wl_cfgp2p_find_p2pie((u8 *)(buf + ie_offset), ie_len))
+                                != NULL) {
+                                /* Total length of P2P Information Element */
+                                p2pie_len = p2p_ie->len + sizeof(p2p_ie->len) + sizeof(p2p_ie->id);
+                                /* Have to change p2p device address in dev_info attribute
+                                 * because Supplicant use primary eth0 address
+                                 */
+                        #ifdef ENABLE_DRIVER_CHANGE_IFADDR /* We are now doing this in supplicant */
+                                wl_cfg80211_change_ifaddr((u8 *)p2p_ie,
+                                        &wl->p2p_dev_addr, P2P_SEID_DEV_INFO);
+                        #endif
+                        }
+                        if ((wps_ie = wl_cfgp2p_find_wpsie((u8 *)(buf + ie_offset), ie_len))
+                                != NULL) {
+                                /* Order of Vendor IE is 1) WPS IE +
+                                 * 2) P2P IE created by supplicant
+                                 *  So, it is ok to find start address of WPS IE
+                                 *  to save IEs to firmware
+                                 */
+                                wpsie_len = wps_ie->length + sizeof(wps_ie->length) +
+                                        sizeof(wps_ie->tag);
+                                wl_cfgp2p_set_management_ie(wl, dev, bssidx,
+                                        VNDR_IE_PRBRSP_FLAG,
+                                        (u8 *)wps_ie, wpsie_len + p2pie_len);
+                        }
+                }
+                cfg80211_mgmt_tx_status(dev, *cookie, buf, len, true, GFP_KERNEL);
+                goto exit;
+        } else {
+            /* Abort the dwell time of any previous off-channel action frame that may
+             * be still in effect.  Sending off-channel action frames relies on the
+             * driver's scan engine.  If a previous off-channel action frame tx is
+             * still in progress (including the dwell time), then this new action
+             * frame will not be sent out.
+             */
+                wl_cfg80211_scan_abort(wl, dev);
+        }
+        af_params = (wl_af_params_t *) kzalloc(WL_WIFI_AF_PARAMS_SIZE, GFP_KERNEL);
+
+        if (af_params == NULL)
+        {
+                WL_ERR(("unable to allocate frame\n"));
+                return -ENOMEM;
+        }
+
+        action_frame = &af_params->action_frame;
+
+        /* Add the packet Id */
+        action_frame->packetId = (u32) action_frame;
+        WL_DBG(("action frame %d\n", action_frame->packetId));
+        /* Add BSSID */
+        memcpy(&action_frame->da, &mgmt->da[0], ETHER_ADDR_LEN);
+        memcpy(&af_params->BSSID, &mgmt->bssid[0], ETHER_ADDR_LEN);
+
+        /* Add the length exepted for 802.11 header  */
+        action_frame->len = len - DOT11_MGMT_HDR_LEN;
+        WL_DBG(("action_frame->len: %d\n", action_frame->len));
+
+        /* Add the channel */
+        af_params->channel =
+                ieee80211_frequency_to_channel(channel->center_freq);
+
+        /* Add the dwell time
+         * Dwell time to stay off-channel to wait for a response action frame
+         * after transmitting an GO Negotiation action frame
+         */
+        af_params->dwell_time = WL_DWELL_TIME;
+
+        memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN], action_frame->len);
+
+        act_frm = (wifi_p2p_pub_act_frame_t *) (action_frame->data);
+        WL_DBG(("action_frame->len: %d chan %d category %d subtype %d\n",
+                action_frame->len, af_params->channel,
+                act_frm->category, act_frm->subtype));
+        if (wl->p2p->vif_created) {
+                /*
+                 * To make sure to send successfully action frame, we have to turn off mpc
+                 */
+                if ((act_frm->subtype == P2P_PAF_GON_REQ)||
+                  (act_frm->subtype == P2P_PAF_GON_RSP)) {
+                        wldev_iovar_setint(dev, "mpc", 0);
+                } else if (act_frm->subtype == P2P_PAF_GON_CONF) {
+                        wldev_iovar_setint(dev, "mpc", 1);
+                } else if (act_frm->subtype == P2P_PAF_DEVDIS_REQ) {
+                        af_params->dwell_time = WL_LONG_DWELL_TIME;
+                }
+        }
+
+        ack = (wl_cfgp2p_tx_action_frame(wl, dev, af_params, bssidx)) ? false : true;
+        cfg80211_mgmt_tx_status(dev, *cookie, buf, len, ack, GFP_KERNEL);
+
+        kfree(af_params);
+exit:
+        return err;
+}
+
+
+static void
+wl_cfg80211_mgmt_frame_register(struct wiphy *wiphy, struct net_device *dev,
+        u16 frame_type, bool reg)
+{
+
+        WL_DBG(("%s: frame_type: %x, reg: %d\n", __func__, frame_type, reg));
+
+        if (frame_type != (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ))
+                return;
+
+        return;
+}
+
+
+static s32
+wl_cfg80211_change_bss(struct wiphy *wiphy,
+        struct net_device *dev,
+        struct bss_parameters *params)
+{
+        if (params->use_cts_prot >= 0) {
+        }
+
+        if (params->use_short_preamble >= 0) {
+        }
+
+        if (params->use_short_slot_time >= 0) {
+        }
+
+        if (params->basic_rates) {
+        }
+
+        if (params->ap_isolate >= 0) {
+        }
+
+        if (params->ht_opmode >= 0) {
+        }
+
+        return 0;
+}
+
+static s32
+wl_cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
+        struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type)
+{
+        s32 channel;
+        s32 err = BCME_OK;
+
+        channel = ieee80211_frequency_to_channel(chan->center_freq);
+        WL_DBG(("netdev_ifidx(%d), chan_type(%d) target channel(%d) \n",
+                dev->ifindex, channel_type, channel));
+        err = wldev_ioctl(dev, WLC_SET_CHANNEL, &channel, sizeof(channel), true);
+        if (err < 0) {
+                WL_ERR(("WLC_SET_CHANNEL error %d chip may not be supporting this channel\n", err));
+        }
+        return err;
+}
+
+static s32
+wl_validate_wpa2ie(struct net_device *dev, bcm_tlv_t *wpa2ie, s32 bssidx)
+{
+        s32 len = 0;
+        s32 err = BCME_OK;
+        u16 auth = 0; /* d11 open authentication */
+        u16 count;
+        u32 wsec;
+        u32 pval = 0;
+        u32 gval = 0;
+        u32 wpa_auth = 0;
+        u8* tmp;
+        wpa_suite_mcast_t *mcast;
+        wpa_suite_ucast_t *ucast;
+        wpa_suite_auth_key_mgmt_t *mgmt;
+        if (wpa2ie == NULL)
+                goto exit;
+
+        WL_DBG(("Enter \n"));
+        len =  wpa2ie->len;
+        /* check the mcast cipher */
+        mcast = (wpa_suite_mcast_t *)&wpa2ie->data[WPA2_VERSION_LEN];
+        tmp = mcast->oui;
+        switch (tmp[DOT11_OUI_LEN]) {
+                case WPA_CIPHER_NONE:
+                        gval = 0;
+                        break;
+                case WPA_CIPHER_WEP_40:
+                case WPA_CIPHER_WEP_104:
+                        gval = WEP_ENABLED;
+                        break;
+                case WPA_CIPHER_TKIP:
+                        gval = TKIP_ENABLED;
+                        break;
+                case WPA_CIPHER_AES_CCM:
+                        gval = AES_ENABLED;
+                        break;
+                default:
+                        WL_ERR(("No Security Info\n"));
+                        break;
+        }
+        len -= WPA_SUITE_LEN;
+        /* check the unicast cipher */
+        ucast = (wpa_suite_ucast_t *)&mcast[1];
+        count = ltoh16_ua(&ucast->count);
+        tmp = ucast->list[0].oui;
+        switch (tmp[DOT11_OUI_LEN]) {
+                case WPA_CIPHER_NONE:
+                        pval = 0;
+                        break;
+                case WPA_CIPHER_WEP_40:
+                case WPA_CIPHER_WEP_104:
+                        pval = WEP_ENABLED;
+                        break;
+                case WPA_CIPHER_TKIP:
+                        pval = TKIP_ENABLED;
+                        break;
+                case WPA_CIPHER_AES_CCM:
+                        pval = AES_ENABLED;
+                        break;
+                default:
+                        WL_ERR(("No Security Info\n"));
+        }
+        /* FOR WPS , set SEC_OW_ENABLED */
+        wsec = (pval | gval | SES_OW_ENABLED);
+        /* check the AKM */
+        mgmt = (wpa_suite_auth_key_mgmt_t *)&ucast->list[1];
+        count = ltoh16_ua(&mgmt->count);
+        tmp = (u8 *)&mgmt->list[0];
+        switch (tmp[DOT11_OUI_LEN]) {
+                case RSN_AKM_NONE:
+                        wpa_auth = WPA_AUTH_NONE;
+                        break;
+                case RSN_AKM_UNSPECIFIED:
+                        wpa_auth = WPA2_AUTH_UNSPECIFIED;
+                        break;
+                case RSN_AKM_PSK:
+                        wpa_auth = WPA2_AUTH_PSK;
+                        break;
+                default:
+                        WL_ERR(("No Key Mgmt Info\n"));
+        }
+        /* set auth */
+        err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+        if (err < 0) {
+                WL_ERR(("auth error %d\n", err));
+                return BCME_ERROR;
+        }
+        /* set wsec */
+        err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+        if (err < 0) {
+                WL_ERR(("wsec error %d\n", err));
+                return BCME_ERROR;
+        }
+        /* set upper-layer auth */
+        err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+        if (err < 0) {
+                WL_ERR(("wpa_auth error %d\n", err));
+                return BCME_ERROR;
+        }
+exit:
+        return 0;
+}
+
+static s32
+wl_validate_wpaie(struct net_device *dev, wpa_ie_fixed_t *wpaie, s32 bssidx)
+{
+        wpa_suite_mcast_t *mcast;
+        wpa_suite_ucast_t *ucast;
+        wpa_suite_auth_key_mgmt_t *mgmt;
+        u16 auth = 0; /* d11 open authentication */
+        u16 count;
+        s32 err = BCME_OK;
+        s32 len = 0;
+        u32 i;
+        u32 wsec;
+        u32 pval = 0;
+        u32 gval = 0;
+        u32 wpa_auth = 0;
+        u32 tmp = 0;
+
+        if (wpaie == NULL)
+                goto exit;
+        WL_DBG(("Enter \n"));
+        len = wpaie->length;    /* value length */
+        len -= WPA_IE_TAG_FIXED_LEN;
+        /* check for multicast cipher suite */
+        if (len < WPA_SUITE_LEN) {
+                WL_INFO(("no multicast cipher suite\n"));
+                goto exit;
+        }
+
+        /* pick up multicast cipher */
+        mcast = (wpa_suite_mcast_t *)&wpaie[1];
+        len -= WPA_SUITE_LEN;
+        if (!bcmp(mcast->oui, WPA_OUI, WPA_OUI_LEN)) {
+                if (IS_WPA_CIPHER(mcast->type)) {
+                        tmp = 0;
+                        switch (mcast->type) {
+                                case WPA_CIPHER_NONE:
+                                        tmp = 0;
+                                        break;
+                                case WPA_CIPHER_WEP_40:
+                                case WPA_CIPHER_WEP_104:
+                                        tmp = WEP_ENABLED;
+                                        break;
+                                case WPA_CIPHER_TKIP:
+                                        tmp = TKIP_ENABLED;
+                                        break;
+                                case WPA_CIPHER_AES_CCM:
+                                        tmp = AES_ENABLED;
+                                        break;
+                                default:
+                                        WL_ERR(("No Security Info\n"));
+                        }
+                        gval |= tmp;
+                }
+        }
+        /* Check for unicast suite(s) */
+        if (len < WPA_IE_SUITE_COUNT_LEN) {
+                WL_INFO(("no unicast suite\n"));
+                goto exit;
+        }
+        /* walk thru unicast cipher list and pick up what we recognize */
+        ucast = (wpa_suite_ucast_t *)&mcast[1];
+        count = ltoh16_ua(&ucast->count);
+        len -= WPA_IE_SUITE_COUNT_LEN;
+        for (i = 0; i < count && len >= WPA_SUITE_LEN;
+                i++, len -= WPA_SUITE_LEN) {
+                if (!bcmp(ucast->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+                        if (IS_WPA_CIPHER(ucast->list[i].type)) {
+                                tmp = 0;
+                                switch (ucast->list[i].type) {
+                                        case WPA_CIPHER_NONE:
+                                                tmp = 0;
+                                                break;
+                                        case WPA_CIPHER_WEP_40:
+                                        case WPA_CIPHER_WEP_104:
+                                                tmp = WEP_ENABLED;
+                                                break;
+                                        case WPA_CIPHER_TKIP:
+                                                tmp = TKIP_ENABLED;
+                                                break;
+                                        case WPA_CIPHER_AES_CCM:
+                                                tmp = AES_ENABLED;
+                                                break;
+                                        default:
+                                                WL_ERR(("No Security Info\n"));
+                                }
+                                pval |= tmp;
+                        }
+                }
+        }
+        len -= (count - i) * WPA_SUITE_LEN;
+        /* Check for auth key management suite(s) */
+        if (len < WPA_IE_SUITE_COUNT_LEN) {
+                WL_INFO((" no auth key mgmt suite\n"));
+                goto exit;
+        }
+        /* walk thru auth management suite list and pick up what we recognize */
+        mgmt = (wpa_suite_auth_key_mgmt_t *)&ucast->list[count];
+        count = ltoh16_ua(&mgmt->count);
+        len -= WPA_IE_SUITE_COUNT_LEN;
+        for (i = 0; i < count && len >= WPA_SUITE_LEN;
+                i++, len -= WPA_SUITE_LEN) {
+                if (!bcmp(mgmt->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+                        if (IS_WPA_AKM(mgmt->list[i].type)) {
+                                tmp = 0;
+                                switch (mgmt->list[i].type) {
+                                        case RSN_AKM_NONE:
+                                                tmp = WPA_AUTH_NONE;
+                                                break;
+                                        case RSN_AKM_UNSPECIFIED:
+                                                tmp = WPA_AUTH_UNSPECIFIED;
+                                                break;
+                                        case RSN_AKM_PSK:
+                                                tmp = WPA_AUTH_PSK;
+                                                break;
+                                        default:
+                                                WL_ERR(("No Key Mgmt Info\n"));
+                                }
+                                wpa_auth |= tmp;
+                        }
+                }
+
+        }
+        /* FOR WPS , set SEC_OW_ENABLED */
+        wsec = (pval | gval | SES_OW_ENABLED);
+        /* set auth */
+        err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+        if (err < 0) {
+                WL_ERR(("auth error %d\n", err));
+                return BCME_ERROR;
+        }
+        /* set wsec */
+        err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+        if (err < 0) {
+                WL_ERR(("wsec error %d\n", err));
+                return BCME_ERROR;
+        }
+        /* set upper-layer auth */
+        err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+        if (err < 0) {
+                WL_ERR(("wpa_auth error %d\n", err));
+                return BCME_ERROR;
+        }
+exit:
+        return 0;
+}
+
+static s32
+wl_cfg80211_add_set_beacon(struct wiphy *wiphy, struct net_device *dev,
+        struct beacon_parameters *info)
+{
+        s32 err = BCME_OK;
+        bcm_tlv_t *ssid_ie;
+        wlc_ssid_t ssid;
+        struct wl_priv *wl = wiphy_priv(wiphy);
+        struct wl_join_params join_params;
+        wpa_ie_fixed_t *wps_ie;
+        wpa_ie_fixed_t *wpa_ie;
+        bcm_tlv_t *wpa2_ie;
+        wifi_p2p_ie_t *p2p_ie;
+        bool is_bssup = false;
+        bool update_bss = false;
+        bool pbc = false;
+        u16 wpsie_len = 0;
+        u16 p2pie_len = 0;
+        u8 beacon_ie[IE_MAX_LEN];
+        s32 ie_offset = 0;
+        s32 bssidx = wl_cfgp2p_find_idx(wl, dev);
+        s32 infra = 1;
+        s32 join_params_size = 0;
+        s32 ap = 0;
+        WL_DBG(("interval (%d) dtim_period (%d) head_len (%d) tail_len (%d)\n",
+                info->interval, info->dtim_period, info->head_len, info->tail_len));
+        if (wl->p2p_supported && p2p_on(wl) &&
+                (bssidx == wl_to_p2p_bss_bssidx(wl,
+                P2PAPI_BSSCFG_CONNECTION))) {
+                memset(beacon_ie, 0, sizeof(beacon_ie));
+                /* We don't need to set beacon for P2P_GO,
+                 * but need to parse ssid from beacon_parameters
+                 * because there is no way to set ssid
+                 */
+                ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
+                /* find the SSID */
+                if ((ssid_ie = bcm_parse_tlvs((u8 *)&info->head[ie_offset],
+                        info->head_len - ie_offset,
+                        DOT11_MNG_SSID_ID)) != NULL) {
+                        memcpy(wl->p2p->ssid.SSID, ssid_ie->data, ssid_ie->len);
+                        wl->p2p->ssid.SSID_len = ssid_ie->len;
+                        WL_DBG(("SSID (%s) in Head \n", ssid_ie->data));
+
+                } else {
+                        WL_ERR(("No SSID in beacon \n"));
+                }
+
+                /* find the WPSIE */
+                if ((wps_ie = wl_cfgp2p_find_wpsie((u8 *)info->tail, info->tail_len)) != NULL) {
+                        wpsie_len = wps_ie->length + WPA_RSN_IE_TAG_FIXED_LEN;
+                        /*
+                         * Should be compared with saved ie before saving it
+                         */
+                        wl_validate_wps_ie((char *) wps_ie, &pbc);
+                        memcpy(beacon_ie, wps_ie, wpsie_len);
+                } else {
+                        WL_ERR(("No WPSIE in beacon \n"));
+                }
+
+
+                /* find the P2PIE */
+                if ((p2p_ie = wl_cfgp2p_find_p2pie((u8 *)info->tail, info->tail_len)) != NULL) {
+                        /* Total length of P2P Information Element */
+                        p2pie_len = p2p_ie->len + sizeof(p2p_ie->len) + sizeof(p2p_ie->id);
+                #ifdef ENABLE_DRIVER_CHANGE_IFADDR /* We are now doing this in supplicant */
+                        /* Have to change device address in dev_id attribute because Supplicant
+                         * use primary eth0 address
+                         */
+                        wl_cfg80211_change_ifaddr((u8 *)p2p_ie, &wl->p2p_dev_addr, P2P_SEID_DEV_ID);
+                #endif
+                        memcpy(&beacon_ie[wpsie_len], p2p_ie, p2pie_len);
+
+                } else {
+                        WL_ERR(("No P2PIE in beacon \n"));
+                }
+                /* add WLC_E_PROBREQ_MSG event to respose probe_request from STA */
+                wl_dongle_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, pbc);
+                wl_cfgp2p_set_management_ie(wl, dev, bssidx, VNDR_IE_BEACON_FLAG,
+                        beacon_ie, wpsie_len + p2pie_len);
+
+                /* find the RSN_IE */
+                if ((wpa2_ie = bcm_parse_tlvs((u8 *)info->tail, info->tail_len,
+                        DOT11_MNG_RSN_ID)) != NULL) {
+                        WL_DBG((" WPA2 IE is found\n"));
+                }
+                is_bssup = wl_cfgp2p_bss_isup(dev, bssidx);
+
+                if (!is_bssup && (wpa2_ie != NULL)) {
+                        wldev_iovar_setint(dev, "mpc", 0);
+                        if ((err = wl_validate_wpa2ie(dev, wpa2_ie, bssidx)) < 0) {
+                                WL_ERR(("WPA2 IE parsing error"));
+                                goto exit;
+                        }
+                        err = wldev_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(s32), true);
+                        if (err < 0) {
+                                WL_ERR(("SET INFRA error %d\n", err));
+                                goto exit;
+                        }
+                        err = wldev_iovar_setbuf_bsscfg(dev, "ssid", &wl->p2p->ssid,
+                                sizeof(wl->p2p->ssid), ioctlbuf, sizeof(ioctlbuf), bssidx);
+                        if (err < 0) {
+                                WL_ERR(("GO SSID setting error %d\n", err));
+                                goto exit;
+                        }
+                        if ((err = wl_cfgp2p_bss(dev, bssidx, 1)) < 0) {
+                                WL_ERR(("GO Bring up error %d\n", err));
+                                goto exit;
+                        }
+                }
+        } else if (wl_get_drv_status(wl, AP_CREATING)) {
+                ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
+                ap = 1;
+                /* find the SSID */
+                if ((ssid_ie = bcm_parse_tlvs((u8 *)&info->head[ie_offset],
+                        info->head_len - ie_offset,
+                        DOT11_MNG_SSID_ID)) != NULL) {
+                        memset(&ssid, 0, sizeof(wlc_ssid_t));
+                        memcpy(ssid.SSID, ssid_ie->data, ssid_ie->len);
+                        WL_DBG(("SSID is (%s) in Head \n", ssid.SSID));
+                        ssid.SSID_len = ssid_ie->len;
+                        wldev_iovar_setint(dev, "mpc", 0);
+                        wldev_ioctl(dev, WLC_DOWN, &ap, sizeof(s32), true);
+                        wldev_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(s32), true);
+                        if ((err = wldev_ioctl(dev, WLC_SET_AP, &ap, sizeof(s32), true)) < 0) {
+                                WL_ERR(("setting AP mode failed %d \n", err));
+                                return err;
+                        }
+                        /* find the RSN_IE */
+                        if ((wpa2_ie = bcm_parse_tlvs((u8 *)info->tail, info->tail_len,
+                                DOT11_MNG_RSN_ID)) != NULL) {
+                                WL_DBG((" WPA2 IE is found\n"));
+                        }
+                        /* find the WPA_IE */
+                        if ((wpa_ie = wl_cfgp2p_find_wpaie((u8 *)info->tail,
+                        info->tail_len)) != NULL) {
+                                WL_DBG((" WPA IE is found\n"));
+                        }
+                        if ((wpa_ie != NULL || wpa2_ie != NULL)) {
+                                if (wl_validate_wpa2ie(dev, wpa2_ie, bssidx)  < 0 ||
+                                        wl_validate_wpaie(dev, wpa_ie, bssidx) < 0) {
+                                        wl->ap_info->security_mode = false;
+                                        return BCME_ERROR;
+                                }
+                                wl->ap_info->security_mode = true;
+                                if (wl->ap_info->rsn_ie) {
+                                        kfree(wl->ap_info->rsn_ie);
+                                        wl->ap_info->rsn_ie = NULL;
+                                }
+                                if (wl->ap_info->wpa_ie) {
+                                        kfree(wl->ap_info->wpa_ie);
+                                        wl->ap_info->wpa_ie = NULL;
+                                }
+                                if (wl->ap_info->wps_ie) {
+                                        kfree(wl->ap_info->wps_ie);
+                                        wl->ap_info->wps_ie = NULL;
+                                }
+                                if (wpa_ie != NULL) {
+                                        /* WPAIE */
+                                        wl->ap_info->rsn_ie = NULL;
+                                        wl->ap_info->wpa_ie = kmemdup(wpa_ie,
+                                                wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+                                                GFP_KERNEL);
+                                } else {
+                                        /* RSNIE */
+                                        wl->ap_info->wpa_ie = NULL;
+                                        wl->ap_info->rsn_ie = kmemdup(wpa2_ie,
+                                                wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+                                                GFP_KERNEL);
+                                }
+                        } else
+                                wl->ap_info->security_mode = false;
+                        /* find the WPSIE */
+                        if ((wps_ie = wl_cfgp2p_find_wpsie((u8 *)info->tail,
+                                info->tail_len)) != NULL) {
+                                wpsie_len = wps_ie->length +WPA_RSN_IE_TAG_FIXED_LEN;
+                                /*
+                                * Should be compared with saved ie before saving it
+                                */
+                                wl_validate_wps_ie((char *) wps_ie, &pbc);
+                                memcpy(beacon_ie, wps_ie, wpsie_len);
+                                wl_cfgp2p_set_management_ie(wl, dev, bssidx, VNDR_IE_BEACON_FLAG,
+                                beacon_ie, wpsie_len);
+                                wl->ap_info->wps_ie = kmemdup(wps_ie,   wpsie_len, GFP_KERNEL);
+                                /* add WLC_E_PROBREQ_MSG event to respose probe_request from STA */
+                                wl_dongle_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, pbc);
+                        } else {
+                                WL_DBG(("No WPSIE in beacon \n"));
+                        }
+                        if (info->interval) {
+                                if ((err = wldev_ioctl(dev, WLC_SET_BCNPRD,
+                                        &info->interval, sizeof(s32), true)) < 0) {
+                                        WL_ERR(("Beacon Interval Set Error, %d\n", err));
+                                        return err;
+                                }
+                        }
+                        if (info->dtim_period) {
+                                if ((err = wldev_ioctl(dev, WLC_SET_DTIMPRD,
+                                        &info->dtim_period, sizeof(s32), true)) < 0) {
+                                        WL_ERR(("DTIM Interval Set Error, %d\n", err));
+                                        return err;
+                                }
+                        }
+                        err = wldev_ioctl(dev, WLC_UP, &ap, sizeof(s32), true);
+                        if (unlikely(err)) {
+                                WL_ERR(("WLC_UP error (%d)\n", err));
+                                return err;
+                        }
+                        memset(&join_params, 0, sizeof(join_params));
+                        /* join parameters starts with ssid */
+                        join_params_size = sizeof(join_params.ssid);
+                        memcpy(join_params.ssid.SSID, ssid.SSID, ssid.SSID_len);
+                        join_params.ssid.SSID_len = htod32(ssid.SSID_len);
+                        /* create softap */
+                        if ((err = wldev_ioctl(dev, WLC_SET_SSID, &join_params,
+                                join_params_size, true)) == 0) {
+                                wl_clr_drv_status(wl, AP_CREATING);
+                                wl_set_drv_status(wl, AP_CREATED);
+                        }
+                }
+        } else if (wl_get_drv_status(wl, AP_CREATED)) {
+                ap = 1;
+                /* find the WPSIE */
+                if ((wps_ie = wl_cfgp2p_find_wpsie((u8 *)info->tail, info->tail_len)) != NULL) {
+                        wpsie_len = wps_ie->length + WPA_RSN_IE_TAG_FIXED_LEN;
+                        /*
+                         * Should be compared with saved ie before saving it
+                         */
+                        wl_validate_wps_ie((char *) wps_ie, &pbc);
+                        memcpy(beacon_ie, wps_ie, wpsie_len);
+                        wl_cfgp2p_set_management_ie(wl, dev, bssidx, VNDR_IE_BEACON_FLAG,
+                        beacon_ie, wpsie_len);
+                        if (wl->ap_info->wps_ie &&
+                                memcmp(wl->ap_info->wps_ie, wps_ie, wpsie_len)) {
+                                WL_DBG((" WPS IE is changed\n"));
+                                kfree(wl->ap_info->wps_ie);
+                                wl->ap_info->wps_ie = kmemdup(wps_ie,   wpsie_len, GFP_KERNEL);
+                                /* add WLC_E_PROBREQ_MSG event to respose probe_request from STA */
+                                wl_dongle_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, pbc);
+                        } else if (wl->ap_info->wps_ie == NULL) {
+                                WL_DBG((" WPS IE is added\n"));
+                                wl->ap_info->wps_ie = kmemdup(wps_ie,   wpsie_len, GFP_KERNEL);
+                                /* add WLC_E_PROBREQ_MSG event to respose probe_request from STA */
+                                wl_dongle_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, pbc);
+                        }
+                        /* find the RSN_IE */
+                        if ((wpa2_ie = bcm_parse_tlvs((u8 *)info->tail, info->tail_len,
+                                DOT11_MNG_RSN_ID)) != NULL) {
+                                WL_DBG((" WPA2 IE is found\n"));
+                        }
+                        /* find the WPA_IE */
+                        if ((wpa_ie = wl_cfgp2p_find_wpaie((u8 *)info->tail,
+                                info->tail_len)) != NULL) {
+                                WL_DBG((" WPA IE is found\n"));
+                        }
+                        if ((wpa_ie != NULL || wpa2_ie != NULL)) {
+                                if (!wl->ap_info->security_mode) {
+                                        /* change from open mode to security mode */
+                                        update_bss = true;
+                                        if (wpa_ie != NULL) {
+                                                wl->ap_info->wpa_ie = kmemdup(wpa_ie,
+                                                wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+                                                GFP_KERNEL);
+                                        } else {
+                                                wl->ap_info->rsn_ie = kmemdup(wpa2_ie,
+                                                wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+                                                GFP_KERNEL);
+                                        }
+                                } else if (wl->ap_info->wpa_ie) {
+                                        /* change from WPA mode to WPA2 mode */
+                                        if (wpa2_ie != NULL) {
+                                                update_bss = true;
+                                                kfree(wl->ap_info->wpa_ie);
+                                                wl->ap_info->rsn_ie = kmemdup(wpa2_ie,
+                                                wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+                                                GFP_KERNEL);
+                                                wl->ap_info->wpa_ie = NULL;
+                                        }
+                                        else if (memcmp(wl->ap_info->wpa_ie,
+                                                wpa_ie, wpa_ie->length +
+                                                WPA_RSN_IE_TAG_FIXED_LEN)) {
+                                                kfree(wl->ap_info->wpa_ie);
+                                                update_bss = true;
+                                                wl->ap_info->wpa_ie = kmemdup(wpa_ie,
+                                                wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+                                                GFP_KERNEL);
+                                                wl->ap_info->rsn_ie = NULL;
+                                        }
+                                } else {
+                                        /* change from WPA2 mode to WPA mode */
+                                        if (wpa_ie != NULL) {
+                                                update_bss = true;
+                                                kfree(wl->ap_info->rsn_ie);
+                                                wl->ap_info->rsn_ie = NULL;
+                                                wl->ap_info->wpa_ie = kmemdup(wpa_ie,
+                                                wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+                                                GFP_KERNEL);
+                                        } else if (memcmp(wl->ap_info->rsn_ie,
+                                                wpa2_ie, wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN)) {
+                                                update_bss = true;
+                                                kfree(wl->ap_info->rsn_ie);
+                                                wl->ap_info->rsn_ie = kmemdup(wpa2_ie,
+                                                wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+                                                GFP_KERNEL);
+                                                wl->ap_info->wpa_ie = NULL;
+                                        }
+                                }
+                                if (update_bss) {
+                                        wl->ap_info->security_mode = true;
+                                        wl_cfgp2p_bss(dev, bssidx, 0);
+                                        if (wl_validate_wpa2ie(dev, wpa2_ie, bssidx)  < 0 ||
+                                                wl_validate_wpaie(dev, wpa_ie, bssidx) < 0) {
+                                                return BCME_ERROR;
+                                        }
+                                        wl_cfgp2p_bss(dev, bssidx, 1);
+                                }
+                        }
+                } else {
+                        WL_ERR(("No WPSIE in beacon \n"));
+                }
+        }
+exit:
+        if (err)
+                wldev_iovar_setint(dev, "mpc", 1);
+        return err;
+}
+
+static struct cfg80211_ops wl_cfg80211_ops = {
+        .add_virtual_intf = wl_cfg80211_add_virtual_iface,
+        .del_virtual_intf = wl_cfg80211_del_virtual_iface,
+        .change_virtual_intf = wl_cfg80211_change_virtual_iface,
+        .scan = wl_cfg80211_scan,
+        .set_wiphy_params = wl_cfg80211_set_wiphy_params,
+        .join_ibss = wl_cfg80211_join_ibss,
+        .leave_ibss = wl_cfg80211_leave_ibss,
+        .get_station = wl_cfg80211_get_station,
+        .set_tx_power = wl_cfg80211_set_tx_power,
+        .get_tx_power = wl_cfg80211_get_tx_power,
+        .add_key = wl_cfg80211_add_key,
+        .del_key = wl_cfg80211_del_key,
+        .get_key = wl_cfg80211_get_key,
+        .set_default_key = wl_cfg80211_config_default_key,
+        .set_default_mgmt_key = wl_cfg80211_config_default_mgmt_key,
+        .set_power_mgmt = wl_cfg80211_set_power_mgmt,
+        .connect = wl_cfg80211_connect,
+        .disconnect = wl_cfg80211_disconnect,
+        .suspend = wl_cfg80211_suspend,
+        .resume = wl_cfg80211_resume,
+        .set_pmksa = wl_cfg80211_set_pmksa,
+        .del_pmksa = wl_cfg80211_del_pmksa,
+        .flush_pmksa = wl_cfg80211_flush_pmksa,
+        .remain_on_channel = wl_cfg80211_remain_on_channel,
+        .cancel_remain_on_channel = wl_cfg80211_cancel_remain_on_channel,
+        .mgmt_tx = wl_cfg80211_mgmt_tx,
+        .mgmt_frame_register = wl_cfg80211_mgmt_frame_register,
+        .change_bss = wl_cfg80211_change_bss,
+        .set_channel = wl_cfg80211_set_channel,
+        .set_beacon = wl_cfg80211_add_set_beacon,
+        .add_beacon = wl_cfg80211_add_set_beacon,
+};
+
+static s32 wl_mode_to_nl80211_iftype(s32 mode)
+{
+        s32 err = 0;
+
+        switch (mode) {
+        case WL_MODE_BSS:
+                return NL80211_IFTYPE_STATION;
+        case WL_MODE_IBSS:
+                return NL80211_IFTYPE_ADHOC;
+        case WL_MODE_AP:
+                return NL80211_IFTYPE_AP;
+        default:
+                return NL80211_IFTYPE_UNSPECIFIED;
+        }
+
+        return err;
+}
+
+static struct wireless_dev *wl_alloc_wdev(struct device *sdiofunc_dev)
+{
+        struct wireless_dev *wdev;
+        s32 err = 0;
+        wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+        if (unlikely(!wdev)) {
+                WL_ERR(("Could not allocate wireless device\n"));
+                return ERR_PTR(-ENOMEM);
+        }
+        wdev->wiphy =
+            wiphy_new(&wl_cfg80211_ops, sizeof(struct wl_priv));
+        if (unlikely(!wdev->wiphy)) {
+                WL_ERR(("Couldn not allocate wiphy device\n"));
+                err = -ENOMEM;
+                goto wiphy_new_out;
+        }
+        set_wiphy_dev(wdev->wiphy, sdiofunc_dev);
+        wdev->wiphy->max_scan_ie_len = WL_SCAN_IE_LEN_MAX;
+        /* Report  how many SSIDs Driver can support per Scan request */
+        wdev->wiphy->max_scan_ssids = WL_SCAN_PARAMS_SSID_MAX;
+        wdev->wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
+        wdev->wiphy->interface_modes =
+            BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC)
+            | BIT(NL80211_IFTYPE_AP) | BIT(NL80211_IFTYPE_MONITOR);
+
+        wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
+        wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_a;
+        wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+        wdev->wiphy->cipher_suites = __wl_cipher_suites;
+        wdev->wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
+        wdev->wiphy->max_remain_on_channel_duration = 5000;
+        wdev->wiphy->mgmt_stypes = wl_cfg80211_default_mgmt_stypes;
+#ifndef WL_POWERSAVE_DISABLED
+        wdev->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#else
+        wdev->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#endif                          /* !WL_POWERSAVE_DISABLED */
+        wdev->wiphy->flags |= WIPHY_FLAG_NETNS_OK |
+                WIPHY_FLAG_4ADDR_AP |
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)
+                WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS |
+#endif
+                WIPHY_FLAG_4ADDR_STATION;
+
+        WL_DBG(("Registering custom regulatory)\n"));
+        wdev->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+        wiphy_apply_custom_regulatory(wdev->wiphy, &brcm_regdom);
+        /* Now we can register wiphy with cfg80211 module */
+        err = wiphy_register(wdev->wiphy);
+        if (unlikely(err < 0)) {
+                WL_ERR(("Couldn not register wiphy device (%d)\n", err));
+                goto wiphy_register_out;
+        }
+        return wdev;
+
+wiphy_register_out:
+        wiphy_free(wdev->wiphy);
+
+wiphy_new_out:
+        kfree(wdev);
+
+        return ERR_PTR(err);
+}
+
+static void wl_free_wdev(struct wl_priv *wl)
+{
+        int i;
+        struct wireless_dev *wdev = wl->wdev;
+
+        if (unlikely(!wdev)) {
+                WL_ERR(("wdev is invalid\n"));
+                return;
+        }
+
+        for (i = 0; i < VWDEV_CNT; i++) {
+                if ((wl->vwdev[i] != NULL)) {
+                        kfree(wl->vwdev[i]);
+                        wl->vwdev[i] = NULL;
+                }
+        }
+        wiphy_unregister(wdev->wiphy);
+        wdev->wiphy->dev.parent = NULL;
+        wiphy_free(wdev->wiphy);
+        kfree(wdev);
+}
+
+static s32 wl_inform_bss(struct wl_priv *wl)
+{
+        struct wl_scan_results *bss_list;
+        struct wl_bss_info *bi = NULL;  /* must be initialized */
+        s32 err = 0;
+        s32 i;
+
+        bss_list = wl->bss_list;
+        WL_DBG(("scanned AP count (%d)\n", bss_list->count));
+        bi = next_bss(bss_list, bi);
+        for_each_bss(bss_list, bi, i) {
+                err = wl_inform_single_bss(wl, bi);
+                if (unlikely(err))
+                        break;
+        }
+        return err;
+}
+
+static s32 wl_inform_single_bss(struct wl_priv *wl, struct wl_bss_info *bi)
+{
+        struct wiphy *wiphy = wiphy_from_scan(wl);
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_channel *channel;
+        struct ieee80211_supported_band *band;
+        struct wl_cfg80211_bss_info *notif_bss_info;
+        struct wl_scan_req *sr = wl_to_sr(wl);
+        struct beacon_proberesp *beacon_proberesp;
+        s32 mgmt_type;
+        s32 signal;
+        u32 freq;
+        s32 err = 0;
+
+        if (unlikely(dtoh32(bi->length) > WL_BSS_INFO_MAX)) {
+                WL_DBG(("Beacon is larger than buffer. Discarding\n"));
+                return err;
+        }
+        notif_bss_info = kzalloc(sizeof(*notif_bss_info) + sizeof(*mgmt)
+                - sizeof(u8) + WL_BSS_INFO_MAX, GFP_KERNEL);
+        if (unlikely(!notif_bss_info)) {
+                WL_ERR(("notif_bss_info alloc failed\n"));
+                return -ENOMEM;
+        }
+        mgmt = (struct ieee80211_mgmt *)notif_bss_info->frame_buf;
+        notif_bss_info->channel =
+                bi->ctl_ch ? bi->ctl_ch : CHSPEC_CHANNEL(bi->chanspec);
+
+        if (notif_bss_info->channel <= CH_MAX_2G_CHANNEL)
+                band = wiphy->bands[IEEE80211_BAND_2GHZ];
+        else
+                band = wiphy->bands[IEEE80211_BAND_5GHZ];
+        notif_bss_info->rssi = dtoh16(bi->RSSI);
+        memcpy(mgmt->bssid, &bi->BSSID, ETHER_ADDR_LEN);
+        mgmt_type = wl->active_scan ?
+                IEEE80211_STYPE_PROBE_RESP : IEEE80211_STYPE_BEACON;
+        if (!memcmp(bi->SSID, sr->ssid.SSID, bi->SSID_len)) {
+            mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | mgmt_type);
+        }
+        beacon_proberesp = wl->active_scan ?
+                (struct beacon_proberesp *)&mgmt->u.probe_resp :
+                (struct beacon_proberesp *)&mgmt->u.beacon;
+        beacon_proberesp->timestamp = 0;
+        beacon_proberesp->beacon_int = cpu_to_le16(bi->beacon_period);
+        beacon_proberesp->capab_info = cpu_to_le16(bi->capability);
+        wl_rst_ie(wl);
+
+        wl_mrg_ie(wl, ((u8 *) bi) + bi->ie_offset, bi->ie_length);
+        wl_cp_ie(wl, beacon_proberesp->variable, WL_BSS_INFO_MAX -
+                offsetof(struct wl_cfg80211_bss_info, frame_buf));
+        notif_bss_info->frame_len = offsetof(struct ieee80211_mgmt,
+                u.beacon.variable) + wl_get_ielen(wl);
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+        freq = ieee80211_channel_to_frequency(notif_bss_info->channel);
+#else
+        freq = ieee80211_channel_to_frequency(notif_bss_info->channel, band->band);
+#endif
+        channel = ieee80211_get_channel(wiphy, freq);
+
+        WL_DBG(("SSID : \"%s\", rssi %d, channel %d, capability : 0x04%x, bssid %pM"
+                        "mgmt_type %d frame_len %d\n", bi->SSID,
+                        notif_bss_info->rssi, notif_bss_info->channel,
+                        mgmt->u.beacon.capab_info, &bi->BSSID, mgmt_type,
+                        notif_bss_info->frame_len));
+
+        signal = notif_bss_info->rssi * 100;
+
+        if (unlikely(!cfg80211_inform_bss_frame(wiphy, channel, mgmt,
+                le16_to_cpu(notif_bss_info->frame_len),
+                signal, GFP_KERNEL))) {
+                WL_ERR(("cfg80211_inform_bss_frame error\n"));
+                kfree(notif_bss_info);
+                return -EINVAL;
+        }
+        kfree(notif_bss_info);
+
+        return err;
+}
+
+static bool wl_is_linkup(struct wl_priv *wl, const wl_event_msg_t *e, struct net_device *ndev)
+{
+        u32 event = ntoh32(e->event_type);
+        u32 status =  ntoh32(e->status);
+        u16 flags = ntoh16(e->flags);
+
+        WL_DBG(("event %d, status %d\n", event, status));
+        if (event == WLC_E_SET_SSID) {
+                if (status == WLC_E_STATUS_SUCCESS) {
+                        if (!wl_is_ibssmode(wl, ndev))
+                                return true;
+                }
+        } else if (event == WLC_E_LINK) {
+                if (flags & WLC_EVENT_MSG_LINK)
+                        return true;
+        }
+
+        WL_DBG(("wl_is_linkup false\n"));
+        return false;
+}
+
+static bool wl_is_linkdown(struct wl_priv *wl, const wl_event_msg_t *e)
+{
+        u32 event = ntoh32(e->event_type);
+        u16 flags = ntoh16(e->flags);
+
+        if (event == WLC_E_DEAUTH_IND ||
+        event == WLC_E_DISASSOC_IND ||
+        event == WLC_E_DISASSOC ||
+        event == WLC_E_DEAUTH) {
+                return true;
+        } else if (event == WLC_E_LINK) {
+                if (!(flags & WLC_EVENT_MSG_LINK))
+                        return true;
+        }
+
+        return false;
+}
+
+static bool wl_is_nonetwork(struct wl_priv *wl, const wl_event_msg_t *e)
+{
+        u32 event = ntoh32(e->event_type);
+        u32 status = ntoh32(e->status);
+
+        if (event == WLC_E_LINK && status == WLC_E_STATUS_NO_NETWORKS)
+                return true;
+        if (event == WLC_E_SET_SSID && status != WLC_E_STATUS_SUCCESS)
+                return true;
+
+        return false;
+}
+
+static s32
+wl_notify_connect_status(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data)
+{
+        bool act;
+        bool isfree = false;
+        s32 err = 0;
+        s32 freq;
+        s32 channel;
+        u8 body[200];
+        u32 event = ntoh32(e->event_type);
+        u32 reason = ntoh32(e->reason);
+        u32 len = ntoh32(e->datalen);
+        u16 fc = 0;
+        u8 *mgmt_frame;
+        u8 bsscfgidx = e->bsscfgidx;
+        struct ieee80211_supported_band *band;
+        struct ether_addr da;
+        struct ether_addr bssid;
+        struct wiphy *wiphy = wl_to_wiphy(wl);
+        channel_info_t ci;
+
+        memset(body, 0, sizeof(body));
+        memset(&bssid, 0, ETHER_ADDR_LEN);
+        WL_DBG(("Enter \n"));
+
+        if (get_mode_by_netdev(wl, ndev) == WL_MODE_AP) {
+                memcpy(body, data, len);
+                wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+                NULL, 0, ioctlbuf, sizeof(ioctlbuf), bsscfgidx);
+                memcpy(da.octet, ioctlbuf, ETHER_ADDR_LEN);
+                err = wldev_ioctl(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false);
+                switch (event) {
+                        case WLC_E_ASSOC_IND:
+                                fc = FC_ASSOC_REQ;
+                                break;
+                        case WLC_E_REASSOC_IND:
+                                fc = FC_REASSOC_REQ;
+                                break;
+                        case WLC_E_DISASSOC_IND:
+                                fc = FC_DISASSOC;
+                                break;
+                        case WLC_E_DEAUTH_IND:
+                                fc = FC_DISASSOC;
+                                break;
+                        case WLC_E_DEAUTH:
+                                fc = FC_DISASSOC;
+                                break;
+                        default:
+                                fc = 0;
+                                goto exit;
+                }
+                if ((err = wldev_ioctl(ndev, WLC_GET_CHANNEL, &ci, sizeof(ci), false)))
+                        return err;
+
+                channel = dtoh32(ci.hw_channel);
+                if (channel <= CH_MAX_2G_CHANNEL)
+                        band = wiphy->bands[IEEE80211_BAND_2GHZ];
+                else
+                        band = wiphy->bands[IEEE80211_BAND_5GHZ];
+
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+                freq = ieee80211_channel_to_frequency(channel);
+#else
+                freq = ieee80211_channel_to_frequency(channel, band->band);
+#endif
+
+                err = wl_frame_get_mgmt(fc, &da, &e->addr, &bssid,
+                &mgmt_frame, &len, body);
+                if (err < 0)
+                                goto exit;
+                isfree = true;
+
+                if (event == WLC_E_ASSOC_IND && reason == DOT11_SC_SUCCESS) {
+                        cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+                } else if (event == WLC_E_DISASSOC_IND) {
+                        cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+                } else if ((event == WLC_E_DEAUTH_IND) || (event == WLC_E_DEAUTH)) {
+                        cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+                }
+
+        } else {
+                WL_DBG(("wl_notify_connect_status : event %d status : %d \n",
+                ntoh32(e->event_type), ntoh32(e->status)));
+                if (wl_is_linkup(wl, e, ndev)) {
+                        wl_link_up(wl);
+                        act = true;
+                        wl_update_prof(wl, e, &act, WL_PROF_ACT);
+                        wl_update_prof(wl, NULL, (void *)(e->addr.octet), WL_PROF_BSSID);
+                        if (wl_is_ibssmode(wl, ndev)) {
+                                printk("cfg80211_ibss_joined\n");
+                                cfg80211_ibss_joined(ndev, (s8 *)&e->addr,
+                                        GFP_KERNEL);
+                                WL_DBG(("joined in IBSS network\n"));
+                        } else {
+                                if (!wl_get_drv_status(wl, DISCONNECTING)) {
+                                        printk("wl_bss_connect_done succeeded status=(0x%x)\n",
+                                                (int)wl->status);
+                                        wl_bss_connect_done(wl, ndev, e, data, true);
+                                        WL_DBG(("joined in BSS network \"%s\"\n",
+                                        ((struct wlc_ssid *)
+                                         wl_read_prof(wl, WL_PROF_SSID))->SSID));
+                                }
+                        }
+
+                } else if (wl_is_linkdown(wl, e)) {
+                        if (wl->scan_request) {
+                                del_timer_sync(&wl->scan_timeout);
+                                if (wl->escan_on) {
+                                        wl_notify_escan_complete(wl, true);
+                                } else
+                                        wl_iscan_aborted(wl);
+                        }
+                        if (wl_get_drv_status(wl, CONNECTED)) {
+                                scb_val_t scbval;
+                                u8 *curbssid = wl_read_prof(wl, WL_PROF_BSSID);
+                                printk("link down, call cfg80211_disconnected\n");
+                                wl_clr_drv_status(wl, CONNECTED);
+                                /* To make sure disconnect, explictly send dissassoc
+                                *  for BSSID 00:00:00:00:00:00 issue
+                                */
+                                scbval.val = WLAN_REASON_DEAUTH_LEAVING;
+
+                                memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+                                scbval.val = htod32(scbval.val);
+                                wldev_ioctl(ndev, WLC_DISASSOC, &scbval,
+                                        sizeof(scb_val_t), true);
+                                cfg80211_disconnected(ndev, 0, NULL, 0, GFP_KERNEL);
+                                wl_link_down(wl);
+                                wl_init_prof(wl);
+                        } else if (wl_get_drv_status(wl, CONNECTING)) {
+                                printk("link down, during connecting\n");
+                                wl_bss_connect_done(wl, ndev, e, data, false);
+                        }
+                        wl_clr_drv_status(wl, DISCONNECTING);
+
+                } else if (wl_is_nonetwork(wl, e)) {
+                        printk("connect failed event=%d e->status 0x%x\n",
+                                event, (int)ntoh32(e->status));
+                        /* Clean up any pending scan request */
+                        if (wl->scan_request) {
+                                del_timer_sync(&wl->scan_timeout);
+                                if (wl->escan_on) {
+                                        wl_notify_escan_complete(wl, true);
+                                } else
+                                        wl_iscan_aborted(wl);
+                        }
+                        if (wl_get_drv_status(wl, CONNECTING))
+                                wl_bss_connect_done(wl, ndev, e, data, false);
+                } else {
+                        printk("%s nothing\n", __FUNCTION__);
+                }
+        }
+exit:
+        if (isfree)
+                kfree(mgmt_frame);
+        return err;
+}
+
+static s32
+wl_notify_roaming_status(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data)
+{
+        bool act;
+        s32 err = 0;
+        u32 event = be32_to_cpu(e->event_type);
+        u32 status = be32_to_cpu(e->status);
+        WL_DBG(("Enter \n"));
+        if (event == WLC_E_ROAM && status == WLC_E_STATUS_SUCCESS) {
+                if (wl_get_drv_status(wl, CONNECTED))
+                        wl_bss_roaming_done(wl, ndev, e, data);
+                else
+                        wl_bss_connect_done(wl, ndev, e, data, true);
+                act = true;
+                wl_update_prof(wl, e, &act, WL_PROF_ACT);
+                wl_update_prof(wl, NULL, (void *)(e->addr.octet), WL_PROF_BSSID);
+        }
+        return err;
+}
+
+static __used s32
+wl_dev_bufvar_set(struct net_device *dev, s8 *name, s8 *buf, s32 len)
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        u32 buflen;
+
+        buflen = bcm_mkiovar(name, buf, len, wl->ioctl_buf, WL_IOCTL_LEN_MAX);
+        BUG_ON(unlikely(!buflen));
+
+        return wldev_ioctl(dev, WLC_SET_VAR, wl->ioctl_buf, buflen, true);
+}
+
+static s32
+wl_dev_bufvar_get(struct net_device *dev, s8 *name, s8 *buf,
+        s32 buf_len)
+{
+        struct wl_priv *wl = wlcfg_drv_priv;
+        u32 len;
+        s32 err = 0;
+
+        len = bcm_mkiovar(name, NULL, 0, wl->ioctl_buf, WL_IOCTL_LEN_MAX);
+        BUG_ON(unlikely(!len));
+        err = wldev_ioctl(dev, WLC_GET_VAR, (void *)wl->ioctl_buf,
+                WL_IOCTL_LEN_MAX, false);
+        if (unlikely(err)) {
+                WL_ERR(("error (%d)\n", err));
+                return err;
+        }
+        memcpy(buf, wl->ioctl_buf, buf_len);
+
+        return err;
+}
+
+static s32 wl_get_assoc_ies(struct wl_priv *wl, struct net_device *ndev)
+{
+        wl_assoc_info_t assoc_info;
+        struct wl_connect_info *conn_info = wl_to_conn(wl);
+        s32 err = 0;
+
+        WL_DBG(("Enter \n"));
+        err = wl_dev_bufvar_get(ndev, "assoc_info", wl->extra_buf,
+                WL_ASSOC_INFO_MAX);
+        if (unlikely(err)) {
+                WL_ERR(("could not get assoc info (%d)\n", err));
+                return err;
+        }
+        memcpy(&assoc_info, wl->extra_buf, sizeof(wl_assoc_info_t));
+        assoc_info.req_len = htod32(assoc_info.req_len);
+        assoc_info.resp_len = htod32(assoc_info.resp_len);
+        assoc_info.flags = htod32(assoc_info.flags);
+        if (conn_info->req_ie_len) {
+                conn_info->req_ie_len = 0;
+                bzero(conn_info->req_ie, sizeof(conn_info->req_ie));
+        }
+        if (conn_info->resp_ie_len) {
+                conn_info->resp_ie_len = 0;
+                bzero(conn_info->resp_ie, sizeof(conn_info->resp_ie));
+        }
+        if (assoc_info.req_len) {
+                err = wl_dev_bufvar_get(ndev, "assoc_req_ies", wl->extra_buf,
+                        WL_ASSOC_INFO_MAX);
+                if (unlikely(err)) {
+                        WL_ERR(("could not get assoc req (%d)\n", err));
+                        return err;
+                }
+                conn_info->req_ie_len = assoc_info.req_len - sizeof(struct dot11_assoc_req);
+                if (assoc_info.flags & WLC_ASSOC_REQ_IS_REASSOC) {
+                        conn_info->req_ie_len -= ETHER_ADDR_LEN;
+                }
+                if (conn_info->req_ie_len <= MAX_REQ_LINE)
+                        memcpy(conn_info->req_ie, wl->extra_buf, conn_info->req_ie_len);
+                else {
+                        WL_ERR(("%s IE size %d above max %d size \n",
+                                __FUNCTION__, conn_info->req_ie_len, MAX_REQ_LINE));
+                        return err;
+                }
+        } else {
+                conn_info->req_ie_len = 0;
+        }
+        if (assoc_info.resp_len) {
+                err = wl_dev_bufvar_get(ndev, "assoc_resp_ies", wl->extra_buf,
+                        WL_ASSOC_INFO_MAX);
+                if (unlikely(err)) {
+                        WL_ERR(("could not get assoc resp (%d)\n", err));
+                        return err;
+                }
+                conn_info->resp_ie_len = assoc_info.resp_len -sizeof(struct dot11_assoc_resp);
+                if (conn_info->resp_ie_len <= MAX_REQ_LINE)
+                        memcpy(conn_info->resp_ie, wl->extra_buf, conn_info->resp_ie_len);
+                else {
+                        WL_ERR(("%s IE size %d above max %d size \n",
+                                __FUNCTION__, conn_info->resp_ie_len, MAX_REQ_LINE));
+                        return err;
+                }
+        } else {
+                conn_info->resp_ie_len = 0;
+        }
+        WL_DBG(("req len (%d) resp len (%d)\n", conn_info->req_ie_len,
+                conn_info->resp_ie_len));
+
+        return err;
+}
+
+static void wl_ch_to_chanspec(int ch, struct wl_join_params *join_params,
+        size_t *join_params_size)
+{
+        chanspec_t chanspec = 0;
+
+        if (ch != 0) {
+                join_params->params.chanspec_num = 1;
+                join_params->params.chanspec_list[0] = ch;
+
+                if (join_params->params.chanspec_list[0] <= CH_MAX_2G_CHANNEL)
+                        chanspec |= WL_CHANSPEC_BAND_2G;
+                else
+                        chanspec |= WL_CHANSPEC_BAND_5G;
+
+                chanspec |= WL_CHANSPEC_BW_20;
+                chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+                *join_params_size += WL_ASSOC_PARAMS_FIXED_SIZE +
+                        join_params->params.chanspec_num * sizeof(chanspec_t);
+
+                join_params->params.chanspec_list[0]  &= WL_CHANSPEC_CHAN_MASK;
+                join_params->params.chanspec_list[0] |= chanspec;
+                join_params->params.chanspec_list[0] =
+                        htodchanspec(join_params->params.chanspec_list[0]);
+
+                join_params->params.chanspec_num =
+                        htod32(join_params->params.chanspec_num);
+
+                WL_DBG(("%s  join_params->params.chanspec_list[0]= %X\n",
+                        __FUNCTION__, join_params->params.chanspec_list[0]));
+
+        }
+}
+
+static s32 wl_update_bss_info(struct wl_priv *wl, struct net_device *ndev)
+{
+        struct cfg80211_bss *bss;
+        struct wl_bss_info *bi;
+        struct wlc_ssid *ssid;
+        struct bcm_tlv *tim;
+        u16 beacon_interval;
+        u8 dtim_period;
+        size_t ie_len;
+        u8 *ie;
+        u8 *curbssid;
+        s32 err = 0;
+        struct wiphy *wiphy;
+        wiphy = wl_to_wiphy(wl);
+
+        if (wl_is_ibssmode(wl, ndev))
+                return err;
+
+        ssid = (struct wlc_ssid *)wl_read_prof(wl, WL_PROF_SSID);
+        curbssid = wl_read_prof(wl, WL_PROF_BSSID);
+        bss = cfg80211_get_bss(wiphy, NULL, curbssid,
+                ssid->SSID, ssid->SSID_len, WLAN_CAPABILITY_ESS,
+                WLAN_CAPABILITY_ESS);
+
+        mutex_lock(&wl->usr_sync);
+        if (unlikely(!bss)) {
+                WL_DBG(("Could not find the AP\n"));
+                *(u32 *) wl->extra_buf = htod32(WL_EXTRA_BUF_MAX);
+                err = wldev_ioctl(ndev, WLC_GET_BSS_INFO,
+                        wl->extra_buf, WL_EXTRA_BUF_MAX, false);
+                if (unlikely(err)) {
+                        WL_ERR(("Could not get bss info %d\n", err));
+                        goto update_bss_info_out;
+                }
+                bi = (struct wl_bss_info *)(wl->extra_buf + 4);
+                if (memcmp(bi->BSSID.octet, curbssid, ETHER_ADDR_LEN)) {
+                        err = -EIO;
+                        goto update_bss_info_out;
+                }
+                err = wl_inform_single_bss(wl, bi);
+                if (unlikely(err))
+                        goto update_bss_info_out;
+
+                ie = ((u8 *)bi) + bi->ie_offset;
+                ie_len = bi->ie_length;
+                beacon_interval = cpu_to_le16(bi->beacon_period);
+        } else {
+                WL_DBG(("Found the AP in the list - BSSID %pM\n", bss->bssid));
+                ie = bss->information_elements;
+                ie_len = bss->len_information_elements;
+                beacon_interval = bss->beacon_interval;
+                cfg80211_put_bss(bss);
+        }
+
+        tim = bcm_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
+        if (tim) {
+                dtim_period = tim->data[1];
+        } else {
+                /*
+                * active scan was done so we could not get dtim
+                * information out of probe response.
+                * so we speficially query dtim information to dongle.
+                */
+                err = wldev_ioctl(ndev, WLC_GET_DTIMPRD,
+                        &dtim_period, sizeof(dtim_period), false);
+                if (unlikely(err)) {
+                        WL_ERR(("WLC_GET_DTIMPRD error (%d)\n", err));
+                        goto update_bss_info_out;
+                }
+        }
+
+        wl_update_prof(wl, NULL, &beacon_interval, WL_PROF_BEACONINT);
+        wl_update_prof(wl, NULL, &dtim_period, WL_PROF_DTIMPERIOD);
+
+update_bss_info_out:
+        mutex_unlock(&wl->usr_sync);
+        return err;
+}
+
+static s32
+wl_bss_roaming_done(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data)
+{
+        struct wl_connect_info *conn_info = wl_to_conn(wl);
+        s32 err = 0;
+        u8 *curbssid;
+
+        wl_get_assoc_ies(wl, ndev);
+        wl_update_prof(wl, NULL, (void *)(e->addr.octet), WL_PROF_BSSID);
+        curbssid = wl_read_prof(wl, WL_PROF_BSSID);
+        wl_update_bss_info(wl, ndev);
+        wl_update_pmklist(ndev, wl->pmk_list, err);
+        cfg80211_roamed(ndev,
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)
+                NULL,
+#endif
+                curbssid,
+                conn_info->req_ie, conn_info->req_ie_len,
+                conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
+        WL_DBG(("Report roaming result\n"));
+
+        wl_set_drv_status(wl, CONNECTED);
+
+        return err;
+}
+
+static s32
+wl_bss_connect_done(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data, bool completed)
+{
+        struct wl_connect_info *conn_info = wl_to_conn(wl);
+        s32 err = 0;
+        u8 *curbssid = wl_read_prof(wl, WL_PROF_BSSID);
+        WL_DBG((" enter\n"));
+        if (wl->scan_request) {
+                wl_cfg80211_scan_abort(wl, ndev);
+        }
+        if (wl_get_drv_status(wl, CONNECTING)) {
+                wl_clr_drv_status(wl, CONNECTING);
+                if (completed) {
+                        wl_get_assoc_ies(wl, ndev);
+                        wl_update_prof(wl, NULL, (void *)(e->addr.octet), WL_PROF_BSSID);
+                        curbssid = wl_read_prof(wl, WL_PROF_BSSID);
+                        wl_update_bss_info(wl, ndev);
+                        wl_update_pmklist(ndev, wl->pmk_list, err);
+                        wl_set_drv_status(wl, CONNECTED);
+                }
+                cfg80211_connect_result(ndev,
+                        curbssid,
+                        conn_info->req_ie,
+                        conn_info->req_ie_len,
+                        conn_info->resp_ie,
+                        conn_info->resp_ie_len,
+                        completed ? WLAN_STATUS_SUCCESS : WLAN_STATUS_AUTH_TIMEOUT,
+                        GFP_KERNEL);
+                if (completed)
+                        WL_INFO(("Report connect result - connection succeeded\n"));
+                else
+                        WL_ERR(("Report connect result - connection failed\n"));
+        }
+        return err;
+}
+
+static s32
+wl_notify_mic_status(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data)
+{
+        u16 flags = ntoh16(e->flags);
+        enum nl80211_key_type key_type;
+
+        mutex_lock(&wl->usr_sync);
+        if (flags & WLC_EVENT_MSG_GROUP)
+                key_type = NL80211_KEYTYPE_GROUP;
+        else
+                key_type = NL80211_KEYTYPE_PAIRWISE;
+
+        cfg80211_michael_mic_failure(ndev, (u8 *)&e->addr, key_type, -1,
+                NULL, GFP_KERNEL);
+        mutex_unlock(&wl->usr_sync);
+
+        return 0;
+}
+
+static s32
+wl_notify_scan_status(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data)
+{
+        struct channel_info channel_inform;
+        struct wl_scan_results *bss_list;
+        u32 len = WL_SCAN_BUF_MAX;
+        s32 err = 0;
+        unsigned long flags;
+
+        WL_DBG(("Enter \n"));
+        if (wl->iscan_on && wl->iscan_kickstart)
+                return wl_wakeup_iscan(wl_to_iscan(wl));
+
+        mutex_lock(&wl->usr_sync);
+        wl_clr_drv_status(wl, SCANNING);
+        err = wldev_ioctl(ndev, WLC_GET_CHANNEL, &channel_inform,
+                sizeof(channel_inform), false);
+        if (unlikely(err)) {
+                WL_ERR(("scan busy (%d)\n", err));
+                goto scan_done_out;
+        }
+        channel_inform.scan_channel = dtoh32(channel_inform.scan_channel);
+        if (unlikely(channel_inform.scan_channel)) {
+
+                WL_DBG(("channel_inform.scan_channel (%d)\n",
+                        channel_inform.scan_channel));
+        }
+        wl->bss_list = wl->scan_results;
+        bss_list = wl->bss_list;
+        memset(bss_list, 0, len);
+        bss_list->buflen = htod32(len);
+        err = wldev_ioctl(ndev, WLC_SCAN_RESULTS, bss_list, len, false);
+        if (unlikely(err)) {
+                WL_ERR(("%s Scan_results error (%d)\n", ndev->name, err));
+                err = -EINVAL;
+                goto scan_done_out;
+        }
+        bss_list->buflen = dtoh32(bss_list->buflen);
+        bss_list->version = dtoh32(bss_list->version);
+        bss_list->count = dtoh32(bss_list->count);
+
+        err = wl_inform_bss(wl);
+
+scan_done_out:
+        del_timer_sync(&wl->scan_timeout);
+        flags = dhd_os_spin_lock((dhd_pub_t *)(wl->pub));
+        if (wl->scan_request) {
+                WL_DBG(("cfg80211_scan_done\n"));
+                cfg80211_scan_done(wl->scan_request, false);
+                wl->scan_request = NULL;
+        }
+        dhd_os_spin_unlock((dhd_pub_t *)(wl->pub), flags);
+        mutex_unlock(&wl->usr_sync);
+        return err;
+}
+static s32
+wl_frame_get_mgmt(u16 fc, const struct ether_addr *da,
+        const struct ether_addr *sa, const struct ether_addr *bssid,
+        u8 **pheader, u32 *body_len, u8 *pbody)
+{
+        struct dot11_management_header *hdr;
+        u32 totlen = 0;
+        s32 err = 0;
+        u8 *offset;
+        u32 prebody_len = *body_len;
+        switch (fc) {
+                case FC_ASSOC_REQ:
+                        /* capability , listen interval */
+                        totlen = DOT11_ASSOC_REQ_FIXED_LEN;
+                        *body_len += DOT11_ASSOC_REQ_FIXED_LEN;
+                        break;
+
+                case FC_REASSOC_REQ:
+                        /* capability, listen inteval, ap address */
+                        totlen = DOT11_REASSOC_REQ_FIXED_LEN;
+                        *body_len += DOT11_REASSOC_REQ_FIXED_LEN;
+                        break;
+        }
+        totlen += DOT11_MGMT_HDR_LEN + prebody_len;
+        *pheader = kzalloc(totlen, GFP_KERNEL);
+        if (*pheader == NULL) {
+                WL_ERR(("memory alloc failed \n"));
+                return -ENOMEM;
+        }
+        hdr = (struct dot11_management_header *) (*pheader);
+        hdr->fc = htol16(fc);
+        hdr->durid = 0;
+        hdr->seq = 0;
+        offset = (u8*)(hdr + 1) + (totlen - DOT11_MGMT_HDR_LEN - prebody_len);
+        bcopy((const char*)da, (u8*)&hdr->da, ETHER_ADDR_LEN);
+        bcopy((const char*)sa, (u8*)&hdr->sa, ETHER_ADDR_LEN);
+        bcopy((const char*)bssid, (u8*)&hdr->bssid, ETHER_ADDR_LEN);
+        bcopy((const char*)pbody, offset, prebody_len);
+        *body_len = totlen;
+        return err;
+}
+static s32
+wl_notify_rx_mgmt_frame(struct wl_priv *wl, struct net_device *ndev,
+        const wl_event_msg_t *e, void *data)
+{
+        struct ieee80211_supported_band *band;
+        struct wiphy *wiphy = wl_to_wiphy(wl);
+        struct ether_addr da;
+        struct ether_addr bssid;
+        bool isfree = false;
+        s32 err = 0;
+        s32 freq;
+        wifi_p2p_pub_act_frame_t *act_frm;
+        wl_event_rx_frame_data_t *rxframe =
+                (wl_event_rx_frame_data_t*)data;
+        u32 event = ntoh32(e->event_type);
+        u8 *mgmt_frame;
+        u8 bsscfgidx = e->bsscfgidx;
+        u32 mgmt_frame_len = ntoh32(e->datalen) - sizeof(wl_event_rx_frame_data_t);
+        u16 channel = ((ntoh16(rxframe->channel) & WL_CHANSPEC_CHAN_MASK));
+
+        memset(&bssid, 0, ETHER_ADDR_LEN);
+        if (channel <= CH_MAX_2G_CHANNEL)
+                band = wiphy->bands[IEEE80211_BAND_2GHZ];
+        else
+                band = wiphy->bands[IEEE80211_BAND_5GHZ];
+
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+        freq = ieee80211_channel_to_frequency(channel);
+#else
+        freq = ieee80211_channel_to_frequency(channel, band->band);
+#endif
+        if (event == WLC_E_ACTION_FRAME_RX) {
+                wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+                NULL, 0, ioctlbuf, sizeof(ioctlbuf), bsscfgidx);
+
+                wldev_ioctl(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false);
+                memcpy(da.octet, ioctlbuf, ETHER_ADDR_LEN);
+                err = wl_frame_get_mgmt(FC_ACTION, &da, &e->addr, &bssid,
+                        &mgmt_frame, &mgmt_frame_len,
+                        (u8 *)((wl_event_rx_frame_data_t *)rxframe + 1));
+                if (err < 0) {
+                        WL_ERR(("%s: Error in receiving action frame len %d channel %d freq %d\n",
+                                __func__, mgmt_frame_len, channel, freq));
+                        goto exit;
+                }
+                isfree = true;
+                act_frm =
+                        (wifi_p2p_pub_act_frame_t *) (&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+                /*
+                 * After complete GO Negotiation, roll back to mpc mode
+                 */
+                 if (act_frm->subtype == P2P_PAF_GON_CONF) {
+                        wldev_iovar_setint(ndev, "mpc", 1);
+                }
+        } else {
+                mgmt_frame = (u8 *)((wl_event_rx_frame_data_t *)rxframe + 1);
+        }
+
+        cfg80211_rx_mgmt(ndev, freq, mgmt_frame, mgmt_frame_len, GFP_ATOMIC);
+
+        WL_DBG(("%s: mgmt_frame_len (%d) , e->datalen (%d), channel (%d), freq (%d)\n", __func__,
+                mgmt_frame_len, ntoh32(e->datalen), channel, freq));
+
+        if (isfree)
+                kfree(mgmt_frame);
+exit:
+        return 0;
+}
+
+static void wl_init_conf(struct wl_conf *conf)
+{
+        s32 i = 0;
+        WL_DBG(("Enter \n"));
+        for (i = 0; i <= VWDEV_CNT; i++) {
+                conf->mode[i].type = -1;
+                conf->mode[i].ndev = NULL;
+        }
+        conf->frag_threshold = (u32)-1;
+        conf->rts_threshold = (u32)-1;
+        conf->retry_short = (u32)-1;
+        conf->retry_long = (u32)-1;
+        conf->tx_power = -1;
+}
+
+static void wl_init_prof(struct wl_priv *wl)
+{
+        unsigned long flags;
+
+        flags = dhd_os_spin_lock((dhd_pub_t *)(wl->pub));
+        memset(wl->profile, 0, sizeof(struct wl_profile));
+        dhd_os_spin_unlock((dhd_pub_t *)(wl->pub), flags);
+}
+
+static void wl_init_event_handler(struct wl_priv *wl)
+{
+        memset(wl->evt_handler, 0, sizeof(wl->evt_handler));
+
+        wl->evt_handler[WLC_E_SCAN_COMPLETE] = wl_notify_scan_status;
+        wl->evt_handler[WLC_E_LINK] = wl_notify_connect_status;
+        wl->evt_handler[WLC_E_DEAUTH_IND] = wl_notify_connect_status;
+        wl->evt_handler[WLC_E_DEAUTH] = wl_notify_connect_status;
+        wl->evt_handler[WLC_E_DISASSOC_IND] = wl_notify_connect_status;
+        wl->evt_handler[WLC_E_ASSOC_IND] = wl_notify_connect_status;
+        wl->evt_handler[WLC_E_REASSOC_IND] = wl_notify_connect_status;
+        wl->evt_handler[WLC_E_ROAM] = wl_notify_roaming_status;
+        wl->evt_handler[WLC_E_MIC_ERROR] = wl_notify_mic_status;
+        wl->evt_handler[WLC_E_SET_SSID] = wl_notify_connect_status;
+        wl->evt_handler[WLC_E_ACTION_FRAME_RX] = wl_notify_rx_mgmt_frame;
+        wl->evt_handler[WLC_E_PROBREQ_MSG] = wl_notify_rx_mgmt_frame;
+        wl->evt_handler[WLC_E_P2P_PROBREQ_MSG] = wl_notify_rx_mgmt_frame;
+        wl->evt_handler[WLC_E_P2P_DISC_LISTEN_COMPLETE] = wl_cfgp2p_listen_complete;
+        wl->evt_handler[WLC_E_ACTION_FRAME_COMPLETE] = wl_cfgp2p_action_tx_complete;
+        wl->evt_handler[WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE] = wl_cfgp2p_action_tx_complete;
+
+}
+
+static s32 wl_init_priv_mem(struct wl_priv *wl)
+{
+        WL_DBG(("Enter \n"));
+        wl->scan_results = (void *)kzalloc(WL_SCAN_BUF_MAX, GFP_KERNEL);
+        if (unlikely(!wl->scan_results)) {
+                WL_ERR(("Scan results alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->conf = (void *)kzalloc(sizeof(*wl->conf), GFP_KERNEL);
+        if (unlikely(!wl->conf)) {
+                WL_ERR(("wl_conf alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->profile = (void *)kzalloc(sizeof(*wl->profile), GFP_KERNEL);
+        if (unlikely(!wl->profile)) {
+                WL_ERR(("wl_profile alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->bss_info = (void *)kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
+        if (unlikely(!wl->bss_info)) {
+                WL_ERR(("Bss information alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->scan_req_int =
+            (void *)kzalloc(sizeof(*wl->scan_req_int), GFP_KERNEL);
+        if (unlikely(!wl->scan_req_int)) {
+                WL_ERR(("Scan req alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->ioctl_buf = (void *)kzalloc(WL_IOCTL_LEN_MAX, GFP_KERNEL);
+        if (unlikely(!wl->ioctl_buf)) {
+                WL_ERR(("Ioctl buf alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->escan_ioctl_buf = (void *)kzalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+        if (unlikely(!wl->escan_ioctl_buf)) {
+                WL_ERR(("Ioctl buf alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->extra_buf = (void *)kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
+        if (unlikely(!wl->extra_buf)) {
+                WL_ERR(("Extra buf alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->iscan = (void *)kzalloc(sizeof(*wl->iscan), GFP_KERNEL);
+        if (unlikely(!wl->iscan)) {
+                WL_ERR(("Iscan buf alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->fw = (void *)kzalloc(sizeof(*wl->fw), GFP_KERNEL);
+        if (unlikely(!wl->fw)) {
+                WL_ERR(("fw object alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->pmk_list = (void *)kzalloc(sizeof(*wl->pmk_list), GFP_KERNEL);
+        if (unlikely(!wl->pmk_list)) {
+                WL_ERR(("pmk list alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        wl->sta_info = (void *)kzalloc(sizeof(*wl->sta_info), GFP_KERNEL);
+        if (unlikely(!wl->sta_info)) {
+                WL_ERR(("sta info  alloc failed\n"));
+                goto init_priv_mem_out;
+        }
+        return 0;
+
+init_priv_mem_out:
+        wl_deinit_priv_mem(wl);
+
+        return -ENOMEM;
+}
+
+static void wl_deinit_priv_mem(struct wl_priv *wl)
+{
+        kfree(wl->scan_results);
+        wl->scan_results = NULL;
+        kfree(wl->bss_info);
+        wl->bss_info = NULL;
+        kfree(wl->conf);
+        wl->conf = NULL;
+        kfree(wl->profile);
+        wl->profile = NULL;
+        kfree(wl->scan_req_int);
+        wl->scan_req_int = NULL;
+        kfree(wl->ioctl_buf);
+        wl->ioctl_buf = NULL;
+        kfree(wl->escan_ioctl_buf);
+        wl->escan_ioctl_buf = NULL;
+        kfree(wl->extra_buf);
+        wl->extra_buf = NULL;
+        kfree(wl->iscan);
+        wl->iscan = NULL;
+        kfree(wl->fw);
+        wl->fw = NULL;
+        kfree(wl->pmk_list);
+        wl->pmk_list = NULL;
+        kfree(wl->sta_info);
+        wl->sta_info = NULL;
+        if (wl->ap_info) {
+                kfree(wl->ap_info->wpa_ie);
+                kfree(wl->ap_info->rsn_ie);
+                kfree(wl->ap_info->wps_ie);
+                kfree(wl->ap_info);
+                wl->ap_info = NULL;
+        }
+}
+
+static s32 wl_create_event_handler(struct wl_priv *wl)
+{
+        int ret = 0;
+        WL_DBG(("Enter \n"));
+
+        wl->event_tsk.thr_pid = DHD_PID_KT_INVALID;
+        PROC_START(wl_event_handler, wl, &wl->event_tsk, 0);
+        if (wl->event_tsk.thr_pid < 0)
+                ret = -ENOMEM;
+        return ret;
+}
+
+static void wl_destroy_event_handler(struct wl_priv *wl)
+{
+        if (wl->event_tsk.thr_pid >= 0)
+                PROC_STOP(&wl->event_tsk);
+}
+
+static void wl_term_iscan(struct wl_priv *wl)
+{
+        struct wl_iscan_ctrl *iscan = wl_to_iscan(wl);
+        WL_TRACE(("In\n"));
+        if (wl->iscan_on && iscan->tsk) {
+                iscan->state = WL_ISCAN_STATE_IDLE;
+                WL_INFO(("SIGTERM\n"));
+                send_sig(SIGTERM, iscan->tsk, 1);
+                WL_DBG(("kthread_stop\n"));
+                kthread_stop(iscan->tsk);
+                iscan->tsk = NULL;
+        }
+}
+
+static void wl_notify_iscan_complete(struct wl_iscan_ctrl *iscan, bool aborted)
+{
+        struct wl_priv *wl = iscan_to_wl(iscan);
+        unsigned long flags;
+
+        WL_DBG(("Enter \n"));
+        if (unlikely(!wl_get_drv_status(wl, SCANNING))) {
+                wl_clr_drv_status(wl, SCANNING);
+                WL_ERR(("Scan complete while device not scanning\n"));
+                return;
+        }
+        flags = dhd_os_spin_lock((dhd_pub_t *)(wl->pub));
+        wl_clr_drv_status(wl, SCANNING);
+        if (likely(wl->scan_request)) {
+                cfg80211_scan_done(wl->scan_request, aborted);
+                wl->scan_request = NULL;
+        }
+        dhd_os_spin_unlock((dhd_pub_t *)(wl->pub), flags);
+        wl->iscan_kickstart = false;
+}
+
+static s32 wl_wakeup_iscan(struct wl_iscan_ctrl *iscan)
+{
+        if (likely(iscan->state != WL_ISCAN_STATE_IDLE)) {
+                WL_DBG(("wake up iscan\n"));
+                up(&iscan->sync);
+                return 0;
+        }
+
+        return -EIO;
+}
+
+static s32
+wl_get_iscan_results(struct wl_iscan_ctrl *iscan, u32 *status,
+        struct wl_scan_results **bss_list)
+{
+        struct wl_iscan_results list;
+        struct wl_scan_results *results;
+        struct wl_iscan_results *list_buf;
+        s32 err = 0;
+
+        WL_DBG(("Enter \n"));
+        memset(iscan->scan_buf, 0, WL_ISCAN_BUF_MAX);
+        list_buf = (struct wl_iscan_results *)iscan->scan_buf;
+        results = &list_buf->results;
+        results->buflen = WL_ISCAN_RESULTS_FIXED_SIZE;
+        results->version = 0;
+        results->count = 0;
+
+        memset(&list, 0, sizeof(list));
+        list.results.buflen = htod32(WL_ISCAN_BUF_MAX);
+        err = wldev_iovar_getbuf(iscan->dev, "iscanresults", &list,
+                WL_ISCAN_RESULTS_FIXED_SIZE, iscan->scan_buf,
+                WL_ISCAN_BUF_MAX);
+        if (unlikely(err)) {
+                WL_ERR(("error (%d)\n", err));
+                return err;
+        }
+        results->buflen = dtoh32(results->buflen);
+        results->version = dtoh32(results->version);
+        results->count = dtoh32(results->count);
+        WL_DBG(("results->count = %d\n", results->count));
+        WL_DBG(("results->buflen = %d\n", results->buflen));
+        *status = dtoh32(list_buf->status);
+        *bss_list = results;
+
+        return err;
+}
+
+static s32 wl_iscan_done(struct wl_priv *wl)
+{
+        struct wl_iscan_ctrl *iscan = wl->iscan;
+        s32 err = 0;
+
+        iscan->state = WL_ISCAN_STATE_IDLE;
+        mutex_lock(&wl->usr_sync);
+        wl_inform_bss(wl);
+        wl_notify_iscan_complete(iscan, false);
+        mutex_unlock(&wl->usr_sync);
+
+        return err;
+}
+
+static s32 wl_iscan_pending(struct wl_priv *wl)
+{
+        struct wl_iscan_ctrl *iscan = wl->iscan;
+        s32 err = 0;
+
+        /* Reschedule the timer */
+        mod_timer(&iscan->timer, jiffies + iscan->timer_ms * HZ / 1000);
+        iscan->timer_on = 1;
+
+        return err;
+}
+
+static s32 wl_iscan_inprogress(struct wl_priv *wl)
+{
+        struct wl_iscan_ctrl *iscan = wl->iscan;
+        s32 err = 0;
+
+        mutex_lock(&wl->usr_sync);
+        wl_inform_bss(wl);
+        wl_run_iscan(iscan, NULL, WL_SCAN_ACTION_CONTINUE);
+        mutex_unlock(&wl->usr_sync);
+        /* Reschedule the timer */
+        mod_timer(&iscan->timer, jiffies + iscan->timer_ms * HZ / 1000);
+        iscan->timer_on = 1;
+
+        return err;
+}
+
+static s32 wl_iscan_aborted(struct wl_priv *wl)
+{
+        struct wl_iscan_ctrl *iscan = wl->iscan;
+        s32 err = 0;
+
+        iscan->state = WL_ISCAN_STATE_IDLE;
+        mutex_lock(&wl->usr_sync);
+        wl_notify_iscan_complete(iscan, true);
+        mutex_unlock(&wl->usr_sync);
+
+        return err;
+}
+
+static s32 wl_iscan_thread(void *data)
+{
+        struct sched_param param = {.sched_priority = MAX_RT_PRIO - 1 };
+        struct wl_iscan_ctrl *iscan = (struct wl_iscan_ctrl *)data;
+        struct wl_priv *wl = iscan_to_wl(iscan);
+        u32 status;
+        int err = 0;
+
+        sched_setscheduler(current, SCHED_FIFO, &param);
+        allow_signal(SIGTERM);
+        status = WL_SCAN_RESULTS_PARTIAL;
+        while (likely(!down_interruptible(&iscan->sync))) {
+                if (kthread_should_stop())
+                        break;
+                if (iscan->timer_on) {
+                        del_timer_sync(&iscan->timer);
+                        iscan->timer_on = 0;
+                }
+                mutex_lock(&wl->usr_sync);
+                err = wl_get_iscan_results(iscan, &status, &wl->bss_list);
+                if (unlikely(err)) {
+                        status = WL_SCAN_RESULTS_ABORTED;
+                        WL_ERR(("Abort iscan\n"));
+                }
+                mutex_unlock(&wl->usr_sync);
+                iscan->iscan_handler[status] (wl);
+        }
+        if (iscan->timer_on) {
+                del_timer_sync(&iscan->timer);
+                iscan->timer_on = 0;
+        }
+        WL_DBG(("%s was terminated\n", __func__));
+
+        return 0;
+}
+
+static void wl_scan_timeout(unsigned long data)
+{
+        struct wl_priv *wl = (struct wl_priv *)data;
+
+        if (wl->scan_request) {
+                WL_ERR(("timer expired\n"));
+                if (wl->escan_on)
+                        wl_notify_escan_complete(wl, true);
+                else
+                        wl_notify_iscan_complete(wl_to_iscan(wl), true);
+        }
+}
+
+static void wl_iscan_timer(unsigned long data)
+{
+        struct wl_iscan_ctrl *iscan = (struct wl_iscan_ctrl *)data;
+
+        if (iscan) {
+                iscan->timer_on = 0;
+                WL_DBG(("timer expired\n"));
+                wl_wakeup_iscan(iscan);
+        }
+}
+
+static s32 wl_invoke_iscan(struct wl_priv *wl)
+{
+        struct wl_iscan_ctrl *iscan = wl_to_iscan(wl);
+        int err = 0;
+
+        if (wl->iscan_on && !iscan->tsk) {
+                iscan->state = WL_ISCAN_STATE_IDLE;
+                sema_init(&iscan->sync, 0);
+                iscan->tsk = kthread_run(wl_iscan_thread, iscan, "wl_iscan");
+                if (IS_ERR(iscan->tsk)) {
+                        WL_ERR(("Could not create iscan thread\n"));
+                        iscan->tsk = NULL;
+                        return -ENOMEM;
+                }
+        }
+
+        return err;
+}
+
+static void wl_init_iscan_handler(struct wl_iscan_ctrl *iscan)
+{
+        memset(iscan->iscan_handler, 0, sizeof(iscan->iscan_handler));
+        iscan->iscan_handler[WL_SCAN_RESULTS_SUCCESS] = wl_iscan_done;
+        iscan->iscan_handler[WL_SCAN_RESULTS_PARTIAL] = wl_iscan_inprogress;
+        iscan->iscan_handler[WL_SCAN_RESULTS_PENDING] = wl_iscan_pending;
+        iscan->iscan_handler[WL_SCAN_RESULTS_ABORTED] = wl_iscan_aborted;
+        iscan->iscan_handler[WL_SCAN_RESULTS_NO_MEM] = wl_iscan_aborted;
+}
+
+static void wl_notify_escan_complete(struct wl_priv *wl, bool aborted)
+{
+        unsigned long flags;
+
+        WL_DBG(("Enter \n"));
+        wl_clr_drv_status(wl, SCANNING);
+        if (wl->p2p_supported && p2p_on(wl))
+                wl_clr_p2p_status(wl, SCANNING);
+
+        flags = dhd_os_spin_lock((dhd_pub_t *)(wl->pub));
+        if (likely(wl->scan_request)) {
+                cfg80211_scan_done(wl->scan_request, aborted);
+                wl->scan_request = NULL;
+        }
+        dhd_os_spin_unlock((dhd_pub_t *)(wl->pub), flags);
+}
+
+static s32 wl_escan_handler(struct wl_priv *wl,
+        struct net_device *ndev,
+        const wl_event_msg_t *e, void *data)
+{
+        s32 err = BCME_OK;
+        s32 status = ntoh32(e->status);
+        wl_bss_info_t *bi;
+        wl_escan_result_t *escan_result;
+        wl_bss_info_t *bss = NULL;
+        wl_scan_results_t *list;
+        u32 bi_length;
+        u32 i;
+        WL_DBG((" enter event type : %d, status : %d \n",
+                ntoh32(e->event_type), ntoh32(e->status)));
+        if (!wl->escan_on &&
+                !wl_get_drv_status(wl, SCANNING)) {
+                WL_ERR(("escan is not ready \n"));
+                return err;
+        }
+
+        if (status == WLC_E_STATUS_PARTIAL) {
+                WL_INFO(("WLC_E_STATUS_PARTIAL \n"));
+                escan_result = (wl_escan_result_t *) data;
+                if (!escan_result) {
+                        WL_ERR(("Invalid escan result (NULL pointer)\n"));
+                        goto exit;
+                }
+                if (dtoh16(escan_result->bss_count) != 1) {
+                        WL_ERR(("Invalid bss_count %d: ignoring\n", escan_result->bss_count));
+                        goto exit;
+                }
+                bi = escan_result->bss_info;
+                if (!bi) {
+                        WL_ERR(("Invalid escan bss info (NULL pointer)\n"));
+                        goto exit;
+                }
+                bi_length = dtoh32(bi->length);
+                if (bi_length != (dtoh32(escan_result->buflen) - WL_ESCAN_RESULTS_FIXED_SIZE)) {
+                        WL_ERR(("Invalid bss_info length %d: ignoring\n", bi_length));
+                        goto exit;
+                }
+                list = (wl_scan_results_t *)wl->escan_info.escan_buf;
+                if (bi_length > ESCAN_BUF_SIZE - list->buflen) {
+                        WL_ERR(("Buffer is too small: ignoring\n"));
+                        goto exit;
+                }
+#define WLC_BSS_RSSI_ON_CHANNEL 0x0002
+                for (i = 0; i < list->count; i++) {
+                        bss = bss ? (wl_bss_info_t *)((uintptr)bss + dtoh32(bss->length))
+                                : list->bss_info;
+
+                        if (!bcmp(&bi->BSSID, &bss->BSSID, ETHER_ADDR_LEN) &&
+                                CHSPEC_BAND(bi->chanspec) == CHSPEC_BAND(bss->chanspec) &&
+                                bi->SSID_len == bss->SSID_len &&
+                                !bcmp(bi->SSID, bss->SSID, bi->SSID_len)) {
+                                if ((bss->flags & WLC_BSS_RSSI_ON_CHANNEL) ==
+                                        (bi->flags & WLC_BSS_RSSI_ON_CHANNEL)) {
+                                        /* preserve max RSSI if the measurements are
+                                         * both on-channel or both off-channel
+                                         */
+                                        bss->RSSI = MAX(bss->RSSI, bi->RSSI);
+                                } else if ((bss->flags & WLC_BSS_RSSI_ON_CHANNEL) &&
+                                        (bi->flags & WLC_BSS_RSSI_ON_CHANNEL) == 0) {
+                                        /* preserve the on-channel rssi measurement
+                                         * if the new measurement is off channel
+                                         */
+                                        bss->RSSI = bi->RSSI;
+                                        bss->flags |= WLC_BSS_RSSI_ON_CHANNEL;
+                                }
+
+                                goto exit;
+                        }
+                }
+                memcpy(&(wl->escan_info.escan_buf[list->buflen]), bi, bi_length);
+                list->version = dtoh32(bi->version);
+                list->buflen += bi_length;
+                list->count++;
+
+        }
+        else if (status == WLC_E_STATUS_SUCCESS) {
+                wl->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+                if (likely(wl->scan_request)) {
+                        mutex_lock(&wl->usr_sync);
+                        del_timer_sync(&wl->scan_timeout);
+                        WL_INFO(("ESCAN COMPLETED\n"));
+                        wl->bss_list = (wl_scan_results_t *)wl->escan_info.escan_buf;
+                        wl_inform_bss(wl);
+                        wl_notify_escan_complete(wl, false);
+                        mutex_unlock(&wl->usr_sync);
+                }
+        }
+        else if (status == WLC_E_STATUS_ABORT) {
+                wl->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+                if (likely(wl->scan_request)) {
+                        mutex_lock(&wl->usr_sync);
+                        del_timer_sync(&wl->scan_timeout);
+                        WL_INFO(("ESCAN ABORTED\n"));
+                        wl->bss_list = (wl_scan_results_t *)wl->escan_info.escan_buf;
+                        wl_inform_bss(wl);
+                        wl_notify_escan_complete(wl, true);
+                        mutex_unlock(&wl->usr_sync);
+                }
+        }
+        else {
+                WL_ERR(("unexpected Escan Event %d : abort\n", status));
+                wl->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+                if (likely(wl->scan_request)) {
+                        mutex_lock(&wl->usr_sync);
+                        del_timer_sync(&wl->scan_timeout);
+                        wl->bss_list = (wl_scan_results_t *)wl->escan_info.escan_buf;
+                        wl_inform_bss(wl);
+                        wl_notify_escan_complete(wl, true);
+                        mutex_unlock(&wl->usr_sync);
+                }
+        }
+exit:
+        return err;
+}
+
+static s32 wl_init_scan(struct wl_priv *wl)
+{
+        struct wl_iscan_ctrl *iscan = wl_to_iscan(wl);
+        int err = 0;
+
+        if (wl->iscan_on) {
+                iscan->dev = wl_to_prmry_ndev(wl);
+                iscan->state = WL_ISCAN_STATE_IDLE;
+                wl_init_iscan_handler(iscan);
+                iscan->timer_ms = WL_ISCAN_TIMER_INTERVAL_MS;
+                init_timer(&iscan->timer);
+                iscan->timer.data = (unsigned long) iscan;
+                iscan->timer.function = wl_iscan_timer;
+                sema_init(&iscan->sync, 0);
+                iscan->tsk = kthread_run(wl_iscan_thread, iscan, "wl_iscan");
+                if (IS_ERR(iscan->tsk)) {
+                        WL_ERR(("Could not create iscan thread\n"));
+                        iscan->tsk = NULL;
+                        return -ENOMEM;
+                }
+                iscan->data = wl;
+        } else if (wl->escan_on) {
+                wl->evt_handler[WLC_E_ESCAN_RESULT] = wl_escan_handler;
+                wl->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+        }
+        /* Init scan_timeout timer */
+        init_timer(&wl->scan_timeout);
+        wl->scan_timeout.data = (unsigned long) wl;
+        wl->scan_timeout.function = wl_scan_timeout;
+
+        return err;
+}
+
+static void wl_init_fw(struct wl_fw_ctrl *fw)
+{
+        fw->status = 0;
+}
+
+static s32 wl_init_priv(struct wl_priv *wl)
+{
+        struct wiphy *wiphy = wl_to_wiphy(wl);
+        s32 err = 0;
+        s32 i = 0;
+
+        wl->scan_request = NULL;
+        wl->pwr_save = !!(wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT);
+        wl->iscan_on = false;
+        wl->escan_on = true;
+        wl->roam_on = false;
+        wl->iscan_kickstart = false;
+        wl->active_scan = true;
+        wl->dongle_up = false;
+        wl->rf_blocked = false;
+
+        for (i = 0; i < VWDEV_CNT; i++)
+                wl->vwdev[i] = NULL;
+
+        init_waitqueue_head(&wl->dongle_event_wait);
+        wl_init_eq(wl);
+        err = wl_init_priv_mem(wl);
+        if (unlikely(err))
+                return err;
+        if (unlikely(wl_create_event_handler(wl)))
+                return -ENOMEM;
+        wl_init_event_handler(wl);
+        mutex_init(&wl->usr_sync);
+        err = wl_init_scan(wl);
+        if (unlikely(err))
+                return err;
+        wl_init_fw(wl->fw);
+        wl_init_conf(wl->conf);
+        wl_init_prof(wl);
+        wl_link_down(wl);
+
+        return err;
+}
+
+static void wl_deinit_priv(struct wl_priv *wl)
+{
+        wl_destroy_event_handler(wl);
+        wl->dongle_up = false;  /* dongle down */
+        wl_flush_eq(wl);
+        wl_link_down(wl);
+        del_timer_sync(&wl->scan_timeout);
+        wl_term_iscan(wl);
+        wl_deinit_priv_mem(wl);
+}
+
+#if defined(DHD_P2P_DEV_ADDR_FROM_SYSFS) && defined(CONFIG_SYSCTL)
+s32 wl_cfg80211_sysctl_export_devaddr(void *data)
+{
+        /* Export the p2p_dev_addr via sysctl interface
+         * so that wpa_supplicant can access it
+         */
+        dhd_pub_t *dhd = (dhd_pub_t *)data;
+        struct wl_priv *wl = wlcfg_drv_priv;
+
+        wl_cfgp2p_generate_bss_mac(&dhd->mac, &wl->p2p->dev_addr, &wl->p2p->int_addr);
+
+        sprintf((char *)&wl_sysctl_macstring[0], MACSTR, MAC2STR(wl->p2p->dev_addr.octet));
+        sprintf((char *)&wl_sysctl_macstring[1], MACSTR, MAC2STR(wl->p2p->int_addr.octet));
+
+        return 0;
+}
+#endif /* CONFIG_SYSCTL */
+
+s32 wl_cfg80211_attach_post(struct net_device *ndev)
+{
+        struct wl_priv * wl = NULL;
+        s32 err = 0;
+        WL_TRACE(("In\n"));
+        if (unlikely(!ndev)) {
+                WL_ERR(("ndev is invaild\n"));
+                return -ENODEV;
+        }
+        wl = wlcfg_drv_priv;
+        if (wl && !wl_get_drv_status(wl, READY)) {
+                        if (wl->wdev &&
+                                wl_cfgp2p_supported(wl, ndev)) {
+                                wl->wdev->wiphy->interface_modes |=
+                                        (BIT(NL80211_IFTYPE_P2P_CLIENT)|
+                                        BIT(NL80211_IFTYPE_P2P_GO));
+                                if ((err = wl_cfgp2p_init_priv(wl)) != 0)
+                                        goto fail;
+#if defined(DHD_P2P_DEV_ADDR_FROM_SYSFS) && defined(CONFIG_SYSCTL)
+                                wl_cfg80211_sysctl_export_devaddr(wl->pub);
+#endif
+                                wl->p2p_supported = true;
+                        }
+        } else
+                return -ENODEV;
+
+        wl_set_drv_status(wl, READY);
+fail:
+        return err;
+}
+s32 wl_cfg80211_attach(struct net_device *ndev, void *data)
+{
+        struct wireless_dev *wdev;
+        struct wl_priv *wl;
+        s32 err = 0;
+
+        WL_TRACE(("In\n"));
+        if (unlikely(!ndev)) {
+                WL_ERR(("ndev is invaild\n"));
+                return -ENODEV;
+        }
+        WL_DBG(("func %p\n", wl_cfg80211_get_sdio_func()));
+        wdev = wl_alloc_wdev(&wl_cfg80211_get_sdio_func()->dev);
+        if (unlikely(IS_ERR(wdev)))
+                return -ENOMEM;
+
+        wdev->iftype = wl_mode_to_nl80211_iftype(WL_MODE_BSS);
+        wl = (struct wl_priv *)wiphy_priv(wdev->wiphy);
+        wl->wdev = wdev;
+        wl->pub = data;
+
+        ndev->ieee80211_ptr = wdev;
+        SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
+        wdev->netdev = ndev;
+
+        err = wl_init_priv(wl);
+        if (unlikely(err)) {
+                WL_ERR(("Failed to init iwm_priv (%d)\n", err));
+                goto cfg80211_attach_out;
+        }
+
+        err = wl_setup_rfkill(wl, TRUE);
+        if (unlikely(err)) {
+                WL_ERR(("Failed to setup rfkill %d\n", err));
+                goto cfg80211_attach_out;
+        }
+
+#if defined(DHD_P2P_DEV_ADDR_FROM_SYSFS) && defined(CONFIG_SYSCTL)
+        if (!(wl_sysctl_hdr = register_sysctl_table(wl_sysctl_table))) {
+                WL_ERR(("%s: sysctl register failed!! \n", __func__));
+                goto cfg80211_attach_out;
+        }
+#endif
+#if defined(COEX_DHCP)
+        if (wl_cfg80211_btcoex_init(wl))
+                goto cfg80211_attach_out;
+#endif /* COEX_DHCP */
+
+        wlcfg_drv_priv = wl;
+        return err;
+
+cfg80211_attach_out:
+        err = wl_setup_rfkill(wl, FALSE);
+        wl_free_wdev(wl);
+        return err;
+}
+
+void wl_cfg80211_detach(void)
+{
+        struct wl_priv *wl;
+
+        wl = wlcfg_drv_priv;
+
+        WL_TRACE(("In\n"));
+
+#if defined(COEX_DHCP)
+        wl_cfg80211_btcoex_deinit(wl);
+#endif /* COEX_DHCP */
+
+#if defined(DHD_P2P_DEV_ADDR_FROM_SYSFS) && defined(CONFIG_SYSCTL)
+        if (wl_sysctl_hdr)
+                unregister_sysctl_table(wl_sysctl_hdr);
+#endif
+        wl_setup_rfkill(wl, FALSE);
+        if (wl->p2p_supported)
+                wl_cfgp2p_deinit_priv(wl);
+        wl_deinit_priv(wl);
+        wlcfg_drv_priv = NULL;
+        wl_clear_sdio_func();
+        wl_free_wdev(wl);
+}
+
+static void wl_wakeup_event(struct wl_priv *wl)
+{
+        if (wl->event_tsk.thr_pid >= 0) {
+                DHD_OS_WAKE_LOCK(wl->pub);
+                up(&wl->event_tsk.sema);
+        }
+}
+
+static s32 wl_event_handler(void *data)
+{
+        struct net_device *netdev;
+        struct wl_priv *wl = NULL;
+        struct wl_event_q *e;
+        tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+
+        wl = (struct wl_priv *)tsk->parent;
+        complete(&tsk->completed);
+
+        while (down_interruptible (&tsk->sema) == 0) {
+                SMP_RD_BARRIER_DEPENDS();
+                if (tsk->terminated)
+                        break;
+                while ((e = wl_deq_event(wl))) {
+                        WL_DBG(("event type (%d), if idx: %d\n", e->etype, e->emsg.ifidx));
+                        netdev = dhd_idx2net((struct dhd_pub *)(wl->pub), e->emsg.ifidx);
+                        if (!netdev)
+                                netdev = wl_to_prmry_ndev(wl);
+                        if (e->etype < WLC_E_LAST && wl->evt_handler[e->etype]) {
+                                wl->evt_handler[e->etype] (wl, netdev, &e->emsg, e->edata);
+                        } else {
+                                WL_DBG(("Unknown Event (%d): ignoring\n", e->etype));
+                        }
+                        wl_put_event(e);
+                }
+                DHD_OS_WAKE_UNLOCK(wl->pub);
+        }
+        WL_DBG(("%s was terminated\n", __func__));
+        complete_and_exit(&tsk->completed, 0);
+        return 0;
+}
+
+void
+wl_cfg80211_event(struct net_device *ndev, const wl_event_msg_t * e, void *data)
+{
+        u32 event_type = ntoh32(e->event_type);
+        struct wl_priv *wl = wlcfg_drv_priv;
+
+#if (WL_DBG_LEVEL > 0)
+        s8 *estr = (event_type <= sizeof(wl_dbg_estr) / WL_DBG_ESTR_MAX - 1) ?
+            wl_dbg_estr[event_type] : (s8 *) "Unknown";
+        WL_DBG(("event_type (%d):" "WLC_E_" "%s\n", event_type, estr));
+#endif /* (WL_DBG_LEVEL > 0) */
+
+        if (event_type == WLC_E_PFN_NET_FOUND)
+                WL_ERR((" PNO Event\n"));
+
+        if (likely(!wl_enq_event(wl, ndev, event_type, e, data)))
+                wl_wakeup_event(wl);
+}
+
+static void wl_init_eq(struct wl_priv *wl)
+{
+        wl_init_eq_lock(wl);
+        INIT_LIST_HEAD(&wl->eq_list);
+}
+
+static void wl_flush_eq(struct wl_priv *wl)
+{
+        struct wl_event_q *e;
+        unsigned long flags;
+
+        flags = wl_lock_eq(wl);
+        while (!list_empty(&wl->eq_list)) {
+                e = list_first_entry(&wl->eq_list, struct wl_event_q, eq_list);
+                list_del(&e->eq_list);
+                kfree(e);
+        }
+        wl_unlock_eq(wl, flags);
+}
+
+/*
+* retrieve first queued event from head
+*/
+
+static struct wl_event_q *wl_deq_event(struct wl_priv *wl)
+{
+        struct wl_event_q *e = NULL;
+        unsigned long flags;
+
+        flags = wl_lock_eq(wl);
+        if (likely(!list_empty(&wl->eq_list))) {
+                e = list_first_entry(&wl->eq_list, struct wl_event_q, eq_list);
+                list_del(&e->eq_list);
+        }
+        wl_unlock_eq(wl, flags);
+
+        return e;
+}
+
+/*
+ * push event to tail of the queue
+ */
+
+static s32
+wl_enq_event(struct wl_priv *wl, struct net_device *ndev, u32 event, const wl_event_msg_t *msg,
+        void *data)
+{
+        struct wl_event_q *e;
+        s32 err = 0;
+        uint32 evtq_size;
+        uint32 data_len;
+        unsigned long flags;
+        gfp_t aflags;
+
+        data_len = 0;
+        if (data)
+                data_len = ntoh32(msg->datalen);
+        evtq_size = sizeof(struct wl_event_q) + data_len;
+        aflags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+        e = kzalloc(evtq_size, aflags);
+        if (unlikely(!e)) {
+                WL_ERR(("event alloc failed\n"));
+                return -ENOMEM;
+        }
+        e->etype = event;
+        memcpy(&e->emsg, msg, sizeof(wl_event_msg_t));
+        if (data)
+                memcpy(e->edata, data, data_len);
+        flags = wl_lock_eq(wl);
+        list_add_tail(&e->eq_list, &wl->eq_list);
+        wl_unlock_eq(wl, flags);
+
+        return err;
+}
+
+static void wl_put_event(struct wl_event_q *e)
+{
+        kfree(e);
+}
+
+void wl_cfg80211_set_sdio_func(void *func)
+{
+        cfg80211_sdio_func = (struct sdio_func *)func;
+}
+
+static void wl_clear_sdio_func(void)
+{
+        cfg80211_sdio_func = NULL;
+}
+
+struct sdio_func *wl_cfg80211_get_sdio_func(void)
+{
+        return cfg80211_sdio_func;
+}
+
+static s32 wl_dongle_mode(struct wl_priv *wl, struct net_device *ndev, s32 iftype)
+{
+        s32 infra = 0;
+        s32 err = 0;
+        s32 mode = 0;
+        switch (iftype) {
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_WDS:
+                WL_ERR(("type (%d) : currently we do not support this mode\n",
+                        iftype));
+                err = -EINVAL;
+                return err;
+        case NL80211_IFTYPE_ADHOC:
+                mode = WL_MODE_IBSS;
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+                mode = WL_MODE_BSS;
+                infra = 1;
+                break;
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                mode = WL_MODE_AP;
+                infra = 1;
+                break;
+        default:
+                err = -EINVAL;
+                WL_ERR(("invalid type (%d)\n", iftype));
+                return err;
+        }
+        infra = htod32(infra);
+        err = wldev_ioctl(ndev, WLC_SET_INFRA, &infra, sizeof(infra), true);
+        if (unlikely(err)) {
+                WL_ERR(("WLC_SET_INFRA error (%d)\n", err));
+                return err;
+        }
+
+        set_mode_by_netdev(wl, ndev, mode);
+
+        return 0;
+}
+static s32 wl_dongle_add_remove_eventmsg(struct net_device *ndev, u16 event, bool add)
+{
+        s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+
+        s8 eventmask[WL_EVENTING_MASK_LEN];
+        s32 err = 0;
+
+        /* Setup event_msgs */
+        bcm_mkiovar("event_msgs", NULL, 0, iovbuf,
+                sizeof(iovbuf));
+        err = wldev_ioctl(ndev, WLC_GET_VAR, iovbuf, sizeof(iovbuf), false);
+        if (unlikely(err)) {
+                WL_ERR(("Get event_msgs error (%d)\n", err));
+                goto dongle_eventmsg_out;
+        }
+        memcpy(eventmask, iovbuf, WL_EVENTING_MASK_LEN);
+        if (add) {
+                setbit(eventmask, event);
+        } else {
+                clrbit(eventmask, event);
+        }
+        bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf,
+                sizeof(iovbuf));
+        err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+        if (unlikely(err)) {
+                WL_ERR(("Set event_msgs error (%d)\n", err));
+                goto dongle_eventmsg_out;
+        }
+
+dongle_eventmsg_out:
+        return err;
+
+}
+
+
+#ifndef EMBEDDED_PLATFORM
+static s32 wl_dongle_country(struct net_device *ndev, u8 ccode)
+{
+
+        s32 err = 0;
+
+        return err;
+}
+
+static s32 wl_dongle_up(struct net_device *ndev, u32 up)
+{
+        s32 err = 0;
+
+        err = wldev_ioctl(ndev, WLC_UP, &up, sizeof(up), true);
+        if (unlikely(err)) {
+                WL_ERR(("WLC_UP error (%d)\n", err));
+        }
+        return err;
+}
+
+static s32 wl_dongle_power(struct net_device *ndev, u32 power_mode)
+{
+        s32 err = 0;
+
+        WL_TRACE(("In\n"));
+        err = wldev_ioctl(ndev, WLC_SET_PM, &power_mode, sizeof(power_mode), true);
+        if (unlikely(err)) {
+                WL_ERR(("WLC_SET_PM error (%d)\n", err));
+        }
+        return err;
+}
+
+static s32
+wl_dongle_glom(struct net_device *ndev, u32 glom, u32 dongle_align)
+{
+        s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+
+        s32 err = 0;
+
+        /* Match Host and Dongle rx alignment */
+        bcm_mkiovar("bus:txglomalign", (char *)&dongle_align, 4, iovbuf,
+                sizeof(iovbuf));
+        err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+        if (unlikely(err)) {
+                WL_ERR(("txglomalign error (%d)\n", err));
+                goto dongle_glom_out;
+        }
+        /* disable glom option per default */
+        bcm_mkiovar("bus:txglom", (char *)&glom, 4, iovbuf, sizeof(iovbuf));
+        err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+        if (unlikely(err)) {
+                WL_ERR(("txglom error (%d)\n", err));
+                goto dongle_glom_out;
+        }
+dongle_glom_out:
+        return err;
+}
+
+static s32
+wl_dongle_roam(struct net_device *ndev, u32 roamvar, u32 bcn_timeout)
+{
+        s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+
+        s32 err = 0;
+
+        /* Setup timeout if Beacons are lost and roam is off to report link down */
+        if (roamvar) {
+                bcm_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf,
+                        sizeof(iovbuf));
+                err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+                if (unlikely(err)) {
+                        WL_ERR(("bcn_timeout error (%d)\n", err));
+                        goto dongle_rom_out;
+                }
+        }
+        /* Enable/Disable built-in roaming to allow supplicant to take care of roaming */
+        bcm_mkiovar("roam_off", (char *)&roamvar, 4, iovbuf, sizeof(iovbuf));
+        err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+        if (unlikely(err)) {
+                WL_ERR(("roam_off error (%d)\n", err));
+                goto dongle_rom_out;
+        }
+dongle_rom_out:
+        return err;
+}
+
+static s32
+wl_dongle_scantime(struct net_device *ndev, s32 scan_assoc_time,
+        s32 scan_unassoc_time)
+{
+        s32 err = 0;
+
+        err = wldev_ioctl(ndev, WLC_SET_SCAN_CHANNEL_TIME, &scan_assoc_time,
+                sizeof(scan_assoc_time), true);
+        if (err) {
+                if (err == -EOPNOTSUPP) {
+                        WL_INFO(("Scan assoc time is not supported\n"));
+                } else {
+                        WL_ERR(("Scan assoc time error (%d)\n", err));
+                }
+                goto dongle_scantime_out;
+        }
+        err = wldev_ioctl(ndev, WLC_SET_SCAN_UNASSOC_TIME, &scan_unassoc_time,
+                sizeof(scan_unassoc_time), true);
+        if (err) {
+                if (err == -EOPNOTSUPP) {
+                        WL_INFO(("Scan unassoc time is not supported\n"));
+                } else {
+                        WL_ERR(("Scan unassoc time error (%d)\n", err));
+                }
+                goto dongle_scantime_out;
+        }
+
+dongle_scantime_out:
+        return err;
+}
+
+static s32
+wl_dongle_offload(struct net_device *ndev, s32 arpoe, s32 arp_ol)
+{
+        /* Room for "event_msgs" + '\0' + bitvec */
+        s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+
+        s32 err = 0;
+
+        /* Set ARP offload */
+        bcm_mkiovar("arpoe", (char *)&arpoe, 4, iovbuf, sizeof(iovbuf));
+        err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+        if (err) {
+                if (err == -EOPNOTSUPP)
+                        WL_INFO(("arpoe is not supported\n"));
+                else
+                        WL_ERR(("arpoe error (%d)\n", err));
+
+                goto dongle_offload_out;
+        }
+        bcm_mkiovar("arp_ol", (char *)&arp_ol, 4, iovbuf, sizeof(iovbuf));
+        err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+        if (err) {
+                if (err == -EOPNOTSUPP)
+                        WL_INFO(("arp_ol is not supported\n"));
+                else
+                        WL_ERR(("arp_ol error (%d)\n", err));
+
+                goto dongle_offload_out;
+        }
+
+dongle_offload_out:
+        return err;
+}
+
+static s32 wl_pattern_atoh(s8 *src, s8 *dst)
+{
+        int i;
+        if (strncmp(src, "0x", 2) != 0 && strncmp(src, "0X", 2) != 0) {
+                WL_ERR(("Mask invalid format. Needs to start with 0x\n"));
+                return -1;
+        }
+        src = src + 2;          /* Skip past 0x */
+        if (strlen(src) % 2 != 0) {
+                WL_ERR(("Mask invalid format. Needs to be of even length\n"));
+                return -1;
+        }
+        for (i = 0; *src != '\0'; i++) {
+                char num[3];
+                strncpy(num, src, 2);
+                num[2] = '\0';
+                dst[i] = (u8) simple_strtoul(num, NULL, 16);
+                src += 2;
+        }
+        return i;
+}
+
+static s32 wl_dongle_filter(struct net_device *ndev, u32 filter_mode)
+{
+        /* Room for "event_msgs" + '\0' + bitvec */
+        s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+
+        const s8 *str;
+        struct wl_pkt_filter pkt_filter;
+        struct wl_pkt_filter *pkt_filterp;
+        s32 buf_len;
+        s32 str_len;
+        u32 mask_size;
+        u32 pattern_size;
+        s8 buf[256];
+        s32 err = 0;
+
+        /* add a default packet filter pattern */
+        str = "pkt_filter_add";
+        str_len = strlen(str);
+        strncpy(buf, str, str_len);
+        buf[str_len] = '\0';
+        buf_len = str_len + 1;
+
+        pkt_filterp = (struct wl_pkt_filter *)(buf + str_len + 1);
+
+        /* Parse packet filter id. */
+        pkt_filter.id = htod32(100);
+
+        /* Parse filter polarity. */
+        pkt_filter.negate_match = htod32(0);
+
+        /* Parse filter type. */
+        pkt_filter.type = htod32(0);
+
+        /* Parse pattern filter offset. */
+        pkt_filter.u.pattern.offset = htod32(0);
+
+        /* Parse pattern filter mask. */
+        mask_size = htod32(wl_pattern_atoh("0xff",
+                (char *)pkt_filterp->u.pattern.
+                    mask_and_pattern));
+
+        /* Parse pattern filter pattern. */
+        pattern_size = htod32(wl_pattern_atoh("0x00",
+                (char *)&pkt_filterp->u.pattern.mask_and_pattern[mask_size]));
+
+        if (mask_size != pattern_size) {
+                WL_ERR(("Mask and pattern not the same size\n"));
+                err = -EINVAL;
+                goto dongle_filter_out;
+        }
+
+        pkt_filter.u.pattern.size_bytes = mask_size;
+        buf_len += WL_PKT_FILTER_FIXED_LEN;
+        buf_len += (WL_PKT_FILTER_PATTERN_FIXED_LEN + 2 * mask_size);
+
+        /* Keep-alive attributes are set in local
+         * variable (keep_alive_pkt), and
+         * then memcpy'ed into buffer (keep_alive_pktp) since there is no
+         * guarantee that the buffer is properly aligned.
+         */
+        memcpy((char *)pkt_filterp, &pkt_filter,
+                WL_PKT_FILTER_FIXED_LEN + WL_PKT_FILTER_PATTERN_FIXED_LEN);
+
+        err = wldev_ioctl(ndev, WLC_SET_VAR, buf, buf_len, true);
+        if (err) {
+                if (err == -EOPNOTSUPP) {
+                        WL_INFO(("filter not supported\n"));
+                } else {
+                        WL_ERR(("filter (%d)\n", err));
+                }
+                goto dongle_filter_out;
+        }
+
+        /* set mode to allow pattern */
+        bcm_mkiovar("pkt_filter_mode", (char *)&filter_mode, 4, iovbuf,
+                sizeof(iovbuf));
+        err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+        if (err) {
+                if (err == -EOPNOTSUPP) {
+                        WL_INFO(("filter_mode not supported\n"));
+                } else {
+                        WL_ERR(("filter_mode (%d)\n", err));
+                }
+                goto dongle_filter_out;
+        }
+
+dongle_filter_out:
+        return err;
+}
+#endif                          /* !EMBEDDED_PLATFORM */
+
+s32 wl_config_dongle(struct wl_priv *wl, bool need_lock)
+{
+#ifndef DHD_SDALIGN
+#define DHD_SDALIGN     32
+#endif
+        struct net_device *ndev;
+        struct wireless_dev *wdev;
+        s32 err = 0;
+
+        WL_TRACE(("In\n"));
+        if (wl->dongle_up) {
+                WL_ERR(("Dongle is already up\n"));
+                return err;
+        }
+
+        ndev = wl_to_prmry_ndev(wl);
+        wdev = ndev->ieee80211_ptr;
+        if (need_lock)
+                rtnl_lock();
+#ifndef EMBEDDED_PLATFORM
+        err = wl_dongle_up(ndev, 0);
+        if (unlikely(err)) {
+                WL_ERR(("wl_dongle_up failed\n"));
+                goto default_conf_out;
+        }
+        err = wl_dongle_country(ndev, 0);
+        if (unlikely(err)) {
+                WL_ERR(("wl_dongle_country failed\n"));
+                goto default_conf_out;
+        }
+        err = wl_dongle_power(ndev, PM_FAST);
+        if (unlikely(err)) {
+                WL_ERR(("wl_dongle_power failed\n"));
+                goto default_conf_out;
+        }
+        err = wl_dongle_glom(ndev, 0, DHD_SDALIGN);
+        if (unlikely(err)) {
+                WL_ERR(("wl_dongle_glom failed\n"));
+                goto default_conf_out;
+        }
+        err = wl_dongle_roam(ndev, (wl->roam_on ? 0 : 1), 3);
+        if (unlikely(err)) {
+                WL_ERR(("wl_dongle_roam failed\n"));
+                goto default_conf_out;
+        }
+        wl_dongle_scantime(ndev, 40, 80);
+        wl_dongle_offload(ndev, 1, 0xf);
+        wl_dongle_filter(ndev, 1);
+#endif                          /* !EMBEDDED_PLATFORM */
+
+        err = wl_dongle_mode(wl, ndev, wdev->iftype);
+        if (unlikely(err && err != -EINPROGRESS)) {
+                WL_ERR(("wl_dongle_mode failed\n"));
+                goto default_conf_out;
+        }
+        err = wl_dongle_probecap(wl);
+        if (unlikely(err)) {
+                WL_ERR(("wl_dongle_probecap failed\n"));
+                goto default_conf_out;
+        }
+
+        /* -EINPROGRESS: Call commit handler */
+
+default_conf_out:
+        if (need_lock)
+                rtnl_unlock();
+
+        wl->dongle_up = true;
+
+        return err;
+
+}
+
+static s32 wl_update_wiphybands(struct wl_priv *wl)
+{
+        struct wiphy *wiphy;
+        s8 phylist_buf[128];
+        s8 *phy;
+        s32 err = 0;
+
+        err = wldev_ioctl(wl_to_prmry_ndev(wl), WLC_GET_PHYLIST, phylist_buf,
+                sizeof(phylist_buf), false);
+        if (unlikely(err)) {
+                WL_ERR(("error (%d)\n", err));
+                return err;
+        }
+        phy = phylist_buf;
+        for (; *phy; phy++) {
+                if (*phy == 'a' || *phy == 'n') {
+                        wiphy = wl_to_wiphy(wl);
+                        wiphy->bands[IEEE80211_BAND_5GHZ] =
+                                &__wl_band_5ghz_a;
+                }
+        }
+        return err;
+}
+
+static s32 __wl_cfg80211_up(struct wl_priv *wl)
+{
+        s32 err = 0;
+
+        WL_TRACE(("In\n"));
+        wl_debugfs_add_netdev_params(wl);
+
+        err = wl_config_dongle(wl, false);
+        if (unlikely(err))
+                return err;
+        dhd_monitor_init(wl->pub);
+        wl_invoke_iscan(wl);
+        wl_set_drv_status(wl, READY);
+        return err;
+}
+
+static s32 __wl_cfg80211_down(struct wl_priv *wl)
+{
+        s32 err = 0;
+        unsigned long flags;
+
+        WL_TRACE(("In\n"));
+        /* Check if cfg80211 interface is already down */
+        if (!wl_get_drv_status(wl, READY))
+                return err;     /* it is even not ready */
+
+        wl_set_drv_status(wl, SCAN_ABORTING);
+
+        wl_term_iscan(wl);
+        flags = dhd_os_spin_lock((dhd_pub_t *)(wl->pub));
+        if (wl->scan_request) {
+                cfg80211_scan_done(wl->scan_request, true);
+                wl->scan_request = NULL;
+        }
+        wl_clr_drv_status(wl, READY);
+        wl_clr_drv_status(wl, SCANNING);
+        wl_clr_drv_status(wl, SCAN_ABORTING);
+        wl_clr_drv_status(wl, CONNECTING);
+        wl_clr_drv_status(wl, CONNECTED);
+        wl_clr_drv_status(wl, DISCONNECTING);
+        if (wl_get_drv_status(wl, AP_CREATED)) {
+                wl_clr_drv_status(wl, AP_CREATED);
+                wl_clr_drv_status(wl, AP_CREATING);
+        }
+        wl_to_prmry_ndev(wl)->ieee80211_ptr->iftype =
+                NL80211_IFTYPE_STATION;
+        dhd_os_spin_unlock((dhd_pub_t *)(wl->pub), flags);
+
+        wl->dongle_up = false;
+        wl_flush_eq(wl);
+        wl_link_down(wl);
+        if (wl->p2p_supported)
+                wl_cfgp2p_down(wl);
+        dhd_monitor_uninit();
+
+        wl_debugfs_remove_netdev(wl);
+
+        return err;
+}
+
+s32 wl_cfg80211_up(void)
+{
+        struct wl_priv *wl;
+        s32 err = 0;
+
+        WL_TRACE(("In\n"));
+        wl = wlcfg_drv_priv;
+        mutex_lock(&wl->usr_sync);
+        wl_cfg80211_attach_post(wl_to_prmry_ndev(wl));
+        err = __wl_cfg80211_up(wl);
+        if (err)
+                WL_ERR(("__wl_cfg80211_up failed\n"));
+        mutex_unlock(&wl->usr_sync);
+
+        return err;
+}
+
+/* Private Event  to Supplicant with indication that FW hangs */
+int wl_cfg80211_hang(struct net_device *dev, u16 reason)
+{
+        struct wl_priv *wl;
+        wl = wlcfg_drv_priv;
+
+        WL_ERR(("In : FW crash Eventing\n"));
+        cfg80211_disconnected(dev, reason, NULL, 0, GFP_KERNEL);
+        if (wl != NULL) {
+                wl_link_down(wl);
+        }
+        return 0;
+}
+
+s32 wl_cfg80211_down(void)
+{
+        struct wl_priv *wl;
+        s32 err = 0;
+
+        WL_TRACE(("In\n"));
+        wl = wlcfg_drv_priv;
+        mutex_lock(&wl->usr_sync);
+        err = __wl_cfg80211_down(wl);
+        mutex_unlock(&wl->usr_sync);
+
+        return err;
+}
+
+static s32 wl_dongle_probecap(struct wl_priv *wl)
+{
+        s32 err = 0;
+
+        err = wl_update_wiphybands(wl);
+        if (unlikely(err))
+                return err;
+
+        return err;
+}
+
+static void *wl_read_prof(struct wl_priv *wl, s32 item)
+{
+        unsigned long flags;
+        void *rptr = NULL;
+
+        flags = dhd_os_spin_lock((dhd_pub_t *)(wl->pub));
+        switch (item) {
+        case WL_PROF_SEC:
+                rptr = &wl->profile->sec;
+                break;
+        case WL_PROF_ACT:
+                rptr = &wl->profile->active;
+                break;
+        case WL_PROF_BSSID:
+                rptr = &wl->profile->bssid;
+                break;
+        case WL_PROF_SSID:
+                rptr = &wl->profile->ssid;
+                break;
+        }
+        dhd_os_spin_unlock((dhd_pub_t *)(wl->pub), flags);
+        if (!rptr)
+                WL_ERR(("invalid item (%d)\n", item));
+        return rptr;
+}
+
+static s32
+wl_update_prof(struct wl_priv *wl, const wl_event_msg_t *e, void *data,
+        s32 item)
+{
+        s32 err = 0;
+        struct wlc_ssid *ssid;
+        unsigned long flags;
+
+        flags = dhd_os_spin_lock((dhd_pub_t *)(wl->pub));
+        switch (item) {
+        case WL_PROF_SSID:
+                ssid = (wlc_ssid_t *) data;
+                memset(wl->profile->ssid.SSID, 0,
+                        sizeof(wl->profile->ssid.SSID));
+                memcpy(wl->profile->ssid.SSID, ssid->SSID, ssid->SSID_len);
+                wl->profile->ssid.SSID_len = ssid->SSID_len;
+                break;
+        case WL_PROF_BSSID:
+                if (data)
+                        memcpy(wl->profile->bssid, data, ETHER_ADDR_LEN);
+                else
+                        memset(wl->profile->bssid, 0, ETHER_ADDR_LEN);
+                break;
+        case WL_PROF_SEC:
+                memcpy(&wl->profile->sec, data, sizeof(wl->profile->sec));
+                break;
+        case WL_PROF_ACT:
+                wl->profile->active = *(bool *)data;
+                break;
+        case WL_PROF_BEACONINT:
+                wl->profile->beacon_interval = *(u16 *)data;
+                break;
+        case WL_PROF_DTIMPERIOD:
+                wl->profile->dtim_period = *(u8 *)data;
+                break;
+        default:
+                WL_ERR(("unsupported item (%d)\n", item));
+                err = -EOPNOTSUPP;
+                break;
+        }
+        dhd_os_spin_unlock((dhd_pub_t *)(wl->pub), flags);
+        return err;
+}
+
+void wl_cfg80211_dbg_level(u32 level)
+{
+        /*
+        * prohibit to change debug level
+        * by insmod parameter.
+        * eventually debug level will be configured
+        * in compile time by using CONFIG_XXX
+        */
+        /* wl_dbg_level = level; */
+}
+
+static bool wl_is_ibssmode(struct wl_priv *wl, struct net_device *ndev)
+{
+        return get_mode_by_netdev(wl, ndev) == WL_MODE_IBSS;
+}
+
+static __used bool wl_is_ibssstarter(struct wl_priv *wl)
+{
+        return wl->ibss_starter;
+}
+
+static void wl_rst_ie(struct wl_priv *wl)
+{
+        struct wl_ie *ie = wl_to_ie(wl);
+
+        ie->offset = 0;
+}
+
+static __used s32 wl_add_ie(struct wl_priv *wl, u8 t, u8 l, u8 *v)
+{
+        struct wl_ie *ie = wl_to_ie(wl);
+        s32 err = 0;
+
+        if (unlikely(ie->offset + l + 2 > WL_TLV_INFO_MAX)) {
+                WL_ERR(("ei crosses buffer boundary\n"));
+                return -ENOSPC;
+        }
+        ie->buf[ie->offset] = t;
+        ie->buf[ie->offset + 1] = l;
+        memcpy(&ie->buf[ie->offset + 2], v, l);
+        ie->offset += l + 2;
+
+        return err;
+}
+
+static s32 wl_mrg_ie(struct wl_priv *wl, u8 *ie_stream, u16 ie_size)
+{
+        struct wl_ie *ie = wl_to_ie(wl);
+        s32 err = 0;
+
+        if (unlikely(ie->offset + ie_size > WL_TLV_INFO_MAX)) {
+                WL_ERR(("ei_stream crosses buffer boundary\n"));
+                return -ENOSPC;
+        }
+        memcpy(&ie->buf[ie->offset], ie_stream, ie_size);
+        ie->offset += ie_size;
+
+        return err;
+}
+
+static s32 wl_cp_ie(struct wl_priv *wl, u8 *dst, u16 dst_size)
+{
+        struct wl_ie *ie = wl_to_ie(wl);
+        s32 err = 0;
+
+        if (unlikely(ie->offset > dst_size)) {
+                WL_ERR(("dst_size is not enough\n"));
+                return -ENOSPC;
+        }
+        memcpy(dst, &ie->buf[0], ie->offset);
+
+        return err;
+}
+
+static u32 wl_get_ielen(struct wl_priv *wl)
+{
+        struct wl_ie *ie = wl_to_ie(wl);
+
+        return ie->offset;
+}
+
+static void wl_link_up(struct wl_priv *wl)
+{
+        wl->link_up = true;
+}
+
+static void wl_link_down(struct wl_priv *wl)
+{
+        struct wl_connect_info *conn_info = wl_to_conn(wl);
+
+        WL_DBG(("In\n"));
+        wl->link_up = false;
+        conn_info->req_ie_len = 0;
+        conn_info->resp_ie_len = 0;
+}
+
+static unsigned long wl_lock_eq(struct wl_priv *wl)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&wl->eq_lock, flags);
+        return flags;
+}
+
+static void wl_unlock_eq(struct wl_priv *wl, unsigned long flags)
+{
+        spin_unlock_irqrestore(&wl->eq_lock, flags);
+}
+
+static void wl_init_eq_lock(struct wl_priv *wl)
+{
+        spin_lock_init(&wl->eq_lock);
+}
+
+static void wl_delay(u32 ms)
+{
+        if (ms < 1000 / HZ) {
+                cond_resched();
+                mdelay(ms);
+        } else {
+                msleep(ms);
+        }
+}
+
+s32 wl_cfg80211_read_fw(s8 *buf, u32 size)
+{
+        const struct firmware *fw_entry;
+        struct wl_priv *wl;
+
+        wl = wlcfg_drv_priv;
+
+        fw_entry = wl->fw->fw_entry;
+
+        if (fw_entry->size < wl->fw->ptr + size)
+                size = fw_entry->size - wl->fw->ptr;
+
+        memcpy(buf, &fw_entry->data[wl->fw->ptr], size);
+        wl->fw->ptr += size;
+        return size;
+}
+
+void wl_cfg80211_release_fw(void)
+{
+        struct wl_priv *wl;
+
+        wl = wlcfg_drv_priv;
+        release_firmware(wl->fw->fw_entry);
+        wl->fw->ptr = 0;
+}
+
+void *wl_cfg80211_request_fw(s8 *file_name)
+{
+        struct wl_priv *wl;
+        const struct firmware *fw_entry = NULL;
+        s32 err = 0;
+
+        WL_TRACE(("In\n"));
+        WL_DBG(("file name : \"%s\"\n", file_name));
+        wl = wlcfg_drv_priv;
+
+        if (!test_bit(WL_FW_LOADING_DONE, &wl->fw->status)) {
+                err = request_firmware(&wl->fw->fw_entry, file_name,
+                        &wl_cfg80211_get_sdio_func()->dev);
+                if (unlikely(err)) {
+                        WL_ERR(("Could not download fw (%d)\n", err));
+                        goto req_fw_out;
+                }
+                set_bit(WL_FW_LOADING_DONE, &wl->fw->status);
+                fw_entry = wl->fw->fw_entry;
+                if (fw_entry) {
+                        WL_DBG(("fw size (%zd), data (%p)\n", fw_entry->size,
+                                fw_entry->data));
+                }
+        } else if (!test_bit(WL_NVRAM_LOADING_DONE, &wl->fw->status)) {
+                err = request_firmware(&wl->fw->fw_entry, file_name,
+                        &wl_cfg80211_get_sdio_func()->dev);
+                if (unlikely(err)) {
+                        WL_ERR(("Could not download nvram (%d)\n", err));
+                        goto req_fw_out;
+                }
+                set_bit(WL_NVRAM_LOADING_DONE, &wl->fw->status);
+                fw_entry = wl->fw->fw_entry;
+                if (fw_entry) {
+                        WL_DBG(("nvram size (%zd), data (%p)\n", fw_entry->size,
+                                fw_entry->data));
+                }
+        } else {
+                WL_DBG(("Downloading already done. Nothing to do more\n"));
+                err = -EPERM;
+        }
+
+req_fw_out:
+        if (unlikely(err)) {
+                return NULL;
+        }
+        wl->fw->ptr = 0;
+        return (void *)fw_entry->data;
+}
+
+s8 *wl_cfg80211_get_fwname(void)
+{
+        struct wl_priv *wl;
+
+        wl = wlcfg_drv_priv;
+        strcpy(wl->fw->fw_name, WL_4329_FW_FILE);
+        return wl->fw->fw_name;
+}
+
+s8 *wl_cfg80211_get_nvramname(void)
+{
+        struct wl_priv *wl;
+
+        wl = wlcfg_drv_priv;
+        strcpy(wl->fw->nvram_name, WL_4329_NVRAM_FILE);
+        return wl->fw->nvram_name;
+}
+
+s32 wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr)
+{
+        struct wl_priv *wl;
+        dhd_pub_t *dhd_pub;
+        struct ether_addr p2pif_addr;
+
+        wl = wlcfg_drv_priv;
+        dhd_pub = (dhd_pub_t *)wl->pub;
+        wl_cfgp2p_generate_bss_mac(&dhd_pub->mac, p2pdev_addr, &p2pif_addr);
+
+        return 0;
+}
+s32 wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len)
+{
+        struct wl_priv *wl;
+        wl = wlcfg_drv_priv;
+
+        return wl_cfgp2p_set_p2p_noa(wl, net, buf, len);
+}
+
+s32 wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len)
+{
+        struct wl_priv *wl;
+        wl = wlcfg_drv_priv;
+
+        return wl_cfgp2p_get_p2p_noa(wl, net, buf, len);
+}
+
+s32 wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len)
+{
+        struct wl_priv *wl;
+        wl = wlcfg_drv_priv;
+
+        return wl_cfgp2p_set_p2p_ps(wl, net, buf, len);
+}
+
+s32 wl_cfg80211_set_wps_p2p_ie(struct net_device *net, char *buf, int len,
+        enum wl_management_type type)
+{
+        struct wl_priv *wl;
+        struct net_device *ndev = NULL;
+        s32 ret = 0;
+        s32 bssidx = 0;
+        s32 pktflag = 0;
+        wl = wlcfg_drv_priv;
+        if (wl->p2p && wl->p2p->vif_created) {
+                ndev = wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_CONNECTION);
+                bssidx = wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_CONNECTION);
+        } else if (wl_get_drv_status(wl, AP_CREATING) ||
+                wl_get_drv_status(wl, AP_CREATED)) {
+                ndev = net;
+                bssidx = 0;
+        }
+        if (ndev != NULL) {
+                switch (type) {
+                        case WL_BEACON:
+                                pktflag = VNDR_IE_BEACON_FLAG;
+                                break;
+                        case WL_PROBE_RESP:
+                                pktflag = VNDR_IE_PRBRSP_FLAG;
+                                break;
+                        case WL_ASSOC_RESP:
+                                pktflag = VNDR_IE_ASSOCRSP_FLAG;
+                                break;
+                }
+                if (pktflag)
+                        ret = wl_cfgp2p_set_management_ie(wl, ndev, bssidx, pktflag, buf, len);
+        }
+
+        return ret;
+}
+
+static __used void wl_dongle_poweron(struct wl_priv *wl)
+{
+        WL_DBG(("Enter \n"));
+        dhd_customer_gpio_wlan_ctrl(WLAN_RESET_ON);
+
+#if defined(BCMLXSDMMC)
+        sdioh_start(NULL, 0);
+#endif
+#if defined(BCMLXSDMMC)
+        sdioh_start(NULL, 1);
+#endif
+        wl_cfg80211_resume(wl_to_wiphy(wl));
+}
+
+static __used void wl_dongle_poweroff(struct wl_priv *wl)
+{
+        WL_DBG(("Enter \n"));
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)
+        wl_cfg80211_suspend(wl_to_wiphy(wl), NULL);
+#else
+        wl_cfg80211_suspend(wl_to_wiphy(wl));
+#endif
+
+#if defined(BCMLXSDMMC)
+        sdioh_stop(NULL);
+#endif
+        /* clean up dtim_skip setting */
+        dhd_customer_gpio_wlan_ctrl(WLAN_RESET_OFF);
+}
+
+static int wl_debugfs_add_netdev_params(struct wl_priv *wl)
+{
+        char buf[10+IFNAMSIZ];
+        struct dentry *fd;
+        s32 err = 0;
+
+        WL_TRACE(("In\n"));
+        sprintf(buf, "netdev:%s", wl_to_prmry_ndev(wl)->name);
+        wl->debugfsdir = debugfs_create_dir(buf, wl_to_wiphy(wl)->debugfsdir);
+
+        fd = debugfs_create_u16("beacon_int", S_IRUGO, wl->debugfsdir,
+                (u16 *)&wl->profile->beacon_interval);
+        if (!fd) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+        fd = debugfs_create_u8("dtim_period", S_IRUGO, wl->debugfsdir,
+                (u8 *)&wl->profile->dtim_period);
+        if (!fd) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+err_out:
+        return err;
+}
+
+static void wl_debugfs_remove_netdev(struct wl_priv *wl)
+{
+        WL_DBG(("Enter \n"));
+}
+
+static const struct rfkill_ops wl_rfkill_ops = {
+        .set_block = wl_rfkill_set
+};
+
+static int wl_rfkill_set(void *data, bool blocked)
+{
+        struct wl_priv *wl = (struct wl_priv *)data;
+
+        WL_DBG(("Enter \n"));
+        WL_DBG(("RF %s\n", blocked ? "blocked" : "unblocked"));
+
+        if (!wl)
+                return -EINVAL;
+
+        wl->rf_blocked = blocked;
+
+        return 0;
+}
+
+static int wl_setup_rfkill(struct wl_priv *wl, bool setup)
+{
+        s32 err = 0;
+
+        WL_DBG(("Enter \n"));
+        if (!wl)
+                return -EINVAL;
+        if (setup) {
+                wl->rfkill = rfkill_alloc("brcmfmac-wifi",
+                        &wl_cfg80211_get_sdio_func()->dev,
+                        RFKILL_TYPE_WLAN, &wl_rfkill_ops, (void *)wl);
+
+                if (!wl->rfkill) {
+                        err = -ENOMEM;
+                        goto err_out;
+                }
+
+                err = rfkill_register(wl->rfkill);
+
+                if (err)
+                        rfkill_destroy(wl->rfkill);
+        } else {
+                if (!wl->rfkill) {
+                        err = -ENOMEM;
+                        goto err_out;
+                }
+
+                rfkill_unregister(wl->rfkill);
+                rfkill_destroy(wl->rfkill);
+        }
+
+err_out:
+        return err;
+}
+
+#if defined(COEX_DHCP)
+/*
+ * get named driver variable to uint register value and return error indication
+ * calling example: dev_wlc_intvar_get_reg(dev, "btc_params",66, &reg_value)
+ */
+static int
+dev_wlc_intvar_get_reg(struct net_device *dev, char *name,
+        uint reg, int *retval)
+{
+        union {
+                char buf[WLC_IOCTL_SMLEN];
+                int val;
+        } var;
+        int error;
+
+        bcm_mkiovar(name, (char *)(&reg), sizeof(reg),
+                (char *)(&var), sizeof(var.buf));
+        error = wldev_ioctl(dev, WLC_GET_VAR, (char *)(&var), sizeof(var.buf), false);
+
+        *retval = dtoh32(var.val);
+        return (error);
+}
+
+static int
+dev_wlc_bufvar_set(struct net_device *dev, char *name, char *buf, int len)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+        char ioctlbuf[1024];
+#else
+        static char ioctlbuf[1024];
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31) */
+
+        bcm_mkiovar(name, buf, len, ioctlbuf, sizeof(ioctlbuf));
+
+        return (wldev_ioctl(dev, WLC_SET_VAR, ioctlbuf, sizeof(ioctlbuf), true));
+}
+/*
+get named driver variable to uint register value and return error indication
+calling example: dev_wlc_intvar_set_reg(dev, "btc_params",66, value)
+*/
+static int
+dev_wlc_intvar_set_reg(struct net_device *dev, char *name, char *addr, char * val)
+{
+        char reg_addr[8];
+
+        memset(reg_addr, 0, sizeof(reg_addr));
+        memcpy((char *)&reg_addr[0], (char *)addr, 4);
+        memcpy((char *)&reg_addr[4], (char *)val, 4);
+
+        return (dev_wlc_bufvar_set(dev, name, (char *)&reg_addr[0], sizeof(reg_addr)));
+}
+
+static bool btcoex_is_sco_active(struct net_device *dev)
+{
+        int ioc_res = 0;
+        bool res = FALSE;
+        int sco_id_cnt = 0;
+        int param27;
+        int i;
+
+        for (i = 0; i < 12; i++) {
+
+                ioc_res = dev_wlc_intvar_get_reg(dev, "btc_params", 27, &param27);
+
+                WL_TRACE(("%s, sample[%d], btc params: 27:%x\n",
+                        __FUNCTION__, i, param27));
+
+                if (ioc_res < 0) {
+                        WL_ERR(("%s ioc read btc params error\n", __FUNCTION__));
+                        break;
+                }
+
+                if ((param27 & 0x6) == 2) { /* count both sco & esco  */
+                        sco_id_cnt++;
+                }
+
+                if (sco_id_cnt > 2) {
+                        WL_TRACE(("%s, sco/esco detected, pkt id_cnt:%d  samples:%d\n",
+                                __FUNCTION__, sco_id_cnt, i));
+                        res = TRUE;
+                        break;
+                }
+
+                msleep(5);
+        }
+
+        return res;
+}
+
+#if defined(BT_DHCP_eSCO_FIX)
+/* Enhanced BT COEX settings for eSCO compatibility during DHCP window */
+static int set_btc_esco_params(struct net_device *dev, bool trump_sco)
+{
+        static bool saved_status = FALSE;
+
+        char buf_reg50va_dhcp_on[8] =
+                { 50, 00, 00, 00, 0x22, 0x80, 0x00, 0x00 };
+        char buf_reg51va_dhcp_on[8] =
+                { 51, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+        char buf_reg64va_dhcp_on[8] =
+                { 64, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+        char buf_reg65va_dhcp_on[8] =
+                { 65, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+        char buf_reg71va_dhcp_on[8] =
+                { 71, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+        uint32 regaddr;
+        static uint32 saved_reg50;
+        static uint32 saved_reg51;
+        static uint32 saved_reg64;
+        static uint32 saved_reg65;
+        static uint32 saved_reg71;
+
+        if (trump_sco) {
+                /* this should reduce eSCO agressive retransmit
+                 * w/o breaking it
+                 */
+
+                /* 1st save current */
+                WL_TRACE(("Do new SCO/eSCO coex algo {save &"
+                          "override}\n"));
+                if ((!dev_wlc_intvar_get_reg(dev, "btc_params", 50, &saved_reg50)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 51, &saved_reg51)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 64, &saved_reg64)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 65, &saved_reg65)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 71, &saved_reg71))) {
+                        saved_status = TRUE;
+                        WL_TRACE(("%s saved bt_params[50,51,64,65,71]:"
+                                  "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                                  __FUNCTION__, saved_reg50, saved_reg51,
+                                  saved_reg64, saved_reg65, saved_reg71));
+                } else {
+                        WL_ERR((":%s: save btc_params failed\n",
+                                __FUNCTION__));
+                        saved_status = FALSE;
+                        return -1;
+                }
+
+                WL_TRACE(("override with [50,51,64,65,71]:"
+                          "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                          *(u32 *)(buf_reg50va_dhcp_on+4),
+                          *(u32 *)(buf_reg51va_dhcp_on+4),
+                          *(u32 *)(buf_reg64va_dhcp_on+4),
+                          *(u32 *)(buf_reg65va_dhcp_on+4),
+                          *(u32 *)(buf_reg71va_dhcp_on+4)));
+
+                dev_wlc_bufvar_set(dev, "btc_params",
+                        (char *)&buf_reg50va_dhcp_on[0], 8);
+                dev_wlc_bufvar_set(dev, "btc_params",
+                        (char *)&buf_reg51va_dhcp_on[0], 8);
+                dev_wlc_bufvar_set(dev, "btc_params",
+                        (char *)&buf_reg64va_dhcp_on[0], 8);
+                dev_wlc_bufvar_set(dev, "btc_params",
+                        (char *)&buf_reg65va_dhcp_on[0], 8);
+                dev_wlc_bufvar_set(dev, "btc_params",
+                        (char *)&buf_reg71va_dhcp_on[0], 8);
+
+                saved_status = TRUE;
+        } else if (saved_status) {
+                /* restore previously saved bt params */
+                WL_TRACE(("Do new SCO/eSCO coex algo {save &"
+                          "override}\n"));
+
+                regaddr = 50;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg50);
+                regaddr = 51;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg51);
+                regaddr = 64;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg64);
+                regaddr = 65;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg65);
+                regaddr = 71;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg71);
+
+                WL_TRACE(("restore bt_params[50,51,64,65,71]:"
+                        "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                        saved_reg50, saved_reg51, saved_reg64,
+                        saved_reg65, saved_reg71));
+
+                saved_status = FALSE;
+        } else {
+                WL_ERR((":%s att to restore not saved BTCOEX params\n",
+                        __FUNCTION__));
+                return -1;
+        }
+        return 0;
+}
+#endif /* BT_DHCP_eSCO_FIX */
+
+static void
+wl_cfg80211_bt_setflag(struct net_device *dev, bool set)
+{
+#if defined(BT_DHCP_USE_FLAGS)
+        char buf_flag7_dhcp_on[8] = { 7, 00, 00, 00, 0x1, 0x0, 0x00, 0x00 };
+        char buf_flag7_default[8]   = { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+#endif
+
+#if defined(BT_DHCP_eSCO_FIX)
+        /* set = 1, save & turn on  0 - off & restore prev settings */
+        set_btc_esco_params(dev, set);
+#endif
+
+#if defined(BT_DHCP_USE_FLAGS)
+        WL_TRACE(("WI-FI priority boost via bt flags, set:%d\n", set));
+        if (set == TRUE)
+                /* Forcing bt_flag7  */
+                dev_wlc_bufvar_set(dev, "btc_flags",
+                        (char *)&buf_flag7_dhcp_on[0],
+                        sizeof(buf_flag7_dhcp_on));
+        else
+                /* Restoring default bt flag7 */
+                dev_wlc_bufvar_set(dev, "btc_flags",
+                        (char *)&buf_flag7_default[0],
+                        sizeof(buf_flag7_default));
+#endif
+}
+
+static void wl_cfg80211_bt_timerfunc(ulong data)
+{
+        struct btcoex_info *bt_local = (struct btcoex_info *)data;
+        WL_TRACE(("%s\n", __FUNCTION__));
+        bt_local->timer_on = 0;
+        schedule_work(&bt_local->work);
+}
+
+static void wl_cfg80211_bt_handler(struct work_struct *work)
+{
+        struct btcoex_info *btcx_inf;
+
+        btcx_inf = container_of(work, struct btcoex_info, work);
+
+        if (btcx_inf->timer_on) {
+                btcx_inf->timer_on = 0;
+                del_timer_sync(&btcx_inf->timer);
+        }
+
+        switch (btcx_inf->bt_state) {
+                case BT_DHCP_START:
+                        /* DHCP started
+                         * provide OPPORTUNITY window to get DHCP address
+                         */
+                        WL_TRACE(("%s bt_dhcp stm: started \n",
+                                __FUNCTION__));
+                        btcx_inf->bt_state = BT_DHCP_OPPR_WIN;
+                        mod_timer(&btcx_inf->timer,
+                                jiffies + BT_DHCP_OPPR_WIN_TIME*HZ/1000);
+                        btcx_inf->timer_on = 1;
+                        break;
+
+                case BT_DHCP_OPPR_WIN:
+                        if (btcx_inf->dhcp_done) {
+                                WL_TRACE(("%s DHCP Done before T1 expiration\n",
+                                        __FUNCTION__));
+                                goto btc_coex_idle;
+                        }
+
+                        /* DHCP is not over yet, start lowering BT priority
+                         * enforce btc_params + flags if necessary
+                         */
+                        WL_TRACE(("%s DHCP T1:%d expired\n", __FUNCTION__,
+                                BT_DHCP_OPPR_WIN_TIME));
+                        if (btcx_inf->dev)
+                                wl_cfg80211_bt_setflag(btcx_inf->dev, TRUE);
+                        btcx_inf->bt_state = BT_DHCP_FLAG_FORCE_TIMEOUT;
+                        mod_timer(&btcx_inf->timer,
+                                jiffies + BT_DHCP_FLAG_FORCE_TIME*HZ/1000);
+                        btcx_inf->timer_on = 1;
+                        break;
+
+                case BT_DHCP_FLAG_FORCE_TIMEOUT:
+                        if (btcx_inf->dhcp_done) {
+                                WL_TRACE(("%s DHCP Done before T2 expiration\n",
+                                        __FUNCTION__));
+                        } else {
+                                /* Noo dhcp during T1+T2, restore BT priority */
+                                WL_TRACE(("%s DHCP wait interval T2:%d"
+                                          "msec expired\n", __FUNCTION__,
+                                          BT_DHCP_FLAG_FORCE_TIME));
+                        }
+
+                        /* Restoring default bt priority */
+                        if (btcx_inf->dev)
+                                wl_cfg80211_bt_setflag(btcx_inf->dev, FALSE);
+btc_coex_idle:
+                        btcx_inf->bt_state = BT_DHCP_IDLE;
+                        btcx_inf->timer_on = 0;
+                        break;
+
+                default:
+                        WL_ERR(("%s error g_status=%d !!!\n", __FUNCTION__,
+                                btcx_inf->bt_state));
+                        if (btcx_inf->dev)
+                                wl_cfg80211_bt_setflag(btcx_inf->dev, FALSE);
+                        btcx_inf->bt_state = BT_DHCP_IDLE;
+                        btcx_inf->timer_on = 0;
+                        break;
+        }
+
+        net_os_wake_unlock(btcx_inf->dev);
+}
+
+static int wl_cfg80211_btcoex_init(struct wl_priv *wl)
+{
+        struct btcoex_info *btco_inf = NULL;
+
+        btco_inf = kmalloc(sizeof(struct btcoex_info), GFP_KERNEL);
+        if (!btco_inf)
+                return -ENOMEM;
+
+        btco_inf->bt_state = BT_DHCP_IDLE;
+        btco_inf->ts_dhcp_start = 0;
+        btco_inf->ts_dhcp_ok = 0;
+        /* Set up timer for BT  */
+        btco_inf->timer_ms = 10;
+        init_timer(&btco_inf->timer);
+        btco_inf->timer.data = (ulong)btco_inf;
+        btco_inf->timer.function = wl_cfg80211_bt_timerfunc;
+
+        btco_inf->dev = wl->wdev->netdev;
+
+        INIT_WORK(&btco_inf->work, wl_cfg80211_bt_handler);
+
+        wl->btcoex_info = btco_inf;
+        return 0;
+}
+
+static void
+wl_cfg80211_btcoex_deinit(struct wl_priv *wl)
+{
+        if (!wl->btcoex_info)
+                return;
+
+        if (!wl->btcoex_info->timer_on) {
+                wl->btcoex_info->timer_on = 0;
+                del_timer_sync(&wl->btcoex_info->timer);
+        }
+
+        cancel_work_sync(&wl->btcoex_info->work);
+
+        kfree(wl->btcoex_info);
+        wl->btcoex_info = NULL;
+}
+#endif          /* COEX_DHCP */
+
+int wl_cfg80211_set_btcoex_dhcp(struct net_device *dev, char *command)
+{
+        char powermode_val = 0;
+        char buf_reg66va_dhcp_on[8] = { 66, 00, 00, 00, 0x10, 0x27, 0x00, 0x00 };
+        char buf_reg41va_dhcp_on[8] = { 41, 00, 00, 00, 0x33, 0x00, 0x00, 0x00 };
+        char buf_reg68va_dhcp_on[8] = { 68, 00, 00, 00, 0x90, 0x01, 0x00, 0x00 };
+
+        uint32 regaddr;
+        static uint32 saved_reg66;
+        static uint32 saved_reg41;
+        static uint32 saved_reg68;
+        static bool saved_status = FALSE;
+
+#ifdef COEX_DHCP
+        char buf_flag7_default[8] =   { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+        struct btcoex_info *btco_inf = wlcfg_drv_priv->btcoex_info;
+#endif /* COEX_DHCP */
+
+        /* Figure out powermode 1 or o command */
+        strncpy((char *)&powermode_val, command + strlen("BTCOEXMODE") +1, 1);
+
+        if (strnicmp((char *)&powermode_val, "1", strlen("1")) == 0) {
+
+                WL_TRACE(("%s: DHCP session starts\n", __FUNCTION__));
+
+                /* Retrieve and saved orig regs value */
+                if ((saved_status == FALSE) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 66,  &saved_reg66)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 41,  &saved_reg41)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 68,  &saved_reg68)))   {
+                                saved_status = TRUE;
+                                WL_TRACE(("Saved 0x%x 0x%x 0x%x\n",
+                                        saved_reg66, saved_reg41, saved_reg68));
+
+                                /* Disable PM mode during dhpc session */
+
+                                /* Disable PM mode during dhpc session */
+#ifdef COEX_DHCP
+                                /* Start  BT timer only for SCO connection */
+                                if (btcoex_is_sco_active(dev)) {
+                                        /* btc_params 66 */
+                                        dev_wlc_bufvar_set(dev, "btc_params",
+                                                (char *)&buf_reg66va_dhcp_on[0],
+                                                sizeof(buf_reg66va_dhcp_on));
+                                        /* btc_params 41 0x33 */
+                                        dev_wlc_bufvar_set(dev, "btc_params",
+                                                (char *)&buf_reg41va_dhcp_on[0],
+                                                sizeof(buf_reg41va_dhcp_on));
+                                        /* btc_params 68 0x190 */
+                                        dev_wlc_bufvar_set(dev, "btc_params",
+                                                (char *)&buf_reg68va_dhcp_on[0],
+                                                sizeof(buf_reg68va_dhcp_on));
+                                        saved_status = TRUE;
+
+                                        btco_inf->bt_state = BT_DHCP_START;
+                                        btco_inf->timer_on = 1;
+                                        mod_timer(&btco_inf->timer, btco_inf->timer.expires);
+                                        WL_TRACE(("%s enable BT DHCP Timer\n",
+                                        __FUNCTION__));
+                                }
+#endif /* COEX_DHCP */
+                }
+                else if (saved_status == TRUE) {
+                        WL_ERR(("%s was called w/o DHCP OFF. Continue\n", __FUNCTION__));
+                }
+        }
+        else if (strnicmp((char *)&powermode_val, "2", strlen("2")) == 0) {
+
+
+                /* Restoring PM mode */
+
+#ifdef COEX_DHCP
+                /* Stop any bt timer because DHCP session is done */
+                WL_TRACE(("%s disable BT DHCP Timer\n", __FUNCTION__));
+                if (btco_inf->timer_on) {
+                        btco_inf->timer_on = 0;
+                        del_timer_sync(&btco_inf->timer);
+
+                        if (btco_inf->bt_state != BT_DHCP_IDLE) {
+                        /* need to restore original btc flags & extra btc params */
+                                WL_TRACE(("%s bt->bt_state:%d\n",
+                                        __FUNCTION__, btco_inf->bt_state));
+                                /* wake up btcoex thread to restore btlags+params  */
+                                schedule_work(&btco_inf->work);
+                        }
+                }
+
+                /* Restoring btc_flag paramter anyway */
+                if (saved_status == TRUE)
+                        dev_wlc_bufvar_set(dev, "btc_flags",
+                                (char *)&buf_flag7_default[0], sizeof(buf_flag7_default));
+#endif /* COEX_DHCP */
+
+                /* Restore original values */
+                if (saved_status == TRUE) {
+                        regaddr = 66;
+                        dev_wlc_intvar_set_reg(dev, "btc_params",
+                                (char *)&regaddr, (char *)&saved_reg66);
+                        regaddr = 41;
+                        dev_wlc_intvar_set_reg(dev, "btc_params",
+                                (char *)&regaddr, (char *)&saved_reg41);
+                        regaddr = 68;
+                        dev_wlc_intvar_set_reg(dev, "btc_params",
+                                (char *)&regaddr, (char *)&saved_reg68);
+
+                        WL_TRACE(("restore regs {66,41,68} <- 0x%x 0x%x 0x%x\n",
+                                saved_reg66, saved_reg41, saved_reg68));
+                }
+                saved_status = FALSE;
+
+        }
+        else {
+                WL_ERR(("%s Unkwown yet power setting, ignored\n",
+                        __FUNCTION__));
+        }
+
+        snprintf(command, 3, "OK");
+
+        return (strlen("OK"));
+}
diff --git a/drivers/net/wireless/bcmdhd/wl_cfg80211.h b/drivers/net/wireless/bcmdhd/wl_cfg80211.h
new file mode 100644
index 00000000000..262335ef99c
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wl_cfg80211.h
@@ -0,0 +1,558 @@
+/*
+ * Linux cfg80211 driver
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wl_cfg80211.h,v 1.1.4.1.2.8 2011/02/09 01:37:52 Exp $
+ */
+
+#ifndef _wl_cfg80211_h_
+#define _wl_cfg80211_h_
+
+#include <linux/wireless.h>
+#include <typedefs.h>
+#include <proto/ethernet.h>
+#include <wlioctl.h>
+#include <linux/wireless.h>
+#include <net/cfg80211.h>
+#include <linux/rfkill.h>
+
+#include <wl_cfgp2p.h>
+
+struct wl_conf;
+struct wl_iface;
+struct wl_priv;
+struct wl_security;
+struct wl_ibss;
+
+
+#define htod32(i) i
+#define htod16(i) i
+#define dtoh32(i) i
+#define dtoh16(i) i
+#define htodchanspec(i) i
+#define dtohchanspec(i) i
+
+#define WL_DBG_NONE     0
+#define WL_DBG_TRACE    (1 << 4)
+#define WL_DBG_SCAN     (1 << 3)
+#define WL_DBG_DBG      (1 << 2)
+#define WL_DBG_INFO     (1 << 1)
+#define WL_DBG_ERR      (1 << 0)
+
+/* 0 invalidates all debug messages.  default is 1 */
+#define WL_DBG_LEVEL 0xFF
+
+#define WL_ERR(args)                                                                    \
+do {                                                                            \
+        if (wl_dbg_level & WL_DBG_ERR) {                                \
+                        printk(KERN_ERR "CFG80211-ERROR) %s : ", __func__);     \
+                        printk args;                                            \
+                }                                                               \
+} while (0)
+#define WL_INFO(args)                                                                   \
+do {                                                                            \
+        if (wl_dbg_level & WL_DBG_INFO) {                               \
+                        printk(KERN_ERR "CFG80211-INFO) %s : ", __func__);      \
+                        printk args;                                            \
+                }                                                               \
+} while (0)
+#define WL_SCAN(args)                                                           \
+do {                                                                    \
+        if (wl_dbg_level & WL_DBG_SCAN) {                       \
+                printk(KERN_ERR "CFG80211-SCAN) %s :", __func__);       \
+                printk args;                                                    \
+        }                                                                       \
+} while (0)
+#define WL_TRACE(args)                                                          \
+do {                                                                    \
+        if (wl_dbg_level & WL_DBG_TRACE) {                      \
+                printk(KERN_ERR "CFG80211-TRACE) %s :", __func__);      \
+                printk args;                                                    \
+        }                                                                       \
+} while (0)
+#if (WL_DBG_LEVEL > 0)
+#define WL_DBG(args)                                                            \
+do {                                                                    \
+        if (wl_dbg_level & WL_DBG_DBG) {                        \
+                printk(KERN_ERR "CFG80211-DEBUG) %s :", __func__);      \
+                printk args;                                                    \
+        }                                                                       \
+} while (0)
+#else                           /* !(WL_DBG_LEVEL > 0) */
+#define WL_DBG(args)
+#endif                          /* (WL_DBG_LEVEL > 0) */
+
+
+#define WL_SCAN_RETRY_MAX       3       /* used for ibss scan */
+#define WL_NUM_PMKIDS_MAX       MAXPMKID        /* will be used
+                                                 * for 2.6.33 kernel
+                                                 * or later
+                                                 */
+#define WL_SCAN_BUF_MAX                 (1024 * 8)
+#define WL_TLV_INFO_MAX                 1024
+#define WL_SCAN_IE_LEN_MAX      2048
+#define WL_BSS_INFO_MAX                 2048
+#define WL_ASSOC_INFO_MAX       512     /*
+                                 * needs to grab assoc info from dongle to
+                                 * report it to cfg80211 through "connect"
+                                 * event
+                                 */
+#define WL_IOCTL_LEN_MAX        1024
+#define WL_EXTRA_BUF_MAX        2048
+#define WL_ISCAN_BUF_MAX        2048    /*
+                                 * the buf lengh can be WLC_IOCTL_MAXLEN (8K)
+                                 * to reduce iteration
+                                 */
+#define WL_ISCAN_TIMER_INTERVAL_MS      3000
+#define WL_SCAN_ERSULTS_LAST    (WL_SCAN_RESULTS_NO_MEM+1)
+#define WL_AP_MAX       256     /* virtually unlimitted as long
+                                 * as kernel memory allows
+                                 */
+#define WL_FILE_NAME_MAX        256
+#define WL_DWELL_TIME           200
+#define WL_LONG_DWELL_TIME      1000
+#define VWDEV_CNT 3
+
+#define WL_SCAN_TIMER_INTERVAL_MS       8000 /* Scan timeout */
+
+/* dongle status */
+enum wl_status {
+        WL_STATUS_READY = 0,
+        WL_STATUS_SCANNING,
+        WL_STATUS_SCAN_ABORTING,
+        WL_STATUS_CONNECTING,
+        WL_STATUS_CONNECTED,
+        WL_STATUS_DISCONNECTING,
+        WL_STATUS_AP_CREATING,
+        WL_STATUS_AP_CREATED
+};
+
+/* wi-fi mode */
+enum wl_mode {
+        WL_MODE_BSS,
+        WL_MODE_IBSS,
+        WL_MODE_AP
+};
+
+/* dongle profile list */
+enum wl_prof_list {
+        WL_PROF_MODE,
+        WL_PROF_SSID,
+        WL_PROF_SEC,
+        WL_PROF_IBSS,
+        WL_PROF_BAND,
+        WL_PROF_BSSID,
+        WL_PROF_ACT,
+        WL_PROF_BEACONINT,
+        WL_PROF_DTIMPERIOD
+};
+
+/* dongle iscan state */
+enum wl_iscan_state {
+        WL_ISCAN_STATE_IDLE,
+        WL_ISCAN_STATE_SCANING
+};
+
+/* donlge escan state */
+enum wl_escan_state {
+    WL_ESCAN_STATE_IDLE,
+    WL_ESCAN_STATE_SCANING
+};
+/* fw downloading status */
+enum wl_fw_status {
+        WL_FW_LOADING_DONE,
+        WL_NVRAM_LOADING_DONE
+};
+
+enum wl_management_type {
+        WL_BEACON = 0x1,
+        WL_PROBE_RESP = 0x2,
+        WL_ASSOC_RESP = 0x4
+};
+/* beacon / probe_response */
+struct beacon_proberesp {
+        __le64 timestamp;
+        __le16 beacon_int;
+        __le16 capab_info;
+        u8 variable[0];
+} __attribute__ ((packed));
+
+/* dongle configuration */
+struct wl_conf {
+        struct net_mode {
+                struct net_device *ndev;
+                s32 type;
+        } mode [VWDEV_CNT + 1];         /* adhoc , infrastructure or ap */
+        u32 frag_threshold;
+        u32 rts_threshold;
+        u32 retry_short;
+        u32 retry_long;
+        s32 tx_power;
+        struct ieee80211_channel channel;
+};
+
+typedef s32(*EVENT_HANDLER) (struct wl_priv *wl,
+                            struct net_device *ndev, const wl_event_msg_t *e, void *data);
+
+/* bss inform structure for cfg80211 interface */
+struct wl_cfg80211_bss_info {
+        u16 band;
+        u16 channel;
+        s16 rssi;
+        u16 frame_len;
+        u8 frame_buf[1];
+};
+
+/* basic structure of scan request */
+struct wl_scan_req {
+        struct wlc_ssid ssid;
+};
+
+/* basic structure of information element */
+struct wl_ie {
+        u16 offset;
+        u8 buf[WL_TLV_INFO_MAX];
+};
+
+/* event queue for cfg80211 main event */
+struct wl_event_q {
+        struct list_head eq_list;
+        u32 etype;
+        wl_event_msg_t emsg;
+        s8 edata[1];
+};
+
+/* security information with currently associated ap */
+struct wl_security {
+        u32 wpa_versions;
+        u32 auth_type;
+        u32 cipher_pairwise;
+        u32 cipher_group;
+        u32 wpa_auth;
+};
+
+/* ibss information for currently joined ibss network */
+struct wl_ibss {
+        u8 beacon_interval;     /* in millisecond */
+        u8 atim;                /* in millisecond */
+        s8 join_only;
+        u8 band;
+        u8 channel;
+};
+
+/* dongle profile */
+struct wl_profile {
+        u32 mode;
+        struct wlc_ssid ssid;
+        u8 bssid[ETHER_ADDR_LEN];
+        u16 beacon_interval;
+        u8 dtim_period;
+        struct wl_security sec;
+        struct wl_ibss ibss;
+        s32 band;
+        bool active;
+};
+
+typedef s32(*ISCAN_HANDLER) (struct wl_priv *wl);
+
+/* dongle iscan controller */
+struct wl_iscan_ctrl {
+        struct net_device *dev;
+        struct timer_list timer;
+        u32 timer_ms;
+        u32 timer_on;
+        s32 state;
+        struct task_struct *tsk;
+        struct semaphore sync;
+        ISCAN_HANDLER iscan_handler[WL_SCAN_ERSULTS_LAST];
+        void *data;
+        s8 ioctl_buf[WLC_IOCTL_SMLEN];
+        s8 scan_buf[WL_ISCAN_BUF_MAX];
+};
+
+/* association inform */
+#define MAX_REQ_LINE 1024
+struct wl_connect_info {
+        u8 req_ie[MAX_REQ_LINE];
+        s32 req_ie_len;
+        u8 resp_ie[MAX_REQ_LINE];
+        s32 resp_ie_len;
+};
+
+/* firmware /nvram downloading controller */
+struct wl_fw_ctrl {
+        const struct firmware *fw_entry;
+        unsigned long status;
+        u32 ptr;
+        s8 fw_name[WL_FILE_NAME_MAX];
+        s8 nvram_name[WL_FILE_NAME_MAX];
+};
+
+/* assoc ie length */
+struct wl_assoc_ielen {
+        u32 req_len;
+        u32 resp_len;
+};
+
+/* wpa2 pmk list */
+struct wl_pmk_list {
+        pmkid_list_t pmkids;
+        pmkid_t foo[MAXPMKID - 1];
+};
+
+
+#define ESCAN_BUF_SIZE (64 * 1024)
+
+struct escan_info {
+    u32 escan_state;
+    u8 escan_buf[ESCAN_BUF_SIZE];
+    struct wiphy *wiphy;
+};
+
+struct ap_info {
+/* Structure to hold WPS, WPA IEs for a AP */
+        u8   probe_res_ie[IE_MAX_LEN];
+        u8   beacon_ie[IE_MAX_LEN];
+        u32 probe_res_ie_len;
+        u32 beacon_ie_len;
+        u8 *wpa_ie;
+        u8 *rsn_ie;
+        u8 *wps_ie;
+        bool security_mode;
+};
+struct btcoex_info {
+        struct timer_list timer;
+        uint32 timer_ms;
+        uint32 timer_on;
+        uint32 ts_dhcp_start;   /* ms ts ecord time stats */
+        uint32 ts_dhcp_ok;      /* ms ts ecord time stats */
+        bool dhcp_done;         /* flag, indicates that host done with
+                                 * dhcp before t1/t2 expiration
+                                 */
+        int bt_state;
+        struct work_struct work;
+        struct net_device *dev;
+};
+
+struct sta_info {
+        /* Structure to hold WPS IE for a STA */
+        u8  probe_req_ie[IE_MAX_LEN];
+        u8  assoc_req_ie[IE_MAX_LEN];
+        u32 probe_req_ie_len;
+        u32 assoc_req_ie_len;
+};
+/* dongle private data of cfg80211 interface */
+struct wl_priv {
+        struct wireless_dev *wdev;      /* representing wl cfg80211 device */
+        struct wireless_dev *vwdev[VWDEV_CNT];
+        struct wl_conf *conf;   /* dongle configuration */
+        struct cfg80211_scan_request *scan_request;     /* scan request object */
+        EVENT_HANDLER evt_handler[WLC_E_LAST];
+        struct list_head eq_list;       /* used for event queue */
+        spinlock_t eq_lock;     /* for event queue synchronization */
+        struct mutex usr_sync;  /* maily for dongle up/down synchronization */
+        struct wl_scan_results *bss_list;
+        struct wl_scan_results *scan_results;
+
+        /* scan request object for internal purpose */
+        struct wl_scan_req *scan_req_int;
+
+        /* bss information for cfg80211 layer */
+        struct wl_cfg80211_bss_info *bss_info;
+        /* information element object for internal purpose */
+        struct wl_ie ie;
+
+        /* for synchronization of main event thread */
+        struct wl_profile *profile;     /* holding dongle profile */
+        struct wl_iscan_ctrl *iscan;    /* iscan controller */
+
+        /* association information container */
+        struct wl_connect_info conn_info;
+
+        /* control firwmare and nvram paramter downloading */
+        struct wl_fw_ctrl *fw;
+        struct wl_pmk_list *pmk_list;   /* wpa2 pmk list */
+        tsk_ctl_t event_tsk;            /* task of main event handler thread */
+        unsigned long status;           /* current dongle status */
+        void *pub;
+        u32 channel;            /* current channel */
+        bool iscan_on;          /* iscan on/off switch */
+        bool iscan_kickstart;   /* indicate iscan already started */
+        bool escan_on;      /* escan on/off switch */
+        struct escan_info escan_info;   /* escan information */
+        bool active_scan;       /* current scan mode */
+        bool ibss_starter;      /* indicates this sta is ibss starter */
+        bool link_up;           /* link/connection up flag */
+
+        /* indicate whether dongle to support power save mode */
+        bool pwr_save;
+        bool dongle_up;         /* indicate whether dongle up or not */
+        bool roam_on;           /* on/off switch for dongle self-roaming */
+        bool scan_tried;        /* indicates if first scan attempted */
+        u8 *ioctl_buf;  /* ioctl buffer */
+        u8 *escan_ioctl_buf;
+        u8 *extra_buf;  /* maily to grab assoc information */
+        struct dentry *debugfsdir;
+        struct rfkill *rfkill;
+        bool rf_blocked;
+        struct ieee80211_channel remain_on_chan;
+        enum nl80211_channel_type remain_on_chan_type;
+        u64 cache_cookie;
+        wait_queue_head_t dongle_event_wait;
+        struct ap_info *ap_info;
+        struct sta_info *sta_info;
+        struct p2p_info *p2p;
+        bool p2p_supported;
+        struct btcoex_info *btcoex_info;
+        struct timer_list scan_timeout;   /* Timer for catch scan event timeout */
+};
+
+#define wl_to_wiphy(w) (w->wdev->wiphy)
+#define wl_to_prmry_ndev(w) (w->wdev->netdev)
+#define ndev_to_wl(n) (wdev_to_wl(n->ieee80211_ptr))
+#define wl_to_sr(w) (w->scan_req_int)
+#define wl_to_ie(w) (&w->ie)
+#define iscan_to_wl(i) ((struct wl_priv *)(i->data))
+#define wl_to_iscan(w) (w->iscan)
+#define wl_to_conn(w) (&w->conn_info)
+#define wiphy_from_scan(w) (w->escan_info.wiphy)
+#define wl_get_drv_status(wl, stat)   (test_bit(WL_STATUS_ ## stat, &(wl)->status))
+#define wl_set_drv_status(wl, stat)   (set_bit(WL_STATUS_ ## stat, &(wl)->status))
+#define wl_clr_drv_status(wl, stat)   (clear_bit(WL_STATUS_ ## stat, &(wl)->status))
+#define wl_chg_drv_status(wl, stat)   (change_bit(WL_STATUS_ ## stat, &(wl)->status))
+
+static inline struct wl_bss_info *next_bss(struct wl_scan_results *list, struct wl_bss_info *bss)
+{
+        return bss = bss ?
+                (struct wl_bss_info *)((uintptr) bss + dtoh32(bss->length)) : list->bss_info;
+}
+static inline s32 alloc_idx_vwdev(struct wl_priv *wl)
+{
+        s32 i = 0;
+        for (i = 0; i < VWDEV_CNT; i++) {
+                if (wl->vwdev[i] == NULL)
+                                return i;
+        }
+        return -1;
+}
+
+static inline s32 get_idx_vwdev_by_netdev(struct wl_priv *wl, struct net_device *ndev)
+{
+        s32 i = 0;
+        for (i = 0; i < VWDEV_CNT; i++) {
+                if ((wl->vwdev[i] != NULL) && (wl->vwdev[i]->netdev == ndev))
+                                return i;
+        }
+        return -1;
+}
+
+static inline s32 get_mode_by_netdev(struct wl_priv *wl, struct net_device *ndev)
+{
+        s32 i = 0;
+        for (i = 0; i <= VWDEV_CNT; i++) {
+                if (wl->conf->mode[i].ndev != NULL && (wl->conf->mode[i].ndev == ndev))
+                        return wl->conf->mode[i].type;
+        }
+        return -1;
+}
+static inline void set_mode_by_netdev(struct wl_priv *wl, struct net_device *ndev, s32 type)
+{
+        s32 i = 0;
+        for (i = 0; i <= VWDEV_CNT; i++) {
+                if (type == -1) {
+                        /* free the info of netdev */
+                        if (wl->conf->mode[i].ndev == ndev) {
+                                wl->conf->mode[i].ndev = NULL;
+                                wl->conf->mode[i].type = -1;
+                                break;
+                        }
+
+                } else {
+                        if ((wl->conf->mode[i].ndev != NULL)&&
+                        (wl->conf->mode[i].ndev == ndev)) {
+                                /* update type of ndev */
+                                wl->conf->mode[i].type = type;
+                                break;
+                        }
+                        else if ((wl->conf->mode[i].ndev == NULL)&&
+                        (wl->conf->mode[i].type == -1)) {
+                                wl->conf->mode[i].ndev = ndev;
+                                wl->conf->mode[i].type = type;
+                                break;
+                        }
+                }
+        }
+}
+#define free_vwdev_by_index(wl, __i) do {      \
+                                                if (wl->vwdev[__i] != NULL) \
+                                                        kfree(wl->vwdev[__i]); \
+                                                wl->vwdev[__i] = NULL; \
+                                        } while (0)
+
+#define for_each_bss(list, bss, __i)    \
+        for (__i = 0; __i < list->count && __i < WL_AP_MAX; __i++, bss = next_bss(list, bss))
+
+/* In case of WPS from wpa_supplicant, pairwise siute and group suite is 0.
+ * In addtion to that, wpa_version is WPA_VERSION_1
+ */
+#define is_wps_conn(_sme) \
+        ((_sme->crypto.wpa_versions & NL80211_WPA_VERSION_1) && \
+         (!_sme->crypto.n_ciphers_pairwise) && \
+         (!_sme->crypto.cipher_group))
+extern s32 wl_cfg80211_attach(struct net_device *ndev, void *data);
+extern s32 wl_cfg80211_attach_post(struct net_device *ndev);
+extern void wl_cfg80211_detach(void);
+/* event handler from dongle */
+extern void wl_cfg80211_event(struct net_device *ndev, const wl_event_msg_t *e,
+            void *data);
+extern void wl_cfg80211_set_sdio_func(void *func);      /* set sdio function info */
+extern struct sdio_func *wl_cfg80211_get_sdio_func(void);       /* set sdio function info */
+extern s32 wl_cfg80211_up(void);        /* dongle up */
+extern s32 wl_cfg80211_down(void);      /* dongle down */
+extern s32 wl_cfg80211_notify_ifadd(struct net_device *net, s32 idx, s32 bssidx,
+int (*_net_attach)(dhd_pub_t *dhdp, int ifidx));
+extern s32 wl_cfg80211_notify_ifdel(struct net_device *ndev);
+extern s32 wl_cfg80211_is_progress_ifadd(void);
+extern s32 wl_cfg80211_is_progress_ifchange(void);
+extern s32 wl_cfg80211_is_progress_ifadd(void);
+extern s32 wl_cfg80211_notify_ifchange(void);
+extern void wl_cfg80211_dbg_level(u32 level);
+extern void *wl_cfg80211_request_fw(s8 *file_name);
+extern s32 wl_cfg80211_read_fw(s8 *buf, u32 size);
+extern void wl_cfg80211_release_fw(void);
+extern s8 *wl_cfg80211_get_fwname(void);
+extern s8 *wl_cfg80211_get_nvramname(void);
+extern s32 wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr);
+extern s32 wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_set_wps_p2p_ie(struct net_device *net, char *buf, int len,
+        enum wl_management_type type);
+extern s32 wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len);
+extern int wl_cfg80211_hang(struct net_device *dev, u16 reason);
+
+/* do scan abort */
+extern s32
+wl_cfg80211_scan_abort(struct wl_priv *wl, struct net_device *ndev);
+
+extern s32
+wl_cfg80211_if_is_group_owner(void);
+#endif                          /* _wl_cfg80211_h_ */
diff --git a/drivers/net/wireless/bcmdhd/wl_cfgp2p.c b/drivers/net/wireless/bcmdhd/wl_cfgp2p.c
new file mode 100644
index 00000000000..4ee6557e17d
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wl_cfgp2p.c
@@ -0,0 +1,1469 @@
+/*
+ * Linux cfgp2p driver
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wl_cfgp2p.c,v 1.1.4.1.2.14 2011-02-09 01:40:07 $
+ *
+ */
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <wldev_common.h>
+
+
+static s8 ioctlbuf[WLC_IOCTL_MAXLEN];
+static s8 scanparambuf[WLC_IOCTL_SMLEN];
+static s8 *smbuf = ioctlbuf;
+
+static bool
+wl_cfgp2p_has_ie(u8 *ie, u8 **tlvs, u32 *tlvs_len, const u8 *oui, u32 oui_len, u8 type);
+
+static s32
+wl_cfgp2p_vndr_ie(struct net_device *ndev, s32 bssidx, s32 pktflag,
+            s8 *oui, s32 ie_id, s8 *data, s32 data_len, s32 delete);
+/*
+ *  Initialize variables related to P2P
+ *
+ */
+s32
+wl_cfgp2p_init_priv(struct wl_priv *wl)
+{
+        if (!(wl->p2p = kzalloc(sizeof(struct p2p_info), GFP_KERNEL))) {
+                CFGP2P_ERR(("struct p2p_info allocation failed\n"));
+                return -ENOMEM;
+        }
+#define INIT_IE(IE_TYPE, BSS_TYPE)              \
+        do {                                                    \
+                memset(wl_to_p2p_bss_saved_ie(wl, BSS_TYPE).p2p_ ## IE_TYPE ## _ie, 0, \
+                   sizeof(wl_to_p2p_bss_saved_ie(wl, BSS_TYPE).p2p_ ## IE_TYPE ## _ie)); \
+                wl_to_p2p_bss_saved_ie(wl, BSS_TYPE).p2p_ ## IE_TYPE ## _ie_len = 0; \
+        } while (0);
+
+        INIT_IE(probe_req, P2PAPI_BSSCFG_PRIMARY);
+        INIT_IE(probe_res, P2PAPI_BSSCFG_PRIMARY);
+        INIT_IE(assoc_req, P2PAPI_BSSCFG_PRIMARY);
+        INIT_IE(assoc_res, P2PAPI_BSSCFG_PRIMARY);
+        INIT_IE(beacon,    P2PAPI_BSSCFG_PRIMARY);
+        INIT_IE(probe_req, P2PAPI_BSSCFG_DEVICE);
+        INIT_IE(probe_res, P2PAPI_BSSCFG_DEVICE);
+        INIT_IE(assoc_req, P2PAPI_BSSCFG_DEVICE);
+        INIT_IE(assoc_res, P2PAPI_BSSCFG_DEVICE);
+        INIT_IE(beacon,    P2PAPI_BSSCFG_DEVICE);
+        INIT_IE(probe_req, P2PAPI_BSSCFG_CONNECTION);
+        INIT_IE(probe_res, P2PAPI_BSSCFG_CONNECTION);
+        INIT_IE(assoc_req, P2PAPI_BSSCFG_CONNECTION);
+        INIT_IE(assoc_res, P2PAPI_BSSCFG_CONNECTION);
+        INIT_IE(beacon,    P2PAPI_BSSCFG_CONNECTION);
+#undef INIT_IE
+        wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_PRIMARY) = wl_to_prmry_ndev(wl);
+        wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_PRIMARY) = 0;
+        wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_DEVICE) = NULL;
+        wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE) = 0;
+        wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_CONNECTION) = NULL;
+        wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_CONNECTION) = 0;
+        spin_lock_init(&wl->p2p->timer_lock);
+        return BCME_OK;
+
+}
+/*
+ *  Deinitialize variables related to P2P
+ *
+ */
+void
+wl_cfgp2p_deinit_priv(struct wl_priv *wl)
+{
+        if (wl->p2p) {
+                kfree(wl->p2p);
+                wl->p2p = NULL;
+        }
+        wl->p2p_supported = 0;
+}
+/*
+ * Set P2P functions into firmware
+ */
+s32
+wl_cfgp2p_set_firm_p2p(struct wl_priv *wl)
+{
+        struct net_device *ndev = wl_to_prmry_ndev(wl);
+        struct ether_addr null_eth_addr = { { 0, 0, 0, 0, 0, 0 } };
+        s32 ret = BCME_OK;
+        s32 val = 0;
+        /* Do we have to check whether APSTA is enabled or not ? */
+        wldev_iovar_getint(ndev, "apsta", &val);
+        if (val == 0) {
+                val = 1;
+                wldev_ioctl(ndev, WLC_DOWN, &val, sizeof(s32), true);
+                wldev_iovar_setint(ndev, "apsta", val);
+                wldev_ioctl(ndev, WLC_UP, &val, sizeof(s32), true);
+        }
+        val = 1;
+        /* Disable firmware roaming for P2P  */
+        wldev_iovar_setint(ndev, "roam_off", val);
+        /* In case of COB type, firmware has default mac address
+         * After Initializing firmware, we have to set current mac address to
+         * firmware for P2P device address
+         */
+        ret = wldev_iovar_setbuf_bsscfg(ndev, "p2p_da_override", &null_eth_addr,
+                    sizeof(null_eth_addr), ioctlbuf, sizeof(ioctlbuf), 0);
+        if (ret && ret != BCME_UNSUPPORTED) {
+                CFGP2P_ERR(("failed to update device address\n"));
+        }
+        return ret;
+}
+
+/* Create a new P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to create
+ * @if_type  : interface type: WL_P2P_IF_GO or WL_P2P_IF_CLIENT
+ * @chspec   : chspec to use if creating a GO BSS.
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifadd(struct wl_priv *wl, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec)
+{
+        wl_p2p_if_t ifreq;
+        s32 err;
+        struct net_device *ndev = wl_to_prmry_ndev(wl);
+
+        ifreq.type = if_type;
+        ifreq.chspec = chspec;
+        memcpy(ifreq.addr.octet, mac->octet, sizeof(ifreq.addr.octet));
+
+        CFGP2P_INFO(("---wl p2p_ifadd %02x:%02x:%02x:%02x:%02x:%02x %s %u\n",
+            ifreq.addr.octet[0], ifreq.addr.octet[1], ifreq.addr.octet[2],
+                ifreq.addr.octet[3], ifreq.addr.octet[4], ifreq.addr.octet[5],
+                (if_type == WL_P2P_IF_GO) ? "go" : "client",
+                (chspec & WL_CHANSPEC_CHAN_MASK) >> WL_CHANSPEC_CHAN_SHIFT));
+
+        err = wldev_iovar_setbuf(ndev, "p2p_ifadd", &ifreq, sizeof(ifreq),
+                ioctlbuf, sizeof(ioctlbuf));
+        return err;
+}
+
+/* Delete a P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to create
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifdel(struct wl_priv *wl, struct ether_addr *mac)
+{
+        s32 ret;
+        struct net_device *netdev = wl_to_prmry_ndev(wl);
+
+        CFGP2P_INFO(("------primary idx %d : wl p2p_ifdel %02x:%02x:%02x:%02x:%02x:%02x\n",
+            netdev->ifindex, mac->octet[0], mac->octet[1], mac->octet[2],
+            mac->octet[3], mac->octet[4], mac->octet[5]));
+        ret = wldev_iovar_setbuf(netdev, "p2p_ifdel", mac, sizeof(*mac),
+                ioctlbuf, sizeof(ioctlbuf));
+        if (unlikely(ret < 0)) {
+                printk("'wl p2p_ifdel' error %d\n", ret);
+        }
+        return ret;
+}
+
+/* Change a P2P Role.
+ * Parameters:
+ * @mac      : MAC address of the BSS to change a role
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifchange(struct wl_priv *wl, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec)
+{
+        wl_p2p_if_t ifreq;
+        s32 err;
+        struct net_device *netdev =  wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_CONNECTION);
+
+        ifreq.type = if_type;
+        ifreq.chspec = chspec;
+        memcpy(ifreq.addr.octet, mac->octet, sizeof(ifreq.addr.octet));
+
+        CFGP2P_INFO(("---wl p2p_ifchange %02x:%02x:%02x:%02x:%02x:%02x %s %u\n",
+            ifreq.addr.octet[0], ifreq.addr.octet[1], ifreq.addr.octet[2],
+            ifreq.addr.octet[3], ifreq.addr.octet[4], ifreq.addr.octet[5],
+            (if_type == WL_P2P_IF_GO) ? "go" : "client",
+                (chspec & WL_CHANSPEC_CHAN_MASK) >> WL_CHANSPEC_CHAN_SHIFT));
+
+        err = wldev_iovar_setbuf(netdev, "p2p_ifupd", &ifreq, sizeof(ifreq),
+                ioctlbuf, sizeof(ioctlbuf));
+
+        if (unlikely(err < 0)) {
+                printk("'wl p2p_ifupd' error %d\n", err);
+        }
+        return err;
+}
+
+
+/* Get the index of a created P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the created BSS
+ * @index    : output: index of created BSS
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifidx(struct wl_priv *wl, struct ether_addr *mac, s32 *index)
+{
+        s32 ret;
+        u8 getbuf[64];
+        struct net_device *dev = wl_to_prmry_ndev(wl);
+
+        CFGP2P_INFO(("---wl p2p_if %02x:%02x:%02x:%02x:%02x:%02x\n",
+            mac->octet[0], mac->octet[1], mac->octet[2],
+            mac->octet[3], mac->octet[4], mac->octet[5]));
+
+        ret = wldev_iovar_getbuf_bsscfg(dev, "p2p_if", mac, sizeof(*mac),
+                    getbuf, sizeof(getbuf), wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_PRIMARY));
+
+        if (ret == 0) {
+                memcpy(index, getbuf, sizeof(index));
+                CFGP2P_INFO(("---wl p2p_if   ==> %d\n", *index));
+        }
+
+        return ret;
+}
+
+s32
+wl_cfgp2p_set_discovery(struct wl_priv *wl, s32 on)
+{
+        s32 ret = BCME_OK;
+        struct net_device *ndev = wl_to_prmry_ndev(wl);
+        CFGP2P_DBG(("enter\n"));
+
+        ret = wldev_iovar_setint(ndev, "p2p_disc", on);
+
+        if (unlikely(ret < 0)) {
+                CFGP2P_ERR(("p2p_disc %d error %d\n", on, ret));
+        }
+
+        return ret;
+}
+
+/* Set the WL driver's P2P mode.
+ * Parameters :
+ * @mode      : is one of WL_P2P_DISC_ST_{SCAN,LISTEN,SEARCH}.
+ * @channel   : the channel to listen
+ * @listen_ms : the time (milli seconds) to wait
+ * @bssidx    : bss index for BSSCFG
+ * Returns 0 if success
+ */
+
+s32
+wl_cfgp2p_set_p2p_mode(struct wl_priv *wl, u8 mode, u32 channel, u16 listen_ms, int bssidx)
+{
+        wl_p2p_disc_st_t discovery_mode;
+        s32 ret;
+        struct net_device *dev;
+        CFGP2P_DBG(("enter\n"));
+
+        if (unlikely(bssidx >= P2PAPI_BSSCFG_MAX)) {
+                CFGP2P_ERR((" %d index out of range\n", bssidx));
+                return -1;
+        }
+
+        dev = wl_to_p2p_bss_ndev(wl, bssidx);
+        if (unlikely(dev == NULL)) {
+                CFGP2P_ERR(("bssidx %d is not assigned\n", bssidx));
+                return BCME_NOTFOUND;
+        }
+
+        /* Put the WL driver into P2P Listen Mode to respond to P2P probe reqs */
+        discovery_mode.state = mode;
+        discovery_mode.chspec = CH20MHZ_CHSPEC(channel);
+        discovery_mode.dwell = listen_ms;
+        ret = wldev_iovar_setbuf_bsscfg(dev, "p2p_state", &discovery_mode,
+                    sizeof(discovery_mode), ioctlbuf, sizeof(ioctlbuf), bssidx);
+
+        return ret;
+}
+
+/* Get the index of the P2P Discovery BSS */
+s32
+wl_cfgp2p_get_disc_idx(struct wl_priv *wl, s32 *index)
+{
+        s32 ret;
+        struct net_device *dev = wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_PRIMARY);
+
+        ret = wldev_iovar_getint(dev, "p2p_dev", index);
+        CFGP2P_INFO(("p2p_dev bsscfg_idx=%d ret=%d\n", *index, ret));
+
+        if (unlikely(ret <  0)) {
+            CFGP2P_ERR(("'p2p_dev' error %d\n", ret));
+                return ret;
+        }
+        return ret;
+}
+
+s32
+wl_cfgp2p_init_discovery(struct wl_priv *wl)
+{
+
+        s32 index = 0;
+        s32 ret = BCME_OK;
+
+        CFGP2P_DBG(("enter\n"));
+
+        if (wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE) != 0) {
+                CFGP2P_ERR(("do nothing, already initialized\n"));
+                return ret;
+        }
+
+        ret = wl_cfgp2p_set_discovery(wl, 1);
+        if (ret < 0) {
+                CFGP2P_ERR(("set discover error\n"));
+                return ret;
+        }
+        /* Enable P2P Discovery in the WL Driver */
+        ret = wl_cfgp2p_get_disc_idx(wl, &index);
+
+        if (ret < 0) {
+                return ret;
+        }
+        wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_DEVICE) =
+            wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_PRIMARY);
+        wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE) = index;
+
+        /* Set the initial discovery state to SCAN */
+        ret = wl_cfgp2p_set_p2p_mode(wl, WL_P2P_DISC_ST_SCAN, 0, 0,
+                wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE));
+
+        if (unlikely(ret != 0)) {
+                CFGP2P_ERR(("unable to set WL_P2P_DISC_ST_SCAN\n"));
+                wl_cfgp2p_set_discovery(wl, 0);
+                wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE) = 0;
+                wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_DEVICE) = NULL;
+                return 0;
+        }
+        return ret;
+}
+
+/* Deinitialize P2P Discovery
+ * Parameters :
+ * @wl        : wl_private data
+ * Returns 0 if succes
+ */
+s32
+wl_cfgp2p_deinit_discovery(struct wl_priv *wl)
+{
+        s32 ret = BCME_OK;
+        CFGP2P_DBG(("enter\n"));
+
+        if (wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE) == 0) {
+                CFGP2P_ERR(("do nothing, not initialized\n"));
+                return -1;
+        }
+        /* Set the discovery state to SCAN */
+        ret = wl_cfgp2p_set_p2p_mode(wl, WL_P2P_DISC_ST_SCAN, 0, 0,
+                    wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE));
+        /* Disable P2P discovery in the WL driver (deletes the discovery BSSCFG) */
+        ret = wl_cfgp2p_set_discovery(wl, 0);
+
+        /* Clear our saved WPS and P2P IEs for the discovery BSS.  The driver
+         * deleted these IEs when wl_cfgp2p_set_discovery() deleted the discovery
+         * BSS.
+         */
+
+        /* Clear the saved bsscfg index of the discovery BSSCFG to indicate we
+         * have no discovery BSS.
+         */
+        wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE) = 0;
+        wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_DEVICE) = NULL;
+
+        return ret;
+
+}
+/* Enable P2P Discovery
+ * Parameters:
+ * @wl  : wl_private data
+ * @ie  : probe request ie (WPS IE + P2P IE)
+ * @ie_len   : probe request ie length
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_enable_discovery(struct wl_priv *wl, struct net_device *dev, const u8 *ie, u32 ie_len)
+{
+        s32 ret = BCME_OK;
+        if (wl_get_p2p_status(wl, DISCOVERY_ON)) {
+                CFGP2P_INFO((" DISCOVERY is already initialized, we have nothing to do\n"));
+                goto set_ie;
+        }
+
+        wl_set_p2p_status(wl, DISCOVERY_ON);
+
+        CFGP2P_DBG(("enter\n"));
+
+        ret = wl_cfgp2p_init_discovery(wl);
+        if (unlikely(ret < 0)) {
+                CFGP2P_ERR((" init discovery error %d\n", ret));
+                goto exit;
+        }
+        /* Set wsec to any non-zero value in the discovery bsscfg to ensure our
+         * P2P probe responses have the privacy bit set in the 802.11 WPA IE.
+         * Some peer devices may not initiate WPS with us if this bit is not set.
+         */
+        ret = wldev_iovar_setint_bsscfg(wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_DEVICE),
+                        "wsec", AES_ENABLED, wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE));
+        if (unlikely(ret < 0)) {
+                CFGP2P_ERR((" wsec error %d\n", ret));
+        }
+set_ie:
+        ret = wl_cfgp2p_set_management_ie(wl, dev,
+                    wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE),
+                    VNDR_IE_PRBREQ_FLAG, ie, ie_len);
+
+        if (unlikely(ret < 0)) {
+                CFGP2P_ERR(("set probreq ie occurs error %d\n", ret));
+                goto exit;
+        }
+exit:
+        return ret;
+}
+
+/* Disable P2P Discovery
+ * Parameters:
+ * @wl       : wl_private_data
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_disable_discovery(struct wl_priv *wl)
+{
+        s32 ret = BCME_OK;
+        CFGP2P_DBG((" enter\n"));
+        wl_clr_p2p_status(wl, DISCOVERY_ON);
+
+        if (wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE) == 0) {
+                CFGP2P_ERR((" do nothing, not initialized\n"));
+                goto exit;
+        }
+
+        ret = wl_cfgp2p_set_p2p_mode(wl, WL_P2P_DISC_ST_SCAN, 0, 0,
+                    wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE));
+
+        if (unlikely(ret < 0)) {
+
+                CFGP2P_ERR(("unable to set WL_P2P_DISC_ST_SCAN\n"));
+        }
+        /* Do a scan abort to stop the driver's scan engine in case it is still
+         * waiting out an action frame tx dwell time.
+         */
+#ifdef NOT_YET
+        if (wl_get_p2p_status(wl, SCANNING)) {
+                p2pwlu_scan_abort(hdl, FALSE);
+        }
+#endif
+        wl_clr_p2p_status(wl, DISCOVERY_ON);
+        ret = wl_cfgp2p_deinit_discovery(wl);
+
+exit:
+        return ret;
+}
+
+s32
+wl_cfgp2p_escan(struct wl_priv *wl, struct net_device *dev, u16 active,
+        u32 num_chans, u16 *channels,
+        s32 search_state, u16 action, u32 bssidx)
+{
+        s32 ret = BCME_OK;
+        s32 memsize;
+        s32 eparams_size;
+        u32 i;
+        s8 *memblk;
+        wl_p2p_scan_t *p2p_params;
+        wl_escan_params_t *eparams;
+        wlc_ssid_t ssid;
+        /* Scan parameters */
+#define P2PAPI_SCAN_NPROBES 4
+#define P2PAPI_SCAN_DWELL_TIME_MS 80
+#define P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS 100
+#define P2PAPI_SCAN_HOME_TIME_MS 10
+        struct net_device *pri_dev = wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_PRIMARY);
+        wl_set_p2p_status(wl, SCANNING);
+        /* Allocate scan params which need space for 3 channels and 0 ssids */
+        eparams_size = (WL_SCAN_PARAMS_FIXED_SIZE +
+            OFFSETOF(wl_escan_params_t, params)) +
+                num_chans * sizeof(eparams->params.channel_list[0]);
+
+        memsize = sizeof(wl_p2p_scan_t) + eparams_size;
+        memblk = scanparambuf;
+        if (memsize > sizeof(scanparambuf)) {
+                CFGP2P_ERR((" scanpar buf too small (%u > %u)\n",
+                    memsize, sizeof(scanparambuf)));
+                return -1;
+        }
+        memset(memblk, 0, memsize);
+        memset(ioctlbuf, 0, sizeof(ioctlbuf));
+        if (search_state == WL_P2P_DISC_ST_SEARCH) {
+                /*
+                 * If we in SEARCH STATE, we don't need to set SSID explictly
+                 * because dongle use P2P WILDCARD internally by default
+                 */
+                wl_cfgp2p_set_p2p_mode(wl, WL_P2P_DISC_ST_SEARCH, 0, 0, bssidx);
+                ssid.SSID_len = htod32(0);
+
+        } else if (search_state == WL_P2P_DISC_ST_SCAN) {
+                /* SCAN STATE 802.11 SCAN
+                 * WFD Supplicant has p2p_find command with (type=progressive, type= full)
+                 * So if P2P_find command with type=progressive,
+                 * we have to set ssid to P2P WILDCARD because
+                 * we just do broadcast scan unless setting SSID
+                 */
+                strcpy(ssid.SSID, WL_P2P_WILDCARD_SSID);
+                ssid.SSID_len = htod32(WL_P2P_WILDCARD_SSID_LEN);
+                wl_cfgp2p_set_p2p_mode(wl, WL_P2P_DISC_ST_SCAN, 0, 0, bssidx);
+        }
+
+
+        /* Fill in the P2P scan structure at the start of the iovar param block */
+        p2p_params = (wl_p2p_scan_t*) memblk;
+        p2p_params->type = 'E';
+        /* Fill in the Scan structure that follows the P2P scan structure */
+        eparams = (wl_escan_params_t*) (p2p_params + 1);
+        eparams->params.bss_type = DOT11_BSSTYPE_ANY;
+        if (active)
+                eparams->params.scan_type = DOT11_SCANTYPE_ACTIVE;
+        else
+                eparams->params.scan_type = DOT11_SCANTYPE_PASSIVE;
+
+        memcpy(&eparams->params.bssid, &ether_bcast, ETHER_ADDR_LEN);
+        if (ssid.SSID_len)
+                memcpy(&eparams->params.ssid, &ssid, sizeof(wlc_ssid_t));
+
+        eparams->params.nprobes = htod32(P2PAPI_SCAN_NPROBES);
+        eparams->params.home_time = htod32(P2PAPI_SCAN_HOME_TIME_MS);
+        if (wl_get_drv_status(wl, CONNECTED))
+                eparams->params.active_time = htod32(-1);
+        else if (num_chans == 3)
+                eparams->params.active_time = htod32(P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS);
+        else
+                eparams->params.active_time = htod32(P2PAPI_SCAN_DWELL_TIME_MS);
+        eparams->params.passive_time = htod32(-1);
+        eparams->params.channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+            (num_chans & WL_SCAN_PARAMS_COUNT_MASK));
+
+        for (i = 0; i < num_chans; i++) {
+                eparams->params.channel_list[i] = htodchanspec(channels[i]);
+        }
+        eparams->version = htod32(ESCAN_REQ_VERSION);
+        eparams->action =  htod16(action);
+        eparams->sync_id = htod16(0x1234);
+        CFGP2P_INFO(("SCAN CHANNELS : "));
+
+        for (i = 0; i < num_chans; i++) {
+                if (i == 0) CFGP2P_INFO(("%d", channels[i]));
+                else CFGP2P_INFO((",%d", channels[i]));
+        }
+
+        CFGP2P_INFO(("\n"));
+
+        ret = wldev_iovar_setbuf_bsscfg(pri_dev, "p2p_scan",
+                    memblk, memsize, smbuf, sizeof(ioctlbuf), bssidx);
+        return ret;
+}
+/* Check whether pointed-to IE looks like WPA. */
+#define wl_cfgp2p_is_wpa_ie(ie, tlvs, len)      wl_cfgp2p_has_ie(ie, tlvs, len, \
+                (const uint8 *)WPS_OUI, WPS_OUI_LEN, WPA_OUI_TYPE)
+/* Check whether pointed-to IE looks like WPS. */
+#define wl_cfgp2p_is_wps_ie(ie, tlvs, len)      wl_cfgp2p_has_ie(ie, tlvs, len, \
+                (const uint8 *)WPS_OUI, WPS_OUI_LEN, WPS_OUI_TYPE)
+/* Check whether the given IE looks like WFA P2P IE. */
+#define wl_cfgp2p_is_p2p_ie(ie, tlvs, len)      wl_cfgp2p_has_ie(ie, tlvs, len, \
+                (const uint8 *)WFA_OUI, WFA_OUI_LEN, WFA_OUI_TYPE_P2P)
+/* Delete and Set a management vndr ie to firmware
+ * Parameters:
+ * @wl       : wl_private data
+ * @ndev     : net device for bssidx
+ * @bssidx   : bssidx for BSS
+ * @pktflag  : packet flag for IE (VNDR_IE_PRBREQ_FLAG,VNDR_IE_PRBRSP_FLAG, VNDR_IE_ASSOCRSP_FLAG,
+ *                                 VNDR_IE_ASSOCREQ_FLAG)
+ * @ie       :  VNDR IE (such as P2P IE , WPS IE)
+ * @ie_len   : VNDR IE Length
+ * Returns 0 if success.
+ */
+
+s32
+wl_cfgp2p_set_management_ie(struct wl_priv *wl, struct net_device *ndev, s32 bssidx,
+    s32 pktflag, const u8 *vndr_ie, u32 vndr_ie_len)
+{
+        /* Vendor-specific Information Element ID */
+#define VNDR_SPEC_ELEMENT_ID 0xdd
+        s32 ret = BCME_OK;
+        u32 pos;
+        u8  *ie_buf;
+        u8  *mgmt_ie_buf = NULL;
+        u32 mgmt_ie_buf_len = 0;
+        u32 *mgmt_ie_len = 0;
+        u8 ie_id, ie_len;
+        u8 delete = 0;
+#define IE_TYPE(type, bsstype) (wl_to_p2p_bss_saved_ie(wl, bsstype).p2p_ ## type ## _ie)
+#define IE_TYPE_LEN(type, bsstype) (wl_to_p2p_bss_saved_ie(wl, bsstype).p2p_ ## type ## _ie_len)
+        if (wl->p2p_supported && p2p_on(wl) && bssidx != -1) {
+                if (bssidx == P2PAPI_BSSCFG_PRIMARY)
+                        bssidx =  wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE);
+                switch (pktflag) {
+                        case VNDR_IE_PRBREQ_FLAG :
+                                mgmt_ie_buf = IE_TYPE(probe_req, bssidx);
+                                mgmt_ie_len = &IE_TYPE_LEN(probe_req, bssidx);
+                                mgmt_ie_buf_len = sizeof(IE_TYPE(probe_req, bssidx));
+                                break;
+                        case VNDR_IE_PRBRSP_FLAG :
+                                mgmt_ie_buf = IE_TYPE(probe_res, bssidx);
+                                mgmt_ie_len = &IE_TYPE_LEN(probe_res, bssidx);
+                                mgmt_ie_buf_len = sizeof(IE_TYPE(probe_res, bssidx));
+                                break;
+                        case VNDR_IE_ASSOCREQ_FLAG :
+                                mgmt_ie_buf = IE_TYPE(assoc_req, bssidx);
+                                mgmt_ie_len = &IE_TYPE_LEN(assoc_req, bssidx);
+                                mgmt_ie_buf_len = sizeof(IE_TYPE(assoc_req, bssidx));
+                                break;
+                        case VNDR_IE_ASSOCRSP_FLAG :
+                                mgmt_ie_buf = IE_TYPE(assoc_res, bssidx);
+                                mgmt_ie_len = &IE_TYPE_LEN(assoc_res, bssidx);
+                                mgmt_ie_buf_len = sizeof(IE_TYPE(assoc_res, bssidx));
+                                break;
+                        case VNDR_IE_BEACON_FLAG :
+                                mgmt_ie_buf = IE_TYPE(beacon, bssidx);
+                                mgmt_ie_len = &IE_TYPE_LEN(beacon, bssidx);
+                                mgmt_ie_buf_len = sizeof(IE_TYPE(beacon, bssidx));
+                                break;
+                        default:
+                                mgmt_ie_buf = NULL;
+                                mgmt_ie_len = NULL;
+                                CFGP2P_ERR(("not suitable type\n"));
+                                return -1;
+                }
+        } else if (get_mode_by_netdev(wl, ndev) == WL_MODE_AP) {
+                switch (pktflag) {
+                        case VNDR_IE_PRBRSP_FLAG :
+                                mgmt_ie_buf = wl->ap_info->probe_res_ie;
+                                mgmt_ie_len = &wl->ap_info->probe_res_ie_len;
+                                mgmt_ie_buf_len = sizeof(wl->ap_info->probe_res_ie);
+                                break;
+                        case VNDR_IE_BEACON_FLAG :
+                                mgmt_ie_buf = wl->ap_info->beacon_ie;
+                                mgmt_ie_len = &wl->ap_info->beacon_ie_len;
+                                mgmt_ie_buf_len = sizeof(wl->ap_info->beacon_ie);
+                                break;
+                        default:
+                                mgmt_ie_buf = NULL;
+                                mgmt_ie_len = NULL;
+                                CFGP2P_ERR(("not suitable type\n"));
+                                return -1;
+                }
+                bssidx = 0;
+        } else if (bssidx == -1 && get_mode_by_netdev(wl, ndev) == WL_MODE_BSS) {
+                switch (pktflag) {
+                        case VNDR_IE_PRBREQ_FLAG :
+                                mgmt_ie_buf = wl->sta_info->probe_req_ie;
+                                mgmt_ie_len = &wl->sta_info->probe_req_ie_len;
+                                mgmt_ie_buf_len = sizeof(wl->sta_info->probe_req_ie);
+                                break;
+                        case VNDR_IE_ASSOCREQ_FLAG :
+                                mgmt_ie_buf = wl->sta_info->assoc_req_ie;
+                                mgmt_ie_len = &wl->sta_info->assoc_req_ie_len;
+                                mgmt_ie_buf_len = sizeof(wl->sta_info->assoc_req_ie);
+                                break;
+                        default:
+                                mgmt_ie_buf = NULL;
+                                mgmt_ie_len = NULL;
+                                CFGP2P_ERR(("not suitable type\n"));
+                                return -1;
+                }
+                bssidx = 0;
+        } else {
+                CFGP2P_ERR(("not suitable type\n"));
+                return -1;
+        }
+
+        if (vndr_ie_len > mgmt_ie_buf_len) {
+                CFGP2P_ERR(("extra IE size too big\n"));
+                ret = -ENOMEM;
+        } else {
+                if (mgmt_ie_buf != NULL) {
+                        if (vndr_ie_len && (vndr_ie_len == *mgmt_ie_len) &&
+                             (memcmp(mgmt_ie_buf, vndr_ie, vndr_ie_len) == 0)) {
+                                CFGP2P_INFO(("Previous mgmt IE is equals to current IE"));
+                                goto exit;
+                        }
+                        pos = 0;
+                        delete = 1;
+                        ie_buf = (u8 *) mgmt_ie_buf;
+                        while (pos < *mgmt_ie_len) {
+                                ie_id = ie_buf[pos++];
+                                ie_len = ie_buf[pos++];
+                                if ((ie_id == DOT11_MNG_VS_ID) &&
+                                   (wl_cfgp2p_is_wps_ie(&ie_buf[pos-2], NULL, 0) ||
+                                        wl_cfgp2p_is_p2p_ie(&ie_buf[pos-2], NULL, 0))) {
+                                        CFGP2P_INFO(("DELELED ID : %d, Len : %d , OUI :"
+                                                "%02x:%02x:%02x\n", ie_id, ie_len, ie_buf[pos],
+                                                ie_buf[pos+1], ie_buf[pos+2]));
+                                        ret = wl_cfgp2p_vndr_ie(ndev, bssidx, pktflag, ie_buf+pos,
+                                            VNDR_SPEC_ELEMENT_ID, ie_buf+pos+3, ie_len-3, delete);
+                                }
+                                pos += ie_len;
+                        }
+
+                }
+                *mgmt_ie_len = 0;
+                /* Add if there is any extra IE */
+                if (vndr_ie && vndr_ie_len) {
+                        /* save the current IE in wl struct */
+                        memcpy(mgmt_ie_buf, vndr_ie, vndr_ie_len);
+                        *mgmt_ie_len = vndr_ie_len;
+                        pos = 0;
+                        ie_buf = (u8 *) vndr_ie;
+                        delete = 0;
+                        while (pos < vndr_ie_len) {
+                                ie_id = ie_buf[pos++];
+                                ie_len = ie_buf[pos++];
+                                if ((ie_id == DOT11_MNG_VS_ID) &&
+                                   (wl_cfgp2p_is_wps_ie(&ie_buf[pos-2], NULL, 0) ||
+                                        wl_cfgp2p_is_p2p_ie(&ie_buf[pos-2], NULL, 0))) {
+                                        CFGP2P_INFO(("ADDED ID : %d, Len : %d , OUI :"
+                                                "%02x:%02x:%02x\n", ie_id, ie_len, ie_buf[pos],
+                                                ie_buf[pos+1], ie_buf[pos+2]));
+                                        ret = wl_cfgp2p_vndr_ie(ndev, bssidx, pktflag, ie_buf+pos,
+                                            VNDR_SPEC_ELEMENT_ID, ie_buf+pos+3, ie_len-3, delete);
+                                }
+                                pos += ie_len;
+                        }
+                }
+        }
+#undef IE_TYPE
+#undef IE_TYPE_LEN
+exit:
+        return ret;
+}
+
+/* Clear the manament IE buffer of BSSCFG
+ * Parameters:
+ * @wl       : wl_private data
+ * @bssidx   : bssidx for BSS
+ *
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_clear_management_ie(struct wl_priv *wl, s32 bssidx)
+{
+#define INIT_IE(IE_TYPE, BSS_TYPE)              \
+        do {                                                    \
+                memset(wl_to_p2p_bss_saved_ie(wl, BSS_TYPE).p2p_ ## IE_TYPE ## _ie, 0, \
+                   sizeof(wl_to_p2p_bss_saved_ie(wl, BSS_TYPE).p2p_ ## IE_TYPE ## _ie)); \
+                wl_to_p2p_bss_saved_ie(wl, BSS_TYPE).p2p_ ## IE_TYPE ## _ie_len = 0; \
+        } while (0);
+        if (bssidx < 0) {
+                CFGP2P_ERR(("invalid bssidx\n"));
+                return BCME_BADARG;
+        }
+        INIT_IE(probe_req, bssidx);
+        INIT_IE(probe_res, bssidx);
+        INIT_IE(assoc_req, bssidx);
+        INIT_IE(assoc_res, bssidx);
+        INIT_IE(beacon, bssidx);
+        return BCME_OK;
+}
+
+
+/* Is any of the tlvs the expected entry? If
+ * not update the tlvs buffer pointer/length.
+ */
+static bool
+wl_cfgp2p_has_ie(u8 *ie, u8 **tlvs, u32 *tlvs_len, const u8 *oui, u32 oui_len, u8 type)
+{
+        /* If the contents match the OUI and the type */
+        if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
+                !bcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
+                type == ie[TLV_BODY_OFF + oui_len]) {
+                return TRUE;
+        }
+
+        if (tlvs == NULL)
+                return FALSE;
+        /* point to the next ie */
+        ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
+        /* calculate the length of the rest of the buffer */
+        *tlvs_len -= (int)(ie - *tlvs);
+        /* update the pointer to the start of the buffer */
+        *tlvs = ie;
+
+        return FALSE;
+}
+
+wpa_ie_fixed_t *
+wl_cfgp2p_find_wpaie(u8 *parse, u32 len)
+{
+        bcm_tlv_t *ie;
+
+        while ((ie = bcm_parse_tlvs(parse, (u32)len, DOT11_MNG_VS_ID))) {
+                if (wl_cfgp2p_is_wpa_ie((u8*)ie, &parse, &len)) {
+                        return (wpa_ie_fixed_t *)ie;
+                }
+        }
+        return NULL;
+}
+
+wpa_ie_fixed_t *
+wl_cfgp2p_find_wpsie(u8 *parse, u32 len)
+{
+        bcm_tlv_t *ie;
+
+        while ((ie = bcm_parse_tlvs(parse, (u32)len, DOT11_MNG_VS_ID))) {
+                if (wl_cfgp2p_is_wps_ie((u8*)ie, &parse, &len)) {
+                        return (wpa_ie_fixed_t *)ie;
+                }
+        }
+        return NULL;
+}
+
+wifi_p2p_ie_t *
+wl_cfgp2p_find_p2pie(u8 *parse, u32 len)
+{
+        bcm_tlv_t *ie;
+
+        while ((ie = bcm_parse_tlvs(parse, (int)len, DOT11_MNG_VS_ID))) {
+                if (wl_cfgp2p_is_p2p_ie((uint8*)ie, &parse, &len)) {
+                        return (wifi_p2p_ie_t *)ie;
+                }
+        }
+        return NULL;
+}
+
+static s32
+wl_cfgp2p_vndr_ie(struct net_device *ndev, s32 bssidx, s32 pktflag,
+            s8 *oui, s32 ie_id, s8 *data, s32 data_len, s32 delete)
+{
+        s32 err = BCME_OK;
+        s32 buf_len;
+        s32 iecount;
+
+        vndr_ie_setbuf_t *ie_setbuf;
+
+        /* Validate the pktflag parameter */
+        if ((pktflag & ~(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG |
+                    VNDR_IE_ASSOCRSP_FLAG | VNDR_IE_AUTHRSP_FLAG |
+                    VNDR_IE_PRBREQ_FLAG | VNDR_IE_ASSOCREQ_FLAG))) {
+                CFGP2P_ERR(("p2pwl_vndr_ie: Invalid packet flag 0x%x\n", pktflag));
+                return -1;
+        }
+
+        buf_len = sizeof(vndr_ie_setbuf_t) + data_len - 1;
+        ie_setbuf = (vndr_ie_setbuf_t *) kzalloc(buf_len, GFP_KERNEL);
+
+        CFGP2P_INFO((" ie_id : %02x, data length : %d\n", ie_id, data_len));
+        if (!ie_setbuf) {
+
+                CFGP2P_ERR(("Error allocating buffer for IE\n"));
+                return -ENOMEM;
+        }
+        if (delete)
+                strcpy(ie_setbuf->cmd, "del");
+        else
+                strcpy(ie_setbuf->cmd, "add");
+        /* Buffer contains only 1 IE */
+        iecount = htod32(1);
+        memcpy((void *)&ie_setbuf->vndr_ie_buffer.iecount, &iecount, sizeof(int));
+        pktflag = htod32(pktflag);
+        memcpy((void *)&ie_setbuf->vndr_ie_buffer.vndr_ie_list[0].pktflag,
+            &pktflag, sizeof(uint32));
+        ie_setbuf->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = ie_id;
+        ie_setbuf->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len
+                = (uchar)(data_len + VNDR_IE_MIN_LEN);
+        memcpy(ie_setbuf->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui, oui, 3);
+        memcpy(ie_setbuf->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.data, data, data_len);
+        err = wldev_iovar_setbuf_bsscfg(ndev, "vndr_ie", ie_setbuf, buf_len,
+                ioctlbuf, sizeof(ioctlbuf), bssidx);
+
+        CFGP2P_INFO(("vndr_ie iovar returns %d\n", err));
+        kfree(ie_setbuf);
+        return err;
+}
+
+/*
+ * Search the bssidx based on dev argument
+ * Parameters:
+ * @wl       : wl_private data
+ * @ndev     : net device to search bssidx
+ *  Returns bssidx for ndev
+ */
+s32
+wl_cfgp2p_find_idx(struct wl_priv *wl, struct net_device *ndev)
+{
+        u32 i;
+        s32 index = -1;
+
+        if (ndev == NULL) {
+                CFGP2P_ERR((" ndev is NULL\n"));
+                goto exit;
+        }
+        if (!wl->p2p_supported) {
+                return P2PAPI_BSSCFG_PRIMARY;
+        }
+        for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+                if (ndev == wl_to_p2p_bss_ndev(wl, i)) {
+                        index = wl_to_p2p_bss_bssidx(wl, i);
+                        break;
+                }
+        }
+        if (index == -1)
+                return P2PAPI_BSSCFG_PRIMARY;
+exit:
+        return index;
+}
+/*
+ * Callback function for WLC_E_P2P_DISC_LISTEN_COMPLETE
+ */
+s32
+wl_cfgp2p_listen_complete(struct wl_priv *wl, struct net_device *ndev,
+            const wl_event_msg_t *e, void *data)
+{
+        s32 ret = BCME_OK;
+
+        CFGP2P_DBG((" Enter\n"));
+        if (wl_get_p2p_status(wl, LISTEN_EXPIRED) == 0) {
+                wl_set_p2p_status(wl, LISTEN_EXPIRED);
+                if (timer_pending(&wl->p2p->listen_timer)) {
+                        spin_lock_bh(&wl->p2p->timer_lock);
+                        del_timer_sync(&wl->p2p->listen_timer);
+                        spin_unlock_bh(&wl->p2p->timer_lock);
+                }
+                cfg80211_remain_on_channel_expired(ndev, wl->cache_cookie, &wl->remain_on_chan,
+                    wl->remain_on_chan_type, GFP_KERNEL);
+        } else
+                wl_clr_p2p_status(wl, LISTEN_EXPIRED);
+
+        return ret;
+
+}
+
+/*
+ *  Timer expire callback function for LISTEN
+ *  We can't report cfg80211_remain_on_channel_expired from Timer ISR context,
+ *  so lets do it from thread context.
+ */
+static void
+wl_cfgp2p_listen_expired(unsigned long data)
+{
+        wl_event_msg_t msg;
+        struct wl_priv *wl = (struct wl_priv *) data;
+
+        CFGP2P_DBG((" Enter\n"));
+        msg.event_type =  hton32(WLC_E_P2P_DISC_LISTEN_COMPLETE);
+        wl_cfg80211_event(wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_DEVICE), &msg, NULL);
+}
+
+/*
+ * Do a P2P Listen on the given channel for the given duration.
+ * A listen consists of sitting idle and responding to P2P probe requests
+ * with a P2P probe response.
+ *
+ * This fn assumes dongle p2p device discovery is already enabled.
+ * Parameters   :
+ * @wl          : wl_private data
+ * @channel     : channel to listen
+ * @duration_ms : the time (milli seconds) to wait
+ */
+s32
+wl_cfgp2p_discover_listen(struct wl_priv *wl, s32 channel, u32 duration_ms)
+{
+#define INIT_TIMER(timer, func, duration, extra_delay)  \
+        do {                   \
+                init_timer(timer); \
+                timer->function = func; \
+                timer->expires = jiffies + msecs_to_jiffies(duration + extra_delay); \
+                timer->data = (unsigned long) wl; \
+                add_timer(timer); \
+        } while (0);
+
+        s32 ret = BCME_OK;
+        struct timer_list *_timer;
+        CFGP2P_DBG((" Enter Channel : %d, Duration : %d\n", channel, duration_ms));
+        if (unlikely(wl_get_p2p_status(wl, DISCOVERY_ON) == 0)) {
+
+                CFGP2P_ERR((" Discovery is not set, so we have noting to do\n"));
+
+                ret = BCME_NOTREADY;
+                goto exit;
+        }
+        if (timer_pending(&wl->p2p->listen_timer)) {
+                CFGP2P_DBG(("previous LISTEN is not completed yet\n"));
+                goto exit;
+
+        } else
+                wl_clr_p2p_status(wl, LISTEN_EXPIRED);
+
+        wl_cfgp2p_set_p2p_mode(wl, WL_P2P_DISC_ST_LISTEN, channel, (u16) duration_ms,
+                    wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE));
+        _timer = &wl->p2p->listen_timer;
+
+        /*  We will wait to receive WLC_E_P2P_DISC_LISTEN_COMPLETE from dongle ,
+         *  otherwise we will wait up to duration_ms + 200ms
+         */
+        INIT_TIMER(_timer, wl_cfgp2p_listen_expired, duration_ms, 200);
+
+#undef INIT_TIMER
+exit:
+        return ret;
+}
+
+
+s32
+wl_cfgp2p_discover_enable_search(struct wl_priv *wl, u8 enable)
+{
+        s32 ret = BCME_OK;
+        CFGP2P_DBG((" Enter\n"));
+        if (!wl_get_p2p_status(wl, DISCOVERY_ON)) {
+
+                CFGP2P_DBG((" do nothing, discovery is off\n"));
+                return ret;
+        }
+        if (wl_get_p2p_status(wl, SEARCH_ENABLED) == enable) {
+                CFGP2P_DBG(("already : %d\n", enable));
+                return ret;
+        }
+
+        wl_chg_p2p_status(wl, SEARCH_ENABLED);
+        /* When disabling Search, reset the WL driver's p2p discovery state to
+         * WL_P2P_DISC_ST_SCAN.
+         */
+        if (!enable) {
+                wl_clr_p2p_status(wl, SCANNING);
+                ret = wl_cfgp2p_set_p2p_mode(wl, WL_P2P_DISC_ST_SCAN, 0, 0,
+                            wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE));
+        }
+
+        return ret;
+}
+
+/*
+ * Callback function for WLC_E_ACTION_FRAME_COMPLETE, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE
+ */
+s32
+wl_cfgp2p_action_tx_complete(struct wl_priv *wl, struct net_device *ndev,
+            const wl_event_msg_t *e, void *data)
+{
+        s32 ret = BCME_OK;
+        u32 event_type = ntoh32(e->event_type);
+        u32 status = ntoh32(e->status);
+        CFGP2P_DBG((" Enter\n"));
+        if (event_type == WLC_E_ACTION_FRAME_COMPLETE) {
+
+                CFGP2P_INFO((" WLC_E_ACTION_FRAME_COMPLETE is received : %d\n", status));
+                if (status == WLC_E_STATUS_SUCCESS) {
+                        wl_set_p2p_status(wl, ACTION_TX_COMPLETED);
+                }
+                else {
+                        wl_set_p2p_status(wl, ACTION_TX_NOACK);
+                        CFGP2P_ERR(("WLC_E_ACTION_FRAME_COMPLETE : NO ACK\n"));
+                }
+                wake_up_interruptible(&wl->dongle_event_wait);
+        } else {
+                CFGP2P_INFO((" WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE is received,"
+                                        "status : %d\n", status));
+        }
+        return ret;
+}
+/* Send an action frame immediately without doing channel synchronization.
+ *
+ * This function does not wait for a completion event before returning.
+ * The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action
+ * frame is transmitted.
+ * The WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE event will be received when an
+ * 802.11 ack has been received for the sent action frame.
+ */
+s32
+wl_cfgp2p_tx_action_frame(struct wl_priv *wl, struct net_device *dev,
+        wl_af_params_t *af_params, s32 bssidx)
+{
+        s32 ret = BCME_OK;
+        s32 timeout = 0;
+
+
+        CFGP2P_INFO(("\n"));
+        CFGP2P_INFO(("channel : %u , dwell time : %u\n",
+            af_params->channel, af_params->dwell_time));
+
+        wl_clr_p2p_status(wl, ACTION_TX_COMPLETED);
+        wl_clr_p2p_status(wl, ACTION_TX_NOACK);
+#define MAX_WAIT_TIME 2000
+        if (bssidx == P2PAPI_BSSCFG_PRIMARY)
+                bssidx =  wl_to_p2p_bss_bssidx(wl, P2PAPI_BSSCFG_DEVICE);
+
+        ret = wldev_iovar_setbuf_bsscfg(dev, "actframe",
+                   af_params, sizeof(*af_params), ioctlbuf, sizeof(ioctlbuf), bssidx);
+
+        if (ret < 0) {
+
+                CFGP2P_ERR((" sending action frame is failed\n"));
+                goto exit;
+        }
+        timeout = wait_event_interruptible_timeout(wl->dongle_event_wait,
+        (wl_get_p2p_status(wl, ACTION_TX_COMPLETED) || wl_get_p2p_status(wl, ACTION_TX_NOACK)),
+        msecs_to_jiffies(MAX_WAIT_TIME));
+
+        if (timeout > 0 && wl_get_p2p_status(wl, ACTION_TX_COMPLETED)) {
+                CFGP2P_INFO(("tx action frame operation is completed\n"));
+                ret = BCME_OK;
+        } else {
+                ret = BCME_ERROR;
+                CFGP2P_INFO(("tx action frame operation is failed\n"));
+        }
+exit:
+        CFGP2P_INFO((" via act frame iovar : status = %d\n", ret));
+#undef MAX_WAIT_TIME
+        return ret;
+}
+
+/* Generate our P2P Device Address and P2P Interface Address from our primary
+ * MAC address.
+ */
+void
+wl_cfgp2p_generate_bss_mac(struct ether_addr *primary_addr,
+            struct ether_addr *out_dev_addr, struct ether_addr *out_int_addr)
+{
+        memset(out_dev_addr, 0, sizeof(*out_dev_addr));
+        memset(out_int_addr, 0, sizeof(*out_int_addr));
+
+        /* Generate the P2P Device Address.  This consists of the device's
+         * primary MAC address with the locally administered bit set.
+         */
+        memcpy(out_dev_addr, primary_addr, sizeof(*out_dev_addr));
+        out_dev_addr->octet[0] |= 0x02;
+
+        /* Generate the P2P Interface Address.  If the discovery and connection
+         * BSSCFGs need to simultaneously co-exist, then this address must be
+         * different from the P2P Device Address.
+         */
+        memcpy(out_int_addr, out_dev_addr, sizeof(*out_int_addr));
+        out_int_addr->octet[4] ^= 0x80;
+
+}
+
+/* P2P IF Address change to Virtual Interface MAC Address */
+void
+wl_cfg80211_change_ifaddr(u8* buf, struct ether_addr *p2p_int_addr, u8 element_id)
+{
+        wifi_p2p_ie_t *ie = (wifi_p2p_ie_t*) buf;
+        u16 len = ie->len;
+        u8 *subel;
+        u8 subelt_id;
+        u16 subelt_len;
+        CFGP2P_DBG((" Enter\n"));
+
+        /* Point subel to the P2P IE's subelt field.
+         * Subtract the preceding fields (id, len, OUI, oui_type) from the length.
+         */
+        subel = ie->subelts;
+        len -= 4;       /* exclude OUI + OUI_TYPE */
+
+        while (len >= 3) {
+        /* attribute id */
+                subelt_id = *subel;
+                subel += 1;
+                len -= 1;
+
+                /* 2-byte little endian */
+                subelt_len = *subel++;
+                subelt_len |= *subel++ << 8;
+
+                len -= 2;
+                len -= subelt_len;      /* for the remaining subelt fields */
+
+                if (subelt_id == element_id) {
+                        if (subelt_id == P2P_SEID_INTINTADDR) {
+                                memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                                CFGP2P_INFO(("Intended P2P Interface Address ATTR FOUND\n"));
+                        } else if (subelt_id == P2P_SEID_DEV_ID) {
+                                memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                                CFGP2P_INFO(("Device ID ATTR FOUND\n"));
+                        } else if (subelt_id == P2P_SEID_DEV_INFO) {
+                                memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                                CFGP2P_INFO(("Device INFO ATTR FOUND\n"));
+                        } else if (subelt_id == P2P_SEID_GROUP_ID) {
+                                memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                                CFGP2P_INFO(("GROUP ID ATTR FOUND\n"));
+                        }                       return;
+                } else {
+                        CFGP2P_DBG(("OTHER id : %d\n", subelt_id));
+                }
+                subel += subelt_len;
+        }
+}
+/*
+ * Check if a BSS is up.
+ * This is a common implementation called by most OSL implementations of
+ * p2posl_bss_isup().  DO NOT call this function directly from the
+ * common code -- call p2posl_bss_isup() instead to allow the OSL to
+ * override the common implementation if necessary.
+ */
+bool
+wl_cfgp2p_bss_isup(struct net_device *ndev, int bsscfg_idx)
+{
+        s32 result, val;
+        bool isup = false;
+        s8 getbuf[64];
+
+        /* Check if the BSS is up */
+        *(int*)getbuf = -1;
+        result = wldev_iovar_getbuf_bsscfg(ndev, "bss", &bsscfg_idx,
+                            sizeof(bsscfg_idx), getbuf, sizeof(getbuf), 0);
+        if (result != 0) {
+                CFGP2P_ERR(("'wl bss -C %d' failed: %d\n", bsscfg_idx, result));
+                CFGP2P_ERR(("NOTE: this ioctl error is normal "
+                                        "when the BSS has not been created yet.\n"));
+        } else {
+                val = *(int*)getbuf;
+                val = dtoh32(val);
+                CFGP2P_INFO(("---wl bss -C %d   ==> %d\n", bsscfg_idx, val));
+                isup = (val ? TRUE : FALSE);
+        }
+        return isup;
+}
+
+
+/* Bring up or down a BSS */
+s32
+wl_cfgp2p_bss(struct net_device *ndev, s32 bsscfg_idx, s32 up)
+{
+        s32 ret = BCME_OK;
+        s32 val = up ? 1 : 0;
+
+        struct {
+                s32 cfg;
+                s32 val;
+        } bss_setbuf;
+
+        bss_setbuf.cfg = htod32(bsscfg_idx);
+        bss_setbuf.val = htod32(val);
+        CFGP2P_INFO(("---wl bss -C %d %s\n", bsscfg_idx, up ? "up" : "down"));
+        ret = wldev_iovar_setbuf(ndev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+                ioctlbuf, sizeof(ioctlbuf));
+
+        if (ret != 0) {
+                CFGP2P_ERR(("'bss %d' failed with %d\n", up, ret));
+        }
+
+        return ret;
+}
+
+/* Check if 'p2p' is supported in the driver */
+s32
+wl_cfgp2p_supported(struct wl_priv *wl, struct net_device *ndev)
+{
+        s32 ret = BCME_OK;
+        s32 p2p_supported = 0;
+        ret = wldev_iovar_getint(ndev, "p2p",
+                       &p2p_supported);
+        if (ret < 0) {
+                CFGP2P_ERR(("wl p2p error %d\n", ret));
+                return 0;
+        }
+        if (p2p_supported == 1) {
+                CFGP2P_INFO(("p2p is supported\n"));
+        } else {
+                CFGP2P_INFO(("p2p is unsupported\n"));
+                p2p_supported = 0;
+        }
+        return p2p_supported;
+}
+
+/* Cleanup P2P resources */
+s32
+wl_cfgp2p_down(struct wl_priv *wl)
+{
+        if (timer_pending(&wl->p2p->listen_timer))
+                del_timer_sync(&wl->p2p->listen_timer);
+        wl_cfgp2p_deinit_priv(wl);
+        return 0;
+}
+
+s32 wl_cfgp2p_set_p2p_noa(struct wl_priv *wl, struct net_device *ndev, char* buf, int len)
+{
+        s32 ret = -1;
+        int count, start, duration;
+        wl_p2p_sched_t dongle_noa;
+
+        CFGP2P_DBG((" Enter\n"));
+
+        memset(&dongle_noa, 0, sizeof(dongle_noa));
+
+        if (wl->p2p && wl->p2p->vif_created) {
+
+                wl->p2p->noa.desc[0].start = 0;
+
+                sscanf(buf, "%d %d %d", &count, &start, &duration);
+                CFGP2P_DBG(("set_p2p_noa count %d start %d duration %d\n",
+                                count, start, duration));
+                if (count != -1)
+                        wl->p2p->noa.desc[0].count = count;
+
+                /* supplicant gives interval as start */
+                if (start != -1)
+                        wl->p2p->noa.desc[0].interval = start;
+
+                if (duration != -1)
+                        wl->p2p->noa.desc[0].duration = duration;
+
+                if (wl->p2p->noa.desc[0].count != 255) {
+                        wl->p2p->noa.desc[0].start = 200;
+                        dongle_noa.type = WL_P2P_SCHED_TYPE_REQ_ABS;
+                        dongle_noa.action = WL_P2P_SCHED_ACTION_GOOFF;
+                        dongle_noa.option = WL_P2P_SCHED_OPTION_TSFOFS;
+                }
+                else {
+                        /* Continuous NoA interval. */
+                        dongle_noa.action = WL_P2P_SCHED_ACTION_NONE;
+                        dongle_noa.type = WL_P2P_SCHED_TYPE_ABS;
+                        if ((wl->p2p->noa.desc[0].interval == 102) ||
+                                (wl->p2p->noa.desc[0].interval == 100)) {
+                                wl->p2p->noa.desc[0].start = 100 -
+                                        wl->p2p->noa.desc[0].duration;
+                                dongle_noa.option = WL_P2P_SCHED_OPTION_BCNPCT;
+                        }
+                        else {
+                                dongle_noa.option = WL_P2P_SCHED_OPTION_NORMAL;
+                        }
+                }
+                /* Put the noa descriptor in dongle format for dongle */
+                dongle_noa.desc[0].count = htod32(wl->p2p->noa.desc[0].count);
+                if (dongle_noa.option == WL_P2P_SCHED_OPTION_BCNPCT) {
+                        dongle_noa.desc[0].start = htod32(wl->p2p->noa.desc[0].start);
+                        dongle_noa.desc[0].duration = htod32(wl->p2p->noa.desc[0].duration);
+                }
+                else {
+                        dongle_noa.desc[0].start = htod32(wl->p2p->noa.desc[0].start*1000);
+                        dongle_noa.desc[0].duration = htod32(wl->p2p->noa.desc[0].duration*1000);
+                }
+                dongle_noa.desc[0].interval = htod32(wl->p2p->noa.desc[0].interval*1000);
+
+                ret = wldev_iovar_setbuf(wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_CONNECTION),
+                        "p2p_noa", &dongle_noa, sizeof(dongle_noa), ioctlbuf, sizeof(ioctlbuf));
+
+                if (ret < 0) {
+                        CFGP2P_ERR(("fw set p2p_noa failed %d\n", ret));
+                }
+        }
+        else {
+                CFGP2P_ERR(("ERROR: set_noa in non-p2p mode\n"));
+        }
+        return ret;
+}
+
+s32 wl_cfgp2p_get_p2p_noa(struct wl_priv *wl, struct net_device *ndev, char* buf, int buf_len)
+{
+        wifi_p2p_noa_desc_t *noa_desc;
+        int len = 0, i;
+        char _buf[200];
+
+        CFGP2P_DBG((" Enter\n"));
+        buf[0] = '\0';
+        if (wl->p2p && wl->p2p->vif_created) {
+                if (wl->p2p->noa.desc[0].count || wl->p2p->ops.ops) {
+                        _buf[0] = 1; /* noa index */
+                        _buf[1] = (wl->p2p->ops.ops ? 0x80: 0) |
+                                (wl->p2p->ops.ctw & 0x7f); /* ops + ctw */
+                        len += 2;
+                        if (wl->p2p->noa.desc[0].count) {
+                                noa_desc = (wifi_p2p_noa_desc_t*)&_buf[len];
+                                noa_desc->cnt_type = wl->p2p->noa.desc[0].count;
+                                noa_desc->duration = wl->p2p->noa.desc[0].duration;
+                                noa_desc->interval = wl->p2p->noa.desc[0].interval;
+                                noa_desc->start = wl->p2p->noa.desc[0].start;
+                                len += sizeof(wifi_p2p_noa_desc_t);
+                        }
+                        if (buf_len <= len * 2) {
+                                CFGP2P_ERR(("ERROR: buf_len %d in not enough for"
+                                        "returning noa in string format\n", buf_len));
+                                return -1;
+                        }
+                        /* We have to convert the buffer data into ASCII strings */
+                        for (i = 0; i < len; i++) {
+                                sprintf(buf, "%02x", _buf[i]);
+                                buf += 2;
+                        }
+                        buf[i*2] = '\0';
+                }
+        }
+        else {
+                CFGP2P_ERR(("ERROR: get_noa in non-p2p mode\n"));
+                return -1;
+        }
+        return len * 2;
+}
+
+s32 wl_cfgp2p_set_p2p_ps(struct wl_priv *wl, struct net_device *ndev, char* buf, int len)
+{
+        int ps, ctw;
+        int ret = -1;
+        s32 legacy_ps;
+
+        CFGP2P_DBG((" Enter\n"));
+        if (wl->p2p && wl->p2p->vif_created) {
+                sscanf(buf, "%d %d %d", &legacy_ps, &ps, &ctw);
+                CFGP2P_DBG((" Enter legacy_ps %d ps %d ctw %d\n", legacy_ps, ps, ctw));
+                if (ctw != -1) {
+                        wl->p2p->ops.ctw = ctw;
+                        ret = 0;
+                }
+                if (ps != -1) {
+                        wl->p2p->ops.ops = ps;
+                        ret = wldev_iovar_setbuf(wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_CONNECTION),
+                                "p2p_ops", &wl->p2p->ops, sizeof(wl->p2p->ops),
+                                ioctlbuf, sizeof(ioctlbuf));
+                        if (ret < 0) {
+                                CFGP2P_ERR(("fw set p2p_ops failed %d\n", ret));
+                        }
+                }
+
+                if (legacy_ps != -1) {
+                        s32 pm = legacy_ps ? PM_MAX : PM_OFF;
+                        ret = wldev_ioctl(wl_to_p2p_bss_ndev(wl, P2PAPI_BSSCFG_CONNECTION),
+                                WLC_SET_PM, &pm, sizeof(pm), true);
+                        if (unlikely(ret)) {
+                                CFGP2P_ERR(("error (%d)\n", ret));
+                        }
+                }
+        }
+        else {
+                CFGP2P_ERR(("ERROR: set_p2p_ps in non-p2p mode\n"));
+                ret = -1;
+        }
+        return ret;
+}
diff --git a/drivers/net/wireless/bcmdhd/wl_cfgp2p.h b/drivers/net/wireless/bcmdhd/wl_cfgp2p.h
new file mode 100644
index 00000000000..5a69168c6a3
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wl_cfgp2p.h
@@ -0,0 +1,247 @@
+/*
+ * Linux cfgp2p driver
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wl_cfgp2p.h,v 1.1.4.1.2.8 2011/02/09 01:37:52 Exp $
+ */
+#ifndef _wl_cfgp2p_h_
+#define _wl_cfgp2p_h_
+#include <proto/802.11.h>
+#include <proto/p2p.h>
+
+struct wl_priv;
+extern u32 wl_dbg_level;
+
+/* Enumeration of the usages of the BSSCFGs used by the P2P Library.  Do not
+ * confuse this with a bsscfg index.  This value is an index into the
+ * saved_ie[] array of structures which in turn contains a bsscfg index field.
+ */
+typedef enum {
+        P2PAPI_BSSCFG_PRIMARY, /* maps to driver's primary bsscfg */
+        P2PAPI_BSSCFG_DEVICE, /* maps to driver's P2P device discovery bsscfg */
+        P2PAPI_BSSCFG_CONNECTION, /* maps to driver's P2P connection bsscfg */
+        P2PAPI_BSSCFG_MAX
+} p2p_bsscfg_type_t;
+
+#define IE_MAX_LEN 300
+/* Structure to hold all saved P2P and WPS IEs for a BSSCFG */
+struct p2p_saved_ie {
+        u8  p2p_probe_req_ie[IE_MAX_LEN];
+        u8  p2p_probe_res_ie[IE_MAX_LEN];
+        u8  p2p_assoc_req_ie[IE_MAX_LEN];
+        u8  p2p_assoc_res_ie[IE_MAX_LEN];
+        u8  p2p_beacon_ie[IE_MAX_LEN];
+        u32 p2p_probe_req_ie_len;
+        u32 p2p_probe_res_ie_len;
+        u32 p2p_assoc_req_ie_len;
+        u32 p2p_assoc_res_ie_len;
+        u32 p2p_beacon_ie_len;
+};
+
+struct p2p_bss {
+        u32 bssidx;
+        struct net_device *dev;
+        struct p2p_saved_ie saved_ie;
+        void *private_data;
+};
+
+struct p2p_info {
+        bool on;    /* p2p on/off switch */
+        bool scan;
+        bool vif_created;
+        s8 vir_ifname[IFNAMSIZ];
+        unsigned long status;
+        struct ether_addr dev_addr;
+        struct ether_addr int_addr;
+        struct p2p_bss bss_idx[P2PAPI_BSSCFG_MAX];
+        struct timer_list listen_timer;
+        wl_p2p_sched_t noa;
+        wl_p2p_ops_t ops;
+        wlc_ssid_t ssid;
+        spinlock_t timer_lock;
+};
+
+/* dongle status */
+enum wl_cfgp2p_status {
+        WLP2P_STATUS_DISCOVERY_ON = 0,
+        WLP2P_STATUS_SEARCH_ENABLED,
+        WLP2P_STATUS_IF_ADD,
+        WLP2P_STATUS_IF_DEL,
+        WLP2P_STATUS_IF_DELETING,
+        WLP2P_STATUS_IF_CHANGING,
+        WLP2P_STATUS_IF_CHANGED,
+        WLP2P_STATUS_LISTEN_EXPIRED,
+        WLP2P_STATUS_ACTION_TX_COMPLETED,
+        WLP2P_STATUS_ACTION_TX_NOACK,
+        WLP2P_STATUS_SCANNING
+};
+
+
+#define wl_to_p2p_bss_ndev(w, type)     ((wl)->p2p->bss_idx[type].dev)
+#define wl_to_p2p_bss_bssidx(w, type)   ((wl)->p2p->bss_idx[type].bssidx)
+#define wl_to_p2p_bss_saved_ie(w, type)         ((wl)->p2p->bss_idx[type].saved_ie)
+#define wl_to_p2p_bss_private(w, type)  ((wl)->p2p->bss_idx[type].private_data)
+#define wl_to_p2p_bss(wl, type) ((wl)->p2p->bss_idx[type])
+#define wl_get_p2p_status(wl, stat) ((!(wl)->p2p_supported) ? 0 : test_bit(WLP2P_STATUS_ ## stat, \
+                                                                        &(wl)->p2p->status))
+#define wl_set_p2p_status(wl, stat) ((!(wl)->p2p_supported) ? : set_bit(WLP2P_STATUS_ ## stat, \
+                                                                        &(wl)->p2p->status))
+#define wl_clr_p2p_status(wl, stat) ((!(wl)->p2p_supported) ? : clear_bit(WLP2P_STATUS_ ## stat, \
+                                                                        &(wl)->p2p->status))
+#define wl_chg_p2p_status(wl, stat) ((!(wl)->p2p_supported) ? : change_bit(WLP2P_STATUS_ ## stat, \
+                                                                        &(wl)->p2p->status))
+#define p2p_on(wl) ((wl)->p2p->on)
+#define p2p_scan(wl) ((wl)->p2p->scan)
+#define p2p_is_on(wl) ((wl)->p2p && (wl)->p2p->on)
+
+/* dword align allocation */
+#define WLC_IOCTL_MAXLEN 8192
+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
+#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
+
+#define CFGP2P_ERR(args)                                                                        \
+        do {                                                                            \
+                if (wl_dbg_level & WL_DBG_ERR) {                                \
+                        printk(KERN_ERR "CFGP2P-ERROR) %s : ", __func__);       \
+                        printk args;                                            \
+                }                                                                       \
+        } while (0)
+#define CFGP2P_INFO(args)                                                                       \
+        do {                                                                            \
+                if (wl_dbg_level & WL_DBG_INFO) {                               \
+                        printk(KERN_ERR "CFGP2P-INFO) %s : ", __func__);        \
+                        printk args;                                            \
+                }                                                                       \
+        } while (0)
+#define CFGP2P_DBG(args)                                                                \
+        do {                                                                    \
+                if (wl_dbg_level & WL_DBG_DBG) {                        \
+                        printk(KERN_ERR "CFGP2P-DEBUG) %s :", __func__);        \
+                        printk args;                                                    \
+                }                                                                       \
+        } while (0)
+
+
+extern s32
+wl_cfgp2p_init_priv(struct wl_priv *wl);
+extern void
+wl_cfgp2p_deinit_priv(struct wl_priv *wl);
+extern s32
+wl_cfgp2p_set_firm_p2p(struct wl_priv *wl);
+extern s32
+wl_cfgp2p_set_p2p_mode(struct wl_priv *wl, u8 mode,
+            u32 channel, u16 listen_ms, int bssidx);
+extern s32
+wl_cfgp2p_ifadd(struct wl_priv *wl, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec);
+extern s32
+wl_cfgp2p_ifdel(struct wl_priv *wl, struct ether_addr *mac);
+extern s32
+wl_cfgp2p_ifchange(struct wl_priv *wl, struct ether_addr *mac, u8 if_type, chanspec_t chspec);
+
+extern s32
+wl_cfgp2p_ifidx(struct wl_priv *wl, struct ether_addr *mac, s32 *index);
+
+extern s32
+wl_cfgp2p_init_discovery(struct wl_priv *wl);
+extern s32
+wl_cfgp2p_enable_discovery(struct wl_priv *wl, struct net_device *dev, const u8 *ie, u32 ie_len);
+extern s32
+wl_cfgp2p_disable_discovery(struct wl_priv *wl);
+extern s32
+wl_cfgp2p_escan(struct wl_priv *wl, struct net_device *dev, u16 active, u32 num_chans,
+        u16 *channels,
+        s32 search_state, u16 action, u32 bssidx);
+
+extern wpa_ie_fixed_t *
+wl_cfgp2p_find_wpaie(u8 *parse, u32 len);
+
+extern wpa_ie_fixed_t *
+wl_cfgp2p_find_wpsie(u8 *parse, u32 len);
+
+extern wifi_p2p_ie_t *
+wl_cfgp2p_find_p2pie(u8 *parse, u32 len);
+
+extern s32
+wl_cfgp2p_set_management_ie(struct wl_priv *wl, struct net_device *ndev, s32 bssidx,
+            s32 pktflag, const u8 *vndr_ie, u32 vndr_ie_len);
+extern s32
+wl_cfgp2p_clear_management_ie(struct wl_priv *wl, s32 bssidx);
+
+extern s32
+wl_cfgp2p_find_idx(struct wl_priv *wl, struct net_device *ndev);
+
+
+extern s32
+wl_cfgp2p_listen_complete(struct wl_priv *wl, struct net_device *ndev,
+            const wl_event_msg_t *e, void *data);
+extern s32
+wl_cfgp2p_discover_listen(struct wl_priv *wl, s32 channel, u32 duration_ms);
+
+extern s32
+wl_cfgp2p_discover_enable_search(struct wl_priv *wl, u8 enable);
+
+extern s32
+wl_cfgp2p_action_tx_complete(struct wl_priv *wl, struct net_device *ndev,
+            const wl_event_msg_t *e, void *data);
+extern s32
+wl_cfgp2p_tx_action_frame(struct wl_priv *wl, struct net_device *dev,
+        wl_af_params_t *af_params, s32 bssidx);
+
+extern void
+wl_cfgp2p_generate_bss_mac(struct ether_addr *primary_addr, struct ether_addr *out_dev_addr,
+            struct ether_addr *out_int_addr);
+
+extern void
+wl_cfg80211_change_ifaddr(u8* buf, struct ether_addr *p2p_int_addr, u8 element_id);
+extern bool
+wl_cfgp2p_bss_isup(struct net_device *ndev, int bsscfg_idx);
+
+extern s32
+wl_cfgp2p_bss(struct net_device *ndev, s32 bsscfg_idx, s32 up);
+
+
+extern s32
+wl_cfgp2p_supported(struct wl_priv *wl, struct net_device *ndev);
+
+extern s32
+wl_cfgp2p_down(struct wl_priv *wl);
+
+extern s32
+wl_cfgp2p_set_p2p_noa(struct wl_priv *wl, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_get_p2p_noa(struct wl_priv *wl, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_set_p2p_ps(struct wl_priv *wl, struct net_device *ndev, char* buf, int len);
+
+/* WiFi Direct */
+#define SOCIAL_CHAN_1 1
+#define SOCIAL_CHAN_2 6
+#define SOCIAL_CHAN_3 11
+#define WL_P2P_WILDCARD_SSID "DIRECT-"
+#define WL_P2P_WILDCARD_SSID_LEN 7
+#define WL_P2P_INTERFACE_PREFIX "p2p"
+#define WL_P2P_TEMP_CHAN "11"
+#define IS_P2P_SSID(ssid) (memcmp(ssid, WL_P2P_WILDCARD_SSID, WL_P2P_WILDCARD_SSID_LEN) == 0)
+#endif                          /* _wl_cfgp2p_h_ */
diff --git a/drivers/net/wireless/bcmdhd/wl_dbg.h b/drivers/net/wireless/bcmdhd/wl_dbg.h
new file mode 100644
index 00000000000..0b99557cbe8
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wl_dbg.h
@@ -0,0 +1,49 @@
+/*
+ * Minimal debug/trace/assert driver definitions for
+ * Broadcom 802.11 Networking Adapter.
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wl_dbg.h,v 1.115.6.3 2010-12-15 21:42:23 Exp $
+ */
+
+
+
+#ifndef _wl_dbg_h_
+#define _wl_dbg_h_
+
+
+extern uint32 wl_msg_level;
+extern uint32 wl_msg_level2;
+
+#define WL_PRINT(args)      printf args
+
+
+
+#define WL_NONE(args)
+
+#define WL_ERROR(args)
+#define WL_TRACE(args)
+
+
+extern uint32 wl_msg_level;
+extern uint32 wl_msg_level2;
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/wl_iw.c b/drivers/net/wireless/bcmdhd/wl_iw.c
new file mode 100644
index 00000000000..457372b62b3
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wl_iw.c
@@ -0,0 +1,8766 @@
+/*
+ * Linux Wireless Extensions support
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wl_iw.c,v 1.132.2.18 2011-02-05 01:44:47 Exp $
+ */
+
+#include <wlioctl.h>
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+
+typedef void wlc_info_t;
+typedef void wl_info_t;
+typedef const struct si_pub  si_t;
+#include <wlioctl.h>
+
+#include <proto/ethernet.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#define WL_ERROR(x) printf x
+#define WL_TRACE(x)
+#define WL_ASSOC(x)
+#define WL_INFORM(x)
+#define WL_WSEC(x)
+#define WL_SCAN(x)
+
+
+#ifdef PNO_SET_DEBUG
+#define WL_PNO(x)       printf x
+#else
+#define WL_PNO(x)
+#endif
+
+
+#define JF2MS ((((jiffies / HZ) * 1000) + ((jiffies % HZ) * 1000) / HZ))
+
+#ifdef COEX_DBG       
+#define WL_TRACE_COEX(x) printf("TS:%lu ", JF2MS); \
+                                                        printf x
+#else
+#define WL_TRACE_COEX(x)
+#endif
+
+#ifdef SCAN_DBG        
+#define WL_TRACE_SCAN(x) printf("TS:%lu ", JF2MS); \
+                                                        printf x
+#else
+#define WL_TRACE_SCAN(x)
+#endif
+
+
+#include <wl_iw.h>
+
+
+
+
+#define IW_WSEC_ENABLED(wsec)   ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))
+
+#include <linux/rtnetlink.h>
+
+#define WL_IW_USE_ISCAN  1
+#define ENABLE_ACTIVE_PASSIVE_SCAN_SUPPRESS  1
+
+#ifdef OEM_CHROMIUMOS
+bool g_set_essid_before_scan = TRUE;
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+        struct mutex  g_wl_ss_scan_lock; 
+#endif 
+
+#if defined(SOFTAP)
+#define WL_SOFTAP(x)
+static struct net_device *priv_dev;
+extern bool ap_cfg_running;
+extern bool ap_fw_loaded;
+struct net_device *ap_net_dev = NULL;
+tsk_ctl_t ap_eth_ctl;
+static int wl_iw_set_ap_security(struct net_device *dev, struct ap_profile *ap);
+static int wl_iw_softap_deassoc_stations(struct net_device *dev, u8 *mac);
+#endif 
+
+
+#define WL_IW_IOCTL_CALL(func_call) \
+        do {                            \
+                func_call;              \
+        } while (0)
+
+#define RETURN_IF_EXTRA_NULL(extra) \
+        if (!extra) { \
+                WL_ERROR(("%s: error : extra is null pointer\n", __FUNCTION__)); \
+                return -EINVAL; \
+        }
+
+static int              g_onoff = G_WLAN_SET_ON;
+wl_iw_extra_params_t    g_wl_iw_params;
+
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+
+static struct mutex     wl_cache_lock;
+static struct mutex     wl_softap_lock;
+
+#define DHD_OS_MUTEX_INIT(a) mutex_init(a)
+#define DHD_OS_MUTEX_LOCK(a) mutex_lock(a)
+#define DHD_OS_MUTEX_UNLOCK(a) mutex_unlock(a)
+
+#else
+
+#define DHD_OS_MUTEX_INIT(a)
+#define DHD_OS_MUTEX_LOCK(a)
+#define DHD_OS_MUTEX_UNLOCK(a)
+
+#endif 
+
+#include <bcmsdbus.h>
+extern void dhd_customer_gpio_wlan_ctrl(int onoff);
+extern uint dhd_dev_reset(struct net_device *dev, uint8 flag);
+extern void dhd_dev_init_ioctl(struct net_device *dev);
+
+uint wl_msg_level = WL_ERROR_VAL;
+
+#define MAX_WLIW_IOCTL_LEN 1024
+
+
+#define htod32(i) i
+#define htod16(i) i
+#define dtoh32(i) i
+#define dtoh16(i) i
+#define htodchanspec(i) i
+#define dtohchanspec(i) i
+
+#ifdef CONFIG_WIRELESS_EXT
+
+extern struct iw_statistics *dhd_get_wireless_stats(struct net_device *dev);
+extern int dhd_wait_pend8021x(struct net_device *dev);
+#endif 
+
+#if WIRELESS_EXT < 19
+#define IW_IOCTL_IDX(cmd)       ((cmd) - SIOCIWFIRST)
+#define IW_EVENT_IDX(cmd)       ((cmd) - IWEVFIRST)
+#endif 
+
+static void *g_scan = NULL;
+static volatile uint g_scan_specified_ssid;     
+static wlc_ssid_t g_specific_ssid;              
+
+static wlc_ssid_t g_ssid;
+
+#ifdef CONFIG_WPS2
+static char *g_wps_probe_req_ie;
+static int g_wps_probe_req_ie_len;
+#endif
+
+bool btcoex_is_sco_active(struct net_device *dev);  
+static wl_iw_ss_cache_ctrl_t g_ss_cache_ctrl;   
+#if defined(CONFIG_FIRST_SCAN)
+static volatile uint g_first_broadcast_scan;    
+static volatile uint g_first_counter_scans;
+#define MAX_ALLOWED_BLOCK_SCAN_FROM_FIRST_SCAN 3
+#endif 
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define DAEMONIZE(a) daemonize(a); \
+        allow_signal(SIGKILL); \
+        allow_signal(SIGTERM);
+#else 
+#define RAISE_RX_SOFTIRQ() \
+        cpu_raise_softirq(smp_processor_id(), NET_RX_SOFTIRQ)
+#define DAEMONIZE(a) daemonize(); \
+        do { if (a) \
+                strncpy(current->comm, a, MIN(sizeof(current->comm), (strlen(a) + 1))); \
+        } while (0);
+#endif 
+
+#if defined(WL_IW_USE_ISCAN)
+#if  !defined(CSCAN)
+static void wl_iw_free_ss_cache(void);
+static int   wl_iw_run_ss_cache_timer(int kick_off);
+#endif 
+#if defined(CONFIG_FIRST_SCAN)
+int  wl_iw_iscan_set_scan_broadcast_prep(struct net_device *dev, uint flag);
+#endif 
+static int dev_wlc_bufvar_set(struct net_device *dev, char *name, char *buf, int len);
+#define ISCAN_STATE_IDLE   0
+#define ISCAN_STATE_SCANING 1
+
+
+#define WLC_IW_ISCAN_MAXLEN   2048
+typedef struct iscan_buf {
+        struct iscan_buf * next;
+        char   iscan_buf[WLC_IW_ISCAN_MAXLEN];
+} iscan_buf_t;
+
+typedef struct iscan_info {
+        struct net_device *dev;
+        struct timer_list timer;
+        uint32 timer_ms;
+        uint32 timer_on;
+        int    iscan_state;
+        iscan_buf_t * list_hdr;
+        iscan_buf_t * list_cur;
+
+        
+        tsk_ctl_t tsk_ctl;
+
+        uint32 scan_flag;       
+#if defined CSCAN
+        char ioctlbuf[WLC_IOCTL_MEDLEN];
+#else
+        char ioctlbuf[WLC_IOCTL_SMLEN];
+#endif 
+        
+        wl_iscan_params_t *iscan_ex_params_p;
+        int iscan_ex_param_size;
+} iscan_info_t;
+
+
+
+#define  COEX_DHCP 1    
+#ifdef COEX_DHCP
+
+#define BT_DHCP_eSCO_FIX 
+#define BT_DHCP_USE_FLAGS  
+#define BT_DHCP_OPPORTUNITY_WINDOW_TIME  2500 
+#define BT_DHCP_FLAG_FORCE_TIME 5500 
+
+
+
+static int wl_iw_set_btcoex_dhcp(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+);
+
+static void wl_iw_bt_flag_set(struct net_device *dev, bool set);
+static void wl_iw_bt_release(void);
+
+typedef enum bt_coex_status {
+        BT_DHCP_IDLE = 0,
+        BT_DHCP_START,
+        BT_DHCP_OPPORTUNITY_WINDOW,
+        BT_DHCP_FLAG_FORCE_TIMEOUT
+} coex_status_t;
+
+
+typedef struct bt_info {
+        struct net_device *dev;
+        struct timer_list timer;
+        uint32 timer_ms;
+        uint32 timer_on;
+        uint32 ts_dhcp_start; 
+        uint32 ts_dhcp_ok;    
+        bool    dhcp_done; 
+        int     bt_state;
+
+        
+        tsk_ctl_t tsk_ctl;
+
+} bt_info_t;
+
+bt_info_t *g_bt = NULL;
+static void wl_iw_bt_timerfunc(ulong data);
+#endif 
+iscan_info_t *g_iscan = NULL;
+void dhd_print_buf(void *pbuf, int len, int bytes_per_line);
+static void wl_iw_timerfunc(ulong data);
+static void wl_iw_set_event_mask(struct net_device *dev);
+static int
+wl_iw_iscan(iscan_info_t *iscan, wlc_ssid_t *ssid, uint16 action);
+#endif 
+
+static int
+wl_iw_set_scan(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+);
+
+#ifndef CSCAN
+static int
+wl_iw_get_scan(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+);
+
+static uint
+wl_iw_get_scan_prep(
+        wl_scan_results_t *list,
+        struct iw_request_info *info,
+        char *extra,
+        short max_size
+);
+#endif 
+
+static void
+swap_key_from_BE(
+        wl_wsec_key_t *key
+)
+{
+        key->index = htod32(key->index);
+        key->len = htod32(key->len);
+        key->algo = htod32(key->algo);
+        key->flags = htod32(key->flags);
+        key->rxiv.hi = htod32(key->rxiv.hi);
+        key->rxiv.lo = htod16(key->rxiv.lo);
+        key->iv_initialized = htod32(key->iv_initialized);
+}
+
+static void
+swap_key_to_BE(
+        wl_wsec_key_t *key
+)
+{
+        key->index = dtoh32(key->index);
+        key->len = dtoh32(key->len);
+        key->algo = dtoh32(key->algo);
+        key->flags = dtoh32(key->flags);
+        key->rxiv.hi = dtoh32(key->rxiv.hi);
+        key->rxiv.lo = dtoh16(key->rxiv.lo);
+        key->iv_initialized = dtoh32(key->iv_initialized);
+}
+
+static int
+dev_wlc_ioctl(
+        struct net_device *dev,
+        int cmd,
+        void *arg,
+        int len
+)
+{
+        struct ifreq ifr;
+        wl_ioctl_t ioc;
+        mm_segment_t fs;
+        int ret = -EINVAL;
+
+        if (!dev) {
+                WL_ERROR(("%s: dev is null\n", __FUNCTION__));
+                return ret;
+        }
+
+        net_os_wake_lock(dev);
+
+        WL_INFORM(("%s, PID:%x: send Local IOCTL -> dhd: cmd:0x%x, buf:%p, len:%d ,\n",
+                __FUNCTION__, current->pid, cmd, arg, len));
+
+        if (g_onoff == G_WLAN_SET_ON) {
+                memset(&ioc, 0, sizeof(ioc));
+                ioc.cmd = cmd;
+                ioc.buf = arg;
+                ioc.len = len;
+
+                strcpy(ifr.ifr_name, dev->name);
+                ifr.ifr_data = (caddr_t) &ioc;
+
+                
+                ret = dev_open(dev);
+                if (ret) {
+                        WL_ERROR(("%s: Error dev_open: %d\n", __func__, ret));
+                        net_os_wake_unlock(dev);
+                        return ret;
+                }
+
+                fs = get_fs();
+                set_fs(get_ds());
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 31)
+                ret = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
+#else
+                ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
+#endif 
+                set_fs(fs);
+        }
+        else {
+                WL_TRACE(("%s: call after driver stop : ignored\n", __FUNCTION__));
+        }
+
+        net_os_wake_unlock(dev);
+
+        return ret;
+}
+
+
+static int
+dev_wlc_intvar_get_reg(
+        struct net_device *dev,
+        char *name,
+        uint  reg,
+        int *retval)
+{
+        union {
+                char buf[WLC_IOCTL_SMLEN];
+                int val;
+        } var;
+        int error;
+
+        uint len;
+        len = bcm_mkiovar(name, (char *)(&reg), sizeof(reg), (char *)(&var), sizeof(var.buf));
+        ASSERT(len);
+        error = dev_wlc_ioctl(dev, WLC_GET_VAR, (void *)&var, len);
+
+        *retval = dtoh32(var.val);
+        return (error);
+}
+
+
+static int
+dev_wlc_intvar_set_reg(
+        struct net_device *dev,
+        char *name,
+        char *addr,
+        char * val)
+{
+        char reg_addr[8];
+
+        memset(reg_addr, 0, sizeof(reg_addr));
+        memcpy((char *)&reg_addr[0], (char *)addr, 4);
+        memcpy((char *)&reg_addr[4], (char *)val, 4);
+
+        return (dev_wlc_bufvar_set(dev, name,  (char *)&reg_addr[0], sizeof(reg_addr)));
+}
+
+
+
+
+static int
+dev_wlc_intvar_set(
+        struct net_device *dev,
+        char *name,
+        int val)
+{
+        char buf[WLC_IOCTL_SMLEN];
+        uint len;
+
+        val = htod32(val);
+        len = bcm_mkiovar(name, (char *)(&val), sizeof(val), buf, sizeof(buf));
+        ASSERT(len);
+
+        return (dev_wlc_ioctl(dev, WLC_SET_VAR, buf, len));
+}
+
+#if defined(WL_IW_USE_ISCAN)
+static int
+dev_iw_iovar_setbuf(
+        struct net_device *dev,
+        char *iovar,
+        void *param,
+        int paramlen,
+        void *bufptr,
+        int buflen)
+{
+        int iolen;
+
+        iolen = bcm_mkiovar(iovar, param, paramlen, bufptr, buflen);
+        ASSERT(iolen);
+
+        if (iolen == 0)
+                return 0;
+
+        return (dev_wlc_ioctl(dev, WLC_SET_VAR, bufptr, iolen));
+}
+
+static int
+dev_iw_iovar_getbuf(
+        struct net_device *dev,
+        char *iovar,
+        void *param,
+        int paramlen,
+        void *bufptr,
+        int buflen)
+{
+        int iolen;
+
+        iolen = bcm_mkiovar(iovar, param, paramlen, bufptr, buflen);
+        ASSERT(iolen);
+
+        return (dev_wlc_ioctl(dev, WLC_GET_VAR, bufptr, buflen));
+}
+#endif 
+
+
+#if WIRELESS_EXT > 17
+static int
+dev_wlc_bufvar_set(
+        struct net_device *dev,
+        char *name,
+        char *buf, int len)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+        char ioctlbuf[MAX_WLIW_IOCTL_LEN];
+#else
+        static char ioctlbuf[MAX_WLIW_IOCTL_LEN];
+#endif 
+        uint buflen;
+
+        buflen = bcm_mkiovar(name, buf, len, ioctlbuf, sizeof(ioctlbuf));
+        ASSERT(buflen);
+
+        return (dev_wlc_ioctl(dev, WLC_SET_VAR, ioctlbuf, buflen));
+}
+#endif 
+
+
+static int
+dev_wlc_bufvar_get(
+        struct net_device *dev,
+        char *name,
+        char *buf, int buflen)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+        char ioctlbuf[MAX_WLIW_IOCTL_LEN];
+#else
+        static char ioctlbuf[MAX_WLIW_IOCTL_LEN];
+#endif 
+        int error;
+        uint len;
+
+        len = bcm_mkiovar(name, NULL, 0, ioctlbuf, sizeof(ioctlbuf));
+        ASSERT(len);
+        error = dev_wlc_ioctl(dev, WLC_GET_VAR, (void *)ioctlbuf, MAX_WLIW_IOCTL_LEN);
+        if (!error)
+                bcopy(ioctlbuf, buf, buflen);
+
+        return (error);
+}
+
+
+
+static int
+dev_wlc_intvar_get(
+        struct net_device *dev,
+        char *name,
+        int *retval)
+{
+        union {
+                char buf[WLC_IOCTL_SMLEN];
+                int val;
+        } var;
+        int error;
+
+        uint len;
+        uint data_null;
+
+        len = bcm_mkiovar(name, (char *)(&data_null), 0, (char *)(&var), sizeof(var.buf));
+        ASSERT(len);
+        error = dev_wlc_ioctl(dev, WLC_GET_VAR, (void *)&var, len);
+
+        *retval = dtoh32(var.val);
+
+        return (error);
+}
+
+
+#if WIRELESS_EXT > 12
+static int
+wl_iw_set_active_scan(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int as = 0;
+        int error = 0;
+        char *p = extra;
+
+#if defined(WL_IW_USE_ISCAN)
+        if (g_iscan->iscan_state == ISCAN_STATE_IDLE)
+#endif 
+                error = dev_wlc_ioctl(dev, WLC_SET_PASSIVE_SCAN, &as, sizeof(as));
+#if defined(WL_IW_USE_ISCAN)
+        else
+                g_iscan->scan_flag = as;
+#endif 
+        p += snprintf(p, MAX_WX_STRING, "OK");
+
+        wrqu->data.length = p - extra + 1;
+        return error;
+}
+
+static int
+wl_iw_set_passive_scan(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int ps = 1;
+        int error = 0;
+        char *p = extra;
+
+#if defined(WL_IW_USE_ISCAN)
+        if (g_iscan->iscan_state == ISCAN_STATE_IDLE) {
+#endif 
+
+                 
+                if (g_scan_specified_ssid == 0) {
+                        error = dev_wlc_ioctl(dev, WLC_SET_PASSIVE_SCAN, &ps, sizeof(ps));
+                }
+#if defined(WL_IW_USE_ISCAN)
+        }
+        else
+                g_iscan->scan_flag = ps;
+#endif 
+
+        p += snprintf(p, MAX_WX_STRING, "OK");
+
+        wrqu->data.length = p - extra + 1;
+        return error;
+}
+
+
+static int
+wl_iw_set_txpower(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = 0;
+        char *p = extra;
+        int txpower = -1;
+
+        txpower = bcm_atoi(extra + strlen(TXPOWER_SET_CMD) + 1);
+        if ((txpower >= 0) && (txpower <= 127))
+        {
+                txpower |= WL_TXPWR_OVERRIDE;
+                txpower = htod32(txpower);
+
+                error = dev_wlc_intvar_set(dev, "qtxpower", txpower);
+                p += snprintf(p, MAX_WX_STRING, "OK");
+                WL_TRACE(("%s: set TXpower 0x%X is OK\n", __FUNCTION__, txpower));
+        } else {
+                WL_ERROR(("%s: set tx power failed\n", __FUNCTION__));
+                p += snprintf(p, MAX_WX_STRING, "FAIL");
+        }
+
+        wrqu->data.length = p - extra + 1;
+        return error;
+}
+
+static int
+wl_iw_get_macaddr(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error;
+        char buf[128];
+        struct ether_addr *id;
+        char *p = extra;
+
+        
+        strcpy(buf, "cur_etheraddr");
+        error = dev_wlc_ioctl(dev, WLC_GET_VAR, buf, sizeof(buf));
+        id = (struct ether_addr *) buf;
+        p += snprintf(p, MAX_WX_STRING, "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
+                id->octet[0], id->octet[1], id->octet[2],
+                id->octet[3], id->octet[4], id->octet[5]);
+        wrqu->data.length = p - extra + 1;
+
+        return error;
+}
+
+
+
+static int
+wl_iw_set_country(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        char country_code[WLC_CNTRY_BUF_SZ];
+        int error = 0;
+        char *p = extra;
+        int country_offset;
+        int country_code_size;
+        wl_country_t cspec = {{0}, 0, {0}};
+        char smbuf[WLC_IOCTL_SMLEN];
+        scb_val_t scbval;
+
+        cspec.rev = -1;
+        memset(country_code, 0, sizeof(country_code));
+        memset(smbuf, 0, sizeof(smbuf));
+
+        
+        country_offset = strcspn(extra, " ");
+        country_code_size = strlen(extra) - country_offset;
+
+        
+        if (country_offset != 0) {
+                strncpy(country_code, extra + country_offset +1,
+                        MIN(country_code_size, sizeof(country_code)));
+
+                
+                bzero(&scbval, sizeof(scb_val_t));
+                if ((error = dev_wlc_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t)))) {
+                        WL_ERROR(("%s: set country failed due to Disassoc error\n", __FUNCTION__));
+                        goto exit_failed;
+                }
+
+                memcpy(cspec.country_abbrev, country_code, WLC_CNTRY_BUF_SZ);
+                memcpy(cspec.ccode, country_code, WLC_CNTRY_BUF_SZ);
+
+                get_customized_country_code((char *)&cspec.country_abbrev, &cspec);
+
+                
+                if ((error = dev_iw_iovar_setbuf(dev, "country", &cspec,
+                        sizeof(cspec), smbuf, sizeof(smbuf))) >= 0) {
+                        p += snprintf(p, MAX_WX_STRING, "OK");
+                        WL_ERROR(("%s: set country for %s as %s rev %d is OK\n",
+                                __FUNCTION__, country_code, cspec.ccode, cspec.rev));
+                        dhd_bus_country_set(dev, &cspec);
+                        goto exit;
+                }
+        }
+
+        WL_ERROR(("%s: set country for %s as %s rev %d failed\n",
+                __FUNCTION__, country_code, cspec.ccode, cspec.rev));
+
+exit_failed:
+        p += snprintf(p, MAX_WX_STRING, "FAIL");
+
+exit:
+        wrqu->data.length = p - extra + 1;
+        return error;
+}
+
+static int
+wl_iw_set_power_mode(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = 0;
+        char *p = extra;
+        static int  pm = PM_FAST;
+        int  pm_local = PM_OFF;
+        char powermode_val = 0;
+
+        WL_TRACE_COEX(("%s: DHCP session cmd:%s\n", __FUNCTION__, extra));
+
+        strncpy((char *)&powermode_val, extra + strlen("POWERMODE") +1, 1);
+
+        if (strnicmp((char *)&powermode_val, "1", strlen("1")) == 0) {
+
+                WL_TRACE(("%s: DHCP session starts\n", __FUNCTION__));
+
+                dev_wlc_ioctl(dev, WLC_GET_PM, &pm, sizeof(pm));
+                dev_wlc_ioctl(dev, WLC_SET_PM, &pm_local, sizeof(pm_local));
+
+                
+                net_os_set_packet_filter(dev, 0);
+
+#ifdef COEX_DHCP
+                g_bt->ts_dhcp_start = JF2MS;
+                g_bt->dhcp_done = FALSE;
+                WL_TRACE_COEX(("%s: DHCP start, pm:%d changed to pm:%d\n",
+                        __FUNCTION__, pm, pm_local));
+
+#endif 
+        } else if (strnicmp((char *)&powermode_val, "0", strlen("0")) == 0) {
+                
+
+                dev_wlc_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm));
+
+                
+                net_os_set_packet_filter(dev, 1);
+
+#ifdef COEX_DHCP
+                g_bt->dhcp_done = TRUE;
+                g_bt->ts_dhcp_ok = JF2MS;
+                WL_TRACE_COEX(("%s: DHCP done for:%d ms, restored pm:%d\n",
+                        __FUNCTION__, (g_bt->ts_dhcp_ok - g_bt->ts_dhcp_start), pm));
+#endif 
+
+        } else {
+                WL_ERROR(("%s Unkwown yet power setting, ignored\n",
+                        __FUNCTION__));
+        }
+
+        p += snprintf(p, MAX_WX_STRING, "OK");
+
+        wrqu->data.length = p - extra + 1;
+
+        return error;
+}
+
+
+bool btcoex_is_sco_active(struct net_device *dev)
+{
+        int ioc_res = 0;
+        bool res = FALSE;
+        int sco_id_cnt = 0;
+        int param27;
+        int i;
+
+        for (i = 0; i < 12; i++) {
+
+                ioc_res = dev_wlc_intvar_get_reg(dev, "btc_params", 27, &param27);
+
+                WL_TRACE_COEX(("%s, sample[%d], btc params: 27:%x\n",
+                        __FUNCTION__, i, param27));
+
+                if (ioc_res < 0) {
+                        WL_ERROR(("%s ioc read btc params error\n", __FUNCTION__));
+                        break;
+                }
+
+                if ((param27 & 0x6) == 2) { 
+                        sco_id_cnt++;
+                }
+
+                if (sco_id_cnt > 2) {
+                        WL_TRACE_COEX(("%s, sco/esco detected, pkt id_cnt:%d  samples:%d\n",
+                                __FUNCTION__, sco_id_cnt, i));
+                        res = TRUE;
+                        break;
+                }
+
+                msleep(5);
+        }
+
+        return res;
+}
+
+#if defined(BT_DHCP_eSCO_FIX)
+
+static int set_btc_esco_params(struct net_device *dev, bool trump_sco)
+{
+        static bool saved_status = FALSE;
+
+        char buf_reg50va_dhcp_on[8] = { 50, 00, 00, 00, 0x22, 0x80, 0x00, 0x00 };
+        char buf_reg51va_dhcp_on[8] = { 51, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+        char buf_reg64va_dhcp_on[8] = { 64, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+        char buf_reg65va_dhcp_on[8] = { 65, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+        char buf_reg71va_dhcp_on[8] = { 71, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+
+        uint32 regaddr;
+        static uint32 saved_reg50;
+        static uint32 saved_reg51;
+        static uint32 saved_reg64;
+        static uint32 saved_reg65;
+        static uint32 saved_reg71;
+
+        if (trump_sco) { 
+
+                
+                WL_TRACE_COEX(("Do new SCO/eSCO coex algo {save & override} \n"));
+
+
+                if  ((!dev_wlc_intvar_get_reg(dev, "btc_params", 50,  &saved_reg50)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 51,  &saved_reg51)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 64,  &saved_reg64)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 65,  &saved_reg65)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 71,  &saved_reg71))) {
+
+                        saved_status = TRUE;
+                        WL_TRACE_COEX(("%s saved bt_params[50,51,64,65,71]:"
+                                " 0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                                __FUNCTION__, saved_reg50, saved_reg51,
+                                saved_reg64, saved_reg65, saved_reg71));
+
+                } else {
+                        WL_ERROR((":%s: save btc_params failed\n",
+                                __FUNCTION__));
+                        saved_status = FALSE;
+                        return -1;
+                }
+
+                WL_TRACE_COEX(("override with [50,51,64,65,71]:"
+                        " 0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                        *(u32 *)(buf_reg50va_dhcp_on+4),
+                        *(u32 *)(buf_reg51va_dhcp_on+4),
+                        *(u32 *)(buf_reg64va_dhcp_on+4),
+                        *(u32 *)(buf_reg65va_dhcp_on+4),
+                        *(u32 *)(buf_reg71va_dhcp_on+4)));
+
+                dev_wlc_bufvar_set(dev, "btc_params", (char *)&buf_reg50va_dhcp_on[0], 8);
+                dev_wlc_bufvar_set(dev, "btc_params", (char *)&buf_reg51va_dhcp_on[0], 8);
+                dev_wlc_bufvar_set(dev, "btc_params", (char *)&buf_reg64va_dhcp_on[0], 8);
+                dev_wlc_bufvar_set(dev, "btc_params", (char *)&buf_reg65va_dhcp_on[0], 8);
+                dev_wlc_bufvar_set(dev, "btc_params", (char *)&buf_reg71va_dhcp_on[0], 8);
+
+                saved_status = TRUE;
+
+        } else if (saved_status) {
+                
+                WL_TRACE_COEX(("Do new SCO/eSCO coex algo {save & override} \n"));
+
+                regaddr = 50;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg50);
+                regaddr = 51;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg51);
+                regaddr = 64;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg64);
+                regaddr = 65;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg65);
+                regaddr = 71;
+                dev_wlc_intvar_set_reg(dev, "btc_params",
+                        (char *)&regaddr, (char *)&saved_reg71);
+
+                WL_TRACE_COEX(("restore bt_params[50,51,64,65,71]: 0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                        saved_reg50, saved_reg51, saved_reg64,
+                        saved_reg65, saved_reg71));
+
+                saved_status = FALSE;
+        } else {
+                WL_ERROR((":%s att to restore not saved BTCOEX params\n",
+                        __FUNCTION__));
+                return -1;
+        }
+        return 0;
+}
+#endif 
+
+
+static int
+wl_iw_get_power_mode(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = 0;
+        int pm_local;
+        char *p = extra;
+
+        error = dev_wlc_ioctl(dev, WLC_GET_PM, &pm_local, sizeof(pm_local));
+        if (!error) {
+                WL_TRACE(("%s: Powermode = %d\n", __func__, pm_local));
+                if (pm_local == PM_OFF)
+                        pm_local = 1; 
+                else
+                        pm_local = 0; 
+                p += snprintf(p, MAX_WX_STRING, "powermode = %d", pm_local);
+        }
+        else {
+                WL_TRACE(("%s: Error = %d\n", __func__, error));
+                p += snprintf(p, MAX_WX_STRING, "FAIL");
+        }
+        wrqu->data.length = p - extra + 1;
+        return error;
+}
+
+static int
+wl_iw_set_btcoex_dhcp(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = 0;
+        char *p = extra;
+        char powermode_val = 0;
+        char buf_reg66va_dhcp_on[8] = { 66, 00, 00, 00, 0x10, 0x27, 0x00, 0x00 };
+        char buf_reg41va_dhcp_on[8] = { 41, 00, 00, 00, 0x33, 0x00, 0x00, 0x00 };
+        char buf_reg68va_dhcp_on[8] = { 68, 00, 00, 00, 0x90, 0x01, 0x00, 0x00 };
+
+        uint32 regaddr;
+        static uint32 saved_reg66;
+        static uint32 saved_reg41;
+        static uint32 saved_reg68;
+        static bool saved_status = FALSE;
+
+#ifdef COEX_DHCP
+        char buf_flag7_default[8] =   { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+#endif 
+
+        
+        strncpy((char *)&powermode_val, extra + strlen("BTCOEXMODE") +1, 1);
+
+        if (strnicmp((char *)&powermode_val, "1", strlen("1")) == 0) {
+
+                WL_TRACE(("%s: DHCP session starts\n", __FUNCTION__));
+
+                
+                if ((saved_status == FALSE) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 66,  &saved_reg66)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 41,  &saved_reg41)) &&
+                        (!dev_wlc_intvar_get_reg(dev, "btc_params", 68,  &saved_reg68)))   {
+                                saved_status = TRUE;
+                                WL_TRACE(("Saved 0x%x 0x%x 0x%x\n",
+                                        saved_reg66, saved_reg41, saved_reg68));
+
+                                
+
+                                
+#ifdef COEX_DHCP
+                                
+                                if (btcoex_is_sco_active(dev)) {
+                                        
+                                        dev_wlc_bufvar_set(dev, "btc_params",
+                                                (char *)&buf_reg66va_dhcp_on[0],
+                                                sizeof(buf_reg66va_dhcp_on));
+                                        
+                                        dev_wlc_bufvar_set(dev, "btc_params",
+                                                (char *)&buf_reg41va_dhcp_on[0],
+                                                sizeof(buf_reg41va_dhcp_on));
+                                        
+                                        dev_wlc_bufvar_set(dev, "btc_params",
+                                                (char *)&buf_reg68va_dhcp_on[0],
+                                                sizeof(buf_reg68va_dhcp_on));
+                                        saved_status = TRUE;
+
+                                        g_bt->bt_state = BT_DHCP_START;
+                                        g_bt->timer_on = 1;
+                                        mod_timer(&g_bt->timer, g_bt->timer.expires);
+                                        WL_TRACE_COEX(("%s enable BT DHCP Timer\n",
+                                        __FUNCTION__));
+                                }
+#endif 
+                }
+                else if (saved_status == TRUE) {
+                        WL_ERROR(("%s was called w/o DHCP OFF. Continue\n", __FUNCTION__));
+                }
+        }
+        else if (strnicmp((char *)&powermode_val, "2", strlen("2")) == 0) {
+
+
+                
+
+#ifdef COEX_DHCP
+                
+                WL_TRACE(("%s disable BT DHCP Timer\n", __FUNCTION__));
+                if (g_bt->timer_on) {
+                        g_bt->timer_on = 0;
+                        del_timer_sync(&g_bt->timer);
+
+                        if (g_bt->bt_state != BT_DHCP_IDLE) {
+                        
+                                WL_TRACE_COEX(("%s bt->bt_state:%d\n",
+                                        __FUNCTION__, g_bt->bt_state));
+                                
+                                up(&g_bt->tsk_ctl.sema);
+                        }
+                }
+
+                
+                if (saved_status == TRUE)
+                        dev_wlc_bufvar_set(dev, "btc_flags",
+                                (char *)&buf_flag7_default[0], sizeof(buf_flag7_default));
+#endif 
+
+                
+                if (saved_status == TRUE) {
+                        regaddr = 66;
+                        dev_wlc_intvar_set_reg(dev, "btc_params",
+                                (char *)&regaddr, (char *)&saved_reg66);
+                        regaddr = 41;
+                        dev_wlc_intvar_set_reg(dev, "btc_params",
+                                (char *)&regaddr, (char *)&saved_reg41);
+                        regaddr = 68;
+                        dev_wlc_intvar_set_reg(dev, "btc_params",
+                                (char *)&regaddr, (char *)&saved_reg68);
+
+                        WL_TRACE_COEX(("restore regs {66,41,68} <- 0x%x 0x%x 0x%x\n",
+                                saved_reg66, saved_reg41, saved_reg68));
+                }
+                saved_status = FALSE;
+
+        }
+        else {
+                WL_ERROR(("%s Unkwown yet power setting, ignored\n",
+                        __FUNCTION__));
+        }
+
+        p += snprintf(p, MAX_WX_STRING, "OK");
+
+        wrqu->data.length = p - extra + 1;
+
+        return error;
+}
+
+static int
+wl_iw_set_suspend(
+struct net_device *dev,
+struct iw_request_info *info,
+union iwreq_data *wrqu,
+char *extra
+)
+{
+        int suspend_flag;
+        int ret_now;
+        int ret = 0;
+
+        suspend_flag = *(extra + strlen(SETSUSPEND_CMD) + 1) - '0';
+
+        if (suspend_flag != 0)
+                suspend_flag = 1;
+
+        ret_now = net_os_set_suspend_disable(dev, suspend_flag);
+
+        
+        if (ret_now != suspend_flag) {
+                if (!(ret = net_os_set_suspend(dev, ret_now)))
+                        WL_ERROR(("%s: Suspend Flag %d -> %d\n",
+                                  __FUNCTION__, ret_now, suspend_flag));
+                else
+                        WL_ERROR(("%s: failed %d\n", __FUNCTION__, ret));
+        }
+
+        return ret;
+}
+
+static int
+wl_format_ssid(char* ssid_buf, uint8* ssid, int ssid_len)
+{
+        int i, c;
+        char *p = ssid_buf;
+
+        if (ssid_len > 32) ssid_len = 32;
+
+        for (i = 0; i < ssid_len; i++) {
+                c = (int)ssid[i];
+                if (c == '\\') {
+                        *p++ = '\\';
+                        *p++ = '\\';
+                } else if (isprint((uchar)c)) {
+                        *p++ = (char)c;
+                } else {
+                        p += sprintf(p, "\\x%02X", c);
+                }
+        }
+        *p = '\0';
+
+        return p - ssid_buf;
+}
+
+static int
+wl_iw_get_link_speed(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = 0;
+        char *p = extra;
+        static int link_speed;
+
+        
+        net_os_wake_lock(dev);
+        if (g_onoff == G_WLAN_SET_ON) {
+                error = dev_wlc_ioctl(dev, WLC_GET_RATE, &link_speed, sizeof(link_speed));
+                link_speed *= 500000;
+        }
+
+        p += snprintf(p, MAX_WX_STRING, "LinkSpeed %d", link_speed/1000000);
+
+        wrqu->data.length = p - extra + 1;
+
+        net_os_wake_unlock(dev);
+        return error;
+}
+
+
+static int
+wl_iw_get_dtim_skip(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = -1;
+        char *p = extra;
+        char iovbuf[32];
+
+        net_os_wake_lock(dev);
+        if (g_onoff == G_WLAN_SET_ON) {
+
+                        memset(iovbuf, 0, sizeof(iovbuf));
+                        strcpy(iovbuf, "bcn_li_dtim");
+
+                        if ((error = dev_wlc_ioctl(dev, WLC_GET_VAR,
+                                &iovbuf, sizeof(iovbuf))) >= 0) {
+
+                                p += snprintf(p, MAX_WX_STRING, "Dtim_skip %d", iovbuf[0]);
+                                WL_TRACE(("%s: get dtim_skip = %d\n", __FUNCTION__, iovbuf[0]));
+                                wrqu->data.length = p - extra + 1;
+                        }
+                        else
+                                WL_ERROR(("%s: get dtim_skip failed code %d\n",
+                                        __FUNCTION__, error));
+        }
+        net_os_wake_unlock(dev);
+        return error;
+}
+
+
+static int
+wl_iw_set_dtim_skip(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = -1;
+        char *p = extra;
+        int bcn_li_dtim;
+        char iovbuf[32];
+
+        net_os_wake_lock(dev);
+        if (g_onoff == G_WLAN_SET_ON) {
+
+                bcn_li_dtim = htod32((uint)*(extra + strlen(DTIM_SKIP_SET_CMD) + 1) - '0');
+
+                if ((bcn_li_dtim >= 0) || ((bcn_li_dtim <= 5))) {
+
+                        memset(iovbuf, 0, sizeof(iovbuf));
+                        bcm_mkiovar("bcn_li_dtim", (char *)&bcn_li_dtim,
+                                4, iovbuf, sizeof(iovbuf));
+
+                        if ((error = dev_wlc_ioctl(dev, WLC_SET_VAR,
+                                &iovbuf, sizeof(iovbuf))) >= 0) {
+                                p += snprintf(p, MAX_WX_STRING, "OK");
+
+                                
+                                net_os_set_dtim_skip(dev, bcn_li_dtim);
+
+                                WL_TRACE(("%s: set dtim_skip %d OK\n", __FUNCTION__,
+                                        bcn_li_dtim));
+                                goto exit;
+                        }
+                        else  WL_ERROR(("%s: set dtim_skip %d failed code %d\n",
+                                __FUNCTION__, bcn_li_dtim, error));
+                }
+                else  WL_ERROR(("%s Incorrect dtim_skip setting %d, ignored\n",
+                        __FUNCTION__, bcn_li_dtim));
+        }
+
+        p += snprintf(p, MAX_WX_STRING, "FAIL");
+
+exit:
+        wrqu->data.length = p - extra + 1;
+        net_os_wake_unlock(dev);
+        return error;
+}
+
+
+static int
+wl_iw_get_band(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = -1;
+        char *p = extra;
+        static int band;
+
+        net_os_wake_lock(dev);
+
+        if (g_onoff == G_WLAN_SET_ON) {
+                error = dev_wlc_ioctl(dev, WLC_GET_BAND, &band, sizeof(band));
+
+                p += snprintf(p, MAX_WX_STRING, "Band %d", band);
+
+                wrqu->data.length = p - extra + 1;
+        }
+
+        net_os_wake_unlock(dev);
+        return error;
+}
+
+
+static int
+wl_iw_set_band(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = -1;
+        char *p = extra;
+        uint band;
+
+        net_os_wake_lock(dev);
+
+        if (g_onoff == G_WLAN_SET_ON) {
+
+                band = htod32((uint)*(extra + strlen(BAND_SET_CMD) + 1) - '0');
+
+                if ((band == WLC_BAND_AUTO) || (band == WLC_BAND_5G) || (band == WLC_BAND_2G)) {
+                        
+                        if ((error = dev_wlc_ioctl(dev, WLC_SET_BAND,
+                                &band, sizeof(band))) >= 0) {
+                                p += snprintf(p, MAX_WX_STRING, "OK");
+                                WL_TRACE(("%s: set band %d OK\n", __FUNCTION__, band));
+                                goto exit;
+                        } else {
+                                WL_ERROR(("%s: set band %d failed code %d\n", __FUNCTION__,
+                                          band, error));
+                        }
+                } else {
+                        WL_ERROR(("%s Incorrect band setting %d, ignored\n", __FUNCTION__, band));
+                }
+        }
+
+        p += snprintf(p, MAX_WX_STRING, "FAIL");
+
+exit:
+        wrqu->data.length = p - extra + 1;
+        net_os_wake_unlock(dev);
+        return error;
+}
+
+#ifdef PNO_SUPPORT
+
+static int
+wl_iw_set_pno_reset(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = -1;
+        char *p = extra;
+
+        net_os_wake_lock(dev);
+        if ((g_onoff == G_WLAN_SET_ON) && (dev != NULL)) {
+
+                if ((error = dhd_dev_pno_reset(dev)) >= 0) {
+                                p += snprintf(p, MAX_WX_STRING, "OK");
+                                WL_TRACE(("%s: set OK\n", __FUNCTION__));
+                                goto exit;
+                }
+                else  WL_ERROR(("%s: failed code %d\n", __FUNCTION__, error));
+        }
+
+        p += snprintf(p, MAX_WX_STRING, "FAIL");
+
+exit:
+        wrqu->data.length = p - extra + 1;
+        net_os_wake_unlock(dev);
+        return error;
+}
+
+
+
+static int
+wl_iw_set_pno_enable(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error = -1;
+        char *p = extra;
+        int pfn_enabled;
+
+        net_os_wake_lock(dev);
+        pfn_enabled = htod32((uint)*(extra + strlen(PNOENABLE_SET_CMD) + 1) - '0');
+
+        if ((g_onoff == G_WLAN_SET_ON) && (dev != NULL)) {
+
+                if ((error = dhd_dev_pno_enable(dev, pfn_enabled)) >= 0) {
+                                p += snprintf(p, MAX_WX_STRING, "OK");
+                                WL_TRACE(("%s: set OK\n", __FUNCTION__));
+                                goto exit;
+                }
+                else  WL_ERROR(("%s: failed code %d\n", __FUNCTION__, error));
+        }
+
+        p += snprintf(p, MAX_WX_STRING, "FAIL");
+
+exit:
+        wrqu->data.length = p - extra + 1;
+        net_os_wake_unlock(dev);
+        return error;
+}
+
+
+
+static int
+wl_iw_set_pno_set(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int res = -1;
+        wlc_ssid_t ssids_local[MAX_PFN_LIST_COUNT];
+        int nssid = 0;
+        cmd_tlv_t *cmd_tlv_temp;
+        char *str_ptr;
+        int tlv_size_left;
+        int pno_time;
+        int pno_repeat;
+        int pno_freq_expo_max;
+#ifdef PNO_SET_DEBUG
+        int i;
+        char pno_in_example[] = {
+                'P', 'N', 'O', 'S', 'E', 'T', 'U', 'P', ' ',
+                'S', '1', '2', '0',
+                'S',
+                0x04,
+                'B', 'R', 'C', 'M',
+                'S',
+                0x04,
+                'G', 'O', 'O', 'G',
+                'T',
+                '1', 'E',
+                'R',
+                '2',
+                'M',
+                '2',
+                0x00
+                };
+#endif 
+
+        net_os_wake_lock(dev);
+        WL_ERROR(("\n### %s: info->cmd:%x, info->flags:%x, u.data=0x%p, u.len=%d\n",
+                __FUNCTION__, info->cmd, info->flags,
+                wrqu->data.pointer, wrqu->data.length));
+
+        if (g_onoff == G_WLAN_SET_OFF) {
+                WL_TRACE(("%s: driver is not up yet after START\n", __FUNCTION__));
+                goto exit_proc;
+        }
+
+        if (wrqu->data.length < (strlen(PNOSETUP_SET_CMD) + sizeof(cmd_tlv_t))) {
+                WL_ERROR(("%s argument=%d less %d\n", __FUNCTION__,
+                          wrqu->data.length, (int)(strlen(PNOSETUP_SET_CMD) + sizeof(cmd_tlv_t))));
+                goto exit_proc;
+        }
+
+#ifdef PNO_SET_DEBUG
+        if (!(extra = kmalloc(sizeof(pno_in_example) +100, GFP_KERNEL))) {
+                res = -ENOMEM;
+                goto exit_proc;
+        }
+        memcpy(extra, pno_in_example, sizeof(pno_in_example));
+        wrqu->data.length = sizeof(pno_in_example);
+        for (i = 0; i < wrqu->data.length; i++)
+                printf("%02X ", extra[i]);
+        printf("\n");
+#endif 
+
+        str_ptr = extra;
+#ifdef PNO_SET_DEBUG
+        str_ptr +=  strlen("PNOSETUP ");
+        tlv_size_left = wrqu->data.length - strlen("PNOSETUP ");
+#else
+        str_ptr +=  strlen(PNOSETUP_SET_CMD);
+        tlv_size_left = wrqu->data.length - strlen(PNOSETUP_SET_CMD);
+#endif
+
+        cmd_tlv_temp = (cmd_tlv_t *)str_ptr;
+        memset(ssids_local, 0, sizeof(ssids_local));
+        pno_repeat = pno_freq_expo_max = 0;
+        
+        if ((cmd_tlv_temp->prefix == PNO_TLV_PREFIX) &&
+                (cmd_tlv_temp->version == PNO_TLV_VERSION) &&
+                (cmd_tlv_temp->subver == PNO_TLV_SUBVERSION))
+        {
+                str_ptr += sizeof(cmd_tlv_t);
+                tlv_size_left  -= sizeof(cmd_tlv_t);
+
+                
+                if ((nssid = wl_iw_parse_ssid_list_tlv(&str_ptr, ssids_local,
+                        MAX_PFN_LIST_COUNT,
+                        &tlv_size_left)) <= 0) {
+                        WL_ERROR(("SSID is not presented or corrupted ret=%d\n", nssid));
+                        goto exit_proc;
+                }
+                else {
+                        if ((str_ptr[0] != PNO_TLV_TYPE_TIME) || (tlv_size_left <= 1)) {
+                                WL_ERROR(("%s scan duration corrupted field size %d\n",
+                                        __FUNCTION__, tlv_size_left));
+                                goto exit_proc;
+                        }
+                        str_ptr++;
+                        pno_time = simple_strtoul(str_ptr, &str_ptr, 16);
+                        WL_PNO(("%s: pno_time=%d\n", __FUNCTION__, pno_time));
+
+                        
+                        if (str_ptr[0] != 0) {
+                                if ((str_ptr[0] != PNO_TLV_FREQ_REPEAT)) {
+                                        WL_ERROR(("%s pno repeat : corrupted field\n",
+                                                __FUNCTION__));
+                                        goto exit_proc;
+                                }
+                                str_ptr++;
+                                pno_repeat = simple_strtoul(str_ptr, &str_ptr, 16);
+                                WL_PNO(("%s :got pno_repeat=%d\n", __FUNCTION__, pno_repeat));
+                                if (str_ptr[0] != PNO_TLV_FREQ_EXPO_MAX) {
+                                        WL_ERROR(("%s FREQ_EXPO_MAX corrupted field size\n",
+                                                __FUNCTION__));
+                                        goto exit_proc;
+                                }
+                                str_ptr++;
+                                pno_freq_expo_max = simple_strtoul(str_ptr, &str_ptr, 16);
+                                WL_PNO(("%s: pno_freq_expo_max=%d\n",
+                                        __FUNCTION__, pno_freq_expo_max));
+                        }
+                }
+        }
+        else {
+                WL_ERROR(("%s get wrong TLV command\n", __FUNCTION__));
+                goto exit_proc;
+        }
+
+        
+        res = dhd_dev_pno_set(dev, ssids_local, nssid, pno_time, pno_repeat, pno_freq_expo_max);
+
+exit_proc:
+        net_os_wake_unlock(dev);
+        return res;
+}
+#endif 
+
+static int
+wl_iw_get_rssi(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        static int rssi = 0;
+        static wlc_ssid_t ssid = {0};
+        int error = 0;
+        char *p = extra;
+        static char ssidbuf[SSID_FMT_BUF_LEN];
+        scb_val_t scb_val;
+
+        net_os_wake_lock(dev);
+
+        bzero(&scb_val, sizeof(scb_val_t));
+
+        if (g_onoff == G_WLAN_SET_ON) {
+                error = dev_wlc_ioctl(dev, WLC_GET_RSSI, &scb_val, sizeof(scb_val_t));
+                if (error) {
+                        WL_ERROR(("%s: Fails %d\n", __FUNCTION__, error));
+                        net_os_wake_unlock(dev);
+                        return error;
+                }
+                rssi = dtoh32(scb_val.val);
+
+                error = dev_wlc_ioctl(dev, WLC_GET_SSID, &ssid, sizeof(ssid));
+                if (!error) {
+                        ssid.SSID_len = dtoh32(ssid.SSID_len);
+                        wl_format_ssid(ssidbuf, ssid.SSID, dtoh32(ssid.SSID_len));
+                }
+        }
+
+        p += snprintf(p, MAX_WX_STRING, "%s rssi %d ", ssidbuf, rssi);
+        wrqu->data.length = p - extra + 1;
+
+        net_os_wake_unlock(dev);
+        return error;
+}
+
+int
+wl_iw_send_priv_event(
+        struct net_device *dev,
+        char *flag
+)
+{
+        union iwreq_data wrqu;
+        char extra[IW_CUSTOM_MAX + 1];
+        int cmd;
+
+        cmd = IWEVCUSTOM;
+        memset(&wrqu, 0, sizeof(wrqu));
+        if (strlen(flag) > sizeof(extra))
+                return -1;
+
+        strcpy(extra, flag);
+        wrqu.data.length = strlen(extra);
+        wireless_send_event(dev, cmd, &wrqu, extra);
+        net_os_wake_lock_timeout_enable(dev, DHD_EVENT_TIMEOUT);
+        WL_TRACE(("Send IWEVCUSTOM Event as %s\n", extra));
+
+        return 0;
+}
+
+
+int
+wl_control_wl_start(struct net_device *dev)
+{
+        wl_iw_t *iw;
+        int ret = 0;
+
+        WL_TRACE(("Enter %s \n", __FUNCTION__));
+
+        if (!dev) {
+                WL_ERROR(("%s: dev is null\n", __FUNCTION__));
+                return -1;
+        }
+
+        iw = *(wl_iw_t **)netdev_priv(dev);
+
+        if (!iw) {
+                WL_ERROR(("%s: wl is null\n", __FUNCTION__));
+                return -1;
+        }
+
+        dhd_net_if_lock(dev);
+
+        if (g_onoff == G_WLAN_SET_OFF) {
+                dhd_customer_gpio_wlan_ctrl(WLAN_RESET_ON);
+
+#if defined(BCMLXSDMMC)
+                sdioh_start(NULL, 0);
+#endif
+
+                ret = dhd_dev_reset(dev, 0);
+
+#if defined(BCMLXSDMMC)
+                sdioh_start(NULL, 1);
+#endif
+                if (!ret)
+                        dhd_dev_init_ioctl(dev);
+
+                g_onoff = G_WLAN_SET_ON;
+        }
+        WL_TRACE(("Exited %s\n", __FUNCTION__));
+
+        dhd_net_if_unlock(dev);
+        return ret;
+}
+
+
+static int
+wl_iw_control_wl_off(
+        struct net_device *dev,
+        struct iw_request_info *info
+)
+{
+        wl_iw_t *iw;
+        int ret = 0;
+
+        WL_TRACE(("Enter %s\n", __FUNCTION__));
+
+        if (!dev) {
+                WL_ERROR(("%s: dev is null\n", __FUNCTION__));
+                return -1;
+        }
+
+        iw = *(wl_iw_t **)netdev_priv(dev);
+
+        if (!iw) {
+                WL_ERROR(("%s: wl is null\n", __FUNCTION__));
+                return -1;
+        }
+
+        dhd_net_if_lock(dev);
+
+#ifdef SOFTAP
+        ap_cfg_running = FALSE;
+#endif 
+
+        if (g_onoff == G_WLAN_SET_ON) {
+                g_onoff = G_WLAN_SET_OFF;
+
+#if defined(WL_IW_USE_ISCAN)
+                g_iscan->iscan_state = ISCAN_STATE_IDLE;
+#endif 
+
+                ret = dhd_dev_reset(dev, 1);
+
+#if defined(WL_IW_USE_ISCAN)
+#if !defined(CSCAN)
+                
+                wl_iw_free_ss_cache();
+                wl_iw_run_ss_cache_timer(0);
+                
+                g_ss_cache_ctrl.m_link_down = 1;
+#endif 
+                memset(g_scan, 0, G_SCAN_RESULTS);
+                g_scan_specified_ssid = 0;
+#if defined(CONFIG_FIRST_SCAN)
+                
+                g_first_broadcast_scan = BROADCAST_SCAN_FIRST_IDLE;
+                g_first_counter_scans = 0;
+#endif 
+#endif 
+
+#if defined(BCMLXSDMMC)
+                sdioh_stop(NULL);
+#endif
+
+                dhd_customer_gpio_wlan_ctrl(WLAN_RESET_OFF);
+
+                wl_iw_send_priv_event(dev, "STOP");
+        }
+
+        dhd_net_if_unlock(dev);
+
+        WL_TRACE(("Exited %s\n", __FUNCTION__));
+
+        return ret;
+}
+
+static int
+wl_iw_control_wl_on(
+        struct net_device *dev,
+        struct iw_request_info *info
+)
+{
+        int ret = 0;
+
+        WL_TRACE(("Enter %s \n", __FUNCTION__));
+
+        ret = wl_control_wl_start(dev);
+
+        wl_iw_send_priv_event(dev, "START");
+
+#ifdef SOFTAP
+        if (!ap_fw_loaded) {
+                wl_iw_iscan_set_scan_broadcast_prep(dev, 0);
+        }
+#else
+        wl_iw_iscan_set_scan_broadcast_prep(dev, 0);
+#endif
+
+        WL_TRACE(("Exited %s\n", __FUNCTION__));
+
+        return ret;
+}
+
+#ifdef SOFTAP
+static struct ap_profile my_ap;
+static int set_ap_cfg(struct net_device *dev, struct ap_profile *ap); 
+static int get_assoc_sta_list(struct net_device *dev, char *buf, int len);
+static int set_ap_mac_list(struct net_device *dev, void *buf);
+
+#define PTYPE_STRING 0
+#define PTYPE_INTDEC 1   
+#define PTYPE_INTHEX 2
+#define PTYPE_STR_HEX 3  
+
+static int get_parameter_from_string(
+        char **str_ptr, const char *token, int param_type, void  *dst, int param_max_len);
+
+static int
+hex2num(char c)
+{
+        if (c >= '0' && c <= '9')
+                return c - '0';
+        if (c >= 'a' && c <= 'f')
+                return c - 'a' + 10;
+        if (c >= 'A' && c <= 'F')
+                return c - 'A' + 10;
+        return -1;
+}
+
+
+
+static int
+hstr_2_buf(const char *txt, u8 *buf, int len)
+{
+        int i;
+
+        for (i = 0; i < len; i++) {
+                int a, b;
+
+                a = hex2num(*txt++);
+                if (a < 0)
+                        return -1;
+                b = hex2num(*txt++);
+                if (b < 0)
+                        return -1;
+                *buf++ = (a << 4) | b;
+        }
+
+        return 0;
+}
+
+
+
+static int
+init_ap_profile_from_string(char *param_str, struct ap_profile *ap_cfg)
+{
+        char *str_ptr = param_str;
+        char sub_cmd[16];
+        int ret = 0;
+
+        memset(sub_cmd, 0, sizeof(sub_cmd));
+        memset(ap_cfg, 0, sizeof(struct ap_profile));
+
+        
+        if (get_parameter_from_string(&str_ptr, "ASCII_CMD=",
+                PTYPE_STRING, sub_cmd, SSID_LEN) != 0) {
+         return -1;
+        }
+        if (strncmp(sub_cmd, "AP_CFG", 6)) {
+           WL_ERROR(("ERROR: sub_cmd:%s != 'AP_CFG'!\n", sub_cmd));
+                return -1;
+        }
+
+        
+        
+        ret = get_parameter_from_string(&str_ptr, "SSID=", PTYPE_STRING, ap_cfg->ssid, SSID_LEN);
+
+        ret |= get_parameter_from_string(&str_ptr, "SEC=", PTYPE_STRING,  ap_cfg->sec, SEC_LEN);
+
+        ret |= get_parameter_from_string(&str_ptr, "KEY=", PTYPE_STRING,  ap_cfg->key, KEY_LEN);
+
+        ret |= get_parameter_from_string(&str_ptr, "CHANNEL=", PTYPE_INTDEC, &ap_cfg->channel, 5);
+
+        
+        get_parameter_from_string(&str_ptr, "PREAMBLE=", PTYPE_INTDEC, &ap_cfg->preamble, 5);
+
+        
+        get_parameter_from_string(&str_ptr, "MAX_SCB=", PTYPE_INTDEC,  &ap_cfg->max_scb, 5);
+
+        
+        get_parameter_from_string(&str_ptr, "HIDDEN=",
+                PTYPE_INTDEC,  &ap_cfg->closednet, 5);
+
+        
+        get_parameter_from_string(&str_ptr, "COUNTRY=",
+                PTYPE_STRING,  &ap_cfg->country_code, 3);
+
+        return ret;
+}
+#endif 
+
+
+
+#ifdef SOFTAP
+static int
+iwpriv_set_ap_config(struct net_device *dev,
+            struct iw_request_info *info,
+            union iwreq_data *wrqu,
+            char *ext)
+{
+        int res = 0;
+        char  *extra = NULL;
+        struct ap_profile *ap_cfg = &my_ap;
+
+        WL_TRACE(("> Got IWPRIV SET_AP IOCTL: info->cmd:%x, info->flags:%x, u.data:%p, u.len:%d\n",
+                info->cmd, info->flags,
+                wrqu->data.pointer, wrqu->data.length));
+
+        if (!ap_fw_loaded) {
+                WL_ERROR(("Can't execute %s(), SOFTAP fw is not Loaded\n",
+                        __FUNCTION__));
+                return -1;
+        }
+
+        if (wrqu->data.length != 0) {
+
+                char *str_ptr;
+
+                if (!(extra = kmalloc(wrqu->data.length+1, GFP_KERNEL)))
+                        return -ENOMEM;
+
+                if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) {
+                        kfree(extra);
+                        return -EFAULT;
+                }
+
+                extra[wrqu->data.length] = 0;
+                WL_SOFTAP((" Got str param in iw_point:\n %s\n", extra));
+
+                memset(ap_cfg, 0, sizeof(struct ap_profile));
+
+                
+
+                str_ptr = extra;
+
+                if ((res = init_ap_profile_from_string(extra, ap_cfg)) < 0) {
+                        WL_ERROR(("%s failed to parse %d\n", __FUNCTION__, res));
+                        kfree(extra);
+                        return -1;
+                }
+
+        } else {
+         
+          WL_ERROR(("IWPRIV argument len = 0 \n"));
+          return -1;
+        }
+
+        if ((res = set_ap_cfg(dev, ap_cfg)) < 0)
+                WL_ERROR(("%s failed to set_ap_cfg %d\n", __FUNCTION__, res));
+
+        kfree(extra);
+
+        return res;
+}
+#endif 
+
+
+
+#ifdef SOFTAP
+static int iwpriv_get_assoc_list(struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *p_iwrq,
+        char *extra)
+{
+        int i, ret = 0;
+        char mac_buf[256];
+        struct maclist *sta_maclist = (struct maclist *)mac_buf;
+
+        char mac_lst[384];
+        char *p_mac_str;
+        char *p_mac_str_end;
+        wl_iw_t *iw;
+
+        if ((!dev) || (!extra)) {
+                
+                return -EINVAL;
+        }
+
+
+        iw = *(wl_iw_t **)netdev_priv(dev);
+
+        net_os_wake_lock(dev);
+        DHD_OS_MUTEX_LOCK(&wl_softap_lock);
+
+        WL_TRACE(("\n %s: IWPRIV IOCTL: cmd:%hx, flags:%hx, extra:%p, iwp.len:%d,"
+                "iwp.len:%p, iwp.flags:%x  \n", __FUNCTION__, info->cmd, info->flags,
+                extra, p_iwrq->data.length, p_iwrq->data.pointer, p_iwrq->data.flags));
+
+
+        memset(sta_maclist, 0, sizeof(mac_buf));
+
+        sta_maclist->count = 8;
+
+        WL_SOFTAP(("%s: net device:%s, buf_sz:%d\n",
+                __FUNCTION__, dev->name, sizeof(mac_buf)));
+
+        if ((ret = get_assoc_sta_list(dev, mac_buf, sizeof(mac_buf))) < 0) {
+                WL_ERROR(("%s: sta list ioctl error:%d\n",
+                        __FUNCTION__, ret));
+                goto func_exit;
+        }
+
+        WL_SOFTAP(("%s: got %d stations\n", __FUNCTION__,
+                sta_maclist->count));
+
+
+        
+        memset(mac_lst, 0, sizeof(mac_lst));
+        p_mac_str = mac_lst;
+        p_mac_str_end = &mac_lst[sizeof(mac_lst)-1];
+
+        for (i = 0; i < 8; i++) { 
+                struct ether_addr * id = &sta_maclist->ea[i];
+                if (!ETHER_ISNULLADDR(id->octet)) {
+                        scb_val_t scb_val;
+                        int rssi = 0;
+                        bzero(&scb_val, sizeof(scb_val_t));
+
+                        
+                        if ((p_mac_str_end - p_mac_str) <= 36) {
+                                WL_ERROR(("%s: mac list buf is < 36 for item[%i] item\n",
+                                        __FUNCTION__, i));
+                                break;
+                        }
+
+                        p_mac_str += snprintf(p_mac_str, MAX_WX_STRING,
+                        "\nMac[%d]=%02X:%02X:%02X:%02X:%02X:%02X,", i,
+                        id->octet[0], id->octet[1], id->octet[2],
+                        id->octet[3], id->octet[4], id->octet[5]);
+
+                        
+                        bcopy(id->octet, &scb_val.ea, 6);
+                        ret = dev_wlc_ioctl(dev, WLC_GET_RSSI, &scb_val, sizeof(scb_val_t));
+                        if (ret  < 0) {
+                                snprintf(p_mac_str, MAX_WX_STRING, "RSSI:ERR");
+                                WL_ERROR(("%s: RSSI ioctl error:%d\n",
+                                        __FUNCTION__, ret));
+                                break;
+                        }
+
+                        rssi = dtoh32(scb_val.val);
+                        p_mac_str += snprintf(p_mac_str, MAX_WX_STRING,
+                        "RSSI:%d", rssi);
+                }
+        }
+
+        p_iwrq->data.length = strlen(mac_lst)+1; 
+
+        WL_SOFTAP(("%s: data to user:\n%s\n usr_ptr:%p\n", __FUNCTION__,
+                mac_lst, p_iwrq->data.pointer));
+
+        if (p_iwrq->data.length) {
+                bcopy(mac_lst, extra, p_iwrq->data.length);
+        }
+
+func_exit:
+
+        DHD_OS_MUTEX_UNLOCK(&wl_softap_lock);
+        net_os_wake_unlock(dev);
+
+        WL_SOFTAP(("%s: Exited\n", __FUNCTION__));
+        return ret;
+}
+#endif 
+
+
+#ifdef SOFTAP
+
+#define MAC_FILT_MAX 8
+static int iwpriv_set_mac_filters(struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *ext)
+{
+        int i, ret = -1;
+        char  * extra = NULL;
+        int mac_cnt = 0; 
+        int mac_mode = 0;
+        struct ether_addr *p_ea;
+        struct mac_list_set mflist_set; 
+
+        WL_SOFTAP((">>> Got IWPRIV SET_MAC_FILTER IOCTL:  info->cmd:%x,"
+                        "info->flags:%x, u.data:%p, u.len:%d\n",
+                        info->cmd, info->flags,
+                        wrqu->data.pointer, wrqu->data.length));
+
+        if (wrqu->data.length != 0) {
+
+                char *str_ptr;
+
+                if (!(extra = kmalloc(wrqu->data.length+1, GFP_KERNEL)))
+                        return -ENOMEM;
+
+                if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) {
+                        kfree(extra);
+                        return -EFAULT;
+                }
+
+                extra[wrqu->data.length] = 0;
+                WL_SOFTAP((" Got parameter string in iw_point:\n %s \n", extra));
+
+                memset(&mflist_set, 0, sizeof(mflist_set));
+
+                
+                str_ptr = extra;
+
+
+                
+                if (get_parameter_from_string(&str_ptr, "MAC_MODE=",
+                        PTYPE_INTDEC, &mac_mode, 4) != 0) {
+                        WL_ERROR(("ERROR: 'MAC_MODE=' token is missing\n"));
+                        goto exit_proc;
+                }
+
+                p_ea = &mflist_set.mac_list.ea[0];
+
+                if (get_parameter_from_string(&str_ptr, "MAC_CNT=",
+                        PTYPE_INTDEC, &mac_cnt, 4) != 0) {
+                        WL_ERROR(("ERROR: 'MAC_CNT=' token param is missing \n"));
+                        goto exit_proc;
+                }
+
+                if (mac_cnt > MAC_FILT_MAX) {
+                        WL_ERROR(("ERROR: number of MAC filters > MAX\n"));
+                        goto exit_proc;
+                }
+
+                for (i=0; i< mac_cnt; i++)      
+                if (get_parameter_from_string(&str_ptr, "MAC=",
+                        PTYPE_STR_HEX, &p_ea[i], 12) != 0) {
+                        WL_ERROR(("ERROR: MAC_filter[%d] is missing !\n", i));
+                        goto exit_proc;
+                }
+
+                WL_SOFTAP(("MAC_MODE=:%d, MAC_CNT=%d, MACs:..\n", mac_mode, mac_cnt));
+                for (i = 0; i < mac_cnt; i++) {
+                   WL_SOFTAP(("mac_filt[%d]:", i));
+                   dhd_print_buf(&p_ea[i], 6, 0);
+                }
+
+                
+                mflist_set.mode = mac_mode;
+                mflist_set.mac_list.count = mac_cnt;
+                set_ap_mac_list(dev, &mflist_set);
+
+                
+                wrqu->data.pointer = NULL;
+                wrqu->data.length = 0;
+                ret = 0;
+
+        } else {
+         
+          WL_ERROR(("IWPRIV argument len is 0\n"));
+          return -1;
+        }
+
+        exit_proc:
+        kfree(extra);
+        return ret;
+}
+#endif 
+
+
+#ifdef SOFTAP
+
+static int iwpriv_set_ap_sta_disassoc(struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *ext)
+{
+        int res = 0;
+        char sta_mac[6] = {0, 0, 0, 0, 0, 0};
+        char cmd_buf[256];
+        char *str_ptr = cmd_buf;
+
+        WL_SOFTAP((">>%s called\n args: info->cmd:%x,"
+                " info->flags:%x, u.data.p:%p, u.data.len:%d\n",
+                __FUNCTION__, info->cmd, info->flags,
+                wrqu->data.pointer, wrqu->data.length));
+
+        if (wrqu->data.length != 0) {
+
+                if (copy_from_user(cmd_buf, wrqu->data.pointer, wrqu->data.length)) {
+                        return -EFAULT;
+                }
+
+                if (get_parameter_from_string(&str_ptr,
+                        "MAC=", PTYPE_STR_HEX, sta_mac, 12) == 0) {
+                        res = wl_iw_softap_deassoc_stations(dev, sta_mac);
+                } else  {
+                        WL_ERROR(("ERROR: STA_MAC= token not found\n"));
+                }
+        }
+
+        return res;
+}
+#endif 
+
+#endif 
+
+#if WIRELESS_EXT < 13
+struct iw_request_info
+{
+        __u16           cmd;            
+        __u16           flags;          
+};
+
+typedef int (*iw_handler)(struct net_device *dev,
+                struct iw_request_info *info,
+                void *wrqu,
+                char *extra);
+#endif 
+
+static int
+wl_iw_config_commit(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        void *zwrq,
+        char *extra
+)
+{
+        wlc_ssid_t ssid;
+        int error;
+        struct sockaddr bssid;
+
+        WL_TRACE(("%s: SIOCSIWCOMMIT\n", dev->name));
+
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_SSID, &ssid, sizeof(ssid))))
+                return error;
+
+        ssid.SSID_len = dtoh32(ssid.SSID_len);
+
+        if (!ssid.SSID_len)
+                return 0;
+
+        bzero(&bssid, sizeof(struct sockaddr));
+        if ((error = dev_wlc_ioctl(dev, WLC_REASSOC, &bssid, ETHER_ADDR_LEN))) {
+                WL_ERROR(("%s: WLC_REASSOC to %s failed \n", __FUNCTION__, ssid.SSID));
+                return error;
+        }
+
+        return 0;
+}
+
+static int
+wl_iw_get_name(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        char *cwrq,
+        char *extra
+)
+{
+        WL_TRACE(("%s: SIOCGIWNAME\n", dev->name));
+
+        strcpy(cwrq, "IEEE 802.11-DS");
+
+        return 0;
+}
+
+static int
+wl_iw_set_freq(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_freq *fwrq,
+        char *extra
+)
+{
+        int error, chan;
+        uint sf = 0;
+
+        WL_TRACE(("%s %s: SIOCSIWFREQ\n", __FUNCTION__, dev->name));
+
+#if defined(SOFTAP)
+        if (ap_cfg_running) {
+                WL_TRACE(("%s:>> not executed, 'SOFT_AP is active' \n", __FUNCTION__));
+                return 0;
+        }
+#endif
+
+        
+        if (fwrq->e == 0 && fwrq->m < MAXCHANNEL) {
+                chan = fwrq->m;
+        }
+        
+        else {
+                
+                if (fwrq->e >= 6) {
+                        fwrq->e -= 6;
+                        while (fwrq->e--)
+                                fwrq->m *= 10;
+                } else if (fwrq->e < 6) {
+                        while (fwrq->e++ < 6)
+                                fwrq->m /= 10;
+                }
+                
+                if (fwrq->m > 4000 && fwrq->m < 5000)
+                        sf = WF_CHAN_FACTOR_4_G; 
+
+                chan = wf_mhz2channel(fwrq->m, sf);
+        }
+
+        chan = htod32(chan);
+
+        if ((error = dev_wlc_ioctl(dev, WLC_SET_CHANNEL, &chan, sizeof(chan))))
+                return error;
+
+        g_wl_iw_params.target_channel = chan;
+
+        
+        return -EINPROGRESS;
+}
+
+static int
+wl_iw_get_freq(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_freq *fwrq,
+        char *extra
+)
+{
+        channel_info_t ci;
+        int error;
+
+        WL_TRACE(("%s: SIOCGIWFREQ\n", dev->name));
+
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_CHANNEL, &ci, sizeof(ci))))
+                return error;
+
+        
+        fwrq->m = dtoh32(ci.hw_channel);
+        fwrq->e = dtoh32(0);
+        return 0;
+}
+
+static int
+wl_iw_set_mode(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        __u32 *uwrq,
+        char *extra
+)
+{
+        int infra = 0, ap = 0, error = 0;
+
+        WL_TRACE(("%s: SIOCSIWMODE\n", dev->name));
+
+        switch (*uwrq) {
+        case IW_MODE_MASTER:
+                infra = ap = 1;
+                break;
+        case IW_MODE_ADHOC:
+        case IW_MODE_AUTO:
+                break;
+        case IW_MODE_INFRA:
+                infra = 1;
+                break;
+        default:
+                return -EINVAL;
+        }
+        infra = htod32(infra);
+        ap = htod32(ap);
+
+        if ((error = dev_wlc_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(infra))) ||
+            (error = dev_wlc_ioctl(dev, WLC_SET_AP, &ap, sizeof(ap))))
+                return error;
+
+        
+        return -EINPROGRESS;
+}
+
+static int
+wl_iw_get_mode(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        __u32 *uwrq,
+        char *extra
+)
+{
+        int error, infra = 0, ap = 0;
+
+        WL_TRACE(("%s: SIOCGIWMODE\n", dev->name));
+
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_INFRA, &infra, sizeof(infra))) ||
+            (error = dev_wlc_ioctl(dev, WLC_GET_AP, &ap, sizeof(ap))))
+                return error;
+
+        infra = dtoh32(infra);
+        ap = dtoh32(ap);
+        *uwrq = infra ? ap ? IW_MODE_MASTER : IW_MODE_INFRA : IW_MODE_ADHOC;
+
+        return 0;
+}
+
+static int
+wl_iw_get_range(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        struct iw_range *range = (struct iw_range *) extra;
+        wl_uint32_list_t *list;
+        wl_rateset_t rateset;
+        int8 *channels;
+        int error, i, k;
+        uint sf, ch;
+
+        int phytype;
+        int bw_cap = 0, sgi_tx = 0, nmode = 0;
+        channel_info_t ci;
+        uint8 nrate_list2copy = 0;
+        uint16 nrate_list[4][8] = { {13, 26, 39, 52, 78, 104, 117, 130},
+                {14, 29, 43, 58, 87, 116, 130, 144},
+                {27, 54, 81, 108, 162, 216, 243, 270},
+                {30, 60, 90, 120, 180, 240, 270, 300}};
+
+        WL_TRACE(("%s: SIOCGIWRANGE\n", dev->name));
+
+        if (!extra)
+                return -EINVAL;
+
+        channels = kmalloc((MAXCHANNEL+1)*4, GFP_KERNEL);
+        if (!channels) {
+                WL_ERROR(("Could not alloc channels\n"));
+                return -ENOMEM;
+        }
+        list = (wl_uint32_list_t *)channels;
+
+        dwrq->length = sizeof(struct iw_range);
+        memset(range, 0, sizeof(*range));
+
+        
+        range->min_nwid = range->max_nwid = 0;
+
+        
+        list->count = htod32(MAXCHANNEL);
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels, (MAXCHANNEL+1)*4))) {
+                kfree(channels);
+                return error;
+        }
+        for (i = 0; i < dtoh32(list->count) && i < IW_MAX_FREQUENCIES; i++) {
+                range->freq[i].i = dtoh32(list->element[i]);
+
+                ch = dtoh32(list->element[i]);
+                if (ch <= CH_MAX_2G_CHANNEL)
+                        sf = WF_CHAN_FACTOR_2_4_G;
+                else
+                        sf = WF_CHAN_FACTOR_5_G;
+
+                range->freq[i].m = wf_channel2mhz(ch, sf);
+                range->freq[i].e = 6;
+        }
+        range->num_frequency = range->num_channels = i;
+
+        
+        range->max_qual.qual = 5;
+        
+        range->max_qual.level = 0x100 - 200;    
+        
+        range->max_qual.noise = 0x100 - 200;    
+        
+        range->sensitivity = 65535;
+
+#if WIRELESS_EXT > 11
+        
+        range->avg_qual.qual = 3;
+        
+        range->avg_qual.level = 0x100 + WL_IW_RSSI_GOOD;
+        
+        range->avg_qual.noise = 0x100 - 75;     
+#endif 
+
+        
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset)))) {
+                kfree(channels);
+                return error;
+        }
+        rateset.count = dtoh32(rateset.count);
+        range->num_bitrates = rateset.count;
+        for (i = 0; i < rateset.count && i < IW_MAX_BITRATES; i++)
+                range->bitrate[i] = (rateset.rates[i]& 0x7f) * 500000; 
+        dev_wlc_intvar_get(dev, "nmode", &nmode);
+        dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &phytype, sizeof(phytype));
+
+        if (nmode == 1 && phytype == WLC_PHY_TYPE_SSN) {
+                dev_wlc_intvar_get(dev, "mimo_bw_cap", &bw_cap);
+                dev_wlc_intvar_get(dev, "sgi_tx", &sgi_tx);
+                dev_wlc_ioctl(dev, WLC_GET_CHANNEL, &ci, sizeof(channel_info_t));
+                ci.hw_channel = dtoh32(ci.hw_channel);
+
+                if (bw_cap == 0 ||
+                        (bw_cap == 2 && ci.hw_channel <= 14)) {
+                        if (sgi_tx == 0)
+                                nrate_list2copy = 0;
+                        else
+                                nrate_list2copy = 1;
+                }
+                if (bw_cap == 1 ||
+                        (bw_cap == 2 && ci.hw_channel >= 36)) {
+                        if (sgi_tx == 0)
+                                nrate_list2copy = 2;
+                        else
+                                nrate_list2copy = 3;
+                }
+                range->num_bitrates += 8;
+                for (k = 0; i < range->num_bitrates; k++, i++) {
+                        
+                        range->bitrate[i] = (nrate_list[nrate_list2copy][k]) * 500000;
+                }
+        }
+
+        
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &i, sizeof(i)))) {
+                kfree(channels);
+                return error;
+        }
+        i = dtoh32(i);
+        if (i == WLC_PHY_TYPE_A)
+                range->throughput = 24000000;   
+        else
+                range->throughput = 1500000;    
+
+        
+        range->min_rts = 0;
+        range->max_rts = 2347;
+        range->min_frag = 256;
+        range->max_frag = 2346;
+
+        range->max_encoding_tokens = DOT11_MAX_DEFAULT_KEYS;
+        range->num_encoding_sizes = 4;
+        range->encoding_size[0] = WEP1_KEY_SIZE;
+        range->encoding_size[1] = WEP128_KEY_SIZE;
+#if WIRELESS_EXT > 17
+        range->encoding_size[2] = TKIP_KEY_SIZE;
+#else
+        range->encoding_size[2] = 0;
+#endif
+        range->encoding_size[3] = AES_KEY_SIZE;
+
+        
+        range->min_pmp = 0;
+        range->max_pmp = 0;
+        range->min_pmt = 0;
+        range->max_pmt = 0;
+        range->pmp_flags = 0;
+        range->pm_capa = 0;
+
+        
+        range->num_txpower = 2;
+        range->txpower[0] = 1;
+        range->txpower[1] = 255;
+        range->txpower_capa = IW_TXPOW_MWATT;
+
+#if WIRELESS_EXT > 10
+        range->we_version_compiled = WIRELESS_EXT;
+        range->we_version_source = 19;
+
+        
+        range->retry_capa = IW_RETRY_LIMIT;
+        range->retry_flags = IW_RETRY_LIMIT;
+        range->r_time_flags = 0;
+        
+        range->min_retry = 1;
+        range->max_retry = 255;
+        
+        range->min_r_time = 0;
+        range->max_r_time = 0;
+#endif 
+
+#if WIRELESS_EXT > 17
+        range->enc_capa = IW_ENC_CAPA_WPA;
+        range->enc_capa |= IW_ENC_CAPA_CIPHER_TKIP;
+        range->enc_capa |= IW_ENC_CAPA_CIPHER_CCMP;
+        range->enc_capa |= IW_ENC_CAPA_WPA2;
+
+        
+        IW_EVENT_CAPA_SET_KERNEL(range->event_capa);
+        
+        IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
+        IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
+        IW_EVENT_CAPA_SET(range->event_capa, IWEVTXDROP);
+        IW_EVENT_CAPA_SET(range->event_capa, IWEVMICHAELMICFAILURE);
+        IW_EVENT_CAPA_SET(range->event_capa, IWEVPMKIDCAND);
+#endif 
+
+        kfree(channels);
+
+        return 0;
+}
+
+static int
+rssi_to_qual(int rssi)
+{
+        if (rssi <= WL_IW_RSSI_NO_SIGNAL)
+                return 0;
+        else if (rssi <= WL_IW_RSSI_VERY_LOW)
+                return 1;
+        else if (rssi <= WL_IW_RSSI_LOW)
+                return 2;
+        else if (rssi <= WL_IW_RSSI_GOOD)
+                return 3;
+        else if (rssi <= WL_IW_RSSI_VERY_GOOD)
+                return 4;
+        else
+                return 5;
+}
+
+static int
+wl_iw_set_spy(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_iw_t *iw = NETDEV_PRIV(dev);
+        struct sockaddr *addr = (struct sockaddr *) extra;
+        int i;
+
+        WL_TRACE(("%s: SIOCSIWSPY\n", dev->name));
+
+        if (!extra)
+                return -EINVAL;
+
+        iw->spy_num = MIN(ARRAYSIZE(iw->spy_addr), dwrq->length);
+        for (i = 0; i < iw->spy_num; i++)
+                memcpy(&iw->spy_addr[i], addr[i].sa_data, ETHER_ADDR_LEN);
+        memset(iw->spy_qual, 0, sizeof(iw->spy_qual));
+
+        return 0;
+}
+
+static int
+wl_iw_get_spy(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_iw_t *iw = NETDEV_PRIV(dev);
+        struct sockaddr *addr = (struct sockaddr *) extra;
+        struct iw_quality *qual = (struct iw_quality *) &addr[iw->spy_num];
+        int i;
+
+        WL_TRACE(("%s: SIOCGIWSPY\n", dev->name));
+
+        if (!extra)
+                return -EINVAL;
+
+        dwrq->length = iw->spy_num;
+        for (i = 0; i < iw->spy_num; i++) {
+                memcpy(addr[i].sa_data, &iw->spy_addr[i], ETHER_ADDR_LEN);
+                addr[i].sa_family = AF_UNIX;
+                memcpy(&qual[i], &iw->spy_qual[i], sizeof(struct iw_quality));
+                iw->spy_qual[i].updated = 0;
+        }
+
+        return 0;
+}
+
+
+static int
+wl_iw_ch_to_chanspec(int ch, wl_join_params_t *join_params, int *join_params_size)
+{
+        chanspec_t chanspec = 0;
+
+        if (ch != 0) {
+                
+                join_params->params.chanspec_num = 1;
+                join_params->params.chanspec_list[0] = ch;
+
+                if (join_params->params.chanspec_list[0])
+                        chanspec |= WL_CHANSPEC_BAND_2G;
+                else
+                        chanspec |= WL_CHANSPEC_BAND_5G;
+
+                chanspec |= WL_CHANSPEC_BW_20;
+                chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+                
+                *join_params_size += WL_ASSOC_PARAMS_FIXED_SIZE +
+                        join_params->params.chanspec_num * sizeof(chanspec_t);
+
+                
+                join_params->params.chanspec_list[0]  &= WL_CHANSPEC_CHAN_MASK;
+                join_params->params.chanspec_list[0] |= chanspec;
+                join_params->params.chanspec_list[0] =
+                        htodchanspec(join_params->params.chanspec_list[0]);
+
+                join_params->params.chanspec_num = htod32(join_params->params.chanspec_num);
+
+                WL_TRACE(("%s  join_params->params.chanspec_list[0]= %X\n",
+                        __FUNCTION__, join_params->params.chanspec_list[0]));
+        }
+        return 1;
+}
+
+static int
+wl_iw_set_wap(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct sockaddr *awrq,
+        char *extra
+)
+{
+        int error = -EINVAL;
+        wl_join_params_t join_params;
+        int join_params_size;
+
+        WL_TRACE(("%s: SIOCSIWAP\n", dev->name));
+
+        if (awrq->sa_family != ARPHRD_ETHER) {
+                WL_ERROR(("Invalid Header...sa_family\n"));
+                return -EINVAL;
+        }
+
+        
+        if (ETHER_ISBCAST(awrq->sa_data) || ETHER_ISNULLADDR(awrq->sa_data)) {
+                scb_val_t scbval;
+                
+                bzero(&scbval, sizeof(scb_val_t));
+                
+                (void) dev_wlc_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t));
+                return 0;
+        }
+
+
+        
+        memset(&join_params, 0, sizeof(join_params));
+        join_params_size = sizeof(join_params.ssid);
+
+        memcpy(join_params.ssid.SSID, g_ssid.SSID, g_ssid.SSID_len);
+        join_params.ssid.SSID_len = htod32(g_ssid.SSID_len);
+        memcpy(&join_params.params.bssid, awrq->sa_data, ETHER_ADDR_LEN);
+
+        
+        
+        WL_TRACE(("%s  target_channel=%d\n", __FUNCTION__, g_wl_iw_params.target_channel));
+        wl_iw_ch_to_chanspec(g_wl_iw_params.target_channel, &join_params, &join_params_size);
+
+        if ((error = dev_wlc_ioctl(dev, WLC_SET_SSID, &join_params, join_params_size))) {
+                WL_ERROR(("%s Invalid ioctl data=%d\n", __FUNCTION__, error));
+                return error;
+        }
+
+        if (g_ssid.SSID_len) {
+                WL_TRACE(("%s: join SSID=%s BSSID="MACSTR" ch=%d\n", __FUNCTION__,
+                        g_ssid.SSID, MAC2STR((u8 *)awrq->sa_data),
+                        g_wl_iw_params.target_channel));
+        }
+
+        
+        memset(&g_ssid, 0, sizeof(g_ssid));
+        return 0;
+}
+
+static int
+wl_iw_get_wap(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct sockaddr *awrq,
+        char *extra
+)
+{
+        WL_TRACE(("%s: SIOCGIWAP\n", dev->name));
+
+        awrq->sa_family = ARPHRD_ETHER;
+        memset(awrq->sa_data, 0, ETHER_ADDR_LEN);
+
+        
+        (void) dev_wlc_ioctl(dev, WLC_GET_BSSID, awrq->sa_data, ETHER_ADDR_LEN);
+
+        return 0;
+}
+
+#if WIRELESS_EXT > 17
+static int
+wl_iw_mlme(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct sockaddr *awrq,
+        char *extra
+)
+{
+        struct iw_mlme *mlme;
+        scb_val_t scbval;
+        int error  = -EINVAL;
+
+        WL_TRACE(("%s: SIOCSIWMLME DISASSOC/DEAUTH\n", dev->name));
+
+        mlme = (struct iw_mlme *)extra;
+        if (mlme == NULL) {
+                WL_ERROR(("Invalid ioctl data.\n"));
+                return error;
+        }
+
+        scbval.val = mlme->reason_code;
+        bcopy(&mlme->addr.sa_data, &scbval.ea, ETHER_ADDR_LEN);
+
+        if (mlme->cmd == IW_MLME_DISASSOC) {
+                scbval.val = htod32(scbval.val);
+                error = dev_wlc_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t));
+        }
+        else if (mlme->cmd == IW_MLME_DEAUTH) {
+                scbval.val = htod32(scbval.val);
+                error = dev_wlc_ioctl(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scbval,
+                        sizeof(scb_val_t));
+        }
+        else {
+                WL_ERROR(("Invalid ioctl data.\n"));
+                return error;
+        }
+
+        return error;
+}
+#endif 
+
+#ifndef WL_IW_USE_ISCAN
+static int
+wl_iw_get_aplist(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_scan_results_t *list;
+        struct sockaddr *addr = (struct sockaddr *) extra;
+        struct iw_quality qual[IW_MAX_AP];
+        wl_bss_info_t *bi = NULL;
+        int error, i;
+        uint buflen = dwrq->length;
+
+        WL_TRACE(("%s: SIOCGIWAPLIST\n", dev->name));
+
+        if (!extra)
+                return -EINVAL;
+
+        
+        list = kmalloc(buflen, GFP_KERNEL);
+        if (!list)
+                return -ENOMEM;
+        memset(list, 0, buflen);
+        list->buflen = htod32(buflen);
+        if ((error = dev_wlc_ioctl(dev, WLC_SCAN_RESULTS, list, buflen))) {
+                WL_ERROR(("%d: Scan results error %d\n", __LINE__, error));
+                kfree(list);
+                return error;
+        }
+        list->buflen = dtoh32(list->buflen);
+        list->version = dtoh32(list->version);
+        list->count = dtoh32(list->count);
+        if (list->version != WL_BSS_INFO_VERSION) {
+                WL_ERROR(("%s : list->version %d != WL_BSS_INFO_VERSION\n",
+                          __FUNCTION__, list->version));
+                kfree(list);
+                return -EINVAL;
+        }
+
+        for (i = 0, dwrq->length = 0; i < list->count && dwrq->length < IW_MAX_AP; i++) {
+                bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+                ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+                        buflen));
+
+                
+                if (!(dtoh16(bi->capability) & DOT11_CAP_ESS))
+                        continue;
+
+                
+                memcpy(addr[dwrq->length].sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+                addr[dwrq->length].sa_family = ARPHRD_ETHER;
+                qual[dwrq->length].qual = rssi_to_qual(dtoh16(bi->RSSI));
+                qual[dwrq->length].level = 0x100 + dtoh16(bi->RSSI);
+                qual[dwrq->length].noise = 0x100 + bi->phy_noise;
+
+                
+#if WIRELESS_EXT > 18
+                qual[dwrq->length].updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+#else
+                qual[dwrq->length].updated = 7;
+#endif 
+
+                dwrq->length++;
+        }
+
+        kfree(list);
+
+        if (dwrq->length) {
+                memcpy(&addr[dwrq->length], qual, sizeof(struct iw_quality) * dwrq->length);
+                
+                dwrq->flags = 1;
+        }
+
+        return 0;
+}
+#endif 
+
+#ifdef WL_IW_USE_ISCAN
+static int
+wl_iw_iscan_get_aplist(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_scan_results_t *list;
+        iscan_buf_t * buf;
+        iscan_info_t *iscan = g_iscan;
+
+        struct sockaddr *addr = (struct sockaddr *) extra;
+        struct iw_quality qual[IW_MAX_AP];
+        wl_bss_info_t *bi = NULL;
+        int i;
+
+        WL_TRACE(("%s: SIOCGIWAPLIST\n", dev->name));
+
+        if (!extra)
+                return -EINVAL;
+
+        if ((!iscan) || (iscan->tsk_ctl.thr_pid < 0)) {
+                WL_ERROR(("%s error\n", __FUNCTION__));
+                return 0;
+        }
+
+        buf = iscan->list_hdr;
+        
+        while (buf) {
+                list = &((wl_iscan_results_t*)buf->iscan_buf)->results;
+                if (list->version != WL_BSS_INFO_VERSION) {
+                        WL_ERROR(("%s : list->version %d != WL_BSS_INFO_VERSION\n",
+                                __FUNCTION__, list->version));
+                        return -EINVAL;
+                }
+
+                bi = NULL;
+                for (i = 0, dwrq->length = 0; i < list->count && dwrq->length < IW_MAX_AP; i++) {
+                        bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length))
+                                  : list->bss_info;
+                        ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+                                WLC_IW_ISCAN_MAXLEN));
+
+                        
+                        if (!(dtoh16(bi->capability) & DOT11_CAP_ESS))
+                                continue;
+
+                        
+                        memcpy(addr[dwrq->length].sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+                        addr[dwrq->length].sa_family = ARPHRD_ETHER;
+                        qual[dwrq->length].qual = rssi_to_qual(dtoh16(bi->RSSI));
+                        qual[dwrq->length].level = 0x100 + dtoh16(bi->RSSI);
+                        qual[dwrq->length].noise = 0x100 + bi->phy_noise;
+
+                        
+#if WIRELESS_EXT > 18
+                        qual[dwrq->length].updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+#else
+                        qual[dwrq->length].updated = 7;
+#endif 
+
+                        dwrq->length++;
+                }
+                buf = buf->next;
+        }
+        if (dwrq->length) {
+                memcpy(&addr[dwrq->length], qual, sizeof(struct iw_quality) * dwrq->length);
+                
+                dwrq->flags = 1;
+        }
+
+        return 0;
+}
+
+static int
+wl_iw_iscan_prep(wl_scan_params_t *params, wlc_ssid_t *ssid)
+{
+        int err = 0;
+
+        memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+        params->bss_type = DOT11_BSSTYPE_ANY;
+        params->scan_type = 0;
+        params->nprobes = -1;
+        params->active_time = -1;
+        params->passive_time = -1;
+        params->home_time = -1;
+        params->channel_num = 0;
+
+#if defined(CONFIG_FIRST_SCAN)
+        
+        if (g_first_broadcast_scan == BROADCAST_SCAN_FIRST_STARTED)
+                params->passive_time = 30;
+#endif 
+        params->nprobes = htod32(params->nprobes);
+        params->active_time = htod32(params->active_time);
+        params->passive_time = htod32(params->passive_time);
+        params->home_time = htod32(params->home_time);
+        if (ssid && ssid->SSID_len)
+                memcpy(&params->ssid, ssid, sizeof(wlc_ssid_t));
+
+        return err;
+}
+
+static int
+wl_iw_iscan(iscan_info_t *iscan, wlc_ssid_t *ssid, uint16 action)
+{
+        int err = 0;
+
+        iscan->iscan_ex_params_p->version = htod32(ISCAN_REQ_VERSION);
+        iscan->iscan_ex_params_p->action = htod16(action);
+        iscan->iscan_ex_params_p->scan_duration = htod16(0);
+
+        WL_SCAN(("%s : nprobes=%d\n", __FUNCTION__, iscan->iscan_ex_params_p->params.nprobes));
+        WL_SCAN(("active_time=%d\n", iscan->iscan_ex_params_p->params.active_time));
+        WL_SCAN(("passive_time=%d\n", iscan->iscan_ex_params_p->params.passive_time));
+        WL_SCAN(("home_time=%d\n", iscan->iscan_ex_params_p->params.home_time));
+        WL_SCAN(("scan_type=%d\n", iscan->iscan_ex_params_p->params.scan_type));
+        WL_SCAN(("bss_type=%d\n", iscan->iscan_ex_params_p->params.bss_type));
+
+        if ((dev_iw_iovar_setbuf(iscan->dev, "iscan", iscan->iscan_ex_params_p,
+                iscan->iscan_ex_param_size, iscan->ioctlbuf, sizeof(iscan->ioctlbuf)))) {
+                        WL_ERROR(("Set ISCAN for %s failed with %d\n", __FUNCTION__, err));
+                        err = -1;
+        }
+
+        return err;
+}
+
+static void
+wl_iw_timerfunc(ulong data)
+{
+        iscan_info_t *iscan = (iscan_info_t *)data;
+        if (iscan) {
+                iscan->timer_on = 0;
+                if (iscan->iscan_state != ISCAN_STATE_IDLE) {
+                        WL_TRACE(("timer trigger\n"));
+                        up(&iscan->tsk_ctl.sema);
+                }
+        }
+}
+
+static void
+wl_iw_set_event_mask(struct net_device *dev)
+{
+        char eventmask[WL_EVENTING_MASK_LEN];
+        char iovbuf[WL_EVENTING_MASK_LEN + 12]; 
+
+        dev_iw_iovar_getbuf(dev, "event_msgs", "", 0, iovbuf, sizeof(iovbuf));
+        bcopy(iovbuf, eventmask, WL_EVENTING_MASK_LEN);
+        setbit(eventmask, WLC_E_SCAN_COMPLETE);
+        dev_iw_iovar_setbuf(dev, "event_msgs", eventmask, WL_EVENTING_MASK_LEN,
+                iovbuf, sizeof(iovbuf));
+}
+
+static uint32
+wl_iw_iscan_get(iscan_info_t *iscan)
+{
+        iscan_buf_t * buf;
+        iscan_buf_t * ptr;
+        wl_iscan_results_t * list_buf;
+        wl_iscan_results_t list;
+        wl_scan_results_t *results;
+        uint32 status;
+        int res = 0;
+
+        DHD_OS_MUTEX_LOCK(&wl_cache_lock);
+        if (iscan->list_cur) {
+                buf = iscan->list_cur;
+                iscan->list_cur = buf->next;
+        }
+        else {
+                buf = kmalloc(sizeof(iscan_buf_t), GFP_KERNEL);
+                if (!buf) {
+                        WL_ERROR(("%s can't alloc iscan_buf_t : going to abort currect iscan\n",
+                                  __FUNCTION__));
+                        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+                        return WL_SCAN_RESULTS_NO_MEM;
+                }
+                buf->next = NULL;
+                if (!iscan->list_hdr)
+                        iscan->list_hdr = buf;
+                else {
+                        ptr = iscan->list_hdr;
+                        while (ptr->next) {
+                                ptr = ptr->next;
+                        }
+                        ptr->next = buf;
+                }
+        }
+        memset(buf->iscan_buf, 0, WLC_IW_ISCAN_MAXLEN);
+        list_buf = (wl_iscan_results_t*)buf->iscan_buf;
+        results = &list_buf->results;
+        results->buflen = WL_ISCAN_RESULTS_FIXED_SIZE;
+        results->version = 0;
+        results->count = 0;
+
+        memset(&list, 0, sizeof(list));
+        list.results.buflen = htod32(WLC_IW_ISCAN_MAXLEN);
+        res = dev_iw_iovar_getbuf(
+                iscan->dev,
+                "iscanresults",
+                &list,
+                WL_ISCAN_RESULTS_FIXED_SIZE,
+                buf->iscan_buf,
+                WLC_IW_ISCAN_MAXLEN);
+        if (res == 0) {
+                results->buflen = dtoh32(results->buflen);
+                results->version = dtoh32(results->version);
+                results->count = dtoh32(results->count);
+                WL_TRACE(("results->count = %d\n", results->count));
+                WL_TRACE(("results->buflen = %d\n", results->buflen));
+                status = dtoh32(list_buf->status);
+        } else {
+                WL_ERROR(("%s returns error %d\n", __FUNCTION__, res));
+                
+                status = WL_SCAN_RESULTS_NO_MEM;
+        }
+        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+        return status;
+}
+
+static void
+wl_iw_force_specific_scan(iscan_info_t *iscan)
+{
+        WL_TRACE(("%s force Specific SCAN for %s\n", __FUNCTION__, g_specific_ssid.SSID));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        rtnl_lock();
+#endif
+
+        (void) dev_wlc_ioctl(iscan->dev, WLC_SCAN, &g_specific_ssid, sizeof(g_specific_ssid));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        rtnl_unlock();
+#endif
+}
+
+static void
+wl_iw_send_scan_complete(iscan_info_t *iscan)
+{
+        union iwreq_data wrqu;
+
+        memset(&wrqu, 0, sizeof(wrqu));
+
+        
+        wireless_send_event(iscan->dev, SIOCGIWSCAN, &wrqu, NULL);
+#if defined(CONFIG_FIRST_SCAN)
+                if (g_first_broadcast_scan == BROADCAST_SCAN_FIRST_STARTED)
+                        g_first_broadcast_scan = BROADCAST_SCAN_FIRST_RESULT_READY;
+#endif 
+                WL_TRACE(("Send Event ISCAN complete\n"));
+}
+
+static int
+_iscan_sysioc_thread(void *data)
+{
+        uint32 status;
+
+        tsk_ctl_t *tsk_ctl = (tsk_ctl_t *)data;
+        iscan_info_t *iscan = (iscan_info_t *) tsk_ctl->parent;
+
+
+        static bool iscan_pass_abort = FALSE;
+
+        DAEMONIZE("iscan_sysioc");
+
+        status = WL_SCAN_RESULTS_PARTIAL;
+
+        
+        complete(&tsk_ctl->completed);
+
+        while (down_interruptible(&tsk_ctl->sema) == 0) {
+
+                SMP_RD_BARRIER_DEPENDS();
+                if (tsk_ctl->terminated) {
+                        break;
+                }
+#if defined(SOFTAP)
+                
+                if (ap_cfg_running) {
+                 WL_TRACE(("%s skipping SCAN ops in AP mode !!!\n", __FUNCTION__));
+                 net_os_wake_unlock(iscan->dev);
+                 continue;
+                }
+#endif 
+
+                if (iscan->timer_on) {
+                        
+                        iscan->timer_on = 0;
+                        del_timer_sync(&iscan->timer);
+                }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                rtnl_lock();
+#endif
+                status = wl_iw_iscan_get(iscan);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                rtnl_unlock();
+#endif
+
+        if  (g_scan_specified_ssid && (iscan_pass_abort == TRUE)) {
+                WL_TRACE(("%s Get results from specific scan status=%d\n", __FUNCTION__, status));
+                        wl_iw_send_scan_complete(iscan);
+                        iscan_pass_abort = FALSE;
+                        status  = -1;
+                }
+
+                switch (status) {
+                        case WL_SCAN_RESULTS_PARTIAL:
+                                WL_TRACE(("iscanresults incomplete\n"));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                                rtnl_lock();
+#endif
+                                
+                                wl_iw_iscan(iscan, NULL, WL_SCAN_ACTION_CONTINUE);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                                rtnl_unlock();
+#endif
+                                
+                                mod_timer(&iscan->timer, jiffies + iscan->timer_ms*HZ/1000);
+                                iscan->timer_on = 1;
+                                break;
+                        case WL_SCAN_RESULTS_SUCCESS:
+                                WL_TRACE(("iscanresults complete\n"));
+                                iscan->iscan_state = ISCAN_STATE_IDLE;
+                                wl_iw_send_scan_complete(iscan);
+                                break;
+                        case WL_SCAN_RESULTS_PENDING:
+                                WL_TRACE(("iscanresults pending\n"));
+                                
+                                mod_timer(&iscan->timer, jiffies + iscan->timer_ms*HZ/1000);
+                                iscan->timer_on = 1;
+                                break;
+                        case WL_SCAN_RESULTS_ABORTED:
+                                WL_TRACE(("iscanresults aborted\n"));
+                                iscan->iscan_state = ISCAN_STATE_IDLE;
+                                if (g_scan_specified_ssid == 0)
+                                        wl_iw_send_scan_complete(iscan);
+                                else {
+                                        iscan_pass_abort = TRUE;
+                                        wl_iw_force_specific_scan(iscan);
+                                }
+                                break;
+                        case WL_SCAN_RESULTS_NO_MEM:
+                                WL_TRACE(("iscanresults can't alloc memory: skip\n"));
+                                iscan->iscan_state = ISCAN_STATE_IDLE;
+                                break;
+                        default:
+                                WL_TRACE(("iscanresults returned unknown status %d\n", status));
+                                break;
+                 }
+
+                net_os_wake_unlock(iscan->dev);
+        }
+
+        if (iscan->timer_on) {
+                iscan->timer_on = 0;
+                del_timer_sync(&iscan->timer);
+        }
+        complete_and_exit(&tsk_ctl->completed, 0);
+}
+#endif 
+
+#if !defined(CSCAN)
+
+static void
+wl_iw_set_ss_cache_timer_flag(void)
+{
+        g_ss_cache_ctrl.m_timer_expired = 1;
+        WL_TRACE(("%s called\n", __FUNCTION__));
+}
+
+
+static int
+wl_iw_init_ss_cache_ctrl(void)
+{
+        WL_TRACE(("%s :\n", __FUNCTION__));
+        g_ss_cache_ctrl.m_prev_scan_mode = 0;
+        g_ss_cache_ctrl.m_cons_br_scan_cnt = 0;
+        g_ss_cache_ctrl.m_cache_head = NULL;
+        g_ss_cache_ctrl.m_link_down = 0;
+        g_ss_cache_ctrl.m_timer_expired = 0;
+        memset(g_ss_cache_ctrl.m_active_bssid, 0, ETHER_ADDR_LEN);
+
+        g_ss_cache_ctrl.m_timer = kmalloc(sizeof(struct timer_list), GFP_KERNEL);
+        if (!g_ss_cache_ctrl.m_timer) {
+                return -ENOMEM;
+        }
+        g_ss_cache_ctrl.m_timer->function = (void *)wl_iw_set_ss_cache_timer_flag;
+        init_timer(g_ss_cache_ctrl.m_timer);
+
+        return 0;
+}
+
+
+
+static void
+wl_iw_free_ss_cache(void)
+{
+        wl_iw_ss_cache_t *node, *cur;
+        wl_iw_ss_cache_t **spec_scan_head;
+
+        WL_TRACE(("%s called\n", __FUNCTION__));
+
+        DHD_OS_MUTEX_LOCK(&wl_cache_lock);
+        spec_scan_head = &g_ss_cache_ctrl.m_cache_head;
+        node = *spec_scan_head;
+
+        for (;node;) {
+                WL_TRACE(("%s : SSID - %s\n", __FUNCTION__, node->bss_info->SSID));
+                cur = node;
+                node = cur->next;
+                kfree(cur);
+        }
+        *spec_scan_head = NULL;
+        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+}
+
+
+
+static int
+wl_iw_run_ss_cache_timer(int kick_off)
+{
+        struct timer_list **timer;
+
+        timer = &g_ss_cache_ctrl.m_timer;
+
+        if (*timer) {
+                if (kick_off) {
+#ifdef CONFIG_PRESCANNED
+                        (*timer)->expires = jiffies + 70000 * HZ / 1000;
+#else
+                        (*timer)->expires = jiffies + 30000 * HZ / 1000;        
+#endif
+                        add_timer(*timer);
+                        WL_TRACE(("%s : timer starts \n", __FUNCTION__));
+                } else {
+                        del_timer_sync(*timer);
+                        WL_TRACE(("%s : timer stops \n", __FUNCTION__));
+                }
+        }
+
+        return 0;
+}
+
+
+static void
+wl_iw_release_ss_cache_ctrl(void)
+{
+        WL_TRACE(("%s :\n", __FUNCTION__));
+        wl_iw_free_ss_cache();
+        wl_iw_run_ss_cache_timer(0);
+        if (g_ss_cache_ctrl.m_timer) {
+                kfree(g_ss_cache_ctrl.m_timer);
+        }
+}
+
+
+
+static void
+wl_iw_reset_ss_cache(void)
+{
+        wl_iw_ss_cache_t *node, *prev, *cur;
+        wl_iw_ss_cache_t **spec_scan_head;
+
+        DHD_OS_MUTEX_LOCK(&wl_cache_lock);
+        spec_scan_head = &g_ss_cache_ctrl.m_cache_head;
+        node = *spec_scan_head;
+        prev = node;
+
+        for (;node;) {
+                WL_TRACE(("%s : node SSID %s \n", __FUNCTION__, node->bss_info->SSID));
+                if (!node->dirty) {
+                        cur = node;
+                        if (cur == *spec_scan_head) {
+                                *spec_scan_head = cur->next;
+                                prev = *spec_scan_head;
+                        }
+                        else {
+                                prev->next = cur->next;
+                        }
+                        node = cur->next;
+
+                        WL_TRACE(("%s : Del node : SSID %s\n", __FUNCTION__, cur->bss_info->SSID));
+                        kfree(cur);
+                        continue;
+                }
+
+                node->dirty = 0;
+                prev = node;
+                node = node->next;
+        }
+        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+}
+
+
+static int
+wl_iw_add_bss_to_ss_cache(wl_scan_results_t *ss_list)
+{
+
+        wl_iw_ss_cache_t *node, *prev, *leaf;
+        wl_iw_ss_cache_t **spec_scan_head;
+        wl_bss_info_t *bi = NULL;
+        int i;
+
+        
+        if (!ss_list->count) {
+                return 0;
+        }
+
+        DHD_OS_MUTEX_LOCK(&wl_cache_lock);
+        spec_scan_head = &g_ss_cache_ctrl.m_cache_head;
+
+        for (i = 0; i < ss_list->count; i++) {
+
+                node = *spec_scan_head;
+                prev = node;
+
+                bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : ss_list->bss_info;
+
+                WL_TRACE(("%s : find %d with specific SSID %s\n", __FUNCTION__, i, bi->SSID));
+                for (;node;) {
+                        if (!memcmp(&node->bss_info->BSSID, &bi->BSSID, ETHER_ADDR_LEN)) {
+                                
+                                WL_TRACE(("dirty marked : SSID %s\n", bi->SSID));
+                                node->dirty = 1;
+                                break;
+                        }
+                        prev = node;
+                        node = node->next;
+                }
+
+                if (node) {
+                        continue;
+                }
+
+                leaf = kmalloc(bi->length + WLC_IW_SS_CACHE_CTRL_FIELD_MAXLEN, GFP_KERNEL);
+                if (!leaf) {
+                        WL_ERROR(("Memory alloc failure %d\n",
+                                bi->length + WLC_IW_SS_CACHE_CTRL_FIELD_MAXLEN));
+                        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+                        return -ENOMEM;
+                }
+
+                memcpy(leaf->bss_info, bi, bi->length);
+                leaf->next = NULL;
+                leaf->dirty = 1;
+                leaf->count = 1;
+                leaf->version = ss_list->version;
+
+                if (!prev) {
+                        *spec_scan_head = leaf;
+                }
+                else {
+                        prev->next = leaf;
+                }
+        }
+        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+        return 0;
+}
+
+
+static int
+wl_iw_merge_scan_cache(struct iw_request_info *info, char *extra, uint buflen_from_user,
+__u16 *merged_len)
+{
+        wl_iw_ss_cache_t *node;
+        wl_scan_results_t *list_merge;
+
+        DHD_OS_MUTEX_LOCK(&wl_cache_lock);
+        node = g_ss_cache_ctrl.m_cache_head;
+        for (;node;) {
+                list_merge = (wl_scan_results_t *)&node->buflen;
+                WL_TRACE(("%s: Cached Specific APs list=%d\n", __FUNCTION__, list_merge->count));
+                if (buflen_from_user - *merged_len > 0) {
+                        *merged_len += (__u16) wl_iw_get_scan_prep(list_merge, info,
+                                extra + *merged_len, buflen_from_user - *merged_len);
+                }
+                else {
+                        WL_TRACE(("%s: exit with break\n", __FUNCTION__));
+                        break;
+                }
+                node = node->next;
+        }
+        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+        return 0;
+}
+
+
+static int
+wl_iw_delete_bss_from_ss_cache(void *addr)
+{
+
+        wl_iw_ss_cache_t *node, *prev;
+        wl_iw_ss_cache_t **spec_scan_head;
+
+        DHD_OS_MUTEX_LOCK(&wl_cache_lock);
+        spec_scan_head = &g_ss_cache_ctrl.m_cache_head;
+        node = *spec_scan_head;
+        prev = node;
+        for (;node;) {
+                if (!memcmp(&node->bss_info->BSSID, addr, ETHER_ADDR_LEN)) {
+                        if (node == *spec_scan_head) {
+                                *spec_scan_head = node->next;
+                        }
+                        else {
+                                prev->next = node->next;
+                        }
+
+                        WL_TRACE(("%s : Del node : %s\n", __FUNCTION__, node->bss_info->SSID));
+                        kfree(node);
+                        break;
+                }
+
+                prev = node;
+                node = node->next;
+        }
+
+        memset(addr, 0, ETHER_ADDR_LEN);
+        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+        return 0;
+}
+
+#endif  
+
+static int
+wl_iw_set_scan(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int error;
+        WL_TRACE(("\n:%s dev:%s: SIOCSIWSCAN : SCAN\n", __FUNCTION__, dev->name));
+
+#ifdef OEM_CHROMIUMOS
+        g_set_essid_before_scan = FALSE;
+#endif
+
+#if defined(CSCAN)
+                WL_ERROR(("%s: Scan from SIOCGIWSCAN not supported\n", __FUNCTION__));
+                return -EINVAL;
+#endif 
+
+#if defined(SOFTAP)
+        
+        if (ap_cfg_running) {
+                WL_TRACE(("\n>%s: Not executed, reason -'SOFTAP is active'\n", __FUNCTION__));
+                return 0;
+        }
+#endif 
+
+        
+        if (g_onoff == G_WLAN_SET_OFF)
+                return 0;
+
+        
+        memset(&g_specific_ssid, 0, sizeof(g_specific_ssid));
+#ifndef WL_IW_USE_ISCAN
+        
+        g_scan_specified_ssid = 0;
+#endif 
+
+#if WIRELESS_EXT > 17
+        
+        if (wrqu->data.length == sizeof(struct iw_scan_req)) {
+                if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+                        struct iw_scan_req *req = (struct iw_scan_req *)extra;
+#if defined(CONFIG_FIRST_SCAN)
+                        if (g_first_broadcast_scan != BROADCAST_SCAN_FIRST_RESULT_CONSUMED) {
+                                
+                                WL_TRACE(("%s Ignoring SC %s first BC is not done = %d\n",
+                                          __FUNCTION__, req->essid,
+                                          g_first_broadcast_scan));
+                                return -EBUSY;
+                        }
+#endif  
+                        if (g_scan_specified_ssid) {
+                                WL_TRACE(("%s Specific SCAN is not done ignore scan for = %s \n",
+                                        __FUNCTION__, req->essid));
+                                
+                                return -EBUSY;
+                        }
+                        else {
+                                g_specific_ssid.SSID_len = MIN(sizeof(g_specific_ssid.SSID),
+                                                               req->essid_len);
+                                memcpy(g_specific_ssid.SSID, req->essid, g_specific_ssid.SSID_len);
+                                g_specific_ssid.SSID_len = htod32(g_specific_ssid.SSID_len);
+                                g_scan_specified_ssid = 1;
+                                WL_TRACE(("### Specific scan ssid=%s len=%d\n",
+                                          g_specific_ssid.SSID, g_specific_ssid.SSID_len));
+                        }
+                }
+        }
+#endif 
+        
+        if ((error = dev_wlc_ioctl(dev, WLC_SCAN, &g_specific_ssid, sizeof(g_specific_ssid)))) {
+                WL_TRACE(("#### Set SCAN for %s failed with %d\n", g_specific_ssid.SSID, error));
+                
+                g_scan_specified_ssid = 0;
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
+#ifdef WL_IW_USE_ISCAN
+int
+wl_iw_iscan_set_scan_broadcast_prep(struct net_device *dev, uint flag)
+{
+        wlc_ssid_t ssid;
+        iscan_info_t *iscan = g_iscan;
+
+#if defined(CONFIG_FIRST_SCAN)
+        
+        if (g_first_broadcast_scan == BROADCAST_SCAN_FIRST_IDLE) {
+                g_first_broadcast_scan = BROADCAST_SCAN_FIRST_STARTED;
+                WL_TRACE(("%s: First Brodcast scan was forced\n", __FUNCTION__));
+        }
+        else if (g_first_broadcast_scan == BROADCAST_SCAN_FIRST_STARTED) {
+                WL_TRACE(("%s: ignore ISCAN request first BS is not done yet\n", __FUNCTION__));
+                return 0;
+        }
+#endif 
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        if (flag)
+                rtnl_lock();
+#endif
+
+        dev_wlc_ioctl(dev, WLC_SET_PASSIVE_SCAN, &iscan->scan_flag, sizeof(iscan->scan_flag));
+        wl_iw_set_event_mask(dev);
+
+        WL_TRACE(("+++: Set Broadcast ISCAN\n"));
+        
+        memset(&ssid, 0, sizeof(ssid));
+
+        iscan->list_cur = iscan->list_hdr;
+        iscan->iscan_state = ISCAN_STATE_SCANING;
+
+        memset(&iscan->iscan_ex_params_p->params, 0, iscan->iscan_ex_param_size);
+        wl_iw_iscan_prep(&iscan->iscan_ex_params_p->params, &ssid);
+        wl_iw_iscan(iscan, &ssid, WL_SCAN_ACTION_START);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        if (flag)
+                rtnl_unlock();
+#endif
+
+        mod_timer(&iscan->timer, jiffies + iscan->timer_ms*HZ/1000);
+
+        iscan->timer_on = 1;
+
+        return 0;
+}
+
+static int
+wl_iw_iscan_set_scan(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        wlc_ssid_t ssid;
+        iscan_info_t *iscan = g_iscan;
+        int ret = 0;
+
+        WL_TRACE_SCAN(("%s: SIOCSIWSCAN : ISCAN\n", dev->name));
+
+#if defined(CSCAN)
+                WL_ERROR(("%s: Scan from SIOCGIWSCAN not supported\n", __FUNCTION__));
+                return -EINVAL;
+#endif 
+
+        net_os_wake_lock(dev);
+
+        
+#if defined(SOFTAP)
+        if (ap_cfg_running) {
+                WL_TRACE(("\n>%s: Not executed, reason -'SOFTAP is active'\n", __FUNCTION__));
+                goto set_scan_end;
+        }
+#endif
+        
+        if (g_onoff == G_WLAN_SET_OFF) {
+                WL_TRACE(("%s: driver is not up yet after START\n", __FUNCTION__));
+                goto set_scan_end;
+        }
+
+#ifdef PNO_SUPPORT
+        
+        if  (dhd_dev_get_pno_status(dev)) {
+                WL_ERROR(("%s: Scan called when PNO is active\n", __FUNCTION__));
+        }
+#endif 
+
+        
+        if ((!iscan) || (iscan->tsk_ctl.thr_pid < 0)) {
+                WL_ERROR(("%s error \n",  __FUNCTION__));
+                goto set_scan_end;
+        }
+
+        if (g_scan_specified_ssid) {
+                WL_TRACE(("%s Specific SCAN already running ignoring BC scan\n",
+                          __FUNCTION__));
+                ret = EBUSY;
+                goto set_scan_end;
+        }
+
+        
+        memset(&ssid, 0, sizeof(ssid));
+
+#if WIRELESS_EXT > 17
+        
+        if (wrqu->data.length == sizeof(struct iw_scan_req)) {
+                if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+                        int as = 0;
+                        struct iw_scan_req *req = (struct iw_scan_req *)extra;
+                        
+                        ssid.SSID_len = MIN(sizeof(ssid.SSID), req->essid_len);
+                        memcpy(ssid.SSID, req->essid, ssid.SSID_len);
+                        ssid.SSID_len = htod32(ssid.SSID_len);
+                        dev_wlc_ioctl(dev, WLC_SET_PASSIVE_SCAN, &as, sizeof(as));
+                        wl_iw_set_event_mask(dev);
+                        ret = wl_iw_set_scan(dev, info, wrqu, extra);
+                        goto set_scan_end;
+                }
+                else {
+                        g_scan_specified_ssid = 0;
+
+                        if (iscan->iscan_state == ISCAN_STATE_SCANING) {
+                                WL_TRACE(("%s ISCAN already in progress \n", __FUNCTION__));
+                                goto set_scan_end;
+                        }
+                }
+        }
+#endif 
+
+#if defined(CONFIG_FIRST_SCAN) && !defined(CSCAN)
+        if (g_first_broadcast_scan < BROADCAST_SCAN_FIRST_RESULT_CONSUMED) {
+                if (++g_first_counter_scans == MAX_ALLOWED_BLOCK_SCAN_FROM_FIRST_SCAN) {
+
+                        WL_ERROR(("%s Clean up First scan flag which is %d\n",
+                                  __FUNCTION__, g_first_broadcast_scan));
+                        g_first_broadcast_scan = BROADCAST_SCAN_FIRST_RESULT_CONSUMED;
+                }
+                else {
+                        WL_ERROR(("%s Ignoring Broadcast Scan:First Scan is not done yet %d\n",
+                                  __FUNCTION__, g_first_counter_scans));
+                        ret = -EBUSY;
+                        goto set_scan_end;
+                }
+        }
+#endif
+
+        wl_iw_iscan_set_scan_broadcast_prep(dev, 0);
+
+set_scan_end:
+        net_os_wake_unlock(dev);
+        return ret;
+}
+#endif 
+
+#if WIRELESS_EXT > 17
+static bool
+ie_is_wpa_ie(uint8 **wpaie, uint8 **tlvs, int *tlvs_len)
+{
+
+
+        uint8 *ie = *wpaie;
+
+        
+        if ((ie[1] >= 6) &&
+                !bcmp((const void *)&ie[2], (const void *)(WPA_OUI "\x01"), 4)) {
+                return TRUE;
+        }
+
+        
+        ie += ie[1] + 2;
+        
+        *tlvs_len -= (int)(ie - *tlvs);
+        
+        *tlvs = ie;
+        return FALSE;
+}
+
+static bool
+ie_is_wps_ie(uint8 **wpsie, uint8 **tlvs, int *tlvs_len)
+{
+
+
+        uint8 *ie = *wpsie;
+
+        
+        if ((ie[1] >= 4) &&
+                !bcmp((const void *)&ie[2], (const void *)(WPA_OUI "\x04"), 4)) {
+                return TRUE;
+        }
+
+        
+        ie += ie[1] + 2;
+        
+        *tlvs_len -= (int)(ie - *tlvs);
+        
+        *tlvs = ie;
+        return FALSE;
+}
+#endif 
+
+
+static int
+wl_iw_handle_scanresults_ies(char **event_p, char *end,
+        struct iw_request_info *info, wl_bss_info_t *bi)
+{
+#if WIRELESS_EXT > 17
+        struct iw_event iwe;
+        char *event;
+
+        event = *event_p;
+        if (bi->ie_length) {
+                
+                bcm_tlv_t *ie;
+                uint8 *ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+                int ptr_len = bi->ie_length;
+
+                if ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_RSN_ID))) {
+                        iwe.cmd = IWEVGENIE;
+                        iwe.u.data.length = ie->len + 2;
+                        event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+                }
+                ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+
+                while ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_WPA_ID))) {
+                        
+                        if (ie_is_wps_ie(((uint8 **)&ie), &ptr, &ptr_len)) {
+                                iwe.cmd = IWEVGENIE;
+                                iwe.u.data.length = ie->len + 2;
+                                event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+                                break;
+                        }
+                }
+
+                ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+                ptr_len = bi->ie_length;
+                while ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_WPA_ID))) {
+                        if (ie_is_wpa_ie(((uint8 **)&ie), &ptr, &ptr_len)) {
+                                iwe.cmd = IWEVGENIE;
+                                iwe.u.data.length = ie->len + 2;
+                                event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+                                break;
+                        }
+                }
+
+        *event_p = event;
+        }
+#endif 
+
+        return 0;
+}
+
+#ifndef CSCAN
+static uint
+wl_iw_get_scan_prep(
+        wl_scan_results_t *list,
+        struct iw_request_info *info,
+        char *extra,
+        short max_size)
+{
+        int  i, j;
+        struct iw_event  iwe;
+        wl_bss_info_t *bi = NULL;
+        char *event = extra, *end = extra + max_size - WE_ADD_EVENT_FIX, *value;
+        int     ret = 0;
+
+        if (!list) {
+                WL_ERROR(("%s: Null list pointer", __FUNCTION__));
+                return ret;
+        }
+
+        
+
+        for (i = 0; i < list->count && i < IW_MAX_AP; i++) {
+                if (list->version != WL_BSS_INFO_VERSION) {
+                        WL_ERROR(("%s : list->version %d != WL_BSS_INFO_VERSION\n",
+                                  __FUNCTION__, list->version));
+                        return ret;
+                }
+
+                bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+
+                WL_TRACE(("%s : %s\n", __FUNCTION__, bi->SSID));
+
+                
+                iwe.cmd = SIOCGIWAP;
+                iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+                memcpy(iwe.u.ap_addr.sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+                event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_ADDR_LEN);
+                
+                iwe.u.data.length = dtoh32(bi->SSID_len);
+                iwe.cmd = SIOCGIWESSID;
+                iwe.u.data.flags = 1;
+                event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, bi->SSID);
+
+                
+                if (dtoh16(bi->capability) & (DOT11_CAP_ESS | DOT11_CAP_IBSS)) {
+                        iwe.cmd = SIOCGIWMODE;
+                        if (dtoh16(bi->capability) & DOT11_CAP_ESS)
+                                iwe.u.mode = IW_MODE_INFRA;
+                        else
+                                iwe.u.mode = IW_MODE_ADHOC;
+                        event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_UINT_LEN);
+                }
+
+                
+                iwe.cmd = SIOCGIWFREQ;
+                iwe.u.freq.m = wf_channel2mhz(CHSPEC_CHANNEL(bi->chanspec),
+                        CHSPEC_CHANNEL(bi->chanspec) <= CH_MAX_2G_CHANNEL ?
+                        WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G);
+                iwe.u.freq.e = 6;
+                event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_FREQ_LEN);
+
+                
+                iwe.cmd = IWEVQUAL;
+                iwe.u.qual.qual = rssi_to_qual(dtoh16(bi->RSSI));
+                iwe.u.qual.level = 0x100 + dtoh16(bi->RSSI);
+                iwe.u.qual.noise = 0x100 + bi->phy_noise;
+                event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_QUAL_LEN);
+
+                
+                 wl_iw_handle_scanresults_ies(&event, end, info, bi);
+
+                
+                iwe.cmd = SIOCGIWENCODE;
+                if (dtoh16(bi->capability) & DOT11_CAP_PRIVACY)
+                        iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+                else
+                        iwe.u.data.flags = IW_ENCODE_DISABLED;
+                iwe.u.data.length = 0;
+                event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)event);
+
+                
+                if (bi->rateset.count) {
+                        if (((event -extra) + IW_EV_LCP_LEN) <= (uintptr)end) {
+                                value = event + IW_EV_LCP_LEN;
+                                iwe.cmd = SIOCGIWRATE;
+                                
+                                iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+                                for (j = 0; j < bi->rateset.count && j < IW_MAX_BITRATES; j++) {
+                                        iwe.u.bitrate.value =
+                                                (bi->rateset.rates[j] & 0x7f) * 500000;
+                                        value = IWE_STREAM_ADD_VALUE(info, event, value, end, &iwe,
+                                                IW_EV_PARAM_LEN);
+                                }
+                                event = value;
+                        }
+                }
+        }
+
+        if ((ret = (event - extra)) < 0) {
+                WL_ERROR(("==> Wrong size\n"));
+                ret = 0;
+        }
+
+        WL_TRACE(("%s: size=%d bytes prepared \n", __FUNCTION__, (unsigned int)(event - extra)));
+        return (uint)ret;
+}
+
+static int
+wl_iw_get_scan(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        channel_info_t ci;
+        wl_scan_results_t *list_merge;
+        wl_scan_results_t *list = (wl_scan_results_t *) g_scan;
+        int error;
+        uint buflen_from_user = dwrq->length;
+        uint len =  G_SCAN_RESULTS;
+        __u16 len_ret = 0;
+#if  !defined(CSCAN)
+        __u16 merged_len = 0;
+#endif
+#if defined(WL_IW_USE_ISCAN)
+        iscan_info_t *iscan = g_iscan;
+        iscan_buf_t * p_buf;
+#if  !defined(CSCAN)
+        uint32 counter = 0;
+#endif 
+#endif 
+
+        WL_TRACE(("%s: buflen_from_user %d: \n", dev->name, buflen_from_user));
+
+        if (!extra) {
+                WL_TRACE(("%s: wl_iw_get_scan return -EINVAL\n", dev->name));
+                return -EINVAL;
+        }
+
+        
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_CHANNEL, &ci, sizeof(ci))))
+                return error;
+        ci.scan_channel = dtoh32(ci.scan_channel);
+        if (ci.scan_channel)
+                return -EAGAIN;
+
+#if  !defined(CSCAN)
+        if (g_ss_cache_ctrl.m_timer_expired) {
+                wl_iw_free_ss_cache();
+                g_ss_cache_ctrl.m_timer_expired ^= 1;
+        }
+        if ((!g_scan_specified_ssid && g_ss_cache_ctrl.m_prev_scan_mode) ||
+                g_ss_cache_ctrl.m_cons_br_scan_cnt > 4) {
+                g_ss_cache_ctrl.m_cons_br_scan_cnt = 0;
+                
+                wl_iw_reset_ss_cache();
+        }
+        g_ss_cache_ctrl.m_prev_scan_mode = g_scan_specified_ssid;
+        if (g_scan_specified_ssid) {
+                g_ss_cache_ctrl.m_cons_br_scan_cnt = 0;
+        }
+        else {
+                g_ss_cache_ctrl.m_cons_br_scan_cnt++;
+        }
+#endif 
+
+
+        
+        if (g_scan_specified_ssid) {
+                
+                list = kmalloc(len, GFP_KERNEL);
+                if (!list) {
+                        WL_TRACE(("%s: wl_iw_get_scan return -ENOMEM\n", dev->name));
+                        g_scan_specified_ssid = 0;
+                        return -ENOMEM;
+                }
+        }
+
+        memset(list, 0, len);
+        list->buflen = htod32(len);
+        if ((error = dev_wlc_ioctl(dev, WLC_SCAN_RESULTS, list, len))) {
+                WL_ERROR(("%s: %s : Scan_results ERROR %d\n", dev->name, __FUNCTION__, error));
+                dwrq->length = len;
+                if (g_scan_specified_ssid) {
+                        g_scan_specified_ssid = 0;
+                        kfree(list);
+                }
+                return 0;
+        }
+        list->buflen = dtoh32(list->buflen);
+        list->version = dtoh32(list->version);
+        list->count = dtoh32(list->count);
+
+        
+        if (list->version != WL_BSS_INFO_VERSION) {
+                WL_ERROR(("%s : list->version %d != WL_BSS_INFO_VERSION\n",
+                          __FUNCTION__, list->version));
+                if (g_scan_specified_ssid) {
+                        g_scan_specified_ssid = 0;
+                        kfree(list);
+                }
+                return -EINVAL;
+        }
+
+#if  !defined(CSCAN)
+        if (g_scan_specified_ssid) {
+                
+                wl_iw_add_bss_to_ss_cache(list);
+                kfree(list);
+        }
+#endif
+
+#if  !defined(CSCAN)
+        DHD_OS_MUTEX_LOCK(&wl_cache_lock);
+#if defined(WL_IW_USE_ISCAN)
+        if (g_scan_specified_ssid)
+                WL_TRACE(("%s: Specified scan APs from scan=%d\n", __FUNCTION__, list->count));
+        p_buf = iscan->list_hdr;
+        
+        while (p_buf != iscan->list_cur) {
+                list_merge = &((wl_iscan_results_t*)p_buf->iscan_buf)->results;
+                WL_TRACE(("%s: Bcast APs list=%d\n", __FUNCTION__, list_merge->count));
+                counter += list_merge->count;
+                if (list_merge->count > 0)
+                        len_ret += (__u16) wl_iw_get_scan_prep(list_merge, info,
+                            extra+len_ret, buflen_from_user -len_ret);
+                p_buf = p_buf->next;
+        }
+        WL_TRACE(("%s merged with total Bcast APs=%d\n", __FUNCTION__, counter));
+#else
+        list_merge = (wl_scan_results_t *) g_scan;
+        len_ret = (__u16) wl_iw_get_scan_prep(list_merge, info, extra, buflen_from_user);
+#endif 
+        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+        if (g_ss_cache_ctrl.m_link_down) {
+                
+                wl_iw_delete_bss_from_ss_cache(g_ss_cache_ctrl.m_active_bssid);
+        }
+        
+        wl_iw_merge_scan_cache(info, extra+len_ret, buflen_from_user-len_ret, &merged_len);
+        len_ret += merged_len;
+        wl_iw_run_ss_cache_timer(0);
+        wl_iw_run_ss_cache_timer(1);
+#else   
+
+        
+        if (g_scan_specified_ssid) {
+                WL_TRACE(("%s: Specified scan APs in the list =%d\n", __FUNCTION__, list->count));
+                len_ret = (__u16) wl_iw_get_scan_prep(list, info, extra, buflen_from_user);
+                kfree(list);
+
+#if defined(WL_IW_USE_ISCAN)
+                p_buf = iscan->list_hdr;
+                
+                while (p_buf != iscan->list_cur) {
+                        list_merge = &((wl_iscan_results_t*)p_buf->iscan_buf)->results;
+                        WL_TRACE(("%s: Bcast APs list=%d\n", __FUNCTION__, list_merge->count));
+                        if (list_merge->count > 0)
+                                len_ret += (__u16) wl_iw_get_scan_prep(list_merge, info,
+                                    extra+len_ret, buflen_from_user -len_ret);
+                        p_buf = p_buf->next;
+                }
+#else
+                list_merge = (wl_scan_results_t *) g_scan;
+                WL_TRACE(("%s: Bcast APs list=%d\n", __FUNCTION__, list_merge->count));
+                if (list_merge->count > 0)
+                        len_ret += (__u16) wl_iw_get_scan_prep(list_merge, info, extra+len_ret,
+                                buflen_from_user -len_ret);
+#endif 
+        }
+        else {
+                list = (wl_scan_results_t *) g_scan;
+                len_ret = (__u16) wl_iw_get_scan_prep(list, info, extra, buflen_from_user);
+        }
+#endif  
+
+#if defined(WL_IW_USE_ISCAN)
+        
+        g_scan_specified_ssid = 0;
+#endif 
+        
+        if ((len_ret + WE_ADD_EVENT_FIX) < buflen_from_user)
+                len = len_ret;
+
+        dwrq->length = len;
+        dwrq->flags = 0;        
+
+        WL_TRACE(("%s return to WE %d bytes APs=%d\n", __FUNCTION__, dwrq->length, list->count));
+        return 0;
+}
+#endif 
+
+#if defined(WL_IW_USE_ISCAN)
+static int
+wl_iw_iscan_get_scan(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_scan_results_t *list;
+        struct iw_event iwe;
+        wl_bss_info_t *bi = NULL;
+        int ii, j;
+        int apcnt;
+        char *event = extra, *end = extra + dwrq->length, *value;
+        iscan_info_t *iscan = g_iscan;
+        iscan_buf_t * p_buf;
+        uint32  counter = 0;
+        uint8   channel;
+#if !defined(CSCAN)
+        __u16 merged_len = 0;
+        uint buflen_from_user = dwrq->length;
+#endif
+
+        WL_TRACE(("%s %s buflen_from_user %d:\n", dev->name, __FUNCTION__, dwrq->length));
+
+#if defined(SOFTAP)
+        if (ap_cfg_running) {
+                WL_TRACE(("%s: Not executed, reason -'SOFTAP is active'\n", __FUNCTION__));
+                return -EINVAL;
+        }
+#endif
+
+        if (!extra) {
+                WL_TRACE(("%s: INVALID SIOCGIWSCAN GET bad parameter\n", dev->name));
+                return -EINVAL;
+        }
+
+#if defined(CONFIG_FIRST_SCAN)
+        if (g_first_broadcast_scan < BROADCAST_SCAN_FIRST_RESULT_READY) {
+                WL_TRACE(("%s %s: first ISCAN results are NOT ready yet \n",
+                          dev->name, __FUNCTION__));
+                return -EAGAIN;
+        }
+#endif  
+        
+        if ((!iscan) || (iscan->tsk_ctl.thr_pid < 0)) {
+                WL_ERROR(("%ssysioc_pid\n", __FUNCTION__));
+                return EAGAIN;
+        }
+
+        
+
+#if !defined(CSCAN)
+        if (g_ss_cache_ctrl.m_timer_expired) {
+                wl_iw_free_ss_cache();
+                g_ss_cache_ctrl.m_timer_expired ^= 1;
+        }
+        if (g_scan_specified_ssid) {
+                return wl_iw_get_scan(dev, info, dwrq, extra);
+        }
+        else {
+                if (g_ss_cache_ctrl.m_link_down) {
+                        
+                        wl_iw_delete_bss_from_ss_cache(g_ss_cache_ctrl.m_active_bssid);
+                }
+                if (g_ss_cache_ctrl.m_prev_scan_mode || g_ss_cache_ctrl.m_cons_br_scan_cnt > 4) {
+                        g_ss_cache_ctrl.m_cons_br_scan_cnt = 0;
+                        
+                        wl_iw_reset_ss_cache();
+                }
+                g_ss_cache_ctrl.m_prev_scan_mode = g_scan_specified_ssid;
+                g_ss_cache_ctrl.m_cons_br_scan_cnt++;
+        }
+#endif 
+
+        WL_TRACE(("%s: SIOCGIWSCAN GET broadcast results\n", dev->name));
+        apcnt = 0;
+        p_buf = iscan->list_hdr;
+        
+        while (p_buf != iscan->list_cur) {
+                list = &((wl_iscan_results_t*)p_buf->iscan_buf)->results;
+
+                counter += list->count;
+
+                if (list->version != WL_BSS_INFO_VERSION) {
+                        WL_ERROR(("%s : list->version %d != WL_BSS_INFO_VERSION\n",
+                                  __FUNCTION__, list->version));
+                        return -EINVAL;
+                }
+
+                bi = NULL;
+                for (ii = 0; ii < list->count && apcnt < IW_MAX_AP; apcnt++, ii++) {
+                        bi = (bi ?
+                              (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) :
+                              list->bss_info);
+                        ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+                                                                      WLC_IW_ISCAN_MAXLEN));
+
+                        
+                        if (event + ETHER_ADDR_LEN + bi->SSID_len +
+                            IW_EV_UINT_LEN + IW_EV_FREQ_LEN + IW_EV_QUAL_LEN >= end)
+                                return -E2BIG;
+                        
+                        iwe.cmd = SIOCGIWAP;
+                        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+                        memcpy(iwe.u.ap_addr.sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+                        event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_ADDR_LEN);
+
+                        
+                        iwe.u.data.length = dtoh32(bi->SSID_len);
+                        iwe.cmd = SIOCGIWESSID;
+                        iwe.u.data.flags = 1;
+                        event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, bi->SSID);
+
+                        
+                        if (dtoh16(bi->capability) & (DOT11_CAP_ESS | DOT11_CAP_IBSS)) {
+                                iwe.cmd = SIOCGIWMODE;
+                                if (dtoh16(bi->capability) & DOT11_CAP_ESS)
+                                        iwe.u.mode = IW_MODE_INFRA;
+                                else
+                                        iwe.u.mode = IW_MODE_ADHOC;
+                                event = IWE_STREAM_ADD_EVENT(info, event, end,
+                                                             &iwe, IW_EV_UINT_LEN);
+                        }
+
+                        
+                        iwe.cmd = SIOCGIWFREQ;
+                        channel = (bi->ctl_ch == 0) ? CHSPEC_CHANNEL(bi->chanspec) : bi->ctl_ch;
+                        iwe.u.freq.m = wf_channel2mhz(channel,
+                                                      channel <= CH_MAX_2G_CHANNEL ?
+                                                      WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G);
+                        iwe.u.freq.e = 6;
+                        event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_FREQ_LEN);
+
+                        
+                        iwe.cmd = IWEVQUAL;
+                        iwe.u.qual.qual = rssi_to_qual(dtoh16(bi->RSSI));
+                        iwe.u.qual.level = 0x100 + dtoh16(bi->RSSI);
+                        iwe.u.qual.noise = 0x100 + bi->phy_noise;
+                        event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_QUAL_LEN);
+
+                        
+                        wl_iw_handle_scanresults_ies(&event, end, info, bi);
+
+                        
+                        iwe.cmd = SIOCGIWENCODE;
+                        if (dtoh16(bi->capability) & DOT11_CAP_PRIVACY)
+                                iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+                        else
+                                iwe.u.data.flags = IW_ENCODE_DISABLED;
+                        iwe.u.data.length = 0;
+                        event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)event);
+
+                        
+                        if (bi->rateset.count) {
+                                if (event + IW_MAX_BITRATES*IW_EV_PARAM_LEN >= end)
+                                        return -E2BIG;
+
+                                value = event + IW_EV_LCP_LEN;
+                                iwe.cmd = SIOCGIWRATE;
+                                
+                                iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+                                for (j = 0; j < bi->rateset.count && j < IW_MAX_BITRATES; j++) {
+                                        iwe.u.bitrate.value =
+                                                (bi->rateset.rates[j] & 0x7f) * 500000;
+                                        value = IWE_STREAM_ADD_VALUE(info, event, value, end, &iwe,
+                                                                     IW_EV_PARAM_LEN);
+                                }
+                                event = value;
+                        }
+                }
+                p_buf = p_buf->next;
+        } 
+
+        dwrq->length = event - extra;
+        dwrq->flags = 0;        
+
+#if !defined(CSCAN)
+        
+        wl_iw_merge_scan_cache(info, event, buflen_from_user - dwrq->length, &merged_len);
+        dwrq->length += merged_len;
+        wl_iw_run_ss_cache_timer(0);
+        wl_iw_run_ss_cache_timer(1);
+#endif 
+        
+#if defined(CONFIG_FIRST_SCAN)
+        g_first_broadcast_scan = BROADCAST_SCAN_FIRST_RESULT_CONSUMED;
+#endif 
+
+        WL_TRACE(("%s return to WE %d bytes APs=%d\n", __FUNCTION__, dwrq->length, counter));
+
+        return 0;
+}
+#endif 
+
+#define WL_JOIN_PARAMS_MAX 1600
+#ifdef CONFIG_PRESCANNED
+static int
+check_prescan(wl_join_params_t *join_params, int *join_params_size)
+{
+        int cnt = 0;
+        int indx = 0;
+        wl_iw_ss_cache_t *node = NULL;
+        wl_bss_info_t *bi = NULL;
+        iscan_info_t *iscan = g_iscan;
+        iscan_buf_t * buf;
+        wl_scan_results_t *list;
+        char *destbuf;
+
+        buf = iscan->list_hdr;
+
+        while (buf) {
+                list = &((wl_iscan_results_t*)buf->iscan_buf)->results;
+                bi = NULL;
+                for (indx = 0;  indx < list->count; indx++) {
+                        bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length))
+                                : list->bss_info;
+                        if (!(dtoh16(bi->capability) & DOT11_CAP_ESS))
+                                continue;
+                        if ((dtoh32(bi->SSID_len) != join_params->ssid.SSID_len) ||
+                                memcmp(bi->SSID, join_params->ssid.SSID,
+                                join_params->ssid.SSID_len))
+                                continue;
+                        memcpy(&join_params->params.chanspec_list[cnt],
+                                &bi->chanspec, sizeof(chanspec_t));
+                        WL_ERROR(("iscan : chanspec :%d, count %d \n", bi->chanspec, cnt));
+                        cnt++;
+                }
+                buf = buf->next;
+        }
+
+        if (!cnt) {
+                MUTEX_LOCK_WL_SCAN_SET();
+                node = g_ss_cache_ctrl.m_cache_head;
+                for (; node; ) {
+                        if (!memcmp(&node->bss_info->SSID, join_params->ssid.SSID,
+                                join_params->ssid.SSID_len)) {
+                                memcpy(&join_params->params.chanspec_list[cnt],
+                                        &node->bss_info->chanspec, sizeof(chanspec_t));
+                                WL_ERROR(("cache_scan : chanspec :%d, count %d \n",
+                                (int)node->bss_info->chanspec, cnt));
+                                cnt++;
+                        }
+                        node = node->next;
+                }
+                MUTEX_UNLOCK_WL_SCAN_SET();
+        }
+
+        if (!cnt) {
+                return 0;
+        }
+
+        destbuf = (char *)&join_params->params.chanspec_list[cnt];
+        *join_params_size = destbuf - (char*)join_params;
+        join_params->ssid.SSID_len = htod32(g_ssid.SSID_len);
+        memcpy(&(join_params->params.bssid), &ether_bcast, ETHER_ADDR_LEN);
+        join_params->params.chanspec_num = htod32(cnt);
+
+        if ((*join_params_size) > WL_JOIN_PARAMS_MAX) {
+                WL_ERROR(("can't fit bssids for all %d APs found\n", cnt));
+                        kfree(join_params);
+                return 0;
+        }
+
+        WL_ERROR(("Passing %d channel/bssid pairs.\n", cnt));
+        return cnt;
+}
+#endif 
+
+static int
+wl_iw_set_essid(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        int error;
+        wl_join_params_t *join_params;
+        int join_params_size;
+
+        WL_TRACE(("%s: SIOCSIWESSID\n", dev->name));
+
+        RETURN_IF_EXTRA_NULL(extra);
+
+#ifdef OEM_CHROMIUMOS
+        if (g_set_essid_before_scan)
+                return -EAGAIN;
+#endif
+        if (!(join_params = kmalloc(WL_JOIN_PARAMS_MAX, GFP_KERNEL))) {
+                WL_ERROR(("allocation failed for join_params size is %d\n", WL_JOIN_PARAMS_MAX));
+                return -ENOMEM;
+        }
+
+        memset(join_params, 0, WL_JOIN_PARAMS_MAX);
+
+        
+        memset(&g_ssid, 0, sizeof(g_ssid));
+
+        if (dwrq->length && extra) {
+#if WIRELESS_EXT > 20
+                g_ssid.SSID_len = MIN(sizeof(g_ssid.SSID), dwrq->length);
+#else
+                g_ssid.SSID_len = MIN(sizeof(g_ssid.SSID), dwrq->length-1);
+#endif
+                memcpy(g_ssid.SSID, extra, g_ssid.SSID_len);
+
+#ifdef CONFIG_PRESCANNED
+                memcpy(join_params->ssid.SSID, g_ssid.SSID, g_ssid.SSID_len);
+                join_params->ssid.SSID_len = g_ssid.SSID_len;
+
+                if (check_prescan(join_params, &join_params_size)) {
+                        if ((error = dev_wlc_ioctl(dev, WLC_SET_SSID,
+                                join_params, join_params_size))) {
+                                WL_ERROR(("Invalid ioctl data=%d\n", error));
+                                kfree(join_params);
+                                return error;
+                        }
+                        kfree(join_params);
+                        return 0;
+                } else {
+                        WL_ERROR(("No matched found\n Trying to join to specific channel\n"));
+                }
+#endif 
+        } else {
+                
+                g_ssid.SSID_len = 0;
+        }
+        g_ssid.SSID_len = htod32(g_ssid.SSID_len);
+
+        
+        memset(join_params, 0, sizeof(*join_params));
+        join_params_size = sizeof(join_params->ssid);
+
+        memcpy(join_params->ssid.SSID, g_ssid.SSID, g_ssid.SSID_len);
+        join_params->ssid.SSID_len = htod32(g_ssid.SSID_len);
+        memcpy(&(join_params->params.bssid), &ether_bcast, ETHER_ADDR_LEN);
+
+        
+        
+        wl_iw_ch_to_chanspec(g_wl_iw_params.target_channel, join_params, &join_params_size);
+
+        if ((error = dev_wlc_ioctl(dev, WLC_SET_SSID, join_params, join_params_size))) {
+                WL_ERROR(("Invalid ioctl data=%d\n", error));
+                return error;
+        }
+
+        if (g_ssid.SSID_len) {
+                WL_ERROR(("%s: join SSID=%s ch=%d\n", __FUNCTION__,
+                        g_ssid.SSID,  g_wl_iw_params.target_channel));
+        }
+        kfree(join_params);
+        return 0;
+}
+
+static int
+wl_iw_get_essid(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wlc_ssid_t ssid;
+        int error;
+
+        WL_TRACE(("%s: SIOCGIWESSID\n", dev->name));
+
+        if (!extra)
+                return -EINVAL;
+
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_SSID, &ssid, sizeof(ssid)))) {
+                WL_ERROR(("Error getting the SSID\n"));
+                return error;
+        }
+
+        ssid.SSID_len = dtoh32(ssid.SSID_len);
+
+        
+        memcpy(extra, ssid.SSID, ssid.SSID_len);
+
+        dwrq->length = ssid.SSID_len;
+
+        dwrq->flags = 1; 
+
+        return 0;
+}
+
+static int
+wl_iw_set_nick(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_iw_t *iw = NETDEV_PRIV(dev);
+
+        WL_TRACE(("%s: SIOCSIWNICKN\n", dev->name));
+
+        if (!extra)
+                return -EINVAL;
+
+        
+        if (dwrq->length > sizeof(iw->nickname))
+                return -E2BIG;
+
+        memcpy(iw->nickname, extra, dwrq->length);
+        iw->nickname[dwrq->length - 1] = '\0';
+
+        return 0;
+}
+
+static int
+wl_iw_get_nick(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_iw_t *iw = NETDEV_PRIV(dev);
+
+        WL_TRACE(("%s: SIOCGIWNICKN\n", dev->name));
+
+        if (!extra)
+                return -EINVAL;
+
+        strcpy(extra, iw->nickname);
+        dwrq->length = strlen(extra) + 1;
+
+        return 0;
+}
+
+static int
+wl_iw_set_rate(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        wl_rateset_t rateset;
+        int error, rate, i, error_bg, error_a;
+
+        WL_TRACE(("%s: SIOCSIWRATE\n", dev->name));
+
+        
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset))))
+                return error;
+
+        rateset.count = dtoh32(rateset.count);
+
+        if (vwrq->value < 0) {
+                
+                rate = rateset.rates[rateset.count - 1] & 0x7f;
+        } else if (vwrq->value < rateset.count) {
+                
+                rate = rateset.rates[vwrq->value] & 0x7f;
+        } else {
+                
+                rate = vwrq->value / 500000;
+        }
+
+        if (vwrq->fixed) {
+                
+                error_bg = dev_wlc_intvar_set(dev, "bg_rate", rate);
+                error_a = dev_wlc_intvar_set(dev, "a_rate", rate);
+
+                if (error_bg && error_a)
+                        return (error_bg | error_a);
+        } else {
+                
+                
+                error_bg = dev_wlc_intvar_set(dev, "bg_rate", 0);
+                
+                error_a = dev_wlc_intvar_set(dev, "a_rate", 0);
+
+                if (error_bg && error_a)
+                        return (error_bg | error_a);
+
+                
+                for (i = 0; i < rateset.count; i++)
+                        if ((rateset.rates[i] & 0x7f) > rate)
+                                break;
+                rateset.count = htod32(i);
+
+                
+                if ((error = dev_wlc_ioctl(dev, WLC_SET_RATESET, &rateset, sizeof(rateset))))
+                        return error;
+        }
+
+        return 0;
+}
+
+static int
+wl_iw_get_rate(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, rate;
+
+        WL_TRACE(("%s: SIOCGIWRATE\n", dev->name));
+
+        
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_RATE, &rate, sizeof(rate))))
+                return error;
+        rate = dtoh32(rate);
+        vwrq->value = rate * 500000;
+
+        return 0;
+}
+
+static int
+wl_iw_set_rts(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, rts;
+
+        WL_TRACE(("%s: SIOCSIWRTS\n", dev->name));
+
+        if (vwrq->disabled)
+                rts = DOT11_DEFAULT_RTS_LEN;
+        else if (vwrq->value < 0 || vwrq->value > DOT11_DEFAULT_RTS_LEN)
+                return -EINVAL;
+        else
+                rts = vwrq->value;
+
+        if ((error = dev_wlc_intvar_set(dev, "rtsthresh", rts)))
+                return error;
+
+        return 0;
+}
+
+static int
+wl_iw_get_rts(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, rts;
+
+        WL_TRACE(("%s: SIOCGIWRTS\n", dev->name));
+
+        if ((error = dev_wlc_intvar_get(dev, "rtsthresh", &rts)))
+                return error;
+
+        vwrq->value = rts;
+        vwrq->disabled = (rts >= DOT11_DEFAULT_RTS_LEN);
+        vwrq->fixed = 1;
+
+        return 0;
+}
+
+static int
+wl_iw_set_frag(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, frag;
+
+        WL_TRACE(("%s: SIOCSIWFRAG\n", dev->name));
+
+        if (vwrq->disabled)
+                frag = DOT11_DEFAULT_FRAG_LEN;
+        else if (vwrq->value < 0 || vwrq->value > DOT11_DEFAULT_FRAG_LEN)
+                return -EINVAL;
+        else
+                frag = vwrq->value;
+
+        if ((error = dev_wlc_intvar_set(dev, "fragthresh", frag)))
+                return error;
+
+        return 0;
+}
+
+static int
+wl_iw_get_frag(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, fragthreshold;
+
+        WL_TRACE(("%s: SIOCGIWFRAG\n", dev->name));
+
+        if ((error = dev_wlc_intvar_get(dev, "fragthresh", &fragthreshold)))
+                return error;
+
+        vwrq->value = fragthreshold;
+        vwrq->disabled = (fragthreshold >= DOT11_DEFAULT_FRAG_LEN);
+        vwrq->fixed = 1;
+
+        return 0;
+}
+
+static int
+wl_iw_set_txpow(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, disable;
+        uint16 txpwrmw;
+        WL_TRACE(("%s: SIOCSIWTXPOW\n", dev->name));
+
+        
+        disable = vwrq->disabled ? WL_RADIO_SW_DISABLE : 0;
+        disable += WL_RADIO_SW_DISABLE << 16;
+
+        disable = htod32(disable);
+        if ((error = dev_wlc_ioctl(dev, WLC_SET_RADIO, &disable, sizeof(disable))))
+                return error;
+
+        
+        if (disable & WL_RADIO_SW_DISABLE)
+                return 0;
+
+        
+        if (!(vwrq->flags & IW_TXPOW_MWATT))
+                return -EINVAL;
+
+        
+        if (vwrq->value < 0)
+                return 0;
+
+        if (vwrq->value > 0xffff) txpwrmw = 0xffff;
+        else txpwrmw = (uint16)vwrq->value;
+
+
+        error = dev_wlc_intvar_set(dev, "qtxpower", (int)(bcm_mw_to_qdbm(txpwrmw)));
+        return error;
+}
+
+static int
+wl_iw_get_txpow(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, disable, txpwrdbm;
+        uint8 result;
+
+        WL_TRACE(("%s: SIOCGIWTXPOW\n", dev->name));
+
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_RADIO, &disable, sizeof(disable))) ||
+            (error = dev_wlc_intvar_get(dev, "qtxpower", &txpwrdbm)))
+                return error;
+
+        disable = dtoh32(disable);
+        result = (uint8)(txpwrdbm & ~WL_TXPWR_OVERRIDE);
+        vwrq->value = (int32)bcm_qdbm_to_mw(result);
+        vwrq->fixed = 0;
+        vwrq->disabled = (disable & (WL_RADIO_SW_DISABLE | WL_RADIO_HW_DISABLE)) ? 1 : 0;
+        vwrq->flags = IW_TXPOW_MWATT;
+
+        return 0;
+}
+
+#if WIRELESS_EXT > 10
+static int
+wl_iw_set_retry(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, lrl, srl;
+
+        WL_TRACE(("%s: SIOCSIWRETRY\n", dev->name));
+
+        
+        if (vwrq->disabled || (vwrq->flags & IW_RETRY_LIFETIME))
+                return -EINVAL;
+
+        
+        if (vwrq->flags & IW_RETRY_LIMIT) {
+
+                
+#if WIRELESS_EXT > 20
+        if ((vwrq->flags & IW_RETRY_LONG) ||(vwrq->flags & IW_RETRY_MAX) ||
+                !((vwrq->flags & IW_RETRY_SHORT) || (vwrq->flags & IW_RETRY_MIN))) {
+#else
+        if ((vwrq->flags & IW_RETRY_MAX) || !(vwrq->flags & IW_RETRY_MIN)) {
+#endif 
+                        lrl = htod32(vwrq->value);
+                        if ((error = dev_wlc_ioctl(dev, WLC_SET_LRL, &lrl, sizeof(lrl))))
+                                return error;
+                }
+
+                
+#if WIRELESS_EXT > 20
+        if ((vwrq->flags & IW_RETRY_SHORT) ||(vwrq->flags & IW_RETRY_MIN) ||
+                !((vwrq->flags & IW_RETRY_LONG) || (vwrq->flags & IW_RETRY_MAX))) {
+#else
+                if ((vwrq->flags & IW_RETRY_MIN) || !(vwrq->flags & IW_RETRY_MAX)) {
+#endif 
+                        srl = htod32(vwrq->value);
+                        if ((error = dev_wlc_ioctl(dev, WLC_SET_SRL, &srl, sizeof(srl))))
+                                return error;
+                }
+        }
+        return 0;
+}
+
+static int
+wl_iw_get_retry(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, lrl, srl;
+
+        WL_TRACE(("%s: SIOCGIWRETRY\n", dev->name));
+
+        vwrq->disabled = 0;      
+
+        
+        if ((vwrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME)
+                return -EINVAL;
+
+        
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_LRL, &lrl, sizeof(lrl))) ||
+            (error = dev_wlc_ioctl(dev, WLC_GET_SRL, &srl, sizeof(srl))))
+                return error;
+
+        lrl = dtoh32(lrl);
+        srl = dtoh32(srl);
+
+        
+        if (vwrq->flags & IW_RETRY_MAX) {
+                vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+                vwrq->value = lrl;
+        } else {
+                vwrq->flags = IW_RETRY_LIMIT;
+                vwrq->value = srl;
+                if (srl != lrl)
+                        vwrq->flags |= IW_RETRY_MIN;
+        }
+
+        return 0;
+}
+#endif 
+
+static int
+wl_iw_set_encode(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_wsec_key_t key;
+        int error, val, wsec;
+
+        WL_TRACE(("%s: SIOCSIWENCODE index %d, len %d, flags %04x (%s%s%s%s%s)\n",
+                dev->name, dwrq->flags & IW_ENCODE_INDEX, dwrq->length, dwrq->flags,
+                dwrq->flags & IW_ENCODE_NOKEY ? "NOKEY" : "",
+                dwrq->flags & IW_ENCODE_DISABLED ? " DISABLED" : "",
+                dwrq->flags & IW_ENCODE_RESTRICTED ? " RESTRICTED" : "",
+                dwrq->flags & IW_ENCODE_OPEN ? " OPEN" : "",
+                dwrq->flags & IW_ENCODE_TEMP ? " TEMP" : ""));
+
+        memset(&key, 0, sizeof(key));
+
+        if ((dwrq->flags & IW_ENCODE_INDEX) == 0) {
+                
+                for (key.index = 0; key.index < DOT11_MAX_DEFAULT_KEYS; key.index++) {
+                        val = htod32(key.index);
+                        if ((error = dev_wlc_ioctl(dev, WLC_GET_KEY_PRIMARY, &val, sizeof(val))))
+                                return error;
+                        val = dtoh32(val);
+                        if (val)
+                                break;
+                }
+                
+                if (key.index == DOT11_MAX_DEFAULT_KEYS)
+                        key.index = 0;
+        } else {
+                key.index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+                if (key.index >= DOT11_MAX_DEFAULT_KEYS)
+                        return -EINVAL;
+        }
+
+        
+        if (!extra || !dwrq->length || (dwrq->flags & IW_ENCODE_NOKEY)) {
+                
+                val = htod32(key.index);
+                if ((error = dev_wlc_ioctl(dev, WLC_SET_KEY_PRIMARY, &val, sizeof(val))))
+                        return error;
+        } else {
+                key.len = dwrq->length;
+
+                if (dwrq->length > sizeof(key.data))
+                        return -EINVAL;
+
+                memcpy(key.data, extra, dwrq->length);
+
+                key.flags = WL_PRIMARY_KEY;
+                switch (key.len) {
+                case WEP1_KEY_SIZE:
+                        key.algo = CRYPTO_ALGO_WEP1;
+                        break;
+                case WEP128_KEY_SIZE:
+                        key.algo = CRYPTO_ALGO_WEP128;
+                        break;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+                case TKIP_KEY_SIZE:
+                        key.algo = CRYPTO_ALGO_TKIP;
+                        break;
+#endif
+                case AES_KEY_SIZE:
+                        key.algo = CRYPTO_ALGO_AES_CCM;
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
+                
+                swap_key_from_BE(&key);
+                if ((error = dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key))))
+                        return error;
+        }
+
+        
+        val = (dwrq->flags & IW_ENCODE_DISABLED) ? 0 : WEP_ENABLED;
+
+        if ((error = dev_wlc_intvar_get(dev, "wsec", &wsec)))
+                return error;
+
+        wsec  &= ~(WEP_ENABLED);
+        wsec |= val;
+
+        if ((error = dev_wlc_intvar_set(dev, "wsec", wsec)))
+                return error;
+
+        
+        val = (dwrq->flags & IW_ENCODE_RESTRICTED) ? 1 : 0;
+        val = htod32(val);
+        if ((error = dev_wlc_ioctl(dev, WLC_SET_AUTH, &val, sizeof(val))))
+                return error;
+
+        return 0;
+}
+
+static int
+wl_iw_get_encode(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_wsec_key_t key;
+        int error, val, wsec, auth;
+
+        WL_TRACE(("%s: SIOCGIWENCODE\n", dev->name));
+
+        
+        bzero(&key, sizeof(wl_wsec_key_t));
+
+        if ((dwrq->flags & IW_ENCODE_INDEX) == 0) {
+                
+                for (key.index = 0; key.index < DOT11_MAX_DEFAULT_KEYS; key.index++) {
+                        val = key.index;
+                        if ((error = dev_wlc_ioctl(dev, WLC_GET_KEY_PRIMARY, &val, sizeof(val))))
+                                return error;
+                        val = dtoh32(val);
+                        if (val)
+                                break;
+                }
+        } else
+                key.index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+
+        if (key.index >= DOT11_MAX_DEFAULT_KEYS)
+                key.index = 0;
+
+        
+
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_WSEC, &wsec, sizeof(wsec))) ||
+            (error = dev_wlc_ioctl(dev, WLC_GET_AUTH, &auth, sizeof(auth))))
+                return error;
+
+        swap_key_to_BE(&key);
+
+        wsec = dtoh32(wsec);
+        auth = dtoh32(auth);
+        
+        dwrq->length = MIN(DOT11_MAX_KEY_SIZE, key.len);
+
+        
+        dwrq->flags = key.index + 1;
+        if (!(wsec & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))) {
+                
+                dwrq->flags |= IW_ENCODE_DISABLED;
+        }
+        if (auth) {
+                
+                dwrq->flags |= IW_ENCODE_RESTRICTED;
+        }
+
+        
+        if (dwrq->length && extra)
+                memcpy(extra, key.data, dwrq->length);
+
+        return 0;
+}
+
+static int
+wl_iw_set_power(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, pm;
+
+        WL_TRACE(("%s: SIOCSIWPOWER\n", dev->name));
+
+        pm = vwrq->disabled ? PM_OFF : PM_MAX;
+
+        pm = htod32(pm);
+        if ((error = dev_wlc_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm))))
+                return error;
+
+        return 0;
+}
+
+static int
+wl_iw_get_power(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error, pm;
+
+        WL_TRACE(("%s: SIOCGIWPOWER\n", dev->name));
+
+        if ((error = dev_wlc_ioctl(dev, WLC_GET_PM, &pm, sizeof(pm))))
+                return error;
+
+        pm = dtoh32(pm);
+        vwrq->disabled = pm ? 0 : 1;
+        vwrq->flags = IW_POWER_ALL_R;
+
+        return 0;
+}
+
+#if WIRELESS_EXT > 17
+static int
+wl_iw_set_wpaie(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *iwp,
+        char *extra
+)
+{
+
+        WL_TRACE(("%s: SIOCSIWGENIE\n", dev->name));
+
+        RETURN_IF_EXTRA_NULL(extra);
+
+#ifdef DHD_DEBUG
+        {
+                int i;
+
+                for (i = 0; i < iwp->length; i++)
+                        WL_TRACE(("%02X ", extra[i]));
+                WL_TRACE(("\n"));
+        }
+#endif
+
+                dev_wlc_bufvar_set(dev, "wpaie", extra, iwp->length);
+
+        return 0;
+}
+
+static int
+wl_iw_get_wpaie(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *iwp,
+        char *extra
+)
+{
+        WL_TRACE(("%s: SIOCGIWGENIE\n", dev->name));
+        iwp->length = 64;
+        dev_wlc_bufvar_get(dev, "wpaie", extra, iwp->length);
+        return 0;
+}
+
+static int
+wl_iw_set_encodeext(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *extra
+)
+{
+        wl_wsec_key_t key;
+        int error;
+        struct iw_encode_ext *iwe;
+
+        WL_TRACE(("%s: SIOCSIWENCODEEXT\n", dev->name));
+
+        RETURN_IF_EXTRA_NULL(extra);
+
+        memset(&key, 0, sizeof(key));
+        iwe = (struct iw_encode_ext *)extra;
+
+        
+        if (dwrq->flags & IW_ENCODE_DISABLED) {
+
+        }
+
+        
+        key.index = 0;
+        if (dwrq->flags & IW_ENCODE_INDEX)
+                key.index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+
+        key.len = iwe->key_len;
+
+        
+        if (!ETHER_ISMULTI(iwe->addr.sa_data))
+                bcopy((void *)&iwe->addr.sa_data, (char *)&key.ea, ETHER_ADDR_LEN);
+
+        
+        if (key.len == 0) {
+                if (iwe->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+                        WL_WSEC(("Changing the the primary Key to %d\n", key.index));
+                        
+                        key.index = htod32(key.index);
+                        error = dev_wlc_ioctl(dev, WLC_SET_KEY_PRIMARY,
+                                &key.index, sizeof(key.index));
+                        if (error)
+                                return error;
+                }
+                
+                else {
+                        swap_key_from_BE(&key);
+                        dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key));
+                }
+        }
+        else {
+                if (iwe->key_len > sizeof(key.data))
+                        return -EINVAL;
+
+                WL_WSEC(("Setting the key index %d\n", key.index));
+                if (iwe->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+                        WL_WSEC(("key is a Primary Key\n"));
+                        key.flags = WL_PRIMARY_KEY;
+                }
+
+                bcopy((void *)iwe->key, key.data, iwe->key_len);
+
+                if (iwe->alg == IW_ENCODE_ALG_TKIP) {
+                        uint8 keybuf[8];
+                        bcopy(&key.data[24], keybuf, sizeof(keybuf));
+                        bcopy(&key.data[16], &key.data[24], sizeof(keybuf));
+                        bcopy(keybuf, &key.data[16], sizeof(keybuf));
+                }
+
+                
+                if (iwe->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
+                        uchar *ivptr;
+                        ivptr = (uchar *)iwe->rx_seq;
+                        key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
+                                (ivptr[3] << 8) | ivptr[2];
+                        key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
+                        key.iv_initialized = TRUE;
+                }
+
+                switch (iwe->alg) {
+                        case IW_ENCODE_ALG_NONE:
+                                key.algo = CRYPTO_ALGO_OFF;
+                                break;
+                        case IW_ENCODE_ALG_WEP:
+                                if (iwe->key_len == WEP1_KEY_SIZE)
+                                        key.algo = CRYPTO_ALGO_WEP1;
+                                else
+                                        key.algo = CRYPTO_ALGO_WEP128;
+                                break;
+                        case IW_ENCODE_ALG_TKIP:
+                                key.algo = CRYPTO_ALGO_TKIP;
+                                break;
+                        case IW_ENCODE_ALG_CCMP:
+                                key.algo = CRYPTO_ALGO_AES_CCM;
+                                break;
+                        default:
+                                break;
+                }
+                swap_key_from_BE(&key);
+
+                dhd_wait_pend8021x(dev);
+
+                error = dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key));
+                if (error)
+                        return error;
+        }
+        return 0;
+}
+
+#if WIRELESS_EXT > 17
+struct {
+        pmkid_list_t pmkids;
+        pmkid_t foo[MAXPMKID-1];
+} pmkid_list;
+
+static int
+wl_iw_set_pmksa(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        struct iw_pmksa *iwpmksa;
+        uint i;
+        int ret = 0;
+        char eabuf[ETHER_ADDR_STR_LEN];
+        pmkid_t * pmkid_array = pmkid_list.pmkids.pmkid;
+
+        WL_WSEC(("%s: SIOCSIWPMKSA\n", dev->name));
+
+        RETURN_IF_EXTRA_NULL(extra);
+
+        iwpmksa = (struct iw_pmksa *)extra;
+        bzero((char *)eabuf, ETHER_ADDR_STR_LEN);
+
+        if (iwpmksa->cmd == IW_PMKSA_FLUSH) {
+                WL_WSEC(("wl_iw_set_pmksa - IW_PMKSA_FLUSH\n"));
+                bzero((char *)&pmkid_list, sizeof(pmkid_list));
+        }
+
+        else if (iwpmksa->cmd == IW_PMKSA_REMOVE) {
+                {
+                        pmkid_list_t pmkid, *pmkidptr;
+                        uint j;
+                        pmkidptr = &pmkid;
+
+                        bcopy(&iwpmksa->bssid.sa_data[0], &pmkidptr->pmkid[0].BSSID,
+                                ETHER_ADDR_LEN);
+                        bcopy(&iwpmksa->pmkid[0], &pmkidptr->pmkid[0].PMKID, WPA2_PMKID_LEN);
+
+                        WL_WSEC(("wl_iw_set_pmksa,IW_PMKSA_REMOVE - PMKID: %s = ",
+                                bcm_ether_ntoa(&pmkidptr->pmkid[0].BSSID,
+                                eabuf)));
+                        for (j = 0; j < WPA2_PMKID_LEN; j++)
+                                WL_WSEC(("%02x ", pmkidptr->pmkid[0].PMKID[j]));
+                        WL_WSEC(("\n"));
+                }
+
+                for (i = 0; i < pmkid_list.pmkids.npmkid; i++)
+                        if (!bcmp(&iwpmksa->bssid.sa_data[0], &pmkid_array[i].BSSID,
+                                ETHER_ADDR_LEN))
+                                break;
+
+                if ((pmkid_list.pmkids.npmkid > 0) && (i < pmkid_list.pmkids.npmkid)) {
+                        bzero(&pmkid_array[i], sizeof(pmkid_t));
+                        for (; i < (pmkid_list.pmkids.npmkid - 1); i++) {
+                                bcopy(&pmkid_array[i+1].BSSID,
+                                        &pmkid_array[i].BSSID,
+                                        ETHER_ADDR_LEN);
+                                bcopy(&pmkid_array[i+1].PMKID,
+                                        &pmkid_array[i].PMKID,
+                                        WPA2_PMKID_LEN);
+                        }
+                        pmkid_list.pmkids.npmkid--;
+                }
+                else
+                        ret = -EINVAL;
+        }
+
+        else if (iwpmksa->cmd == IW_PMKSA_ADD) {
+                for (i = 0; i < pmkid_list.pmkids.npmkid; i++)
+                        if (!bcmp(&iwpmksa->bssid.sa_data[0], &pmkid_array[i].BSSID,
+                                ETHER_ADDR_LEN))
+                                break;
+                if (i < MAXPMKID) {
+                        bcopy(&iwpmksa->bssid.sa_data[0],
+                                &pmkid_array[i].BSSID,
+                                ETHER_ADDR_LEN);
+                        bcopy(&iwpmksa->pmkid[0], &pmkid_array[i].PMKID,
+                                WPA2_PMKID_LEN);
+                        if (i == pmkid_list.pmkids.npmkid)
+                                pmkid_list.pmkids.npmkid++;
+                }
+                else
+                        ret = -EINVAL;
+
+                {
+                        uint j;
+                        uint k;
+                        k = pmkid_list.pmkids.npmkid;
+                        WL_WSEC(("wl_iw_set_pmksa,IW_PMKSA_ADD - PMKID: %s = ",
+                                bcm_ether_ntoa(&pmkid_array[k].BSSID,
+                                eabuf)));
+                        for (j = 0; j < WPA2_PMKID_LEN; j++)
+                                WL_WSEC(("%02x ", pmkid_array[k].PMKID[j]));
+                        WL_WSEC(("\n"));
+                }
+        }
+        WL_WSEC(("PRINTING pmkid LIST - No of elements %d", pmkid_list.pmkids.npmkid));
+        for (i = 0; i < pmkid_list.pmkids.npmkid; i++) {
+                uint j;
+                WL_WSEC(("\nPMKID[%d]: %s = ", i,
+                        bcm_ether_ntoa(&pmkid_array[i].BSSID,
+                        eabuf)));
+                for (j = 0; j < WPA2_PMKID_LEN; j++)
+                        WL_WSEC(("%02x ", pmkid_array[i].PMKID[j]));
+        }
+        WL_WSEC(("\n"));
+
+        if (!ret)
+                ret = dev_wlc_bufvar_set(dev, "pmkid_info", (char *)&pmkid_list,
+                        sizeof(pmkid_list));
+        return ret;
+}
+#endif 
+
+static int
+wl_iw_get_encodeext(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        WL_TRACE(("%s: SIOCGIWENCODEEXT\n", dev->name));
+        return 0;
+}
+
+
+static uint32
+wl_iw_create_wpaauth_wsec(struct net_device *dev)
+{
+        wl_iw_t *iw = NETDEV_PRIV(dev);
+        uint32 wsec;
+
+        
+        if (iw->pcipher & (IW_AUTH_CIPHER_WEP40 | IW_AUTH_CIPHER_WEP104))
+                wsec = WEP_ENABLED;
+        else if (iw->pcipher & IW_AUTH_CIPHER_TKIP)
+                wsec = TKIP_ENABLED;
+        else if (iw->pcipher & IW_AUTH_CIPHER_CCMP)
+                wsec = AES_ENABLED;
+        else
+                wsec = 0;
+
+        
+        if (iw->gcipher & (IW_AUTH_CIPHER_WEP40 | IW_AUTH_CIPHER_WEP104))
+                wsec |= WEP_ENABLED;
+        else if (iw->gcipher & IW_AUTH_CIPHER_TKIP)
+                wsec |= TKIP_ENABLED;
+        else if (iw->gcipher & IW_AUTH_CIPHER_CCMP)
+                wsec |= AES_ENABLED;
+
+        
+        if (wsec == 0 && iw->privacy_invoked)
+                wsec = WEP_ENABLED;
+
+        WL_INFORM(("%s: returning wsec of %d\n", __FUNCTION__, wsec));
+
+        return wsec;
+}
+
+static int
+wl_iw_set_wpaauth(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error = 0;
+        int paramid;
+        int paramval;
+        int val = 0;
+        wl_iw_t *iw = NETDEV_PRIV(dev);
+
+        paramid = vwrq->flags & IW_AUTH_INDEX;
+        paramval = vwrq->value;
+
+        WL_TRACE(("%s: SIOCSIWAUTH, %s(%d), paramval = 0x%0x\n",
+                dev->name,
+                paramid == IW_AUTH_WPA_VERSION ? "IW_AUTH_WPA_VERSION" :
+                paramid == IW_AUTH_CIPHER_PAIRWISE ? "IW_AUTH_CIPHER_PAIRWISE" :
+                paramid == IW_AUTH_CIPHER_GROUP ? "IW_AUTH_CIPHER_GROUP" :
+                paramid == IW_AUTH_KEY_MGMT ? "IW_AUTH_KEY_MGMT" :
+                paramid == IW_AUTH_TKIP_COUNTERMEASURES ? "IW_AUTH_TKIP_COUNTERMEASURES" :
+                paramid == IW_AUTH_DROP_UNENCRYPTED ? "IW_AUTH_DROP_UNENCRYPTED" :
+                paramid == IW_AUTH_80211_AUTH_ALG ? "IW_AUTH_80211_AUTH_ALG" :
+                paramid == IW_AUTH_WPA_ENABLED ? "IW_AUTH_WPA_ENABLED" :
+                paramid == IW_AUTH_RX_UNENCRYPTED_EAPOL ? "IW_AUTH_RX_UNENCRYPTED_EAPOL" :
+                paramid == IW_AUTH_ROAMING_CONTROL ? "IW_AUTH_ROAMING_CONTROL" :
+                paramid == IW_AUTH_PRIVACY_INVOKED ? "IW_AUTH_PRIVACY_INVOKED" :
+                "UNKNOWN",
+                paramid, paramval));
+
+#if defined(SOFTAP)
+        if (ap_cfg_running) {
+                WL_TRACE(("%s: Not executed, reason -'SOFTAP is active'\n", __FUNCTION__));
+                return 0;
+        }
+#endif
+
+        switch (paramid) {
+        case IW_AUTH_WPA_VERSION:
+                
+                iw->wpaversion = paramval;
+                break;
+
+        case IW_AUTH_CIPHER_PAIRWISE:
+                iw->pcipher = paramval;
+                val = wl_iw_create_wpaauth_wsec(dev);
+                if ((error = dev_wlc_intvar_set(dev, "wsec", val)))
+                        return error;
+                break;
+
+        case IW_AUTH_CIPHER_GROUP:
+                iw->gcipher = paramval;
+                val = wl_iw_create_wpaauth_wsec(dev);
+                if ((error = dev_wlc_intvar_set(dev, "wsec", val)))
+                        return error;
+                break;
+
+        case IW_AUTH_KEY_MGMT:
+                if (paramval & IW_AUTH_KEY_MGMT_PSK) {
+                        if (iw->wpaversion == IW_AUTH_WPA_VERSION_WPA)
+                                val = WPA_AUTH_PSK;
+                        else if (iw->wpaversion == IW_AUTH_WPA_VERSION_WPA2)
+                                val = WPA2_AUTH_PSK;
+                        else 
+                                val = WPA_AUTH_DISABLED;
+                } else if (paramval & IW_AUTH_KEY_MGMT_802_1X) {
+                        if (iw->wpaversion == IW_AUTH_WPA_VERSION_WPA)
+                                val = WPA_AUTH_UNSPECIFIED;
+                        else if (iw->wpaversion == IW_AUTH_WPA_VERSION_WPA2)
+                                val = WPA2_AUTH_UNSPECIFIED;
+                        else 
+                                val = WPA_AUTH_DISABLED;
+                }
+                else
+                        val = WPA_AUTH_DISABLED;
+
+                WL_INFORM(("%s: %d: setting wpa_auth to %d\n", __FUNCTION__, __LINE__, val));
+                if ((error = dev_wlc_intvar_set(dev, "wpa_auth", val)))
+                        return error;
+                break;
+
+        case IW_AUTH_TKIP_COUNTERMEASURES:
+                dev_wlc_bufvar_set(dev, "tkip_countermeasures", (char *)&paramval, 1);
+                break;
+
+        case IW_AUTH_80211_AUTH_ALG:
+                
+                WL_INFORM(("Setting the D11auth %d\n", paramval));
+                if (paramval == IW_AUTH_ALG_OPEN_SYSTEM)
+                        val = 0;
+                else if (paramval == IW_AUTH_ALG_SHARED_KEY)
+                        val = 1;
+                else if (paramval == (IW_AUTH_ALG_OPEN_SYSTEM | IW_AUTH_ALG_SHARED_KEY))
+                        val = 2;
+                else
+                        error = 1;
+                if (!error && (error = dev_wlc_intvar_set(dev, "auth", val)))
+                        return error;
+                break;
+
+        case IW_AUTH_WPA_ENABLED:
+                if (paramval == 0) {
+                        iw->privacy_invoked = 0; 
+                        iw->pcipher = 0;
+                        iw->gcipher = 0;
+                        val = wl_iw_create_wpaauth_wsec(dev);
+                        if ((error = dev_wlc_intvar_set(dev, "wsec", val)))
+                                return error;
+                        WL_INFORM(("%s: %d: setting wpa_auth to %d, wsec to %d\n",
+                                __FUNCTION__, __LINE__, paramval, val));
+                        dev_wlc_intvar_set(dev, "wpa_auth", paramval);
+                        return error;
+                }
+
+                
+                break;
+
+        case IW_AUTH_DROP_UNENCRYPTED:
+                if ((error = dev_wlc_intvar_set(dev, "wsec_restrict", paramval)))
+                        return error;
+                break;
+
+        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+                dev_wlc_bufvar_set(dev, "rx_unencrypted_eapol", (char *)&paramval, 1);
+                break;
+
+#if WIRELESS_EXT > 17
+        case IW_AUTH_ROAMING_CONTROL:
+                WL_INFORM(("%s: IW_AUTH_ROAMING_CONTROL\n", __FUNCTION__));
+                
+                break;
+
+        case IW_AUTH_PRIVACY_INVOKED:
+                iw->privacy_invoked = paramval;
+                val = wl_iw_create_wpaauth_wsec(dev);
+                if ((error = dev_wlc_intvar_set(dev, "wsec", val)))
+                        return error;
+                break;
+
+#endif 
+        default:
+                break;
+        }
+        return 0;
+}
+#define VAL_PSK(_val) (((_val) & WPA_AUTH_PSK) || ((_val) & WPA2_AUTH_PSK))
+
+static int
+wl_iw_get_wpaauth(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_param *vwrq,
+        char *extra
+)
+{
+        int error;
+        int paramid;
+        int paramval = 0;
+        int val;
+        wl_iw_t *iw = NETDEV_PRIV(dev);
+
+        WL_TRACE(("%s: SIOCGIWAUTH\n", dev->name));
+
+        paramid = vwrq->flags & IW_AUTH_INDEX;
+
+        switch (paramid) {
+        case IW_AUTH_WPA_VERSION:
+                paramval = iw->wpaversion;
+                break;
+
+        case IW_AUTH_CIPHER_PAIRWISE:
+                paramval = iw->pcipher;
+                break;
+
+        case IW_AUTH_CIPHER_GROUP:
+                paramval = iw->gcipher;
+                break;
+
+        case IW_AUTH_KEY_MGMT:
+                
+                if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val)))
+                        return error;
+                if (VAL_PSK(val))
+                        paramval = IW_AUTH_KEY_MGMT_PSK;
+                else
+                        paramval = IW_AUTH_KEY_MGMT_802_1X;
+
+                break;
+
+        case IW_AUTH_TKIP_COUNTERMEASURES:
+                dev_wlc_bufvar_get(dev, "tkip_countermeasures", (char *)&paramval, 1);
+                break;
+
+        case IW_AUTH_DROP_UNENCRYPTED:
+                dev_wlc_intvar_get(dev, "wsec_restrict", &paramval);
+                break;
+
+        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+                dev_wlc_bufvar_get(dev, "rx_unencrypted_eapol", (char *)&paramval, 1);
+                break;
+
+        case IW_AUTH_80211_AUTH_ALG:
+                
+                if ((error = dev_wlc_intvar_get(dev, "auth", &val)))
+                        return error;
+                if (!val)
+                        paramval = IW_AUTH_ALG_OPEN_SYSTEM;
+                else
+                        paramval = IW_AUTH_ALG_SHARED_KEY;
+                break;
+        case IW_AUTH_WPA_ENABLED:
+                if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val)))
+                        return error;
+                if (val)
+                        paramval = TRUE;
+                else
+                        paramval = FALSE;
+                break;
+#if WIRELESS_EXT > 17
+        case IW_AUTH_ROAMING_CONTROL:
+                WL_ERROR(("%s: IW_AUTH_ROAMING_CONTROL\n", __FUNCTION__));
+                
+                break;
+        case IW_AUTH_PRIVACY_INVOKED:
+                paramval = iw->privacy_invoked;
+                break;
+
+#endif 
+        }
+        vwrq->value = paramval;
+        return 0;
+}
+#endif 
+
+
+#ifdef SOFTAP
+
+static int ap_macmode = MACLIST_MODE_DISABLED;
+static struct mflist ap_black_list;
+
+static int
+wl_iw_parse_wep(char *keystr, wl_wsec_key_t *key)
+{
+        char hex[] = "XX";
+        unsigned char *data = key->data;
+
+        switch (strlen(keystr)) {
+        case 5:
+        case 13:
+        case 16:
+                key->len = strlen(keystr);
+                memcpy(data, keystr, key->len + 1);
+                break;
+        case 12:
+        case 28:
+        case 34:
+        case 66:
+                
+                if (!strnicmp(keystr, "0x", 2))
+                        keystr += 2;
+                else
+                        return -1;
+                
+        case 10:
+        case 26:
+        case 32:
+        case 64:
+                key->len = strlen(keystr) / 2;
+                while (*keystr) {
+                        strncpy(hex, keystr, 2);
+                        *data++ = (char) bcm_strtoul(hex, NULL, 16);
+                        keystr += 2;
+                }
+                break;
+        default:
+                return -1;
+        }
+
+        switch (key->len) {
+        case 5:
+                key->algo = CRYPTO_ALGO_WEP1;
+                break;
+        case 13:
+                key->algo = CRYPTO_ALGO_WEP128;
+                break;
+        case 16:
+                
+                key->algo = CRYPTO_ALGO_AES_CCM;
+                break;
+        case 32:
+                key->algo = CRYPTO_ALGO_TKIP;
+                break;
+        default:
+                return -1;
+        }
+
+        
+        key->flags |= WL_PRIMARY_KEY;
+
+        return 0;
+}
+
+#ifdef EXT_WPA_CRYPTO
+#define SHA1HashSize 20
+extern void pbkdf2_sha1(const char *passphrase, const char *ssid, size_t ssid_len,
+                        int iterations, u8 *buf, size_t buflen);
+
+#else
+
+#define SHA1HashSize 20
+static int
+pbkdf2_sha1(const char *passphrase, const char *ssid, size_t ssid_len,
+            int iterations, u8 *buf, size_t buflen)
+{
+        WL_ERROR(("WARNING: %s is not implemented !!!\n", __FUNCTION__));
+        return -1;
+}
+
+#endif 
+
+
+static int
+dev_iw_write_cfg1_bss_var(struct net_device *dev, int val)
+{
+        struct {
+                int cfg;
+                int val;
+        } bss_setbuf;
+
+        int bss_set_res;
+        char smbuf[WLC_IOCTL_SMLEN];
+        memset(smbuf, 0, sizeof(smbuf));
+
+        bss_setbuf.cfg = 1;
+        bss_setbuf.val = val;
+
+        bss_set_res = dev_iw_iovar_setbuf(dev, "bss",
+                &bss_setbuf, sizeof(bss_setbuf), smbuf, sizeof(smbuf));
+        WL_TRACE(("%s: bss_set_result:%d set with %d\n", __FUNCTION__, bss_set_res, val));
+
+        return bss_set_res;
+}
+
+
+
+#ifndef AP_ONLY
+static int
+wl_bssiovar_mkbuf(
+                const char *iovar,
+                int bssidx,
+                void *param,
+                int paramlen,
+                void *bufptr,
+                int buflen,
+                int *perr)
+{
+        const char *prefix = "bsscfg:";
+        int8* p;
+        uint prefixlen;
+        uint namelen;
+        uint iolen;
+
+        prefixlen = strlen(prefix);     
+        namelen = strlen(iovar) + 1;    
+        iolen = prefixlen + namelen + sizeof(int) + paramlen;
+
+        
+        if (buflen < 0 || iolen > (uint)buflen) {
+                *perr = BCME_BUFTOOSHORT;
+                return 0;
+        }
+
+        p = (int8*)bufptr;
+
+        
+        memcpy(p, prefix, prefixlen);
+        p += prefixlen;
+
+        
+        memcpy(p, iovar, namelen);
+        p += namelen;
+
+        
+        bssidx = htod32(bssidx);
+        memcpy(p, &bssidx, sizeof(int32));
+        p += sizeof(int32);
+
+        
+        if (paramlen)
+                memcpy(p, param, paramlen);
+
+        *perr = 0;
+        return iolen;
+}
+#endif 
+
+
+
+
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+
+
+#if defined(CSCAN)
+
+
+
+static int
+wl_iw_combined_scan_set(struct net_device *dev, wlc_ssid_t* ssids_local, int nssid, int nchan)
+{
+        int params_size = WL_SCAN_PARAMS_FIXED_SIZE + WL_NUMCHANNELS * sizeof(uint16);
+        int err = 0;
+        char *p;
+        int i;
+        iscan_info_t *iscan = g_iscan;
+
+        WL_TRACE(("%s nssid=%d nchan=%d\n", __FUNCTION__, nssid, nchan));
+
+        if ((!dev) && (!g_iscan) && (!iscan->iscan_ex_params_p)) {
+                WL_ERROR(("%s error exit\n", __FUNCTION__));
+                err = -1;
+                goto exit;
+        }
+
+#ifdef PNO_SUPPORT
+        
+        if  (dhd_dev_get_pno_status(dev)) {
+                WL_ERROR(("%s: Scan called when PNO is active\n", __FUNCTION__));
+        }
+#endif 
+
+        params_size += WL_SCAN_PARAMS_SSID_MAX * sizeof(wlc_ssid_t);
+
+        
+        if (nssid > 0) {
+                i = OFFSETOF(wl_scan_params_t, channel_list) + nchan * sizeof(uint16);
+                i = ROUNDUP(i, sizeof(uint32));
+                if (i + nssid * sizeof(wlc_ssid_t) > params_size) {
+                        printf("additional ssids exceed params_size\n");
+                        err = -1;
+                        goto exit;
+                }
+
+                p = ((char*)&iscan->iscan_ex_params_p->params) + i;
+                memcpy(p, ssids_local, nssid * sizeof(wlc_ssid_t));
+                p += nssid * sizeof(wlc_ssid_t);
+        } else {
+                p = (char*)iscan->iscan_ex_params_p->params.channel_list + nchan * sizeof(uint16);
+        }
+
+        
+        iscan->iscan_ex_params_p->params.channel_num =
+                htod32((nssid << WL_SCAN_PARAMS_NSSID_SHIFT) |
+                       (nchan & WL_SCAN_PARAMS_COUNT_MASK));
+
+        nssid = (uint)
+                ((iscan->iscan_ex_params_p->params.channel_num >> WL_SCAN_PARAMS_NSSID_SHIFT) &
+                 WL_SCAN_PARAMS_COUNT_MASK);
+
+        
+        params_size = (int) (p - (char*)iscan->iscan_ex_params_p + nssid * sizeof(wlc_ssid_t));
+        iscan->iscan_ex_param_size = params_size;
+
+        iscan->list_cur = iscan->list_hdr;
+        iscan->iscan_state = ISCAN_STATE_SCANING;
+        wl_iw_set_event_mask(dev);
+        mod_timer(&iscan->timer, jiffies + iscan->timer_ms*HZ/1000);
+
+        iscan->timer_on = 1;
+
+#ifdef SCAN_DUMP
+        {
+                int i;
+                WL_SCAN(("\n### List of SSIDs to scan ###\n"));
+                for (i = 0; i < nssid; i++) {
+                        if (!ssids_local[i].SSID_len)
+                                WL_SCAN(("%d: Broadcast scan\n", i));
+                        else
+                        WL_SCAN(("%d: scan  for  %s size =%d\n", i,
+                                ssids_local[i].SSID, ssids_local[i].SSID_len));
+                }
+                WL_SCAN(("### List of channels to scan ###\n"));
+                for (i = 0; i < nchan; i++)
+                {
+                        WL_SCAN(("%d ", iscan->iscan_ex_params_p->params.channel_list[i]));
+                }
+                WL_SCAN(("\nnprobes=%d\n", iscan->iscan_ex_params_p->params.nprobes));
+                WL_SCAN(("active_time=%d\n", iscan->iscan_ex_params_p->params.active_time));
+                WL_SCAN(("passive_time=%d\n", iscan->iscan_ex_params_p->params.passive_time));
+                WL_SCAN(("home_time=%d\n", iscan->iscan_ex_params_p->params.home_time));
+                WL_SCAN(("scan_type=%d\n", iscan->iscan_ex_params_p->params.scan_type));
+                WL_SCAN(("\n###################\n"));
+        }
+#endif 
+
+        if (params_size > WLC_IOCTL_MEDLEN) {
+                        WL_ERROR(("Set ISCAN for %s due to params_size=%d  \n",
+                                __FUNCTION__, params_size));
+                        err = -1;
+        }
+
+        if ((err = dev_iw_iovar_setbuf(dev, "iscan", iscan->iscan_ex_params_p,
+                                       iscan->iscan_ex_param_size,
+                                       iscan->ioctlbuf, sizeof(iscan->ioctlbuf)))) {
+                WL_TRACE(("Set ISCAN for %s failed with %d\n", __FUNCTION__, err));
+                err = -1;
+        }
+
+exit:
+        return err;
+}
+
+
+static int
+iwpriv_set_cscan(struct net_device *dev, struct iw_request_info *info,
+                 union iwreq_data *wrqu, char *ext)
+{
+        int res;
+        char  *extra = NULL;
+        iscan_info_t *iscan = g_iscan;
+        wlc_ssid_t ssids_local[WL_SCAN_PARAMS_SSID_MAX];
+        int nssid = 0;
+        int nchan = 0;
+        char *str_ptr;
+
+        WL_TRACE(("%s: info->cmd:%x, info->flags:%x, u.data=0x%p, u.len=%d\n",
+                __FUNCTION__, info->cmd, info->flags,
+                wrqu->data.pointer, wrqu->data.length));
+
+        if (g_onoff == G_WLAN_SET_OFF) {
+                WL_TRACE(("%s: driver is not up yet after START\n", __FUNCTION__));
+                return -ENODEV;
+        }
+
+        if (wrqu->data.length == 0) {
+                WL_ERROR(("IWPRIV argument len = 0\n"));
+                return -EINVAL;
+        }
+
+        if (!iscan->iscan_ex_params_p) {
+                return -EFAULT;
+        }
+
+        if (!(extra = kmalloc(wrqu->data.length+1, GFP_KERNEL)))
+                return -ENOMEM;
+
+        if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) {
+                res = -EFAULT;
+                goto exit_proc;
+        }
+
+        extra[wrqu->data.length] = 0;
+        WL_ERROR(("Got str param in iw_point:\n %s\n", extra));
+
+        str_ptr = extra;
+
+        
+        if (strncmp(str_ptr, GET_SSID, strlen(GET_SSID))) {
+                WL_ERROR(("%s Error: extracting SSID='' string\n", __FUNCTION__));
+                res = -EINVAL;
+                goto exit_proc;
+        }
+
+        str_ptr += strlen(GET_SSID);
+        nssid = wl_iw_parse_ssid_list(&str_ptr, ssids_local, nssid,
+                                      WL_SCAN_PARAMS_SSID_MAX);
+        if (nssid == -1) {
+                WL_ERROR(("%s wrong ssid list", __FUNCTION__));
+                res = -EINVAL;
+                goto exit_proc;
+        }
+
+        memset(iscan->iscan_ex_params_p, 0, iscan->iscan_ex_param_size);
+        ASSERT(iscan->iscan_ex_param_size < WLC_IOCTL_MAXLEN);
+
+        
+        wl_iw_iscan_prep(&iscan->iscan_ex_params_p->params, NULL);
+        iscan->iscan_ex_params_p->version = htod32(ISCAN_REQ_VERSION);
+        iscan->iscan_ex_params_p->action = htod16(WL_SCAN_ACTION_START);
+        iscan->iscan_ex_params_p->scan_duration = htod16(0);
+
+        
+        if ((nchan = wl_iw_parse_channel_list(&str_ptr,
+                                              &iscan->iscan_ex_params_p->params.channel_list[0],
+                                              WL_NUMCHANNELS)) == -1) {
+                WL_ERROR(("%s missing channel list\n", __FUNCTION__));
+                res = -EINVAL;
+                goto exit_proc;
+        }
+
+        
+        get_parameter_from_string(&str_ptr,
+                                  GET_NPROBE, PTYPE_INTDEC,
+                                  &iscan->iscan_ex_params_p->params.nprobes, 2);
+
+        get_parameter_from_string(&str_ptr, GET_ACTIVE_ASSOC_DWELL, PTYPE_INTDEC,
+                                  &iscan->iscan_ex_params_p->params.active_time, 4);
+
+        get_parameter_from_string(&str_ptr, GET_PASSIVE_ASSOC_DWELL, PTYPE_INTDEC,
+                                  &iscan->iscan_ex_params_p->params.passive_time, 4);
+
+        get_parameter_from_string(&str_ptr, GET_HOME_DWELL, PTYPE_INTDEC,
+                                  &iscan->iscan_ex_params_p->params.home_time, 4);
+
+        get_parameter_from_string(&str_ptr, GET_SCAN_TYPE, PTYPE_INTDEC,
+                                  &iscan->iscan_ex_params_p->params.scan_type, 1);
+
+        
+        res = wl_iw_combined_scan_set(dev, ssids_local, nssid, nchan);
+
+exit_proc:
+        kfree(extra);
+
+        return res;
+}
+
+
+static int
+wl_iw_set_cscan(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int res = -1;
+        iscan_info_t *iscan = g_iscan;
+        wlc_ssid_t ssids_local[WL_SCAN_PARAMS_SSID_MAX];
+        int nssid = 0;
+        int nchan = 0;
+        cscan_tlv_t *cscan_tlv_temp;
+        char type;
+        char *str_ptr;
+        int tlv_size_left;
+#ifdef TLV_DEBUG
+        int i;
+        char tlv_in_example[] = {
+                'C', 'S', 'C', 'A', 'N', ' ',
+                0x53, 0x01, 0x00, 0x00,
+                'S',      
+                0x00, 
+                'S',    
+                0x04, 
+                'B', 'R', 'C', 'M',
+                'C',
+                0x06, 
+                'P', 
+                0x94,
+                0x11,
+                'T',     
+                0x01  
+        };
+#endif 
+
+        WL_TRACE(("\n### %s: info->cmd:%x, info->flags:%x, u.data=0x%p, u.len=%d\n",
+                __FUNCTION__, info->cmd, info->flags,
+                wrqu->data.pointer, wrqu->data.length));
+
+        net_os_wake_lock(dev);
+
+        if (g_onoff == G_WLAN_SET_OFF) {
+                WL_TRACE(("%s: driver is not up yet after START\n", __FUNCTION__));
+                goto exit_proc;
+        }
+
+        if (wrqu->data.length < (strlen(CSCAN_COMMAND) + sizeof(cscan_tlv_t))) {
+                WL_ERROR(("%s argument=%d  less %d\n", __FUNCTION__,
+                          wrqu->data.length, (int)(strlen(CSCAN_COMMAND) + sizeof(cscan_tlv_t))));
+                goto exit_proc;
+        }
+
+#ifdef TLV_DEBUG
+        memcpy(extra, tlv_in_example, sizeof(tlv_in_example));
+        wrqu->data.length = sizeof(tlv_in_example);
+        for (i = 0; i < wrqu->data.length; i++)
+                printf("%02X ", extra[i]);
+        printf("\n");
+#endif 
+
+        str_ptr = extra;
+        str_ptr +=  strlen(CSCAN_COMMAND);
+        tlv_size_left = wrqu->data.length - strlen(CSCAN_COMMAND);
+
+        cscan_tlv_temp = (cscan_tlv_t *)str_ptr;
+        memset(ssids_local, 0, sizeof(ssids_local));
+        
+        if ((cscan_tlv_temp->prefix == CSCAN_TLV_PREFIX) &&
+                (cscan_tlv_temp->version == CSCAN_TLV_VERSION) &&
+                (cscan_tlv_temp->subver == CSCAN_TLV_SUBVERSION))
+        {
+                str_ptr += sizeof(cscan_tlv_t);
+                tlv_size_left  -= sizeof(cscan_tlv_t);
+
+                
+                if ((nssid = wl_iw_parse_ssid_list_tlv(&str_ptr, ssids_local,
+                        WL_SCAN_PARAMS_SSID_MAX, &tlv_size_left)) <= 0) {
+                        WL_ERROR(("SSID is not presented or corrupted ret=%d\n", nssid));
+                        goto exit_proc;
+                }
+                else {
+                        
+                        memset(iscan->iscan_ex_params_p, 0, iscan->iscan_ex_param_size);
+
+                        
+                        wl_iw_iscan_prep(&iscan->iscan_ex_params_p->params, NULL);
+                        iscan->iscan_ex_params_p->version = htod32(ISCAN_REQ_VERSION);
+                        iscan->iscan_ex_params_p->action = htod16(WL_SCAN_ACTION_START);
+                        iscan->iscan_ex_params_p->scan_duration = htod16(0);
+
+                        
+                        while (tlv_size_left > 0)
+                        {
+                        type = str_ptr[0];
+                        switch (type) {
+                                case CSCAN_TLV_TYPE_CHANNEL_IE:
+                                        
+                                        if ((nchan = wl_iw_parse_channel_list_tlv(&str_ptr,
+                                        &iscan->iscan_ex_params_p->params.channel_list[0],
+                                        WL_NUMCHANNELS, &tlv_size_left)) == -1) {
+                                        WL_ERROR(("%s missing channel list\n",
+                                                __FUNCTION__));
+                                                goto exit_proc;
+                                        }
+                                break;
+                                case CSCAN_TLV_TYPE_NPROBE_IE:
+                                        if ((res = wl_iw_parse_data_tlv(&str_ptr,
+                                                &iscan->iscan_ex_params_p->params.nprobes,
+                                                sizeof(iscan->iscan_ex_params_p->params.nprobes),
+                                                type, sizeof(char), &tlv_size_left)) == -1) {
+                                                WL_ERROR(("%s return %d\n",
+                                                        __FUNCTION__, res));
+                                                        goto exit_proc;
+                                        }
+                                break;
+                                case CSCAN_TLV_TYPE_ACTIVE_IE:
+                                        if ((res = wl_iw_parse_data_tlv(&str_ptr,
+                                        &iscan->iscan_ex_params_p->params.active_time,
+                                        sizeof(iscan->iscan_ex_params_p->params.active_time),
+                                        type, sizeof(short), &tlv_size_left)) == -1) {
+                                                WL_ERROR(("%s return %d\n",
+                                                __FUNCTION__, res));
+                                                goto exit_proc;
+                                        }
+                                break;
+                                case CSCAN_TLV_TYPE_PASSIVE_IE:
+                                        if ((res = wl_iw_parse_data_tlv(&str_ptr,
+                                        &iscan->iscan_ex_params_p->params.passive_time,
+                                        sizeof(iscan->iscan_ex_params_p->params.passive_time),
+                                        type, sizeof(short), &tlv_size_left)) == -1) {
+                                                WL_ERROR(("%s return %d\n",
+                                                __FUNCTION__, res));
+                                                goto exit_proc;
+                                        }
+                                break;
+                                case CSCAN_TLV_TYPE_HOME_IE:
+                                        if ((res = wl_iw_parse_data_tlv(&str_ptr,
+                                        &iscan->iscan_ex_params_p->params.home_time,
+                                        sizeof(iscan->iscan_ex_params_p->params.home_time),
+                                        type, sizeof(short), &tlv_size_left)) == -1) {
+                                                WL_ERROR(("%s return %d\n",
+                                                __FUNCTION__, res));
+                                                goto exit_proc;
+                                        }
+                                break;
+                                case CSCAN_TLV_TYPE_STYPE_IE:
+                                        if ((res = wl_iw_parse_data_tlv(&str_ptr,
+                                        &iscan->iscan_ex_params_p->params.scan_type,
+                                        sizeof(iscan->iscan_ex_params_p->params.scan_type),
+                                        type, sizeof(char), &tlv_size_left)) == -1) {
+                                        WL_ERROR(("%s return %d\n",
+                                                __FUNCTION__, res));
+                                                goto exit_proc;
+                                        }
+                                break;
+
+                                default :
+                                        WL_ERROR(("%s get unkwown type %X\n",
+                                        __FUNCTION__, type));
+                                        goto exit_proc;
+                                break;
+                                }
+                        } 
+                        }
+                }
+                else {
+                        WL_ERROR(("%s get wrong TLV command\n", __FUNCTION__));
+                        goto exit_proc;
+                }
+
+#if defined(CONFIG_FIRST_SCAN)
+                if (g_first_broadcast_scan < BROADCAST_SCAN_FIRST_RESULT_CONSUMED) {
+                        if (++g_first_counter_scans == MAX_ALLOWED_BLOCK_SCAN_FROM_FIRST_SCAN) {
+                                
+                                WL_ERROR(("%s Clean up First scan flag which is %d\n",
+                                        __FUNCTION__, g_first_broadcast_scan));
+                                g_first_broadcast_scan = BROADCAST_SCAN_FIRST_RESULT_CONSUMED;
+                        }
+                        else {
+                                WL_ERROR(("%s Ignoring CSCAN : First Scan is not done yet %d\n",
+                                        __FUNCTION__, g_first_counter_scans));
+                                goto exit_proc;
+                        }
+                }
+#endif 
+
+                
+                res = wl_iw_combined_scan_set(dev, ssids_local, nssid, nchan);
+
+exit_proc:
+        net_os_wake_unlock(dev);
+        return res;
+}
+
+#endif 
+
+#ifdef CONFIG_WPS2
+static int
+wl_iw_del_wps_probe_req_ie(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        int ret;
+        vndr_ie_setbuf_t *ie_delbuf;
+
+        if (g_wps_probe_req_ie) {
+                ie_delbuf = (vndr_ie_setbuf_t *)(g_wps_probe_req_ie + strlen("vndr_ie "));
+                strncpy(ie_delbuf->cmd, "del", 3);
+                ie_delbuf->cmd[3] = '\0';
+
+                ret = dev_wlc_ioctl(dev, WLC_SET_VAR, g_wps_probe_req_ie, g_wps_probe_req_ie_len);
+                if (ret) {
+                        WL_ERROR(("ioctl failed %d \n", ret));
+                }
+
+                kfree(g_wps_probe_req_ie);
+                g_wps_probe_req_ie = NULL;
+                g_wps_probe_req_ie_len = 0;
+        }
+
+        return 0;
+}
+
+static int
+wl_iw_add_wps_probe_req_ie(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *extra
+)
+{
+        char *str_ptr = NULL;
+        char *bufptr = NULL;
+        uint buflen, datalen, iecount, pktflag, iolen, total_len;
+        int ret = 0;
+        vndr_ie_setbuf_t *ie_setbuf = NULL;
+
+        if (!g_wps_probe_req_ie) {
+                ret = -1;
+                str_ptr = extra;
+                str_ptr += WPS_PROBE_REQ_IE_CMD_LENGTH;
+                datalen = wrqu->data.length - WPS_PROBE_REQ_IE_CMD_LENGTH;
+
+                
+                
+                buflen = sizeof(vndr_ie_setbuf_t) + datalen - sizeof(vndr_ie_t);
+                ie_setbuf = (vndr_ie_setbuf_t *)kmalloc(buflen, GFP_KERNEL);
+                if (!ie_setbuf) {
+                        WL_ERROR(("memory alloc failure ie_setbuf\n"));
+                        return ret;
+                }
+
+                memset(ie_setbuf, 0x00, buflen);
+
+                
+                strncpy(ie_setbuf->cmd, "add", VNDR_IE_CMD_LEN - 1);
+                ie_setbuf->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+                
+                iecount = htod32(1);
+                memcpy((void *)&ie_setbuf->vndr_ie_buffer.iecount, &iecount, sizeof(int));
+
+                
+                pktflag = 0x10;
+                memcpy((void *)&ie_setbuf->vndr_ie_buffer.vndr_ie_list[0].pktflag,
+                        &pktflag, sizeof(uint32));
+
+                memcpy((void *)&ie_setbuf->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data,
+                        str_ptr, datalen);
+
+                total_len = strlen("vndr_ie ") + buflen;
+                bufptr = (char *)kmalloc(total_len, GFP_KERNEL);
+                if (!bufptr) {
+                        WL_ERROR(("memory alloc failure bufptr\n"));
+                        goto fail;
+                }
+
+                iolen = bcm_mkiovar("vndr_ie", (char *)ie_setbuf, buflen, bufptr, total_len);
+                if (iolen == 0) {
+                        WL_ERROR(("Buffer length is illegal\n"));
+                        goto fail2;
+                }
+
+                ret = dev_wlc_ioctl(dev, WLC_SET_VAR, bufptr, iolen);
+                if (ret) {
+                        WL_ERROR(("ioctl failed\n"));
+                        goto fail2;
+                }
+
+                g_wps_probe_req_ie = (char *)kmalloc(iolen, GFP_KERNEL);
+                if (!g_wps_probe_req_ie) {
+                        WL_ERROR(("memory alloc failure g_wps_probe_req_ie\n"));
+                        goto fail2;
+                }
+
+                memcpy(g_wps_probe_req_ie, bufptr, iolen);
+                g_wps_probe_req_ie_len = iolen;
+        }
+
+fail2:
+        if (bufptr) {
+                kfree(bufptr);
+                bufptr = NULL;
+        }
+fail:
+        if (ie_setbuf) {
+                kfree(ie_setbuf);
+                ie_setbuf = NULL;
+        }
+        return ret;
+}
+#endif
+
+
+#ifdef SOFTAP
+#ifndef AP_ONLY
+
+
+static int
+thr_wait_for_2nd_eth_dev(void *data)
+{
+        wl_iw_t *iw;
+        int ret = 0;
+        unsigned long flags = 0;
+
+        tsk_ctl_t *tsk_ctl = (tsk_ctl_t *)data;
+        struct net_device *dev = (struct net_device *)tsk_ctl->parent;
+        iw = *(wl_iw_t **)netdev_priv(dev);
+
+        DAEMONIZE("wl0_eth_wthread");
+
+
+        WL_SOFTAP(("\n>%s threda started:, PID:%x\n", __FUNCTION__, current->pid));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        if (!iw) {
+                WL_ERROR(("%s: dev is null\n", __FUNCTION__));
+                tsk_ctl->thr_pid = -1;
+                complete(&tsk_ctl->completed);
+                return -1;
+        }
+        DHD_OS_WAKE_LOCK(iw->pub);
+        complete(&tsk_ctl->completed);
+        if (down_timeout(&tsk_ctl->sema, msecs_to_jiffies(1000)) != 0) {
+#else
+        if (down_interruptible(&tsk_ctl->sema) != 0) {
+#endif 
+                WL_ERROR(("\n%s: sap_eth_sema timeout \n", __FUNCTION__));
+                ret = -1;
+                goto fail;
+        }
+
+        SMP_RD_BARRIER_DEPENDS();
+        if (tsk_ctl->terminated) {
+                        ret = -1;
+                        goto fail;
+        }
+
+        flags = dhd_os_spin_lock(iw->pub);
+        if (!ap_net_dev) {
+                WL_ERROR((" ap_net_dev is null !!!"));
+                ret = -1;
+                dhd_os_spin_unlock(iw->pub, flags);
+                goto fail;
+        }
+
+        WL_SOFTAP(("\n>%s: Thread:'softap ethdev IF:%s is detected!'\n\n",
+                __FUNCTION__, ap_net_dev->name));
+
+        ap_cfg_running = TRUE;
+
+        dhd_os_spin_unlock(iw->pub, flags);
+        bcm_mdelay(500); 
+
+        
+        wl_iw_send_priv_event(priv_dev, "AP_SET_CFG_OK");
+
+fail:
+
+        DHD_OS_WAKE_UNLOCK(iw->pub);
+
+        WL_SOFTAP(("\n>%s, thread completed\n", __FUNCTION__));
+
+        complete_and_exit(&tsk_ctl->completed, 0);
+        return ret;
+}
+#endif 
+#ifndef AP_ONLY
+static int last_auto_channel = 6;
+#endif
+
+static int
+get_softap_auto_channel(struct net_device *dev, struct ap_profile *ap)
+{
+        int chosen = 0;
+        wl_uint32_list_t request;
+        int retry = 0;
+        int updown = 0;
+        int ret = 0;
+        wlc_ssid_t null_ssid;
+        int res = 0;
+#ifndef AP_ONLY
+        int iolen = 0;
+        int mkvar_err = 0;
+        int bsscfg_index = 1;
+        char buf[WLC_IOCTL_SMLEN];
+#endif
+        WL_SOFTAP(("Enter %s\n", __FUNCTION__));
+
+#ifndef AP_ONLY
+        if (ap_cfg_running) {
+                ap->channel = last_auto_channel;
+                return res;
+        }
+#endif
+
+        memset(&null_ssid, 0, sizeof(wlc_ssid_t));
+        res |= dev_wlc_ioctl(dev, WLC_UP, &updown, sizeof(updown));
+
+#ifdef AP_ONLY
+        res |= dev_wlc_ioctl(dev, WLC_SET_SSID, &null_ssid, sizeof(null_ssid));
+#else
+
+        iolen = wl_bssiovar_mkbuf("ssid", bsscfg_index, (char *)(&null_ssid),
+                null_ssid.SSID_len+4, buf, sizeof(buf), &mkvar_err);
+        ASSERT(iolen);
+        res |= dev_wlc_ioctl(dev, WLC_SET_VAR, buf, iolen);
+
+#endif
+
+        request.count = htod32(0);
+        ret = dev_wlc_ioctl(dev, WLC_START_CHANNEL_SEL, &request, sizeof(request));
+        if (ret < 0) {
+                WL_ERROR(("can't start auto channel scan\n"));
+                goto fail;
+        }
+
+        get_channel_retry:
+                bcm_mdelay(350);
+
+        ret = dev_wlc_ioctl(dev, WLC_GET_CHANNEL_SEL, &chosen, sizeof(chosen));
+                if (ret < 0 || dtoh32(chosen) == 0) {
+                        if (retry++ < 15) {
+                                goto get_channel_retry;
+                        } else {
+                                if (ret < 0) {
+                                        WL_ERROR(("can't get auto channel sel, err = %d, "
+                                                  "chosen = 0x%04X\n", ret, (uint16)chosen));
+                                        goto fail;
+                                } else {
+                                        ap->channel = (uint16)last_auto_channel;
+                                        WL_ERROR(("auto channel sel timed out. we get channel %d\n",
+                                                ap->channel));
+                                }
+                        }
+                }
+
+                if (chosen) {
+                        ap->channel = (uint16)chosen & 0x00FF;
+                        WL_SOFTAP(("%s: Got auto channel = %d, attempt:%d\n",
+                                __FUNCTION__, ap->channel, retry));
+                }
+
+                if ((res = dev_wlc_ioctl(dev, WLC_DOWN, &updown, sizeof(updown))) < 0) {
+                        WL_ERROR(("%s fail to set up err =%d\n", __FUNCTION__, res));
+                        goto fail;
+                }
+
+#ifndef AP_ONLY
+        if (!res || !ret)
+                last_auto_channel = ap->channel;
+#endif
+
+fail :
+        if (ret < 0) {
+                WL_TRACE(("%s: return value %d\n", __FUNCTION__, ret));
+                return ret;
+        }
+        return res;
+} 
+
+
+static int
+set_ap_cfg(struct net_device *dev, struct ap_profile *ap)
+{
+        int updown = 0;
+        int channel = 0;
+
+        wlc_ssid_t ap_ssid;
+        int max_assoc = 8;
+
+        int res = 0;
+        int apsta_var = 0;
+#ifndef AP_ONLY
+        int mpc = 0;
+        int iolen = 0;
+        int mkvar_err = 0;
+        int bsscfg_index = 1;
+        char buf[WLC_IOCTL_SMLEN];
+#endif
+
+        if (!dev) {
+                WL_ERROR(("%s: dev is null\n", __FUNCTION__));
+                return -1;
+        }
+
+        net_os_wake_lock(dev);
+        DHD_OS_MUTEX_LOCK(&wl_softap_lock);
+
+        WL_SOFTAP(("wl_iw: set ap profile:\n"));
+        WL_SOFTAP(("    ssid = '%s'\n", ap->ssid));
+        WL_SOFTAP(("    security = '%s'\n", ap->sec));
+        if (ap->key[0] != '\0')
+                WL_SOFTAP(("    key = '%s'\n", ap->key));
+        WL_SOFTAP(("    channel = %d\n", ap->channel));
+        WL_SOFTAP(("    max scb = %d\n", ap->max_scb));
+
+#ifdef AP_ONLY
+        if (ap_cfg_running) {
+                wl_iw_softap_deassoc_stations(dev, NULL); 
+                ap_cfg_running = FALSE;
+        }
+#endif  
+
+        
+        if (ap_cfg_running == FALSE) {
+
+#ifndef AP_ONLY
+
+                
+                sema_init(&ap_eth_ctl.sema, 0);
+
+                mpc = 0;
+                if ((res = dev_wlc_intvar_set(dev, "mpc", mpc))) {
+                        WL_ERROR(("%s fail to set mpc\n", __FUNCTION__));
+                        goto fail;
+                }
+#endif
+
+                updown = 0;
+                if ((res = dev_wlc_ioctl(dev, WLC_DOWN, &updown, sizeof(updown)))) {
+                        WL_ERROR(("%s fail to set updown\n", __FUNCTION__));
+                        goto fail;
+                }
+
+#ifdef AP_ONLY
+                
+                apsta_var = 0;
+                if ((res = dev_wlc_ioctl(dev, WLC_SET_AP, &apsta_var, sizeof(apsta_var)))) {
+                        WL_ERROR(("%s fail to set apsta_var 0\n", __FUNCTION__));
+                        goto fail;
+                }
+                apsta_var = 1;
+                if ((res = dev_wlc_ioctl(dev, WLC_SET_AP, &apsta_var, sizeof(apsta_var)))) {
+                        WL_ERROR(("%s fail to set apsta_var 1\n", __FUNCTION__));
+                        goto fail;
+                }
+                res = dev_wlc_ioctl(dev, WLC_GET_AP, &apsta_var, sizeof(apsta_var));
+#else
+                
+                apsta_var = 1;
+                iolen = wl_bssiovar_mkbuf("apsta",
+                        bsscfg_index,  &apsta_var, sizeof(apsta_var)+4,
+                        buf, sizeof(buf), &mkvar_err);
+                ASSERT(iolen);
+                if ((res = dev_wlc_ioctl(dev, WLC_SET_VAR, buf, iolen)) < 0) {
+                        WL_ERROR(("%s fail to set apsta \n", __FUNCTION__));
+                        goto fail;
+                }
+                WL_TRACE(("\n>in %s: apsta set result: %d \n", __FUNCTION__, res));
+
+
+                mpc = 0;
+                if ((res = dev_wlc_intvar_set(dev, "mpc", mpc))) {
+                        WL_ERROR(("%s fail to set mpc\n", __FUNCTION__));
+                        goto fail;
+                }
+
+
+#endif 
+
+                updown = 1;
+                if ((res = dev_wlc_ioctl(dev, WLC_UP, &updown, sizeof(updown))) < 0) {
+                        WL_ERROR(("%s fail to set apsta \n", __FUNCTION__));
+                        goto fail;
+                }
+
+        } else {
+                
+                if (!ap_net_dev) {
+                        WL_ERROR(("%s: ap_net_dev is null\n", __FUNCTION__));
+                        goto fail;
+                }
+
+                res = wl_iw_softap_deassoc_stations(ap_net_dev, NULL);
+
+                
+                if ((res = dev_iw_write_cfg1_bss_var(dev, 0)) < 0) {
+                        WL_ERROR(("%s fail to set bss down\n", __FUNCTION__));
+                        goto fail;
+                }
+        }
+
+
+        if (strlen(ap->country_code)) {
+                WL_ERROR(("%s: Igonored: Country MUST be specified"
+                        "COUNTRY command with \n",      __FUNCTION__));
+        } else {
+                WL_SOFTAP(("%s: Country code is not specified,"
+                        " will use Radio's default\n",
+                        __FUNCTION__));
+
+        }
+        iolen = wl_bssiovar_mkbuf("closednet",
+                bsscfg_index,  &ap->closednet, sizeof(ap->closednet)+4,
+                buf, sizeof(buf), &mkvar_err);
+        ASSERT(iolen);
+        if ((res = dev_wlc_ioctl(dev, WLC_SET_VAR, buf, iolen)) < 0) {
+                WL_ERROR(("%s failed to set 'closednet'for apsta \n", __FUNCTION__));
+                goto fail;
+        }
+
+        
+        if ((ap->channel == 0) && (get_softap_auto_channel(dev, ap) < 0)) {
+                ap->channel = 1;
+                WL_ERROR(("%s auto channel failed, use channel=%d\n",
+                          __FUNCTION__, ap->channel));
+        }
+
+        channel = ap->channel;
+        if ((res = dev_wlc_ioctl(dev, WLC_SET_CHANNEL, &channel, sizeof(channel)))) {
+                WL_ERROR(("%s fail to set channel\n", __FUNCTION__));
+        }
+
+
+        if (ap_cfg_running == FALSE) {
+                updown = 0;
+                if ((res = dev_wlc_ioctl(dev, WLC_UP, &updown, sizeof(updown)))) {
+                        WL_ERROR(("%s fail to set up\n", __FUNCTION__));
+                        goto fail;
+                }
+        }
+
+        max_assoc = ap->max_scb;
+        if ((res = dev_wlc_intvar_set(dev, "maxassoc", max_assoc))) {
+                WL_ERROR(("%s fail to set maxassoc\n", __FUNCTION__));
+                goto fail;
+        }
+
+        ap_ssid.SSID_len = strlen(ap->ssid);
+        strncpy(ap_ssid.SSID, ap->ssid, ap_ssid.SSID_len);
+
+        
+#ifdef AP_ONLY
+        if ((res = wl_iw_set_ap_security(dev, &my_ap)) != 0) {
+                WL_ERROR(("ERROR:%d in:%s, wl_iw_set_ap_security is skipped\n",
+                          res, __FUNCTION__));
+                goto fail;
+        }
+        wl_iw_send_priv_event(dev, "ASCII_CMD=AP_BSS_START");
+        ap_cfg_running = TRUE;
+#else
+
+        iolen = wl_bssiovar_mkbuf("ssid", bsscfg_index, (char *)(&ap_ssid),
+                ap_ssid.SSID_len+4, buf, sizeof(buf), &mkvar_err);
+        ASSERT(iolen);
+        if ((res = dev_wlc_ioctl(dev, WLC_SET_VAR, buf, iolen)) != 0) {
+                WL_ERROR(("ERROR:%d in:%s, Security & BSS reconfiguration is skipped\n",
+                          res, __FUNCTION__));
+                goto fail;
+        }
+        if (ap_cfg_running == FALSE) {
+                
+                PROC_START(thr_wait_for_2nd_eth_dev, dev, &ap_eth_ctl, 0);
+        } else {
+                ap_eth_ctl.thr_pid = -1;
+                
+                if (ap_net_dev == NULL) {
+                        WL_ERROR(("%s ERROR: ap_net_dev is NULL !!!\n", __FUNCTION__));
+                        goto fail;
+                }
+
+                WL_ERROR(("%s: %s Configure security & restart AP bss \n",
+                          __FUNCTION__, ap_net_dev->name));
+
+                
+                if ((res = wl_iw_set_ap_security(ap_net_dev, &my_ap)) < 0) {
+                        WL_ERROR(("%s fail to set security : %d\n", __FUNCTION__, res));
+                        goto fail;
+                }
+
+                
+                if ((res = dev_iw_write_cfg1_bss_var(dev, 1)) < 0) {
+                        WL_ERROR(("%s fail to set bss up\n", __FUNCTION__));
+                        goto fail;
+                }
+        }
+#endif 
+fail:
+        WL_SOFTAP(("%s exit with %d\n", __FUNCTION__, res));
+
+        DHD_OS_MUTEX_UNLOCK(&wl_softap_lock);
+        net_os_wake_unlock(dev);
+
+        return res;
+}
+#endif 
+
+
+
+static int
+wl_iw_set_ap_security(struct net_device *dev, struct ap_profile *ap)
+{
+        int wsec = 0;
+        int wpa_auth = 0;
+        int res = 0;
+        int i;
+        char *ptr;
+#ifdef AP_ONLY
+        int mpc = 0;
+        wlc_ssid_t ap_ssid;
+#endif
+        wl_wsec_key_t key;
+
+        WL_SOFTAP(("\nsetting SOFTAP security mode:\n"));
+        WL_SOFTAP(("wl_iw: set ap profile:\n"));
+        WL_SOFTAP(("    ssid = '%s'\n", ap->ssid));
+        WL_SOFTAP(("    security = '%s'\n", ap->sec));
+        if (ap->key[0] != '\0')
+                WL_SOFTAP(("    key = '%s'\n", ap->key));
+        WL_SOFTAP(("    channel = %d\n", ap->channel));
+        WL_SOFTAP(("    max scb = %d\n", ap->max_scb));
+
+
+        if (strnicmp(ap->sec, "open", strlen("open")) == 0) {
+
+           
+                wsec = 0;
+                res = dev_wlc_intvar_set(dev, "wsec", wsec);
+                wpa_auth = WPA_AUTH_DISABLED;
+                res |= dev_wlc_intvar_set(dev, "wpa_auth", wpa_auth);
+
+                WL_SOFTAP(("=====================\n"));
+                WL_SOFTAP((" wsec & wpa_auth set 'OPEN', result:&d %d\n", res));
+                WL_SOFTAP(("=====================\n"));
+
+        } else if (strnicmp(ap->sec, "wep", strlen("wep")) == 0) {
+
+           
+                memset(&key, 0, sizeof(key));
+
+                wsec = WEP_ENABLED;
+                res = dev_wlc_intvar_set(dev, "wsec", wsec);
+
+                key.index = 0;
+                if (wl_iw_parse_wep(ap->key, &key)) {
+                        WL_SOFTAP(("wep key parse err!\n"));
+                        return -1;
+                }
+
+                key.index = htod32(key.index);
+                key.len = htod32(key.len);
+                key.algo = htod32(key.algo);
+                key.flags = htod32(key.flags);
+
+                res |= dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key));
+
+                wpa_auth = WPA_AUTH_DISABLED;
+                res |= dev_wlc_intvar_set(dev, "wpa_auth", wpa_auth);
+
+                WL_SOFTAP(("=====================\n"));
+                WL_SOFTAP((" wsec & auth set 'WEP', result:&d %d\n", res));
+                WL_SOFTAP(("=====================\n"));
+
+        } else if (strnicmp(ap->sec, "wpa2-psk", strlen("wpa2-psk")) == 0) {
+
+           
+
+                wsec_pmk_t psk;
+                size_t key_len;
+
+                wsec = AES_ENABLED;
+                dev_wlc_intvar_set(dev, "wsec", wsec);
+
+                key_len = strlen(ap->key);
+                if (key_len < WSEC_MIN_PSK_LEN || key_len > WSEC_MAX_PSK_LEN) {
+                        WL_SOFTAP(("passphrase must be between %d and %d characters long\n",
+                        WSEC_MIN_PSK_LEN, WSEC_MAX_PSK_LEN));
+                        return -1;
+                }
+
+                
+                if (key_len < WSEC_MAX_PSK_LEN) {
+                        unsigned char output[2*SHA1HashSize];
+                        char key_str_buf[WSEC_MAX_PSK_LEN+1];
+
+                        
+                        memset(output, 0, sizeof(output));
+                        pbkdf2_sha1(ap->key, ap->ssid, strlen(ap->ssid), 4096, output, 32);
+                        
+                        ptr = key_str_buf;
+                        for (i = 0; i < (WSEC_MAX_PSK_LEN/8); i++) {
+                                
+                                sprintf(ptr, "%02x%02x%02x%02x", (uint)output[i*4],
+                                        (uint)output[i*4+1], (uint)output[i*4+2],
+                                        (uint)output[i*4+3]);
+                                ptr += 8;
+                        }
+                        WL_SOFTAP(("%s: passphase = %s\n", __FUNCTION__, key_str_buf));
+
+                        psk.key_len = htod16((ushort)WSEC_MAX_PSK_LEN);
+                        memcpy(psk.key, key_str_buf, psk.key_len);
+                } else {
+                        psk.key_len = htod16((ushort) key_len);
+                        memcpy(psk.key, ap->key, key_len);
+                }
+                psk.flags = htod16(WSEC_PASSPHRASE);
+                dev_wlc_ioctl(dev, WLC_SET_WSEC_PMK, &psk, sizeof(psk));
+
+                wpa_auth = WPA2_AUTH_PSK;
+                dev_wlc_intvar_set(dev, "wpa_auth", wpa_auth);
+
+        } else if (strnicmp(ap->sec, "wpa-psk", strlen("wpa-psk")) == 0) {
+
+                
+                wsec_pmk_t psk;
+                size_t key_len;
+
+                wsec = TKIP_ENABLED;
+                res = dev_wlc_intvar_set(dev, "wsec", wsec);
+
+                key_len = strlen(ap->key);
+                if (key_len < WSEC_MIN_PSK_LEN || key_len > WSEC_MAX_PSK_LEN) {
+                        WL_SOFTAP(("passphrase must be between %d and %d characters long\n",
+                        WSEC_MIN_PSK_LEN, WSEC_MAX_PSK_LEN));
+                        return -1;
+                }
+
+                
+                if (key_len < WSEC_MAX_PSK_LEN) {
+                        unsigned char output[2*SHA1HashSize];
+                        char key_str_buf[WSEC_MAX_PSK_LEN+1];
+                        bzero(output, 2*SHA1HashSize);
+
+                        WL_SOFTAP(("%s: do passhash...\n", __FUNCTION__));
+                        
+                        pbkdf2_sha1(ap->key, ap->ssid, strlen(ap->ssid), 4096, output, 32);
+                        
+                        ptr = key_str_buf;
+                        for (i = 0; i < (WSEC_MAX_PSK_LEN/8); i++) {
+                                WL_SOFTAP(("[%02d]: %08x\n", i, *((unsigned int*)&output[i*4])));
+                                
+                                sprintf(ptr, "%02x%02x%02x%02x", (uint)output[i*4],
+                                        (uint)output[i*4+1], (uint)output[i*4+2],
+                                        (uint)output[i*4+3]);
+                                ptr += 8;
+                        }
+                        printk("%s: passphase = %s\n", __FUNCTION__, key_str_buf);
+
+                        psk.key_len = htod16((ushort)WSEC_MAX_PSK_LEN);
+                        memcpy(psk.key, key_str_buf, psk.key_len);
+                } else {
+                        psk.key_len = htod16((ushort) key_len);
+                        memcpy(psk.key, ap->key, key_len);
+                }
+
+                psk.flags = htod16(WSEC_PASSPHRASE);
+                res |= dev_wlc_ioctl(dev, WLC_SET_WSEC_PMK, &psk, sizeof(psk));
+
+                wpa_auth = WPA_AUTH_PSK;
+                res |= dev_wlc_intvar_set(dev, "wpa_auth", wpa_auth);
+
+                WL_SOFTAP((" wsec & auth set 'wpa-psk' (TKIP), result:&d %d\n", res));
+        }
+
+#ifdef AP_ONLY
+                ap_ssid.SSID_len = strlen(ap->ssid);
+                strncpy(ap_ssid.SSID, ap->ssid, ap_ssid.SSID_len);
+                res |= dev_wlc_ioctl(dev, WLC_SET_SSID, &ap_ssid, sizeof(ap_ssid));
+                mpc = 0;
+                res |= dev_wlc_intvar_set(dev, "mpc", mpc);
+                if (strnicmp(ap->sec, "wep", strlen("wep")) == 0) {
+                        res |= dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key));
+                }
+#endif
+        return res;
+}
+
+
+
+static int
+get_parameter_from_string(
+                        char **str_ptr, const char *token,
+                        int param_type, void  *dst, int param_max_len)
+{
+        char int_str[7] = "0";
+        int parm_str_len;
+        char  *param_str_begin;
+        char  *param_str_end;
+        char  *orig_str = *str_ptr;
+
+        if ((*str_ptr) && !strncmp(*str_ptr, token, strlen(token))) {
+
+                strsep(str_ptr, "=,"); 
+                param_str_begin = *str_ptr;
+                strsep(str_ptr, "=,"); 
+
+                if (*str_ptr == NULL) {
+                        
+                        parm_str_len = strlen(param_str_begin);
+                } else {
+                        param_str_end = *str_ptr-1;  
+                        parm_str_len = param_str_end - param_str_begin;
+                }
+
+                WL_TRACE((" 'token:%s', len:%d, ", token, parm_str_len));
+
+                if (parm_str_len > param_max_len) {
+                        WL_ERROR((" WARNING: extracted param len:%d is > MAX:%d\n",
+                                parm_str_len, param_max_len));
+
+                        parm_str_len = param_max_len;
+                }
+
+                switch (param_type) {
+
+                        case PTYPE_INTDEC: {
+                        
+                                int *pdst_int = dst;
+                                char *eptr;
+
+                                if (parm_str_len > sizeof(int_str))
+                                         parm_str_len = sizeof(int_str);
+
+                                memcpy(int_str, param_str_begin, parm_str_len);
+
+                                *pdst_int = simple_strtoul(int_str, &eptr, 10);
+
+                                WL_TRACE((" written as integer:%d\n",  *pdst_int));
+                        }
+                        break;
+                        case PTYPE_STR_HEX: {
+                                u8 *buf = dst;
+                                
+                                param_max_len = param_max_len >> 1;  
+                                hstr_2_buf(param_str_begin, buf, param_max_len);
+                                dhd_print_buf(buf, param_max_len, 0);
+                        }
+                        break;
+                        default:
+                                
+                                memcpy(dst, param_str_begin, parm_str_len);
+                                *((char *)dst + parm_str_len) = 0; 
+                                WL_ERROR((" written as a string:%s\n", (char *)dst));
+                        break;
+
+                }
+
+                return 0;
+        } else {
+                WL_ERROR(("\n %s: ERROR: can't find token:%s in str:%s \n",
+                        __FUNCTION__, token, orig_str));
+
+         return -1;
+        }
+}
+
+static int wl_iw_softap_deassoc_stations(struct net_device *dev, u8 *mac)
+{
+        int i;
+        int res = 0;
+        char mac_buf[128] = {0};
+        char z_mac[6] = {0, 0, 0, 0, 0, 0};
+        char *sta_mac;
+        struct maclist *assoc_maclist = (struct maclist *) mac_buf;
+        bool deauth_all = FALSE;
+
+        
+        if (mac == NULL) {
+                deauth_all = TRUE;
+                sta_mac = z_mac;  
+        } else {
+                sta_mac = mac;  
+        }
+
+        memset(assoc_maclist, 0, sizeof(mac_buf));
+        assoc_maclist->count = 8; 
+
+        res = dev_wlc_ioctl(dev, WLC_GET_ASSOCLIST, assoc_maclist, 128);
+        if (res != 0) {
+                WL_SOFTAP(("%s: Error:%d Couldn't get ASSOC List\n", __FUNCTION__, res));
+                return res;
+        }
+
+        if (assoc_maclist->count)
+                for (i = 0; i < assoc_maclist->count; i++) {
+                scb_val_t scbval;
+                scbval.val = htod32(1);
+                
+                bcopy(&assoc_maclist->ea[i], &scbval.ea, ETHER_ADDR_LEN);
+
+                if (deauth_all || (memcmp(&scbval.ea, sta_mac, ETHER_ADDR_LEN) == 0))  {
+                        
+                        WL_SOFTAP(("%s, deauth STA:%d \n", __FUNCTION__, i));
+                        res |= dev_wlc_ioctl(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON,
+                                &scbval, sizeof(scb_val_t));
+                }
+        } else WL_SOFTAP(("%s: No Stations \n", __FUNCTION__));
+
+        if (res != 0) {
+                WL_ERROR(("%s: Error:%d\n", __FUNCTION__, res));
+        } else if (assoc_maclist->count) {
+                
+                bcm_mdelay(200);
+        }
+        return res;
+}
+
+
+
+static int
+iwpriv_softap_stop(struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *ext)
+{
+        int res = 0;
+
+        WL_SOFTAP(("got iwpriv AP_BSS_STOP \n"));
+
+        if ((!dev) && (!ap_net_dev)) {
+                WL_ERROR(("%s: dev is null\n", __FUNCTION__));
+                return res;
+        }
+
+        net_os_wake_lock(dev);
+        DHD_OS_MUTEX_LOCK(&wl_softap_lock);
+
+        if  ((ap_cfg_running == TRUE)) {
+#ifdef AP_ONLY
+                 wl_iw_softap_deassoc_stations(dev, NULL);
+#else
+                 wl_iw_softap_deassoc_stations(ap_net_dev, NULL);
+                if ((res = dev_iw_write_cfg1_bss_var(dev, 2)) < 0)
+                        WL_ERROR(("%s failed to del BSS err = %d", __FUNCTION__, res));
+#endif
+
+                
+                bcm_mdelay(100);
+
+                wrqu->data.length = 0;
+                ap_cfg_running = FALSE;
+        } else
+                WL_ERROR(("%s: was called when SoftAP is OFF : move on\n", __FUNCTION__));
+
+        WL_SOFTAP(("%s Done with %d\n", __FUNCTION__, res));
+        DHD_OS_MUTEX_UNLOCK(&wl_softap_lock);
+        net_os_wake_unlock(dev);
+
+        return res;
+}
+
+
+
+static int
+iwpriv_fw_reload(struct net_device *dev,
+        struct iw_request_info *info,
+        union iwreq_data *wrqu,
+        char *ext)
+{
+        int ret = -1;
+        char extra[256];
+        char *fwstr = fw_path ; 
+
+        WL_SOFTAP(("current firmware_path[]=%s\n", fwstr));
+
+        WL_TRACE((">Got FW_RELOAD cmd:"
+                  "info->cmd:%x, info->flags:%x, u.data:%p, u.len:%d, "
+                  "fw_path:%p, len:%d \n",
+                  info->cmd, info->flags,
+                  wrqu->data.pointer, wrqu->data.length, fwstr, strlen(fwstr)));
+
+        if ((wrqu->data.length > 4) && (wrqu->data.length < sizeof(extra))) {
+                char *str_ptr;
+
+                if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) {
+                        ret = -EFAULT;
+                        goto exit_proc;
+                }
+
+                
+                extra[wrqu->data.length] = 8;
+                str_ptr = extra;
+
+                if (get_parameter_from_string(&str_ptr,
+                                              "FW_PATH=", PTYPE_STRING, fwstr, 255) != 0) {
+                        WL_ERROR(("Error: extracting FW_PATH='' string\n"));
+                        goto exit_proc;
+                }
+
+                if  (strstr(fwstr, "apsta") != NULL) {
+                          WL_SOFTAP(("GOT APSTA FIRMWARE\n"));
+                          ap_fw_loaded = TRUE;
+                } else {
+                        WL_SOFTAP(("GOT STA FIRMWARE\n"));
+                        ap_fw_loaded = FALSE;
+                }
+
+                WL_SOFTAP(("SET firmware_path[]=%s , str_p:%p\n", fwstr, fwstr));
+                ret = 0;
+        } else {
+                WL_ERROR(("Error: ivalid param len:%d\n", wrqu->data.length));
+        }
+
+exit_proc:
+        return ret;
+}
+
+#ifdef SOFTAP
+
+static int
+iwpriv_wpasupp_loop_tst(struct net_device *dev,
+            struct iw_request_info *info,
+            union iwreq_data *wrqu,
+            char *ext)
+{
+        int res = 0;
+        char *params = NULL;
+
+        WL_TRACE((">Got IWPRIV  wp_supp loopback cmd test:"
+                  "info->cmd:%x, info->flags:%x, u.data:%p, u.len:%d\n",
+                  info->cmd, info->flags,
+                  wrqu->data.pointer, wrqu->data.length));
+
+        if (wrqu->data.length != 0) {
+
+                if (!(params = kmalloc(wrqu->data.length+1, GFP_KERNEL)))
+                        return -ENOMEM;
+
+
+                if (copy_from_user(params, wrqu->data.pointer, wrqu->data.length)) {
+                        kfree(params);
+                        return -EFAULT;
+                }
+
+                params[wrqu->data.length] = 0;
+                WL_SOFTAP(("\n>> copied from user:\n %s\n", params));
+        } else {
+                WL_ERROR(("ERROR param length is 0\n"));
+                return -EFAULT;
+        }
+
+        
+        res = wl_iw_send_priv_event(dev, params);
+        kfree(params);
+
+        return res;
+}
+#endif 
+
+
+static int
+iwpriv_en_ap_bss(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        void *wrqu,
+        char *extra)
+{
+        int res = 0;
+
+        if (!dev) {
+                WL_ERROR(("%s: dev is null\n", __FUNCTION__));
+                return -1;
+        }
+
+        net_os_wake_lock(dev);
+        DHD_OS_MUTEX_LOCK(&wl_softap_lock);
+
+        WL_TRACE(("%s: rcvd IWPRIV IOCTL:  for dev:%s\n", __FUNCTION__, dev->name));
+
+        
+#ifndef AP_ONLY
+        if ((res = wl_iw_set_ap_security(dev, &my_ap)) != 0) {
+                WL_ERROR((" %s ERROR setting SOFTAP security in :%d\n", __FUNCTION__, res));
+        }
+        else {
+                
+                if ((res = dev_iw_write_cfg1_bss_var(dev, 1)) < 0)
+                        WL_ERROR(("%s fail to set bss up err=%d\n", __FUNCTION__, res));
+                else
+                        
+                        bcm_mdelay(100);
+        }
+
+#endif 
+        WL_SOFTAP(("%s done with res %d \n", __FUNCTION__, res));
+
+        DHD_OS_MUTEX_UNLOCK(&wl_softap_lock);
+        net_os_wake_unlock(dev);
+
+        return res;
+}
+
+static int
+get_assoc_sta_list(struct net_device *dev, char *buf, int len)
+{
+        
+        WL_TRACE(("%s: dev_wlc_ioctl(dev:%p, cmd:%d, buf:%p, len:%d)\n",
+                __FUNCTION__, dev, WLC_GET_ASSOCLIST, buf, len));
+
+        return dev_wlc_ioctl(dev, WLC_GET_ASSOCLIST, buf, len);
+
+}
+
+
+void check_error(int res, const char *msg, const char *func, int line)
+{
+        if (res != 0)
+                WL_ERROR(("%s, %d function:%s, line:%d\n", msg, res, func, line));
+}
+
+static int
+set_ap_mac_list(struct net_device *dev, void *buf)
+{
+        struct mac_list_set *mac_list_set = (struct mac_list_set *)buf;
+        struct maclist *maclist = (struct maclist *)&mac_list_set->mac_list;
+        int length;
+        int i;
+        int mac_mode = mac_list_set->mode;
+        int ioc_res = 0;
+        ap_macmode = mac_list_set->mode;  
+
+        
+        bzero(&ap_black_list, sizeof(struct mflist));
+
+        if (mac_mode == MACLIST_MODE_DISABLED) {
+                
+                ioc_res = dev_wlc_ioctl(dev, WLC_SET_MACMODE, &mac_mode, sizeof(mac_mode));
+                check_error(ioc_res, "ioctl ERROR:", __FUNCTION__, __LINE__);
+                WL_SOFTAP(("%s: MAC filtering disabled\n", __FUNCTION__));
+        } else {
+                
+                scb_val_t scbval;
+                char mac_buf[256] = {0};
+                struct maclist *assoc_maclist = (struct maclist *) mac_buf;
+
+                
+                bcopy(maclist, &ap_black_list, sizeof(ap_black_list));
+
+                
+                ioc_res = dev_wlc_ioctl(dev, WLC_SET_MACMODE, &mac_mode, sizeof(mac_mode));
+                check_error(ioc_res, "ioctl ERROR:", __FUNCTION__, __LINE__);
+
+                
+                length = sizeof(maclist->count) + maclist->count*ETHER_ADDR_LEN;
+                dev_wlc_ioctl(dev, WLC_SET_MACLIST, maclist, length);
+
+                WL_SOFTAP(("%s: applied MAC List, mode:%d, length %d:\n",
+                        __FUNCTION__, mac_mode, length));
+
+                for (i = 0; i < maclist->count; i++)
+                        WL_SOFTAP(("mac %d: %02X:%02X:%02X:%02X:%02X:%02X\n",
+                                i, maclist->ea[i].octet[0], maclist->ea[i].octet[1],
+                                maclist->ea[i].octet[2],
+                                maclist->ea[i].octet[3], maclist->ea[i].octet[4],
+                                maclist->ea[i].octet[5]));
+
+                
+                assoc_maclist->count = 8;
+                ioc_res = dev_wlc_ioctl(dev, WLC_GET_ASSOCLIST, assoc_maclist, 256);
+                check_error(ioc_res, "ioctl ERROR:", __FUNCTION__, __LINE__);
+                WL_SOFTAP((" Cur assoc clients:%d\n", assoc_maclist->count));
+
+                
+                if (assoc_maclist->count)
+                        for (i = 0; i < assoc_maclist->count; i++) {
+                                int j;
+                                bool assoc_mac_matched = FALSE;
+                                
+                                WL_SOFTAP(("\n Cheking assoc STA: "));
+                                dhd_print_buf(&assoc_maclist->ea[i], 6, 7);
+                                WL_SOFTAP(("with the b/w list:"));
+
+                                for (j = 0; j < maclist->count; j++)
+                                        if (!bcmp(&assoc_maclist->ea[i], &maclist->ea[j],
+                                                ETHER_ADDR_LEN)) {
+                                                
+                                                assoc_mac_matched = TRUE;
+                                                break;
+                                        }
+
+                                
+                                if (((mac_mode == MACLIST_MODE_ALLOW) && !assoc_mac_matched) ||
+                                        ((mac_mode == MACLIST_MODE_DENY) && assoc_mac_matched)) {
+
+                                        WL_SOFTAP(("b-match or w-mismatch,"
+                                                                " do deauth/disassoc \n"));
+                                                        scbval.val = htod32(1);
+                                                        bcopy(&assoc_maclist->ea[i], &scbval.ea,
+                                                        ETHER_ADDR_LEN);
+                                                        ioc_res = dev_wlc_ioctl(dev,
+                                                                WLC_SCB_DEAUTHENTICATE_FOR_REASON,
+                                                                &scbval, sizeof(scb_val_t));
+                                                        check_error(ioc_res,
+                                                                "ioctl ERROR:",
+                                                                __FUNCTION__, __LINE__);
+
+                                } else {
+                                        WL_SOFTAP((" no b/w list hits, let it be\n"));
+                                }
+                } else {
+                        WL_SOFTAP(("No ASSOC CLIENTS\n"));
+                } 
+
+        } 
+
+        WL_SOFTAP(("%s iocres:%d\n", __FUNCTION__, ioc_res));
+        return ioc_res;
+}
+#endif 
+
+
+
+#ifdef SOFTAP
+#define PARAM_OFFSET PROFILE_OFFSET
+
+static int
+wl_iw_process_private_ascii_cmd(
+                        struct net_device *dev,
+                        struct iw_request_info *info,
+                        union iwreq_data *dwrq,
+                        char *cmd_str)
+{
+        int ret = 0;
+        char *sub_cmd = cmd_str + PROFILE_OFFSET + strlen("ASCII_CMD=");
+
+        WL_SOFTAP(("\n %s: ASCII_CMD: offs_0:%s, offset_32:\n'%s'\n",
+                __FUNCTION__, cmd_str, cmd_str + PROFILE_OFFSET));
+
+        if (strnicmp(sub_cmd, "AP_CFG", strlen("AP_CFG")) == 0) {
+
+                WL_SOFTAP((" AP_CFG \n"));
+
+                
+                if (init_ap_profile_from_string(cmd_str+PROFILE_OFFSET, &my_ap) != 0) {
+                                WL_ERROR(("ERROR: SoftAP CFG prams !\n"));
+                                ret = -1;
+                } else {
+                        ret = set_ap_cfg(dev, &my_ap);
+                }
+
+        } else if (strnicmp(sub_cmd, "AP_BSS_START", strlen("AP_BSS_START")) == 0) {
+
+                WL_SOFTAP(("\n SOFTAP - ENABLE BSS \n"));
+
+                
+                WL_SOFTAP(("\n!!! got 'WL_AP_EN_BSS' from WPA supplicant, dev:%s\n", dev->name));
+
+#ifndef AP_ONLY
+                if (ap_net_dev == NULL) {
+                                 printf("\n ERROR: SOFTAP net_dev* is NULL !!!\n");
+                } else {
+                          
+                        if ((ret = iwpriv_en_ap_bss(ap_net_dev, info, dwrq, cmd_str)) < 0)
+                                WL_ERROR(("%s line %d fail to set bss up\n",
+                                        __FUNCTION__, __LINE__));
+                }
+#else
+                if ((ret = iwpriv_en_ap_bss(dev, info, dwrq, cmd_str)) < 0)
+                                WL_ERROR(("%s line %d fail to set bss up\n",
+                                        __FUNCTION__, __LINE__));
+#endif
+        } else if (strnicmp(sub_cmd, "ASSOC_LST", strlen("ASSOC_LST")) == 0) {
+
+                
+
+        } else if (strnicmp(sub_cmd, "AP_BSS_STOP", strlen("AP_BSS_STOP")) == 0) {
+
+                WL_SOFTAP((" \n temp DOWN SOFTAP\n"));
+#ifndef AP_ONLY
+                if ((ret = dev_iw_write_cfg1_bss_var(dev, 0)) < 0) {
+                                WL_ERROR(("%s line %d fail to set bss down\n",
+                                        __FUNCTION__, __LINE__));
+                }
+#endif
+        }
+
+        return ret;
+
+}
+#endif 
+
+
+static int
+wl_iw_set_priv(
+        struct net_device *dev,
+        struct iw_request_info *info,
+        struct iw_point *dwrq,
+        char *ext
+)
+{
+        int ret = 0;
+        char * extra;
+
+        if (!(extra = kmalloc(dwrq->length, GFP_KERNEL)))
+            return -ENOMEM;
+
+        if (copy_from_user(extra, dwrq->pointer, dwrq->length)) {
+            kfree(extra);
+            return -EFAULT;
+        }
+
+        WL_TRACE(("%s: SIOCSIWPRIV request %s, info->cmd:%x, info->flags:%d\n dwrq->length:%d\n",
+                dev->name, extra, info->cmd, info->flags, dwrq->length));
+
+        
+
+        net_os_wake_lock(dev);
+
+        if (dwrq->length && extra) {
+                if (strnicmp(extra, "START", strlen("START")) == 0) {
+                        wl_iw_control_wl_on(dev, info);
+                        WL_TRACE(("%s, Received regular START command\n", __FUNCTION__));
+                }
+
+                if (g_onoff == G_WLAN_SET_OFF) {
+                        WL_TRACE(("%s, missing START, Fail\n", __FUNCTION__));
+                        kfree(extra);
+                        net_os_wake_unlock(dev);
+                        return -EFAULT;
+                }
+
+                if (strnicmp(extra, "SCAN-ACTIVE", strlen("SCAN-ACTIVE")) == 0) {
+#ifdef ENABLE_ACTIVE_PASSIVE_SCAN_SUPPRESS
+                        WL_TRACE(("%s: active scan setting suppressed\n", dev->name));
+#else
+                        ret = wl_iw_set_active_scan(dev, info, (union iwreq_data *)dwrq, extra);
+#endif 
+                }
+                else if (strnicmp(extra, "SCAN-PASSIVE", strlen("SCAN-PASSIVE")) == 0)
+#ifdef ENABLE_ACTIVE_PASSIVE_SCAN_SUPPRESS
+                        WL_TRACE(("%s: passive scan setting suppressed\n", dev->name));
+#else
+                        ret = wl_iw_set_passive_scan(dev, info, (union iwreq_data *)dwrq, extra);
+#endif 
+                else if (strnicmp(extra, "RSSI", strlen("RSSI")) == 0)
+                        ret = wl_iw_get_rssi(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, "LINKSPEED", strlen("LINKSPEED")) == 0)
+                        ret = wl_iw_get_link_speed(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, "MACADDR", strlen("MACADDR")) == 0)
+                        ret = wl_iw_get_macaddr(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, "COUNTRY", strlen("COUNTRY")) == 0)
+                        ret = wl_iw_set_country(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, "STOP", strlen("STOP")) == 0)
+                        ret = wl_iw_control_wl_off(dev, info);
+                else if (strnicmp(extra, BAND_GET_CMD, strlen(BAND_GET_CMD)) == 0)
+                        ret = wl_iw_get_band(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, BAND_SET_CMD, strlen(BAND_SET_CMD)) == 0)
+                        ret = wl_iw_set_band(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, DTIM_SKIP_GET_CMD, strlen(DTIM_SKIP_GET_CMD)) == 0)
+                        ret = wl_iw_get_dtim_skip(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, DTIM_SKIP_SET_CMD, strlen(DTIM_SKIP_SET_CMD)) == 0)
+                        ret = wl_iw_set_dtim_skip(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, SETSUSPEND_CMD, strlen(SETSUSPEND_CMD)) == 0)
+                        ret = wl_iw_set_suspend(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, TXPOWER_SET_CMD, strlen(TXPOWER_SET_CMD)) == 0)
+                        ret = wl_iw_set_txpower(dev, info, (union iwreq_data *)dwrq, extra);
+#if defined(PNO_SUPPORT)
+                else if (strnicmp(extra, PNOSSIDCLR_SET_CMD, strlen(PNOSSIDCLR_SET_CMD)) == 0)
+                        ret = wl_iw_set_pno_reset(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, PNOSETUP_SET_CMD, strlen(PNOSETUP_SET_CMD)) == 0)
+                        ret = wl_iw_set_pno_set(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, PNOENABLE_SET_CMD, strlen(PNOENABLE_SET_CMD)) == 0)
+                        ret = wl_iw_set_pno_enable(dev, info, (union iwreq_data *)dwrq, extra);
+#endif 
+#if defined(CSCAN)
+            
+                else if (strnicmp(extra, CSCAN_COMMAND, strlen(CSCAN_COMMAND)) == 0)
+                        ret = wl_iw_set_cscan(dev, info, (union iwreq_data *)dwrq, extra);
+#endif 
+#ifdef CONFIG_WPS2
+                else if (strnicmp(extra, WPS_ADD_PROBE_REQ_IE_CMD,
+                        strlen(WPS_ADD_PROBE_REQ_IE_CMD)) == 0)
+                        ret = wl_iw_add_wps_probe_req_ie(dev, info,
+                                (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, WPS_DEL_PROBE_REQ_IE_CMD,
+                        strlen(WPS_DEL_PROBE_REQ_IE_CMD)) == 0)
+                        ret = wl_iw_del_wps_probe_req_ie(dev, info,
+                                (union iwreq_data *)dwrq, extra);
+#endif 
+                else if (strnicmp(extra, "POWERMODE", strlen("POWERMODE")) == 0)
+                        ret = wl_iw_set_power_mode(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, "BTCOEXMODE", strlen("BTCOEXMODE")) == 0)
+                        ret = wl_iw_set_btcoex_dhcp(dev, info, (union iwreq_data *)dwrq, extra);
+                else if (strnicmp(extra, "GETPOWER", strlen("GETPOWER")) == 0)
+                        ret = wl_iw_get_power_mode(dev, info, (union iwreq_data *)dwrq, extra);
+#ifdef SOFTAP
+                else if (strnicmp(extra, "ASCII_CMD", strlen("ASCII_CMD")) == 0) {
+                        wl_iw_process_private_ascii_cmd(dev, info, (union iwreq_data *)dwrq, extra);
+                }
+                else if (strnicmp(extra, "AP_MAC_LIST_SET", strlen("AP_MAC_LIST_SET")) == 0) {
+                        WL_SOFTAP(("penguin, set AP_MAC_LIST_SET\n"));
+                        set_ap_mac_list(dev, (extra + PROFILE_OFFSET));
+                }
+#endif
+            else {
+                        WL_ERROR(("Unknown PRIVATE command %s - ignored\n", extra));
+                        snprintf(extra, MAX_WX_STRING, "OK");
+                        dwrq->length = strlen("OK") + 1;
+                }
+        }
+
+        net_os_wake_unlock(dev);
+
+        if (extra) {
+            if (copy_to_user(dwrq->pointer, extra, dwrq->length)) {
+                        kfree(extra);
+                        return -EFAULT;
+            }
+
+            kfree(extra);
+        }
+
+        return ret;
+}
+
+static const iw_handler wl_iw_handler[] =
+{
+        (iw_handler) wl_iw_config_commit,       
+        (iw_handler) wl_iw_get_name,            
+        (iw_handler) NULL,                      
+        (iw_handler) NULL,                      
+        (iw_handler) wl_iw_set_freq,            
+        (iw_handler) wl_iw_get_freq,            
+        (iw_handler) wl_iw_set_mode,            
+        (iw_handler) wl_iw_get_mode,            
+        (iw_handler) NULL,                      
+        (iw_handler) NULL,                      
+        (iw_handler) NULL,                      
+        (iw_handler) wl_iw_get_range,           
+        (iw_handler) wl_iw_set_priv,            
+        (iw_handler) NULL,                      
+        (iw_handler) NULL,                      
+        (iw_handler) NULL,                      
+        (iw_handler) wl_iw_set_spy,             
+        (iw_handler) wl_iw_get_spy,             
+        (iw_handler) NULL,                      
+        (iw_handler) NULL,                      
+        (iw_handler) wl_iw_set_wap,             
+        (iw_handler) wl_iw_get_wap,             
+#if WIRELESS_EXT > 17
+        (iw_handler) wl_iw_mlme,                
+#else
+        (iw_handler) NULL,                      
+#endif
+#if defined(WL_IW_USE_ISCAN)
+        (iw_handler) wl_iw_iscan_get_aplist,    
+#else
+        (iw_handler) wl_iw_get_aplist,          
+#endif 
+#if WIRELESS_EXT > 13
+#if defined(WL_IW_USE_ISCAN)
+        (iw_handler) wl_iw_iscan_set_scan,      
+        (iw_handler) wl_iw_iscan_get_scan,      
+#else
+        (iw_handler) wl_iw_set_scan,            
+        (iw_handler) wl_iw_get_scan,            
+#endif
+#else   
+        (iw_handler) NULL,                      
+        (iw_handler) NULL,                      
+#endif  
+        (iw_handler) wl_iw_set_essid,           
+        (iw_handler) wl_iw_get_essid,           
+        (iw_handler) wl_iw_set_nick,            
+        (iw_handler) wl_iw_get_nick,            
+        (iw_handler) NULL,                      
+        (iw_handler) NULL,                      
+        (iw_handler) wl_iw_set_rate,            
+        (iw_handler) wl_iw_get_rate,            
+        (iw_handler) wl_iw_set_rts,             
+        (iw_handler) wl_iw_get_rts,             
+        (iw_handler) wl_iw_set_frag,            
+        (iw_handler) wl_iw_get_frag,            
+        (iw_handler) wl_iw_set_txpow,           
+        (iw_handler) wl_iw_get_txpow,           
+#if WIRELESS_EXT > 10
+        (iw_handler) wl_iw_set_retry,           
+        (iw_handler) wl_iw_get_retry,           
+#endif 
+        (iw_handler) wl_iw_set_encode,          
+        (iw_handler) wl_iw_get_encode,          
+        (iw_handler) wl_iw_set_power,           
+        (iw_handler) wl_iw_get_power,           
+#if WIRELESS_EXT > 17
+        (iw_handler) NULL,                      
+        (iw_handler) NULL,                      
+        (iw_handler) wl_iw_set_wpaie,           
+        (iw_handler) wl_iw_get_wpaie,           
+        (iw_handler) wl_iw_set_wpaauth,         
+        (iw_handler) wl_iw_get_wpaauth,         
+        (iw_handler) wl_iw_set_encodeext,       
+        (iw_handler) wl_iw_get_encodeext,       
+        (iw_handler) wl_iw_set_pmksa,                   
+#endif 
+};
+
+#if WIRELESS_EXT > 12
+static const iw_handler wl_iw_priv_handler[] = {
+        NULL,
+        (iw_handler)wl_iw_set_active_scan,
+        NULL,
+        (iw_handler)wl_iw_get_rssi,
+        NULL,
+        (iw_handler)wl_iw_set_passive_scan,
+        NULL,
+        (iw_handler)wl_iw_get_link_speed,
+        NULL,
+        (iw_handler)wl_iw_get_macaddr,
+        NULL,
+        (iw_handler)wl_iw_control_wl_off,
+        NULL,
+        (iw_handler)wl_iw_control_wl_on,
+#ifdef SOFTAP       
+
+        
+        NULL,
+        (iw_handler)iwpriv_set_ap_config,
+
+        
+        
+        NULL,
+        (iw_handler)iwpriv_get_assoc_list,
+
+        
+        NULL,
+        (iw_handler)iwpriv_set_mac_filters,
+
+        
+        NULL,
+        (iw_handler)iwpriv_en_ap_bss,
+
+        
+        NULL,
+        (iw_handler)iwpriv_wpasupp_loop_tst,
+        
+        NULL,
+        (iw_handler)iwpriv_softap_stop,
+        
+        NULL,
+        (iw_handler)iwpriv_fw_reload,
+        NULL, 
+        (iw_handler)iwpriv_set_ap_sta_disassoc,
+#endif 
+#if defined(CSCAN)
+        
+        NULL,
+        (iw_handler)iwpriv_set_cscan
+#endif  
+};
+
+static const struct iw_priv_args wl_iw_priv_args[] =
+{
+        {       
+                WL_IW_SET_ACTIVE_SCAN,
+                0,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
+                "SCAN-ACTIVE"
+        },
+        {
+                WL_IW_GET_RSSI,
+                0,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
+                "RSSI"
+        },
+        {
+                WL_IW_SET_PASSIVE_SCAN,
+                0,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
+                "SCAN-PASSIVE"
+        },
+        {
+                WL_IW_GET_LINK_SPEED,
+                0,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
+                "LINKSPEED"
+        },
+        {
+                WL_IW_GET_CURR_MACADDR,
+                0,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
+                "Macaddr"
+        },
+        {
+                WL_IW_SET_STOP,
+                0,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
+                "STOP"
+        },
+        {
+                WL_IW_SET_START,
+                0,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
+                "START"
+        },
+
+#ifdef SOFTAP
+        
+        
+        {
+                WL_SET_AP_CFG,
+                IW_PRIV_TYPE_CHAR |  256,      
+                0,
+                "AP_SET_CFG"
+        },
+
+        {
+                WL_AP_STA_LIST,
+                IW_PRIV_TYPE_CHAR | 0,  
+                IW_PRIV_TYPE_CHAR | 1024,  
+                "AP_GET_STA_LIST"
+        },
+
+        {
+                WL_AP_MAC_FLTR,
+                IW_PRIV_TYPE_CHAR | 256,                      
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 0,    
+                "AP_SET_MAC_FLTR"
+        },
+
+        { 
+                WL_AP_BSS_START,
+                0,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
+                "AP_BSS_START"
+        },
+
+        {
+                AP_LPB_CMD,
+                IW_PRIV_TYPE_CHAR | 256,   
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 0,    
+                "AP_LPB_CMD"
+        },
+
+        { 
+                WL_AP_STOP,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 0,   
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 0,   
+                "AP_BSS_STOP"
+        },
+        { 
+                WL_FW_RELOAD,
+                IW_PRIV_TYPE_CHAR | 256,
+                IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 0,
+                "WL_FW_RELOAD"
+        },
+#endif 
+#if defined(CSCAN)
+        { 
+                WL_COMBO_SCAN,
+                IW_PRIV_TYPE_CHAR | 1024,  
+                0,
+                "CSCAN"
+        },
+#endif 
+        };
+
+const struct iw_handler_def wl_iw_handler_def =
+{
+        .num_standard = ARRAYSIZE(wl_iw_handler),
+        .standard = (iw_handler *) wl_iw_handler,
+        .num_private = ARRAYSIZE(wl_iw_priv_handler),
+        .num_private_args = ARRAY_SIZE(wl_iw_priv_args),
+        .private = (iw_handler *)wl_iw_priv_handler,
+        .private_args = (void *) wl_iw_priv_args,
+
+#if WIRELESS_EXT >= 19
+        get_wireless_stats: dhd_get_wireless_stats,
+#endif 
+        };
+#endif 
+
+
+
+int
+wl_iw_ioctl(
+        struct net_device *dev,
+        struct ifreq *rq,
+        int cmd
+)
+{
+        struct iwreq *wrq = (struct iwreq *) rq;
+        struct iw_request_info info;
+        iw_handler handler;
+        char *extra = NULL;
+        size_t token_size = 1;
+        int max_tokens = 0, ret = 0;
+
+        net_os_wake_lock(dev);
+
+        WL_TRACE(("\n%s, cmd:%x called via dhd->do_ioctl()entry point\n", __FUNCTION__, cmd));
+        if (cmd < SIOCIWFIRST ||
+                IW_IOCTL_IDX(cmd) >= ARRAYSIZE(wl_iw_handler) ||
+                !(handler = wl_iw_handler[IW_IOCTL_IDX(cmd)])) {
+                        WL_ERROR(("%s: error in cmd=%x : not supported\n", __FUNCTION__, cmd));
+                        net_os_wake_unlock(dev);
+                        return -EOPNOTSUPP;
+        }
+
+        switch (cmd) {
+
+        case SIOCSIWESSID:
+        case SIOCGIWESSID:
+        case SIOCSIWNICKN:
+        case SIOCGIWNICKN:
+                max_tokens = IW_ESSID_MAX_SIZE + 1;
+                break;
+
+        case SIOCSIWENCODE:
+        case SIOCGIWENCODE:
+#if WIRELESS_EXT > 17
+        case SIOCSIWENCODEEXT:
+        case SIOCGIWENCODEEXT:
+#endif
+                max_tokens = wrq->u.data.length;
+                break;
+
+        case SIOCGIWRANGE:
+                
+                max_tokens = sizeof(struct iw_range) + 500;
+                break;
+
+        case SIOCGIWAPLIST:
+                token_size = sizeof(struct sockaddr) + sizeof(struct iw_quality);
+                max_tokens = IW_MAX_AP;
+                break;
+
+#if WIRELESS_EXT > 13
+        case SIOCGIWSCAN:
+#if defined(WL_IW_USE_ISCAN)
+        if (g_iscan)
+                max_tokens = wrq->u.data.length;
+        else
+#endif
+                max_tokens = IW_SCAN_MAX_DATA;
+                break;
+#endif 
+
+        case SIOCSIWSPY:
+                token_size = sizeof(struct sockaddr);
+                max_tokens = IW_MAX_SPY;
+                break;
+
+        case SIOCGIWSPY:
+                token_size = sizeof(struct sockaddr) + sizeof(struct iw_quality);
+                max_tokens = IW_MAX_SPY;
+                break;
+
+#if WIRELESS_EXT > 17
+        case SIOCSIWPMKSA:
+        case SIOCSIWGENIE:
+#endif 
+        case SIOCSIWPRIV:
+                max_tokens = wrq->u.data.length;
+                break;
+        }
+
+        if (max_tokens && wrq->u.data.pointer) {
+                if (wrq->u.data.length > max_tokens) {
+                        WL_ERROR(("%s: error in cmd=%x wrq->u.data.length=%d  > max_tokens=%d\n",
+                                __FUNCTION__, cmd, wrq->u.data.length, max_tokens));
+                        ret = -E2BIG;
+                        goto wl_iw_ioctl_done;
+                }
+                if (!(extra = kmalloc(max_tokens * token_size, GFP_KERNEL))) {
+                        ret = -ENOMEM;
+                        goto wl_iw_ioctl_done;
+                }
+
+                if (copy_from_user(extra, wrq->u.data.pointer, wrq->u.data.length * token_size)) {
+                        kfree(extra);
+                        ret = -EFAULT;
+                        goto wl_iw_ioctl_done;
+                }
+        }
+
+        info.cmd = cmd;
+        info.flags = 0;
+
+        ret = handler(dev, &info, &wrq->u, extra);
+
+        if (extra) {
+                if (copy_to_user(wrq->u.data.pointer, extra, wrq->u.data.length * token_size)) {
+                        kfree(extra);
+                        ret = -EFAULT;
+                        goto wl_iw_ioctl_done;
+                }
+
+                kfree(extra);
+        }
+
+wl_iw_ioctl_done:
+
+        net_os_wake_unlock(dev);
+
+        return ret;
+}
+
+
+static bool
+wl_iw_conn_status_str(uint32 event_type, uint32 status, uint32 reason,
+        char* stringBuf, uint buflen)
+{
+        typedef struct conn_fail_event_map_t {
+                uint32 inEvent;                 
+                uint32 inStatus;                
+                uint32 inReason;                
+                const char* outName;    
+                const char* outCause;   
+        } conn_fail_event_map_t;
+
+        
+#define WL_IW_DONT_CARE 9999
+        const conn_fail_event_map_t event_map [] = {
+                
+                
+                {WLC_E_SET_SSID,     WLC_E_STATUS_SUCCESS,   WL_IW_DONT_CARE,
+                "Conn", "Success"},
+                {WLC_E_SET_SSID,     WLC_E_STATUS_NO_NETWORKS, WL_IW_DONT_CARE,
+                "Conn", "NoNetworks"},
+                {WLC_E_SET_SSID,     WLC_E_STATUS_FAIL,      WL_IW_DONT_CARE,
+                "Conn", "ConfigMismatch"},
+                {WLC_E_PRUNE,        WL_IW_DONT_CARE,        WLC_E_PRUNE_ENCR_MISMATCH,
+                "Conn", "EncrypMismatch"},
+                {WLC_E_PRUNE,        WL_IW_DONT_CARE,        WLC_E_RSN_MISMATCH,
+                "Conn", "RsnMismatch"},
+                {WLC_E_AUTH,         WLC_E_STATUS_TIMEOUT,   WL_IW_DONT_CARE,
+                "Conn", "AuthTimeout"},
+                {WLC_E_AUTH,         WLC_E_STATUS_FAIL,      WL_IW_DONT_CARE,
+                "Conn", "AuthFail"},
+                {WLC_E_AUTH,         WLC_E_STATUS_NO_ACK,    WL_IW_DONT_CARE,
+                "Conn", "AuthNoAck"},
+                {WLC_E_REASSOC,      WLC_E_STATUS_FAIL,      WL_IW_DONT_CARE,
+                "Conn", "ReassocFail"},
+                {WLC_E_REASSOC,      WLC_E_STATUS_TIMEOUT,   WL_IW_DONT_CARE,
+                "Conn", "ReassocTimeout"},
+                {WLC_E_REASSOC,      WLC_E_STATUS_ABORT,     WL_IW_DONT_CARE,
+                "Conn", "ReassocAbort"},
+                {WLC_E_PSK_SUP,      WLC_SUP_KEYED,          WL_IW_DONT_CARE,
+                "Sup", "ConnSuccess"},
+                {WLC_E_PSK_SUP,      WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+                "Sup", "WpaHandshakeFail"},
+                {WLC_E_DEAUTH_IND,   WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+                "Conn", "Deauth"},
+                {WLC_E_DISASSOC_IND, WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+                "Conn", "DisassocInd"},
+                {WLC_E_DISASSOC,     WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+                "Conn", "Disassoc"}
+        };
+
+        const char* name = "";
+        const char* cause = NULL;
+        int i;
+
+        
+        for (i = 0;  i < sizeof(event_map)/sizeof(event_map[0]);  i++) {
+                const conn_fail_event_map_t* row = &event_map[i];
+                if (row->inEvent == event_type &&
+                    (row->inStatus == status || row->inStatus == WL_IW_DONT_CARE) &&
+                    (row->inReason == reason || row->inReason == WL_IW_DONT_CARE)) {
+                        name = row->outName;
+                        cause = row->outCause;
+                        break;
+                }
+        }
+
+        
+        if (cause) {
+                memset(stringBuf, 0, buflen);
+                snprintf(stringBuf, buflen, "%s %s %02d %02d",
+                        name, cause, status, reason);
+                WL_INFORM(("Connection status: %s\n", stringBuf));
+                return TRUE;
+        } else {
+                return FALSE;
+        }
+}
+
+#if WIRELESS_EXT > 14
+
+static bool
+wl_iw_check_conn_fail(wl_event_msg_t *e, char* stringBuf, uint buflen)
+{
+        uint32 event = ntoh32(e->event_type);
+        uint32 status =  ntoh32(e->status);
+        uint32 reason =  ntoh32(e->reason);
+
+        if (wl_iw_conn_status_str(event, status, reason, stringBuf, buflen)) {
+                return TRUE;
+        }
+        else
+                return FALSE;
+}
+#endif 
+
+#ifndef IW_CUSTOM_MAX
+#define IW_CUSTOM_MAX 256 
+#endif 
+
+void
+wl_iw_event(struct net_device *dev, wl_event_msg_t *e, void* data)
+{
+#if WIRELESS_EXT > 13
+        union iwreq_data wrqu;
+        char extra[IW_CUSTOM_MAX + 1];
+        int cmd = 0;
+        uint32 event_type = ntoh32(e->event_type);
+        uint16 flags =  ntoh16(e->flags);
+        uint32 datalen = ntoh32(e->datalen);
+        uint32 status =  ntoh32(e->status);
+        uint32 toto;
+        memset(&wrqu, 0, sizeof(wrqu));
+        memset(extra, 0, sizeof(extra));
+
+        if (!dev) {
+                WL_ERROR(("%s: dev is null\n", __FUNCTION__));
+                return;
+        }
+
+        net_os_wake_lock(dev);
+
+        WL_TRACE(("%s: dev=%s event=%d \n", __FUNCTION__, dev->name, event_type));
+
+        
+        switch (event_type) {
+#if defined(SOFTAP)
+        case WLC_E_PRUNE:
+                if (ap_cfg_running) {
+                        char *macaddr = (char *)&e->addr;
+                        WL_SOFTAP(("PRUNE received, %02X:%02X:%02X:%02X:%02X:%02X!\n",
+                                macaddr[0], macaddr[1], macaddr[2], macaddr[3],
+                                macaddr[4], macaddr[5]));
+
+                        
+                        if (ap_macmode)
+                        {
+                                int i;
+                                for (i = 0; i < ap_black_list.count; i++) {
+                                        if (!bcmp(macaddr, &ap_black_list.ea[i],
+                                                sizeof(struct ether_addr))) {
+                                                WL_SOFTAP(("mac in black list, ignore it\n"));
+                                                break;
+                                        }
+                                }
+
+                                if (i == ap_black_list.count) {
+                                        
+                                        char mac_buf[32] = {0};
+                                        sprintf(mac_buf, "STA_BLOCK %02X:%02X:%02X:%02X:%02X:%02X",
+                                                macaddr[0], macaddr[1], macaddr[2],
+                                                macaddr[3], macaddr[4], macaddr[5]);
+                                        wl_iw_send_priv_event(priv_dev, mac_buf);
+                                }
+                        }
+                }
+                break;
+#endif 
+        case WLC_E_TXFAIL:
+                cmd = IWEVTXDROP;
+                memcpy(wrqu.addr.sa_data, &e->addr, ETHER_ADDR_LEN);
+                wrqu.addr.sa_family = ARPHRD_ETHER;
+                break;
+#if WIRELESS_EXT > 14
+        case WLC_E_JOIN:
+        case WLC_E_ASSOC_IND:
+        case WLC_E_REASSOC_IND:
+#if defined(SOFTAP)
+                WL_SOFTAP(("STA connect received %d\n", event_type));
+                if (ap_cfg_running) {
+                        wl_iw_send_priv_event(priv_dev, "STA_JOIN");
+                        goto wl_iw_event_end;
+                }
+#endif 
+                memcpy(wrqu.addr.sa_data, &e->addr, ETHER_ADDR_LEN);
+                wrqu.addr.sa_family = ARPHRD_ETHER;
+                cmd = IWEVREGISTERED;
+                break;
+        case WLC_E_ROAM:
+                if (status == WLC_E_STATUS_SUCCESS) {
+                        WL_ASSOC((" WLC_E_ROAM : success \n"));
+                        goto wl_iw_event_end;
+                }
+        break;
+
+        case WLC_E_DEAUTH_IND:
+        case WLC_E_DISASSOC_IND:
+#if defined(SOFTAP)
+                WL_SOFTAP(("STA disconnect received %d\n", event_type));
+                if (ap_cfg_running) {
+                        wl_iw_send_priv_event(priv_dev, "STA_LEAVE");
+                        goto wl_iw_event_end;
+                }
+#endif 
+                cmd = SIOCGIWAP;
+                bzero(wrqu.addr.sa_data, ETHER_ADDR_LEN);
+                wrqu.addr.sa_family = ARPHRD_ETHER;
+                bzero(&extra, ETHER_ADDR_LEN);
+                break;
+        case WLC_E_LINK:
+        case WLC_E_NDIS_LINK:
+                cmd = SIOCGIWAP;
+                if (!(flags & WLC_EVENT_MSG_LINK)) {
+                        
+                        
+#ifdef SOFTAP
+#ifdef AP_ONLY
+                if (ap_cfg_running) {
+#else
+                if (ap_cfg_running && !strncmp(dev->name, "wl0.1", 5)) {
+#endif  
+                        
+                        WL_SOFTAP(("AP DOWN %d\n", event_type));
+                        wl_iw_send_priv_event(priv_dev, "AP_DOWN");
+                } else {
+                        WL_TRACE(("STA_Link Down\n"));
+                        g_ss_cache_ctrl.m_link_down = 1;
+                }
+#else           
+                g_ss_cache_ctrl.m_link_down = 1;
+#endif 
+                        WL_TRACE(("Link Down\n"));
+
+                        bzero(wrqu.addr.sa_data, ETHER_ADDR_LEN);
+                        bzero(&extra, ETHER_ADDR_LEN);
+                }
+                else {
+                        
+                        memcpy(wrqu.addr.sa_data, &e->addr, ETHER_ADDR_LEN);
+                        g_ss_cache_ctrl.m_link_down = 0;
+                        
+                        memcpy(g_ss_cache_ctrl.m_active_bssid, &e->addr, ETHER_ADDR_LEN);
+#ifdef SOFTAP
+
+#ifdef AP_ONLY
+                        if (ap_cfg_running) {
+#else
+                        if (ap_cfg_running && !strncmp(dev->name, "wl0.1", 5)) {
+#endif
+                        
+                                WL_SOFTAP(("AP UP %d\n", event_type));
+                                wl_iw_send_priv_event(priv_dev, "AP_UP");
+                        } else {
+                                WL_TRACE(("STA_LINK_UP\n"));
+                        }
+#else
+#endif 
+                        WL_TRACE(("Link UP\n"));
+
+                }
+                wrqu.addr.sa_family = ARPHRD_ETHER;
+                break;
+        case WLC_E_ACTION_FRAME:
+                cmd = IWEVCUSTOM;
+                if (datalen + 1 <= sizeof(extra)) {
+                        wrqu.data.length = datalen + 1;
+                        extra[0] = WLC_E_ACTION_FRAME;
+                        memcpy(&extra[1], data, datalen);
+                        WL_TRACE(("WLC_E_ACTION_FRAME len %d \n", wrqu.data.length));
+                }
+                break;
+
+        case WLC_E_ACTION_FRAME_COMPLETE:
+                cmd = IWEVCUSTOM;
+                memcpy(&toto, data, 4);
+                if (sizeof(status) + 1 <= sizeof(extra)) {
+                        wrqu.data.length = sizeof(status) + 1;
+                        extra[0] = WLC_E_ACTION_FRAME_COMPLETE;
+                        memcpy(&extra[1], &status, sizeof(status));
+                        printf("wl_iw_event status %d PacketId %d \n", status, toto);
+                        printf("WLC_E_ACTION_FRAME_COMPLETE len %d \n", wrqu.data.length);
+                }
+                break;
+#endif 
+#if WIRELESS_EXT > 17
+        case WLC_E_MIC_ERROR: {
+                struct  iw_michaelmicfailure  *micerrevt = (struct  iw_michaelmicfailure  *)&extra;
+                cmd = IWEVMICHAELMICFAILURE;
+                wrqu.data.length = sizeof(struct iw_michaelmicfailure);
+                if (flags & WLC_EVENT_MSG_GROUP)
+                        micerrevt->flags |= IW_MICFAILURE_GROUP;
+                else
+                        micerrevt->flags |= IW_MICFAILURE_PAIRWISE;
+                memcpy(micerrevt->src_addr.sa_data, &e->addr, ETHER_ADDR_LEN);
+                micerrevt->src_addr.sa_family = ARPHRD_ETHER;
+
+                break;
+        }
+        case WLC_E_PMKID_CACHE: {
+                if (data)
+                {
+                        struct iw_pmkid_cand *iwpmkidcand = (struct iw_pmkid_cand *)&extra;
+                        pmkid_cand_list_t *pmkcandlist;
+                        pmkid_cand_t    *pmkidcand;
+                        int count;
+
+                        cmd = IWEVPMKIDCAND;
+                        pmkcandlist = data;
+                        count = ntoh32_ua((uint8 *)&pmkcandlist->npmkid_cand);
+                        ASSERT(count >= 0);
+                        wrqu.data.length = sizeof(struct iw_pmkid_cand);
+                        pmkidcand = pmkcandlist->pmkid_cand;
+                        while (count) {
+                                bzero(iwpmkidcand, sizeof(struct iw_pmkid_cand));
+                                if (pmkidcand->preauth)
+                                        iwpmkidcand->flags |= IW_PMKID_CAND_PREAUTH;
+                                bcopy(&pmkidcand->BSSID, &iwpmkidcand->bssid.sa_data,
+                                        ETHER_ADDR_LEN);
+                                wireless_send_event(dev, cmd, &wrqu, extra);
+                                pmkidcand++;
+                                count--;
+                        }
+                }
+                goto wl_iw_event_end;
+        }
+#endif 
+
+        case WLC_E_SCAN_COMPLETE:
+#if defined(WL_IW_USE_ISCAN)
+                if (!g_iscan) {
+                        WL_ERROR(("Event WLC_E_SCAN_COMPLETE on g_iscan NULL!"));
+                        goto wl_iw_event_end;
+                }
+
+                if ((g_iscan) && (g_iscan->tsk_ctl.thr_pid >= 0) &&
+                        (g_iscan->iscan_state != ISCAN_STATE_IDLE))
+                {
+                        up(&g_iscan->tsk_ctl.sema);
+                } else {
+                        cmd = SIOCGIWSCAN;
+                        wrqu.data.length = strlen(extra);
+                        WL_TRACE(("Event WLC_E_SCAN_COMPLETE from specific scan %d\n",
+                                g_iscan->iscan_state));
+                }
+#else
+                cmd = SIOCGIWSCAN;
+                wrqu.data.length = strlen(extra);
+                WL_TRACE(("Event WLC_E_SCAN_COMPLETE\n"));
+#endif 
+        break;
+
+        
+        case WLC_E_PFN_NET_FOUND:
+        {
+                wl_pfn_net_info_t *netinfo;
+                netinfo = (wl_pfn_net_info_t *)(data + sizeof(wl_pfn_scanresults_t) -
+                            sizeof(wl_pfn_net_info_t));
+                WL_ERROR(("%s Event WLC_E_PFN_NET_FOUND, send %s up : find %s len=%d\n",
+                   __FUNCTION__, PNO_EVENT_UP, netinfo->pfnsubnet.SSID,
+                   netinfo->pfnsubnet.SSID_len));
+                cmd = IWEVCUSTOM;
+                memset(&wrqu, 0, sizeof(wrqu));
+                strcpy(extra, PNO_EVENT_UP);
+                wrqu.data.length = strlen(extra);
+        }
+        break;
+
+        default:
+                
+                WL_TRACE(("Unknown Event %d: ignoring\n", event_type));
+                break;
+        }
+                if (cmd) {
+                        if (cmd == SIOCGIWSCAN)
+                                wireless_send_event(dev, cmd, &wrqu, NULL);
+                        else
+                                wireless_send_event(dev, cmd, &wrqu, extra);
+                }
+
+#if WIRELESS_EXT > 14
+        
+        memset(extra, 0, sizeof(extra));
+        if (wl_iw_check_conn_fail(e, extra, sizeof(extra))) {
+                cmd = IWEVCUSTOM;
+                wrqu.data.length = strlen(extra);
+                wireless_send_event(dev, cmd, &wrqu, extra);
+        }
+#endif 
+
+        goto wl_iw_event_end;   
+wl_iw_event_end:
+
+        net_os_wake_unlock(dev);
+#endif 
+}
+
+int
+wl_iw_get_wireless_stats(struct net_device *dev, struct iw_statistics *wstats)
+{
+        int res = 0;
+        wl_cnt_t cnt;
+        int phy_noise;
+        int rssi;
+        scb_val_t scb_val;
+
+        phy_noise = 0;
+        if ((res = dev_wlc_ioctl(dev, WLC_GET_PHY_NOISE, &phy_noise, sizeof(phy_noise))))
+                goto done;
+
+        phy_noise = dtoh32(phy_noise);
+        WL_TRACE(("wl_iw_get_wireless_stats phy noise=%d\n", phy_noise));
+
+        bzero(&scb_val, sizeof(scb_val_t));
+        if ((res = dev_wlc_ioctl(dev, WLC_GET_RSSI, &scb_val, sizeof(scb_val_t))))
+                goto done;
+
+        rssi = dtoh32(scb_val.val);
+        WL_TRACE(("wl_iw_get_wireless_stats rssi=%d\n", rssi));
+        if (rssi <= WL_IW_RSSI_NO_SIGNAL)
+                wstats->qual.qual = 0;
+        else if (rssi <= WL_IW_RSSI_VERY_LOW)
+                wstats->qual.qual = 1;
+        else if (rssi <= WL_IW_RSSI_LOW)
+                wstats->qual.qual = 2;
+        else if (rssi <= WL_IW_RSSI_GOOD)
+                wstats->qual.qual = 3;
+        else if (rssi <= WL_IW_RSSI_VERY_GOOD)
+                wstats->qual.qual = 4;
+        else
+                wstats->qual.qual = 5;
+
+        
+        wstats->qual.level = 0x100 + rssi;
+        wstats->qual.noise = 0x100 + phy_noise;
+#if WIRELESS_EXT > 18
+        wstats->qual.updated |= (IW_QUAL_ALL_UPDATED | IW_QUAL_DBM);
+#else
+        wstats->qual.updated |= 7;
+#endif 
+
+#if WIRELESS_EXT > 11
+        WL_TRACE(("wl_iw_get_wireless_stats counters=%d\n", (int)sizeof(wl_cnt_t)));
+
+        memset(&cnt, 0, sizeof(wl_cnt_t));
+        res = dev_wlc_bufvar_get(dev, "counters", (char *)&cnt, sizeof(wl_cnt_t));
+        if (res)
+        {
+                WL_ERROR(("wl_iw_get_wireless_stats counters failed error=%d\n", res));
+                goto done;
+        }
+
+        cnt.version = dtoh16(cnt.version);
+        if (cnt.version != WL_CNT_T_VERSION) {
+                WL_TRACE(("\tIncorrect version of counters struct: expected %d; got %d\n",
+                        WL_CNT_T_VERSION, cnt.version));
+                goto done;
+        }
+
+        wstats->discard.nwid = 0;
+        wstats->discard.code = dtoh32(cnt.rxundec);
+        wstats->discard.fragment = dtoh32(cnt.rxfragerr);
+        wstats->discard.retries = dtoh32(cnt.txfail);
+        wstats->discard.misc = dtoh32(cnt.rxrunt) + dtoh32(cnt.rxgiant);
+        wstats->miss.beacon = 0;
+
+        WL_TRACE(("wl_iw_get_wireless_stats counters txframe=%d txbyte=%d\n",
+                dtoh32(cnt.txframe), dtoh32(cnt.txbyte)));
+        WL_TRACE(("wl_iw_get_wireless_stats counters rxfrmtoolong=%d\n", dtoh32(cnt.rxfrmtoolong)));
+        WL_TRACE(("wl_iw_get_wireless_stats counters rxbadplcp=%d\n", dtoh32(cnt.rxbadplcp)));
+        WL_TRACE(("wl_iw_get_wireless_stats counters rxundec=%d\n", dtoh32(cnt.rxundec)));
+        WL_TRACE(("wl_iw_get_wireless_stats counters rxfragerr=%d\n", dtoh32(cnt.rxfragerr)));
+        WL_TRACE(("wl_iw_get_wireless_stats counters txfail=%d\n", dtoh32(cnt.txfail)));
+        WL_TRACE(("wl_iw_get_wireless_stats counters rxrunt=%d\n", dtoh32(cnt.rxrunt)));
+        WL_TRACE(("wl_iw_get_wireless_stats counters rxgiant=%d\n", dtoh32(cnt.rxgiant)));
+
+#endif 
+
+done:
+        return res;
+}
+#if defined(COEX_DHCP)
+static void
+wl_iw_bt_flag_set(
+        struct net_device *dev,
+        bool set)
+{
+#if defined(BT_DHCP_USE_FLAGS)
+        char buf_flag7_dhcp_on[8] = { 7, 00, 00, 00, 0x1, 0x0, 0x00, 0x00 };
+        char buf_flag7_default[8]   = { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        rtnl_lock();
+#endif
+
+
+#if defined(BT_DHCP_eSCO_FIX)
+        
+        set_btc_esco_params(dev, set);
+#endif
+
+
+#if defined(BT_DHCP_USE_FLAGS)
+        WL_TRACE_COEX(("WI-FI priority boost via bt flags, set:%d\n", set));
+        if (set == TRUE) {
+                
+                dev_wlc_bufvar_set(dev, "btc_flags",
+                        (char *)&buf_flag7_dhcp_on[0], sizeof(buf_flag7_dhcp_on));
+        }
+        else  {
+                
+                dev_wlc_bufvar_set(dev, "btc_flags",
+                        (char *)&buf_flag7_default[0], sizeof(buf_flag7_default));
+        }
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+        rtnl_unlock();
+#endif
+}
+
+static void
+wl_iw_bt_timerfunc(ulong data)
+{
+        bt_info_t  *bt_local = (bt_info_t *)data;
+        bt_local->timer_on = 0;
+        WL_TRACE(("%s\n", __FUNCTION__));
+        
+        up(&bt_local->tsk_ctl.sema);
+}
+
+static int
+_bt_dhcp_sysioc_thread(void *data)
+{
+        tsk_ctl_t *tsk_ctl =  (tsk_ctl_t *)data;
+
+        DAEMONIZE("dhcp_sysioc");
+
+        complete(&tsk_ctl->completed);
+
+        while (down_interruptible(&tsk_ctl->sema) == 0) {
+
+                SMP_RD_BARRIER_DEPENDS();
+                if (tsk_ctl->terminated) {
+                        break;
+                }
+
+                if (g_bt->timer_on) {
+                        g_bt->timer_on = 0;
+                        del_timer_sync(&g_bt->timer);
+                }
+
+                switch (g_bt->bt_state) {
+                        case BT_DHCP_START:
+                                
+                                WL_TRACE_COEX(("%s bt_dhcp stm: started \n", __FUNCTION__));
+                                g_bt->bt_state = BT_DHCP_OPPORTUNITY_WINDOW;
+                                mod_timer(&g_bt->timer,
+                                          jiffies + BT_DHCP_OPPORTUNITY_WINDOW_TIME*HZ/1000);
+                                g_bt->timer_on = 1;
+                                break;
+
+                        case BT_DHCP_OPPORTUNITY_WINDOW:
+                                if      (g_bt->dhcp_done) {
+                                        WL_TRACE_COEX(("%s DHCP Done before T1 expiration\n",
+                                                __FUNCTION__));
+                                        goto btc_coex_idle;
+                                }
+
+                                
+                                WL_TRACE_COEX(("%s DHCP T1:%d expired\n",
+                                        __FUNCTION__, BT_DHCP_OPPORTUNITY_WINDOW_TIME));
+                                
+                                if (g_bt->dev) wl_iw_bt_flag_set(g_bt->dev, TRUE);
+                                g_bt->bt_state = BT_DHCP_FLAG_FORCE_TIMEOUT;
+                                mod_timer(&g_bt->timer, jiffies + BT_DHCP_FLAG_FORCE_TIME*HZ/1000);
+                                g_bt->timer_on = 1;
+                                break;
+
+                        case BT_DHCP_FLAG_FORCE_TIMEOUT:
+                                if      (g_bt->dhcp_done) {
+                                        WL_TRACE_COEX(("%s DHCP Done before T2 expiration\n",
+                                                __FUNCTION__));
+                                } else  {
+                                        
+                                        WL_TRACE_COEX(("%s DHCP wait interval T2:%d msec expired\n",
+                                                __FUNCTION__, BT_DHCP_FLAG_FORCE_TIME));
+                                }
+
+                                
+                                if (g_bt->dev)  wl_iw_bt_flag_set(g_bt->dev, FALSE);
+                        btc_coex_idle:
+                                g_bt->bt_state = BT_DHCP_IDLE;
+                                g_bt->timer_on = 0;
+                                break;
+
+                        default:
+                                WL_ERROR(("%s error g_status=%d !!!\n", __FUNCTION__,
+                                          g_bt->bt_state));
+                                if (g_bt->dev) wl_iw_bt_flag_set(g_bt->dev, FALSE);
+                                g_bt->bt_state = BT_DHCP_IDLE;
+                                g_bt->timer_on = 0;
+                                break;
+                 }
+
+                net_os_wake_unlock(g_bt->dev);
+        }
+
+        if (g_bt->timer_on) {
+                g_bt->timer_on = 0;
+                del_timer_sync(&g_bt->timer);
+        }
+        complete_and_exit(&tsk_ctl->completed, 0);
+}
+
+static void
+wl_iw_bt_release(void)
+{
+        bt_info_t *bt_local = g_bt;
+
+        if (!bt_local) {
+                return;
+        }
+
+        if (bt_local->tsk_ctl.thr_pid >= 0) {
+                PROC_STOP(&bt_local->tsk_ctl);
+        }
+        kfree(bt_local);
+        g_bt = NULL;
+}
+
+static int
+wl_iw_bt_init(struct net_device *dev)
+{
+        bt_info_t *bt_dhcp = NULL;
+
+        bt_dhcp = kmalloc(sizeof(bt_info_t), GFP_KERNEL);
+        if (!bt_dhcp)
+                return -ENOMEM;
+
+        memset(bt_dhcp, 0, sizeof(bt_info_t));
+
+        g_bt = bt_dhcp;
+        bt_dhcp->dev = dev;
+        bt_dhcp->bt_state = BT_DHCP_IDLE;
+
+        
+        bt_dhcp->timer_ms    = 10;
+        init_timer(&bt_dhcp->timer);
+        bt_dhcp->timer.data = (ulong)bt_dhcp;
+        bt_dhcp->timer.function = wl_iw_bt_timerfunc;
+        bt_dhcp->ts_dhcp_start = 0;
+        bt_dhcp->ts_dhcp_ok = 0;
+
+        PROC_START(_bt_dhcp_sysioc_thread, bt_dhcp, &bt_dhcp->tsk_ctl, 0);
+        if (bt_dhcp->tsk_ctl.thr_pid < 0) {
+                WL_ERROR(("Failed in %s\n", __FUNCTION__));
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+#endif 
+
+int
+wl_iw_attach(struct net_device *dev, void * dhdp)
+{
+#if defined(WL_IW_USE_ISCAN)
+        int params_size = 0;
+#endif 
+        wl_iw_t *iw;
+#if defined(WL_IW_USE_ISCAN)
+        iscan_info_t *iscan = NULL;
+#endif
+
+        DHD_OS_MUTEX_INIT(&wl_cache_lock);
+        DHD_OS_MUTEX_INIT(&wl_softap_lock);
+
+#if defined(WL_IW_USE_ISCAN)
+        if (!dev)
+                return 0;
+
+        
+        memset(&g_wl_iw_params, 0, sizeof(wl_iw_extra_params_t));
+
+        
+#ifdef CSCAN
+        params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_iscan_params_t, params)) +
+            (WL_NUMCHANNELS * sizeof(uint16)) + WL_SCAN_PARAMS_SSID_MAX * sizeof(wlc_ssid_t);
+#else
+        params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_iscan_params_t, params));
+#endif 
+        iscan = kmalloc(sizeof(iscan_info_t), GFP_KERNEL);
+        if (!iscan)
+                return -ENOMEM;
+        memset(iscan, 0, sizeof(iscan_info_t));
+
+        
+        iscan->iscan_ex_params_p = (wl_iscan_params_t*)kmalloc(params_size, GFP_KERNEL);
+        if (!iscan->iscan_ex_params_p) {
+                kfree(iscan);
+                return -ENOMEM;
+        }
+        iscan->iscan_ex_param_size = params_size;
+
+        
+        g_iscan = iscan;
+        iscan->dev = dev;
+        iscan->iscan_state = ISCAN_STATE_IDLE;
+
+#if defined(CONFIG_FIRST_SCAN)
+        g_first_broadcast_scan = BROADCAST_SCAN_FIRST_IDLE;
+        g_first_counter_scans = 0;
+        g_iscan->scan_flag = 0;
+#endif 
+
+#ifdef CONFIG_WPS2
+        g_wps_probe_req_ie = NULL;
+        g_wps_probe_req_ie_len = 0;
+#endif
+        
+        iscan->timer_ms    = 8000;
+        init_timer(&iscan->timer);
+        iscan->timer.data = (ulong)iscan;
+        iscan->timer.function = wl_iw_timerfunc;
+
+        PROC_START(_iscan_sysioc_thread, iscan, &iscan->tsk_ctl, 0);
+        if (iscan->tsk_ctl.thr_pid < 0)
+                return -ENOMEM;
+#endif 
+
+        iw = *(wl_iw_t **)netdev_priv(dev);
+        iw->pub = (dhd_pub_t *)dhdp;
+#ifdef SOFTAP
+        priv_dev = dev;
+#endif 
+        g_scan = NULL;
+
+        
+        g_scan = (void *)kmalloc(G_SCAN_RESULTS, GFP_KERNEL);
+        if (!g_scan)
+                return -ENOMEM;
+
+        memset(g_scan, 0, G_SCAN_RESULTS);
+        g_scan_specified_ssid = 0;
+
+#if !defined(CSCAN)
+        
+        wl_iw_init_ss_cache_ctrl();
+#endif 
+#ifdef COEX_DHCP
+        
+        wl_iw_bt_init(dev);
+#endif 
+
+
+        return 0;
+}
+
+void
+wl_iw_detach(void)
+{
+#if defined(WL_IW_USE_ISCAN)
+        iscan_buf_t  *buf;
+        iscan_info_t *iscan = g_iscan;
+
+        if (!iscan)
+                return;
+        if (iscan->tsk_ctl.thr_pid >= 0) {
+                PROC_STOP(&iscan->tsk_ctl);
+        }
+        DHD_OS_MUTEX_LOCK(&wl_cache_lock);
+        while (iscan->list_hdr) {
+                buf = iscan->list_hdr->next;
+                kfree(iscan->list_hdr);
+                iscan->list_hdr = buf;
+        }
+        kfree(iscan->iscan_ex_params_p);
+        kfree(iscan);
+        g_iscan = NULL;
+        DHD_OS_MUTEX_UNLOCK(&wl_cache_lock);
+#endif 
+
+        if (g_scan)
+                kfree(g_scan);
+
+        g_scan = NULL;
+#ifdef CONFIG_WPS2
+
+        if (g_wps_probe_req_ie) {
+                kfree(g_wps_probe_req_ie);
+                g_wps_probe_req_ie = NULL;
+                g_wps_probe_req_ie_len = 0;
+        }
+#endif
+#if !defined(CSCAN)
+        wl_iw_release_ss_cache_ctrl();
+#endif 
+#ifdef COEX_DHCP
+        wl_iw_bt_release();
+#endif 
+
+#ifdef SOFTAP
+        if (ap_cfg_running) {
+                WL_TRACE(("\n%s AP is going down\n", __FUNCTION__));
+                
+                wl_iw_send_priv_event(priv_dev, "AP_DOWN");
+        }
+#endif
+
+}
diff --git a/drivers/net/wireless/bcmdhd/wl_iw.h b/drivers/net/wireless/bcmdhd/wl_iw.h
new file mode 100644
index 00000000000..c0cc14bdde4
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wl_iw.h
@@ -0,0 +1,306 @@
+/*
+ * Linux Wireless Extensions support
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wl_iw.h,v 1.15.80.6 2010-12-23 01:13:23 Exp $
+ */
+
+
+#ifndef _wl_iw_h_
+#define _wl_iw_h_
+
+#include <linux/wireless.h>
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+#include <wlioctl.h>
+
+#define WL_SCAN_PARAMS_SSID_MAX         10
+#define GET_SSID                        "SSID="
+#define GET_CHANNEL                     "CH="
+#define GET_NPROBE                      "NPROBE="
+#define GET_ACTIVE_ASSOC_DWELL          "ACTIVE="
+#define GET_PASSIVE_ASSOC_DWELL         "PASSIVE="
+#define GET_HOME_DWELL                  "HOME="
+#define GET_SCAN_TYPE                   "TYPE="
+
+#define BAND_GET_CMD                            "GETBAND"
+#define BAND_SET_CMD                            "SETBAND"
+#define DTIM_SKIP_GET_CMD                       "DTIMSKIPGET"
+#define DTIM_SKIP_SET_CMD                       "DTIMSKIPSET"
+#define SETSUSPEND_CMD                          "SETSUSPENDOPT"
+#define PNOSSIDCLR_SET_CMD                      "PNOSSIDCLR"
+
+#define PNOSETUP_SET_CMD                        "PNOSETUP " 
+#define PNOENABLE_SET_CMD                       "PNOFORCE"
+#define PNODEBUG_SET_CMD                        "PNODEBUG"
+#define TXPOWER_SET_CMD                 "TXPOWER"
+
+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
+#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
+
+
+typedef struct wl_iw_extra_params {
+        int     target_channel; 
+} wl_iw_extra_params_t;
+
+struct cntry_locales_custom {
+        char iso_abbrev[WLC_CNTRY_BUF_SZ];      
+        char custom_locale[WLC_CNTRY_BUF_SZ];   
+        int32 custom_locale_rev;                
+};
+
+
+#define WL_IW_RSSI_MINVAL               -200    
+#define WL_IW_RSSI_NO_SIGNAL    -91     
+#define WL_IW_RSSI_VERY_LOW     -80     
+#define WL_IW_RSSI_LOW          -70     
+#define WL_IW_RSSI_GOOD         -68     
+#define WL_IW_RSSI_VERY_GOOD    -58     
+#define WL_IW_RSSI_EXCELLENT    -57     
+#define WL_IW_RSSI_INVALID       0      
+#define MAX_WX_STRING 80
+#define isprint(c) bcm_isprint(c)
+#define WL_IW_SET_ACTIVE_SCAN   (SIOCIWFIRSTPRIV+1)
+#define WL_IW_GET_RSSI                  (SIOCIWFIRSTPRIV+3)
+#define WL_IW_SET_PASSIVE_SCAN  (SIOCIWFIRSTPRIV+5)
+#define WL_IW_GET_LINK_SPEED    (SIOCIWFIRSTPRIV+7)
+#define WL_IW_GET_CURR_MACADDR  (SIOCIWFIRSTPRIV+9)
+#define WL_IW_SET_STOP                          (SIOCIWFIRSTPRIV+11)
+#define WL_IW_SET_START                 (SIOCIWFIRSTPRIV+13)
+
+
+#define WL_SET_AP_CFG           (SIOCIWFIRSTPRIV+15)
+#define WL_AP_STA_LIST          (SIOCIWFIRSTPRIV+17)
+#define WL_AP_MAC_FLTR          (SIOCIWFIRSTPRIV+19)
+#define WL_AP_BSS_START         (SIOCIWFIRSTPRIV+21)
+#define AP_LPB_CMD              (SIOCIWFIRSTPRIV+23)
+#define WL_AP_STOP              (SIOCIWFIRSTPRIV+25)
+#define WL_FW_RELOAD            (SIOCIWFIRSTPRIV+27)
+#define WL_AP_STA_DISASSOC              (SIOCIWFIRSTPRIV+29)
+#define WL_COMBO_SCAN           (SIOCIWFIRSTPRIV+31)
+
+
+#define                 G_SCAN_RESULTS 8*1024
+#define                 WE_ADD_EVENT_FIX        0x80
+#define          G_WLAN_SET_ON  0
+#define          G_WLAN_SET_OFF 1
+
+#define CHECK_EXTRA_FOR_NULL(extra) \
+if (!extra) { \
+        WL_ERROR(("%s: error : extra is null pointer\n", __FUNCTION__)); \
+        return -EINVAL; \
+}
+
+typedef struct wl_iw {
+        char nickname[IW_ESSID_MAX_SIZE];
+
+        struct iw_statistics wstats;
+
+        int spy_num;
+        int wpaversion;                 
+        int pcipher;                    
+        int gcipher;                    
+        int privacy_invoked;            
+
+        struct ether_addr spy_addr[IW_MAX_SPY];
+        struct iw_quality spy_qual[IW_MAX_SPY];
+        void  *wlinfo;
+        dhd_pub_t * pub;
+} wl_iw_t;
+
+int      wl_control_wl_start(struct net_device *dev);
+#define WLC_IW_SS_CACHE_MAXLEN                          2048
+#define WLC_IW_SS_CACHE_CTRL_FIELD_MAXLEN       32
+#define WLC_IW_BSS_INFO_MAXLEN                          \
+        (WLC_IW_SS_CACHE_MAXLEN - WLC_IW_SS_CACHE_CTRL_FIELD_MAXLEN)
+
+typedef struct wl_iw_ss_cache {
+        struct wl_iw_ss_cache *next;
+        int dirty;
+        uint32 buflen;
+        uint32 version;
+        uint32 count;
+        wl_bss_info_t bss_info[1];
+} wl_iw_ss_cache_t;
+
+typedef struct wl_iw_ss_cache_ctrl {
+        wl_iw_ss_cache_t *m_cache_head; 
+        int m_link_down;                
+        int m_timer_expired;            
+        char m_active_bssid[ETHER_ADDR_LEN];    
+        uint m_prev_scan_mode;  
+        uint m_cons_br_scan_cnt;        
+        struct timer_list *m_timer;     
+} wl_iw_ss_cache_ctrl_t;
+
+typedef enum broadcast_first_scan {
+        BROADCAST_SCAN_FIRST_IDLE = 0,
+        BROADCAST_SCAN_FIRST_STARTED,
+        BROADCAST_SCAN_FIRST_RESULT_READY,
+        BROADCAST_SCAN_FIRST_RESULT_CONSUMED
+} broadcast_first_scan_t;
+#ifdef SOFTAP
+#define SSID_LEN        33
+#define SEC_LEN         16
+#define KEY_LEN         65
+#define PROFILE_OFFSET  32
+struct ap_profile {
+        uint8   ssid[SSID_LEN];
+        uint8   sec[SEC_LEN];
+        uint8   key[KEY_LEN];
+        uint32  channel; 
+        uint32  preamble;
+        uint32  max_scb;        
+        uint32  closednet;  
+        char country_code[WLC_CNTRY_BUF_SZ];
+};
+
+
+#define MACLIST_MODE_DISABLED   0
+#define MACLIST_MODE_DENY               1
+#define MACLIST_MODE_ALLOW              2
+struct mflist {
+        uint count;
+        struct ether_addr ea[16];
+};
+struct mac_list_set {
+        uint32  mode;
+        struct mflist mac_list;
+};
+#endif   
+
+#if WIRELESS_EXT > 12
+#include <net/iw_handler.h>
+extern const struct iw_handler_def wl_iw_handler_def;
+#endif 
+
+extern int wl_iw_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+extern void wl_iw_event(struct net_device *dev, wl_event_msg_t *e, void* data);
+extern int wl_iw_get_wireless_stats(struct net_device *dev, struct iw_statistics *wstats);
+int wl_iw_attach(struct net_device *dev, void * dhdp);
+void wl_iw_detach(void);
+
+extern int net_os_wake_lock(struct net_device *dev);
+extern int net_os_wake_unlock(struct net_device *dev);
+extern int net_os_wake_lock_timeout(struct net_device *dev);
+extern int net_os_wake_lock_timeout_enable(struct net_device *dev, int val);
+extern int net_os_set_suspend_disable(struct net_device *dev, int val);
+extern int net_os_set_suspend(struct net_device *dev, int val);
+extern int net_os_set_dtim_skip(struct net_device *dev, int val);
+extern int net_os_send_hang_message(struct net_device *dev);
+extern void get_customized_country_code(char *country_iso_code, wl_country_t *cspec);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+#define IWE_STREAM_ADD_EVENT(info, stream, ends, iwe, extra) \
+        iwe_stream_add_event(info, stream, ends, iwe, extra)
+#define IWE_STREAM_ADD_VALUE(info, event, value, ends, iwe, event_len) \
+        iwe_stream_add_value(info, event, value, ends, iwe, event_len)
+#define IWE_STREAM_ADD_POINT(info, stream, ends, iwe, extra) \
+        iwe_stream_add_point(info, stream, ends, iwe, extra)
+#else
+#define IWE_STREAM_ADD_EVENT(info, stream, ends, iwe, extra) \
+        iwe_stream_add_event(stream, ends, iwe, extra)
+#define IWE_STREAM_ADD_VALUE(info, event, value, ends, iwe, event_len) \
+        iwe_stream_add_value(event, value, ends, iwe, event_len)
+#define IWE_STREAM_ADD_POINT(info, stream, ends, iwe, extra) \
+        iwe_stream_add_point(stream, ends, iwe, extra)
+#endif
+
+void    dhd_bus_country_set(struct net_device *dev, wl_country_t *cspec);
+
+#define PNO_TLV_PREFIX                  'S'
+#define PNO_TLV_VERSION                 '1'
+#define PNO_TLV_SUBVERSION              '2'
+#define PNO_TLV_RESERVED                '0'
+#define PNO_TLV_TYPE_SSID_IE            'S'
+#define PNO_TLV_TYPE_TIME               'T'
+#define PNO_TLV_FREQ_REPEAT             'R'
+#define PNO_TLV_FREQ_EXPO_MAX   'M'
+#define  PNO_EVENT_UP                   "PNO_EVENT"
+
+typedef struct cmd_tlv {
+        char prefix;
+        char version;
+        char subver;
+        char reserved;
+} cmd_tlv_t;
+
+
+
+
+typedef struct cscan_tlv {
+        char prefix;
+        char version;
+        char subver;
+        char reserved;
+} cscan_tlv_t;
+
+#define CSCAN_COMMAND                           "CSCAN "
+#define CSCAN_TLV_PREFIX                        'S'
+#define CSCAN_TLV_VERSION                       1
+#define CSCAN_TLV_SUBVERSION                    0
+#define CSCAN_TLV_TYPE_SSID_IE          'S'
+#define CSCAN_TLV_TYPE_CHANNEL_IE   'C'
+#define CSCAN_TLV_TYPE_NPROBE_IE     'N'
+#define CSCAN_TLV_TYPE_ACTIVE_IE      'A'
+#define CSCAN_TLV_TYPE_PASSIVE_IE    'P'
+#define CSCAN_TLV_TYPE_HOME_IE         'H'
+#define CSCAN_TLV_TYPE_STYPE_IE        'T'
+
+#ifdef SOFTAP_TLV_CFG
+
+#define SOFTAP_SET_CMD                          "SOFTAPSET "
+#define SOFTAP_TLV_PREFIX                       'A'
+#define SOFTAP_TLV_VERSION                      '1'
+#define SOFTAP_TLV_SUBVERSION           '0'
+#define SOFTAP_TLV_RESERVED             '0'
+
+#define TLV_TYPE_SSID                           'S'
+#define TLV_TYPE_SECUR                          'E'
+#define TLV_TYPE_KEY                            'K'
+#define TLV_TYPE_CHANNEL                        'C'
+#endif 
+
+extern int wl_iw_parse_channel_list_tlv(char** list_str, uint16* channel_list,
+        int channel_num, int *bytes_left);
+
+extern int wl_iw_parse_data_tlv(char** list_str, void  *dst, int dst_size,
+                                const char token, int input_size, int *bytes_left);
+
+extern int wl_iw_parse_ssid_list_tlv(char** list_str, wlc_ssid_t* ssid,
+                                     int max, int *bytes_left);
+
+extern int wl_iw_parse_ssid_list(char** list_str, wlc_ssid_t* ssid, int idx, int max);
+
+extern int wl_iw_parse_channel_list(char** list_str, uint16* channel_list, int channel_num);
+
+
+#define NETDEV_PRIV(dev)        (*(wl_iw_t **)netdev_priv(dev))
+
+#ifdef CONFIG_WPS2
+#define WPS_ADD_PROBE_REQ_IE_CMD "ADD_WPS_PROBE_REQ_IE "
+#define WPS_DEL_PROBE_REQ_IE_CMD "DEL_WPS_PROBE_REQ_IE "
+#define WPS_PROBE_REQ_IE_CMD_LENGTH 21
+#endif
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd/wldev_common.c b/drivers/net/wireless/bcmdhd/wldev_common.c
new file mode 100644
index 00000000000..bb3eaea90d0
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wldev_common.c
@@ -0,0 +1,341 @@
+/*
+ * Common function shared by Linux WEXT, cfg80211 and p2p drivers
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wldev_common.c,v 1.1.4.1.2.14 2011-02-09 01:40:07 $
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+#include <wldev_common.h>
+#include <bcmutils.h>
+#include <dhd_dbg.h>
+
+#define htod32(i) i
+#define htod16(i) i
+#define dtoh32(i) i
+#define dtoh16(i) i
+#define htodchanspec(i) i
+#define dtohchanspec(i) i
+extern int dhd_ioctl_entry_local(struct net_device *net, wl_ioctl_t *ioc, int cmd);
+
+s32 wldev_ioctl(
+        struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set)
+{
+        s32 ret = 0;
+        struct wl_ioctl ioc;
+
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = cmd;
+        ioc.buf = arg;
+        ioc.len = len;
+        ioc.set = set;
+
+        ret = dhd_ioctl_entry_local(dev, &ioc, cmd);
+        return ret;
+}
+
+/* Format a iovar buffer, not bsscfg indexed. The bsscfg index will be
+ * taken care of in dhd_ioctl_entry. Internal use only, not exposed to
+ * wl_iw, wl_cfg80211 and wl_cfgp2p
+ */
+static s32 wldev_mkiovar(
+        s8 *iovar_name, s8 *param, s32 paramlen,
+        s8 *iovar_buf, u32 buflen)
+{
+        s32 iolen = 0;
+
+        iolen = bcm_mkiovar(iovar_name, param, paramlen, iovar_buf, buflen);
+        return iolen;
+}
+
+s32 wldev_iovar_getbuf(
+        struct net_device *dev, s8 *iovar_name,
+        void *param, s32 paramlen, void *buf, s32 buflen)
+{
+        s32 ret = 0;
+        s32 iovar_len = 0;
+
+        iovar_len = wldev_mkiovar(iovar_name, param, paramlen, buf, buflen);
+        ret = wldev_ioctl(dev, WLC_GET_VAR, buf, buflen, FALSE);
+        return ret;
+}
+
+
+s32 wldev_iovar_setbuf(
+        struct net_device *dev, s8 *iovar_name,
+        void *param, s32 paramlen, void *buf, s32 buflen)
+{
+        s32 ret = 0;
+        s32 iovar_len;
+
+        iovar_len = wldev_mkiovar(iovar_name, param, paramlen, buf, buflen);
+        ret = wldev_ioctl(dev, WLC_SET_VAR, buf, iovar_len, TRUE);
+        return ret;
+}
+
+s32 wldev_iovar_setint(
+        struct net_device *dev, s8 *iovar, s32 val)
+{
+        s8 iovar_buf[WLC_IOCTL_SMLEN];
+
+        val = htod32(val);
+        memset(iovar_buf, 0, sizeof(iovar_buf));
+        return wldev_iovar_setbuf(dev, iovar, &val, sizeof(val), iovar_buf,
+                sizeof(iovar_buf));
+}
+
+
+s32 wldev_iovar_getint(
+        struct net_device *dev, s8 *iovar, s32 *pval)
+{
+        s8 iovar_buf[WLC_IOCTL_SMLEN];
+        s32 err;
+
+        memset(iovar_buf, 0, sizeof(iovar_buf));
+        err = wldev_iovar_getbuf(dev, iovar, pval, sizeof(*pval), iovar_buf,
+                sizeof(iovar_buf));
+        if (err == 0)
+        {
+                memcpy(pval, iovar_buf, sizeof(*pval));
+                *pval = dtoh32(*pval);
+        }
+        return err;
+}
+
+/** Format a bsscfg indexed iovar buffer. The bsscfg index will be
+ *  taken care of in dhd_ioctl_entry. Internal use only, not exposed to
+ *  wl_iw, wl_cfg80211 and wl_cfgp2p
+ */
+s32 wldev_mkiovar_bsscfg(
+        const s8 *iovar_name, s8 *param, s32 paramlen,
+        s8 *iovar_buf, s32 buflen, s32 bssidx)
+{
+        const s8 *prefix = "bsscfg:";
+        s8 *p;
+        u32 prefixlen;
+        u32 namelen;
+        u32 iolen;
+
+        if (bssidx == 0) {
+                return wldev_mkiovar((s8*)iovar_name, (s8 *)param, paramlen,
+                        (s8 *) iovar_buf, buflen);
+        }
+
+        prefixlen = (u32) strlen(prefix); /* lengh of bsscfg prefix */
+        namelen = (u32) strlen(iovar_name) + 1; /* lengh of iovar  name + null */
+        iolen = prefixlen + namelen + sizeof(u32) + paramlen;
+
+        if (buflen < 0 || iolen > (u32)buflen)
+        {
+                DHD_ERROR(("%s: buffer is too short\n", __FUNCTION__));
+                return BCME_BUFTOOSHORT;
+        }
+
+        p = (s8 *)iovar_buf;
+
+        /* copy prefix, no null */
+        memcpy(p, prefix, prefixlen);
+        p += prefixlen;
+
+        /* copy iovar name including null */
+        memcpy(p, iovar_name, namelen);
+        p += namelen;
+
+        /* bss config index as first param */
+        bssidx = htod32(bssidx);
+        memcpy(p, &bssidx, sizeof(u32));
+        p += sizeof(u32);
+
+        /* parameter buffer follows */
+        if (paramlen)
+                memcpy(p, param, paramlen);
+
+        return iolen;
+
+}
+
+s32 wldev_iovar_getbuf_bsscfg(
+        struct net_device *dev, s8 *iovar_name,
+        void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx)
+{
+        s32 ret = 0;
+        s32 iovar_len = 0;
+
+        iovar_len = wldev_mkiovar_bsscfg(iovar_name, param, paramlen, buf, buflen, bsscfg_idx);
+        ret = wldev_ioctl(dev, WLC_GET_VAR, buf, buflen, FALSE);
+        return ret;
+
+}
+
+s32 wldev_iovar_setbuf_bsscfg(
+        struct net_device *dev, s8 *iovar_name,
+        void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx)
+{
+        s32 ret = 0;
+        s32 iovar_len;
+
+        iovar_len = wldev_mkiovar_bsscfg(iovar_name, param, paramlen, buf, buflen, bsscfg_idx);
+        ret = wldev_ioctl(dev, WLC_SET_VAR, buf, iovar_len, TRUE);
+        return ret;
+}
+
+s32 wldev_iovar_setint_bsscfg(
+        struct net_device *dev, s8 *iovar, s32 val, s32 bssidx)
+{
+        s8 iovar_buf[WLC_IOCTL_SMLEN];
+
+        val = htod32(val);
+        memset(iovar_buf, 0, sizeof(iovar_buf));
+        return wldev_iovar_setbuf_bsscfg(dev, iovar, &val, sizeof(val), iovar_buf,
+                sizeof(iovar_buf), bssidx);
+}
+
+
+s32 wldev_iovar_getint_bsscfg(
+        struct net_device *dev, s8 *iovar, s32 *pval, s32 bssidx)
+{
+        s8 iovar_buf[WLC_IOCTL_SMLEN];
+        s32 err;
+
+        memset(iovar_buf, 0, sizeof(iovar_buf));
+        err = wldev_iovar_getbuf_bsscfg(dev, iovar, pval, sizeof(*pval), iovar_buf,
+                sizeof(iovar_buf), bssidx);
+        if (err == 0)
+        {
+                memcpy(pval, iovar_buf, sizeof(*pval));
+                *pval = dtoh32(*pval);
+        }
+        return err;
+}
+
+int wldev_get_link_speed(
+        struct net_device *dev, int *plink_speed)
+{
+        int error;
+
+        if (!plink_speed)
+                return -ENOMEM;
+        error = wldev_ioctl(dev, WLC_GET_RATE, plink_speed, sizeof(int), 0);
+        if (unlikely(error))
+                return error;
+
+        /* Convert internal 500Kbps to Kbps */
+        *plink_speed *= 500;
+        return error;
+}
+
+int wldev_get_rssi(
+        struct net_device *dev, int *prssi)
+{
+        scb_val_t scb_val;
+        int error;
+
+        if (!prssi)
+                return -ENOMEM;
+        bzero(&scb_val, sizeof(scb_val_t));
+
+        error = wldev_ioctl(dev, WLC_GET_RSSI, &scb_val, sizeof(scb_val_t), 0);
+        if (unlikely(error))
+                return error;
+
+        *prssi = dtoh32(scb_val.val);
+        return error;
+}
+
+int wldev_get_ssid(
+        struct net_device *dev, wlc_ssid_t *pssid)
+{
+        int error;
+
+        if (!pssid)
+                return -ENOMEM;
+        error = wldev_ioctl(dev, WLC_GET_SSID, pssid, sizeof(wlc_ssid_t), 0);
+        if (unlikely(error))
+                return error;
+        pssid->SSID_len = dtoh32(pssid->SSID_len);
+        return error;
+}
+
+int wldev_get_band(
+        struct net_device *dev, uint *pband)
+{
+        int error;
+
+        error = wldev_ioctl(dev, WLC_GET_BAND, pband, sizeof(uint), 0);
+        return error;
+}
+
+int wldev_set_band(
+        struct net_device *dev, uint band)
+{
+        int error = -1;
+
+        if ((band == WLC_BAND_AUTO) || (band == WLC_BAND_5G) || (band == WLC_BAND_2G)) {
+                error = wldev_ioctl(dev, WLC_SET_BAND, &band, sizeof(band), 1);
+        }
+        return error;
+}
+
+int wldev_set_country(
+        struct net_device *dev, char *country_code)
+{
+        int error = -1;
+        wl_country_t cspec = {{0}, 0, {0}};
+        scb_val_t scbval;
+        char smbuf[WLC_IOCTL_SMLEN];
+
+        if (!country_code)
+                return error;
+
+        error = wldev_iovar_getbuf(dev, "country", &cspec, sizeof(cspec),
+                smbuf, sizeof(smbuf));
+        if (error < 0)
+                DHD_ERROR(("%s: get country failed = %d\n", __FUNCTION__, error));
+
+        if ((error < 0) ||
+            (strncmp(country_code, smbuf, WLC_CNTRY_BUF_SZ) != 0)) {
+                bzero(&scbval, sizeof(scb_val_t));
+                error = wldev_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t), 1);
+                if (error < 0) {
+                        DHD_ERROR(("%s: set country failed due to Disassoc error %d\n",
+                                __FUNCTION__, error));
+                        return error;
+                }
+        }
+        cspec.rev = -1;
+        memcpy(cspec.country_abbrev, country_code, WLC_CNTRY_BUF_SZ);
+        memcpy(cspec.ccode, country_code, WLC_CNTRY_BUF_SZ);
+        get_customized_country_code((char *)&cspec.country_abbrev, &cspec);
+        error = wldev_iovar_setbuf(dev, "country", &cspec, sizeof(cspec),
+                smbuf, sizeof(smbuf));
+        if (error < 0) {
+                DHD_ERROR(("%s: set country for %s as %s rev %d failed\n",
+                        __FUNCTION__, country_code, cspec.ccode, cspec.rev));
+                return error;
+        }
+        dhd_bus_country_set(dev, &cspec);
+        DHD_INFO(("%s: set country for %s as %s rev %d\n",
+                __FUNCTION__, country_code, cspec.ccode, cspec.rev));
+        return 0;
+}
diff --git a/drivers/net/wireless/bcmdhd/wldev_common.h b/drivers/net/wireless/bcmdhd/wldev_common.h
new file mode 100644
index 00000000000..46326803e21
--- /dev/null
+++ b/drivers/net/wireless/bcmdhd/wldev_common.h
@@ -0,0 +1,110 @@
+/*
+ * Common function shared by Linux WEXT, cfg80211 and p2p drivers
+ *
+ * Copyright (C) 1999-2011, Broadcom Corporation
+ * 
+ *         Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: wldev_common.h,v 1.1.4.1.2.14 2011-02-09 01:40:07 Exp $
+ */
+#ifndef __WLDEV_COMMON_H__
+#define __WLDEV_COMMON_H__
+
+#include <wlioctl.h>
+
+/** wl_dev_ioctl - get/set IOCTLs, will call net_device's do_ioctl (or 
+ *  netdev_ops->ndo_do_ioctl in new kernels)
+ *  @dev: the net_device handle
+ */
+s32 wldev_ioctl(
+        struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set);
+
+/** Retrieve named IOVARs, this function calls wl_dev_ioctl with 
+ *  WLC_GET_VAR IOCTL code
+ */
+s32 wldev_iovar_getbuf(
+        struct net_device *dev, s8 *iovar_name,
+        void *param, s32 paramlen, void *buf, s32 buflen);
+
+/** Set named IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_SET_VAR IOCTL code
+ */
+s32 wldev_iovar_setbuf(
+        struct net_device *dev, s8 *iovar_name,
+        void *param, s32 paramlen, void *buf, s32 buflen);
+
+s32 wldev_iovar_setint(
+        struct net_device *dev, s8 *iovar, s32 val);
+
+s32 wldev_iovar_getint(
+        struct net_device *dev, s8 *iovar, s32 *pval);
+
+/** The following function can be implemented if there is a need for bsscfg
+ *  indexed IOVARs
+ */
+
+s32 wldev_mkiovar_bsscfg(
+        const s8 *iovar_name, s8 *param, s32 paramlen,
+        s8 *iovar_buf, s32 buflen, s32 bssidx);
+
+/** Retrieve named and bsscfg indexed IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_GET_VAR IOCTL code
+ */
+s32 wldev_iovar_getbuf_bsscfg(
+        struct net_device *dev, s8 *iovar_name,
+        void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx);
+
+/** Set named and bsscfg indexed IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_SET_VAR IOCTL code
+ */
+s32 wldev_iovar_setbuf_bsscfg(
+        struct net_device *dev, s8 *iovar_name,
+        void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx);
+
+s32 wldev_iovar_getint_bsscfg(
+        struct net_device *dev, s8 *iovar, s32 *pval, s32 bssidx);
+
+s32 wldev_iovar_setint_bsscfg(
+        struct net_device *dev, s8 *iovar, s32 val, s32 bssidx);
+
+extern void get_customized_country_code(char *country_iso_code, wl_country_t *cspec);
+extern void dhd_bus_country_set(struct net_device *dev, wl_country_t *cspec);
+extern int wldev_set_country(struct net_device *dev, char *country_code);
+extern int net_os_wake_lock(struct net_device *dev);
+extern int net_os_wake_unlock(struct net_device *dev);
+extern int net_os_wake_lock_timeout(struct net_device *dev);
+extern int net_os_wake_lock_timeout_enable(struct net_device *dev, int val);
+extern int net_os_set_dtim_skip(struct net_device *dev, int val);
+extern int net_os_set_suspend_disable(struct net_device *dev, int val);
+extern int net_os_set_suspend(struct net_device *dev, int val);
+extern int wl_iw_parse_ssid_list_tlv(char** list_str, wlc_ssid_t* ssid,
+                                        int max, int *bytes_left);
+
+/* Get the link speed from dongle, speed is in kpbs */
+int wldev_get_link_speed(struct net_device *dev, int *plink_speed);
+
+int wldev_get_rssi(struct net_device *dev, int *prssi);
+
+int wldev_get_ssid(struct net_device *dev, wlc_ssid_t *pssid);
+
+int wldev_get_band(struct net_device *dev, uint *pband);
+
+int wldev_set_band(struct net_device *dev, uint band);
+
+#endif /* __WLDEV_COMMON_H__ */