109 files changed, 50003 insertions, 0 deletions

diff --git a/drivers/staging/ath6kl/Kconfig b/drivers/staging/ath6kl/Kconfig
new file mode 100644
index 00000000000..afd6cc16a2b
--- /dev/null
+++ b/drivers/staging/ath6kl/Kconfig
@@ -0,0 +1,158 @@
+config ATH6K_LEGACY
+        tristate "Atheros AR6003 support (non mac80211)"
+        depends on MMC && WLAN
+        depends on CFG80211
+        select WIRELESS_EXT
+        select WEXT_PRIV
+        help
+        This module adds support for wireless adapters based on Atheros AR6003 chipset running over SDIO. If you choose to build it as a module, it will be called ath6kl. Pls note that AR6002 and AR6001 are not supported by this driver.
+
+choice
+        prompt "AR6003 Board Data Configuration"
+        depends on ATH6K_LEGACY
+        default AR600x_SD31_XXX
+        help
+        Select the appropriate board data template from the list below that matches your AR6003 based reference design.
+
+config AR600x_SD31_XXX
+        bool "SD31-xxx"
+        help
+        Board Data file for a standard SD31 reference design (File: bdata.SD31.bin)
+
+config AR600x_WB31_XXX
+        bool "WB31-xxx"
+        help
+        Board Data file for a standard WB31 (BT/WiFi) reference design (File: bdata.WB31.bin)
+
+config AR600x_SD32_XXX
+        bool "SD32-xxx"
+        help
+        Board Data file for a standard SD32 (5GHz) reference design (File: bdata.SD32.bin)
+
+config AR600x_CUSTOM_XXX
+        bool "CUSTOM-xxx"
+        help
+        Board Data file for a custom reference design (File: should be named as bdata.CUSTOM.bin)
+endchoice
+
+config ATH6KL_ENABLE_COEXISTENCE
+        bool "BT Coexistence support"
+        depends on ATH6K_LEGACY
+        help
+        Enables WLAN/BT coexistence support. Select the apprpriate configuration from below.
+
+choice
+        prompt "Front-End Antenna Configuration"
+        depends on ATH6KL_ENABLE_COEXISTENCE
+        default AR600x_DUAL_ANTENNA
+        help
+        Indicates the number of antennas being used by BT and WLAN. Select the appropriate configuration from the list below that matches your AR6003 based reference design.
+
+config AR600x_DUAL_ANTENNA
+        bool "Dual Antenna"
+        help
+        Dual Antenna Design
+
+config AR600x_SINGLE_ANTENNA
+        bool "Single Antenna"
+        help
+        Single Antenna Design
+endchoice
+
+choice
+        prompt "Collocated Bluetooth Type"
+        depends on ATH6KL_ENABLE_COEXISTENCE
+        default AR600x_BT_AR3001
+        help
+        Select the appropriate configuration from the list below that matches your AR6003 based reference design.
+
+config AR600x_BT_QCOM
+        bool "Qualcomm BTS4020X"
+        help
+        Qualcomm BT (3 Wire PTA)
+
+config AR600x_BT_CSR
+        bool "CSR BC06"
+        help
+        CSR BT (3 Wire PTA)
+
+config AR600x_BT_AR3001
+        bool "Atheros AR3001"
+        help
+        Atheros BT (3 Wire PTA)
+endchoice
+
+config ATH6KL_HCI_BRIDGE
+        bool "HCI over SDIO support"
+        depends on ATH6K_LEGACY
+        help
+        Enables BT over SDIO. Applicable only for combo designs (eg: WB31)
+
+config ATH6KL_CONFIG_GPIO_BT_RESET
+        bool "Configure BT Reset GPIO"
+        depends on ATH6KL_HCI_BRIDGE
+        help
+        Configure a WLAN GPIO for use with BT.
+
+config AR600x_BT_RESET_PIN
+        int "GPIO"
+        depends on ATH6KL_CONFIG_GPIO_BT_RESET
+        default 22
+        help
+        WLAN GPIO to be used for resetting BT
+
+config ATH6KL_HTC_RAW_INTERFACE
+        bool "RAW HTC support"
+        depends on ATH6K_LEGACY
+        help
+        Enables raw HTC interface. Allows application to directly talk to the HTC interface via the ioctl interface
+
+config ATH6KL_VIRTUAL_SCATTER_GATHER
+        bool "Virtual Scatter-Gather support"
+        depends on ATH6K_LEGACY
+        help
+        Enables virtual scatter gather support for the hardware that does not support it natively.
+
+config ATH6KL_SKIP_ABI_VERSION_CHECK
+        bool "Skip ABI version check support"
+        depends on ATH6K_LEGACY
+        help
+        Forces the driver to disable ABI version check. Caution: Incompatilbity between the host driver and target firmware may lead to unknown side effects.
+
+config ATH6KL_BT_UART_FC_POLARITY
+        int "UART Flow Control Polarity"
+        depends on ATH6KL_LEGACY
+        default 0
+        help
+        Configures the polarity of UART Flow Control. A value of 0 implies active low and is the default setting. Set it to 1 for active high.
+
+config ATH6KL_DEBUG
+        bool "Debug support"
+        depends on ATH6K_LEGACY
+        help
+        Enables debug support
+
+config ATH6KL_ENABLE_HOST_DEBUG
+        bool "Host Debug support"
+        depends on ATH6KL_DEBUG
+        help
+        Enables debug support in the driver
+
+config ATH6KL_ENABLE_TARGET_DEBUG_PRINTS
+        bool "Target Debug support - Enable UART prints"
+        depends on ATH6KL_DEBUG
+        help
+        Enables uart prints
+
+config AR600x_DEBUG_UART_TX_PIN
+        int "GPIO"
+        depends on ATH6KL_ENABLE_TARGET_DEBUG_PRINTS
+        default 8
+        help
+        WLAN GPIO to be used for Debug UART (Tx)
+
+config ATH6KL_DISABLE_TARGET_DBGLOGS
+        bool "Target Debug support - Disable Debug logs"
+        depends on ATH6KL_DEBUG
+        help
+        Enables debug logs
diff --git a/drivers/staging/ath6kl/Makefile b/drivers/staging/ath6kl/Makefile
new file mode 100644
index 00000000000..1d3f2390a17
--- /dev/null
+++ b/drivers/staging/ath6kl/Makefile
@@ -0,0 +1,122 @@
+#------------------------------------------------------------------------------
+# Copyright (c) 2004-2010 Atheros Communications Inc.
+# All rights reserved.
+#
+# 
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+#
+#
+# Author(s): ="Atheros"
+#------------------------------------------------------------------------------
+
+ccflags-y += -I$(obj)/include
+ccflags-y += -I$(obj)/include/common
+ccflags-y += -I$(obj)/wlan/include
+ccflags-y += -I$(obj)/os/linux/include
+ccflags-y += -I$(obj)/os
+ccflags-y += -I$(obj)/bmi/include
+ccflags-y += -I$(obj)/include/common/AR6002/hw4.0
+
+ifeq ($(CONFIG_AR600x_DUAL_ANTENNA),y)
+ccflags-y += -DAR600x_DUAL_ANTENNA
+endif
+
+ifeq ($(CONFIG_AR600x_SINGLE_ANTENNA),y)
+ccflags-y += -DAR600x_SINGLE_ANTENNA
+endif
+
+ifeq ($(CONFIG_AR600x_BT_QCOM),y)
+ccflags-y += -DAR600x_BT_QCOM
+endif
+
+ifeq ($(CONFIG_AR600x_BT_CSR),y)
+ccflags-y += -DAR600x_BT_CSR
+endif
+
+ifeq ($(CONFIG_AR600x_BT_AR3001),y)
+ccflags-y += -DAR600x_BT_AR3001
+endif
+
+ifeq ($(CONFIG_ATH6KL_HCI_BRIDGE),y)
+ccflags-y += -DATH_AR6K_ENABLE_GMBOX
+ccflags-y += -DHCI_TRANSPORT_SDIO
+ccflags-y += -DSETUPHCI_ENABLED
+ccflags-y += -DSETUPBTDEV_ENABLED
+ath6kl-y += htc2/AR6000/ar6k_gmbox.o
+ath6kl-y += htc2/AR6000/ar6k_gmbox_hciuart.o
+ath6kl-y += miscdrv/ar3kconfig.o
+ath6kl-y += miscdrv/ar3kps/ar3kpsconfig.o
+ath6kl-y += miscdrv/ar3kps/ar3kpsparser.o
+endif
+
+ifeq ($(CONFIG_ATH6KL_CONFIG_GPIO_BT_RESET),y)
+ccflags-y += -DATH6KL_CONFIG_GPIO_BT_RESET
+endif
+
+ifeq ($(CONFIG_ATH6KL_HTC_RAW_INTERFACE),y)
+ccflags-y += -DHTC_RAW_INTERFACE
+endif
+
+ifeq ($(CONFIG_ATH6KL_ENABLE_HOST_DEBUG),y)
+ccflags-y += -DDEBUG
+ccflags-y += -DATH_DEBUG_MODULE
+endif
+
+ifeq ($(CONFIG_ATH6KL_ENABLE_TARGET_DEBUG_PRINTS),y)
+ccflags-y += -DENABLEUARTPRINT_SET
+endif
+
+ifeq ($(CONFIG_ATH6KL_DISABLE_TARGET_DBGLOGS),y)
+ccflags-y += -DATH6KL_DISABLE_TARGET_DBGLOGS
+endif
+
+ifeq ($(CONFIG_ATH6KL_VIRTUAL_SCATTER_GATHER),y)
+ccflags-y += -DATH6KL_CONFIG_HIF_VIRTUAL_SCATTER
+endif
+
+ifeq ($(CONFIG_ATH6KL_SKIP_ABI_VERSION_CHECK),y)
+ccflags-y += -DATH6KL_SKIP_ABI_VERSION_CHECK
+endif
+
+ccflags-y += -DWAPI_ENABLE
+ccflags-y += -DCHECKSUM_OFFLOAD
+
+obj-$(CONFIG_ATH6K_LEGACY) := ath6kl.o
+ath6kl-y += htc2/AR6000/ar6k.o
+ath6kl-y += htc2/AR6000/ar6k_events.o
+ath6kl-y += htc2/htc_send.o
+ath6kl-y += htc2/htc_recv.o
+ath6kl-y += htc2/htc_services.o
+ath6kl-y += htc2/htc.o
+ath6kl-y += bmi/src/bmi.o
+ath6kl-y += os/linux/cfg80211.o
+ath6kl-y += os/linux/ar6000_drv.o
+ath6kl-y += os/linux/ar6000_raw_if.o
+ath6kl-y += os/linux/ar6000_pm.o
+ath6kl-y += os/linux/netbuf.o
+ath6kl-y += os/linux/hci_bridge.o
+ath6kl-y += miscdrv/common_drv.o
+ath6kl-y += miscdrv/credit_dist.o
+ath6kl-y += wmi/wmi.o
+ath6kl-y += reorder/rcv_aggr.o
+ath6kl-y += wlan/src/wlan_node.o
+ath6kl-y += wlan/src/wlan_recv_beacon.o
+ath6kl-y += wlan/src/wlan_utils.o                        
+
+# ATH_HIF_TYPE := sdio
+ccflags-y += -I$(obj)/hif/sdio/linux_sdio/include
+ccflags-y += -DSDIO
+ath6kl-y += hif/sdio/linux_sdio/src/hif.o
+ath6kl-y += hif/sdio/linux_sdio/src/hif_scatter.o
diff --git a/drivers/staging/ath6kl/TODO b/drivers/staging/ath6kl/TODO
new file mode 100644
index 00000000000..7be4b46ebb5
--- /dev/null
+++ b/drivers/staging/ath6kl/TODO
@@ -0,0 +1,25 @@
+TODO:
+
+We are working hard on cleaning up the driver. There's sooooooooo much todo
+so instead of editing this file please use the wiki:
+
+http://wireless.kernel.org/en/users/Drivers/ath6kl
+
+There's a respective TODO page there. Please also subscribe to the wiki page
+to get e-mail updates on changes.
+
+IRC:
+
+We *really* need to coordinate development for ath6kl as the cleanup
+patches will break pretty much any other patches. Please use IRC to
+help coordinate better:
+
+irc.freenode.net
+#ath6kl
+
+Send patches to:
+
+        - Greg Kroah-Hartman <greg@kroah.com>
+        - Luis R. Rodriguez <mcgrof@gmail.com>
+        - Joe Perches <joe@perches.com>
+        - Naveen Singh <nsingh@atheros.com>
diff --git a/drivers/staging/ath6kl/bmi/include/bmi_internal.h b/drivers/staging/ath6kl/bmi/include/bmi_internal.h
new file mode 100644
index 00000000000..8e2577074d6
--- /dev/null
+++ b/drivers/staging/ath6kl/bmi/include/bmi_internal.h
@@ -0,0 +1,54 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef BMI_INTERNAL_H
+#define BMI_INTERNAL_H
+
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_osapi.h"
+#define ATH_MODULE_NAME bmi
+#include "a_debug.h"
+#include "hw/mbox_host_reg.h"
+#include "bmi_msg.h"
+
+#define ATH_DEBUG_BMI  ATH_DEBUG_MAKE_MODULE_MASK(0)
+
+
+#define BMI_COMMUNICATION_TIMEOUT       100000
+
+/* ------ Global Variable Declarations ------- */
+static bool bmiDone;
+
+int
+bmiBufferSend(struct hif_device *device,
+              u8 *buffer,
+              u32 length);
+
+int
+bmiBufferReceive(struct hif_device *device,
+                 u8 *buffer,
+                 u32 length,
+                 bool want_timeout);
+
+#endif
diff --git a/drivers/staging/ath6kl/bmi/src/bmi.c b/drivers/staging/ath6kl/bmi/src/bmi.c
new file mode 100644
index 00000000000..f1f085eba9c
--- /dev/null
+++ b/drivers/staging/ath6kl/bmi/src/bmi.c
@@ -0,0 +1,1010 @@
+//------------------------------------------------------------------------------
+// <copyright file="bmi.c" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+
+#ifdef THREAD_X
+#include <string.h>
+#endif
+
+#include "hif.h"
+#include "bmi.h"
+#include "htc_api.h"
+#include "bmi_internal.h"
+
+#ifdef ATH_DEBUG_MODULE
+static struct ath_debug_mask_description bmi_debug_desc[] = {
+    { ATH_DEBUG_BMI , "BMI Tracing"},
+};
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(bmi,
+                                 "bmi",
+                                 "Boot Manager Interface",
+                                 ATH_DEBUG_MASK_DEFAULTS,
+                                 ATH_DEBUG_DESCRIPTION_COUNT(bmi_debug_desc),
+                                 bmi_debug_desc);
+                                 
+#endif
+
+/*
+Although we had envisioned BMI to run on top of HTC, this is not how the
+final implementation ended up. On the Target side, BMI is a part of the BSP
+and does not use the HTC protocol nor even DMA -- it is intentionally kept
+very simple.
+*/
+
+static bool pendingEventsFuncCheck = false;
+static u32 *pBMICmdCredits;
+static u8 *pBMICmdBuf;
+#define MAX_BMI_CMDBUF_SZ (BMI_DATASZ_MAX + \
+                       sizeof(u32) /* cmd */ + \
+                       sizeof(u32) /* addr */ + \
+                       sizeof(u32))/* length */
+#define BMI_COMMAND_FITS(sz) ((sz) <= MAX_BMI_CMDBUF_SZ)
+    
+/* APIs visible to the driver */
+void
+BMIInit(void)
+{
+    bmiDone = false;
+    pendingEventsFuncCheck = false;
+
+    /*
+     * On some platforms, it's not possible to DMA to a static variable
+     * in a device driver (e.g. Linux loadable driver module).
+     * So we need to A_MALLOC space for "command credits" and for commands.
+     *
+     * Note: implicitly relies on A_MALLOC to provide a buffer that is
+     * suitable for DMA (or PIO).  This buffer will be passed down the
+     * bus stack.
+     */
+    if (!pBMICmdCredits) {
+        pBMICmdCredits = (u32 *)A_MALLOC_NOWAIT(4);
+        A_ASSERT(pBMICmdCredits);
+    }
+
+    if (!pBMICmdBuf) {
+        pBMICmdBuf = (u8 *)A_MALLOC_NOWAIT(MAX_BMI_CMDBUF_SZ);
+        A_ASSERT(pBMICmdBuf);
+    }
+    
+    A_REGISTER_MODULE_DEBUG_INFO(bmi);
+}
+
+void
+BMICleanup(void)
+{
+    if (pBMICmdCredits) {
+        kfree(pBMICmdCredits);
+        pBMICmdCredits = NULL;
+    }
+
+    if (pBMICmdBuf) {
+        kfree(pBMICmdBuf);
+        pBMICmdBuf = NULL;
+    }
+}
+
+int
+BMIDone(struct hif_device *device)
+{
+    int status;
+    u32 cid;
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF (ATH_DEBUG_BMI, ("BMIDone skipped\n"));
+        return 0;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Enter (device: 0x%p)\n", device));
+    bmiDone = true;
+    cid = BMI_DONE;
+
+    status = bmiBufferSend(device, (u8 *)&cid, sizeof(cid));
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+        return A_ERROR;
+    }
+
+    if (pBMICmdCredits) {
+        kfree(pBMICmdCredits);
+        pBMICmdCredits = NULL;
+    }
+
+    if (pBMICmdBuf) {
+        kfree(pBMICmdBuf);
+        pBMICmdBuf = NULL;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Exit\n"));
+
+    return 0;
+}
+
+int
+BMIGetTargetInfo(struct hif_device *device, struct bmi_target_info *targ_info)
+{
+    int status;
+    u32 cid;
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Enter (device: 0x%p)\n", device));
+    cid = BMI_GET_TARGET_INFO;
+
+    status = bmiBufferSend(device, (u8 *)&cid, sizeof(cid));
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+        return A_ERROR;
+    }
+
+    status = bmiBufferReceive(device, (u8 *)&targ_info->target_ver,
+                                                sizeof(targ_info->target_ver), true);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Version from the device\n"));
+        return A_ERROR;
+    }
+
+    if (targ_info->target_ver == TARGET_VERSION_SENTINAL) {
+        /* Determine how many bytes are in the Target's targ_info */
+        status = bmiBufferReceive(device, (u8 *)&targ_info->target_info_byte_count,
+                                            sizeof(targ_info->target_info_byte_count), true);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Info Byte Count from the device\n"));
+            return A_ERROR;
+        }
+
+        /*
+         * The Target's targ_info doesn't match the Host's targ_info.
+         * We need to do some backwards compatibility work to make this OK.
+         */
+        A_ASSERT(targ_info->target_info_byte_count == sizeof(*targ_info));
+
+        /* Read the remainder of the targ_info */
+        status = bmiBufferReceive(device,
+                        ((u8 *)targ_info)+sizeof(targ_info->target_info_byte_count),
+                        sizeof(*targ_info)-sizeof(targ_info->target_info_byte_count), true);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Info (%d bytes) from the device\n",
+                                                                targ_info->target_info_byte_count));
+            return A_ERROR;
+        }
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Exit (ver: 0x%x type: 0x%x)\n",
+                                                                targ_info->target_ver, targ_info->target_type));
+
+    return 0;
+}
+
+int
+BMIReadMemory(struct hif_device *device,
+              u32 address,
+              u8 *buffer,
+              u32 length)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+    u32 remaining, rxlen;
+
+    A_ASSERT(BMI_COMMAND_FITS(BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length)));
+    memset (pBMICmdBuf, 0, BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length));
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+                        ("BMI Read Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
+                                device, address, length));
+
+    cid = BMI_READ_MEMORY;
+
+    remaining = length;
+
+    while (remaining)
+    {
+        rxlen = (remaining < BMI_DATASZ_MAX) ? remaining : BMI_DATASZ_MAX;
+        offset = 0;
+        memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+        offset += sizeof(cid);
+        memcpy(&(pBMICmdBuf[offset]), &address, sizeof(address));
+        offset += sizeof(address);
+        memcpy(&(pBMICmdBuf[offset]), &rxlen, sizeof(rxlen));
+        offset += sizeof(length);
+
+        status = bmiBufferSend(device, pBMICmdBuf, offset);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+            return A_ERROR;
+        }
+        status = bmiBufferReceive(device, pBMICmdBuf, rxlen, true);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
+            return A_ERROR;
+        }
+        memcpy(&buffer[length - remaining], pBMICmdBuf, rxlen);
+        remaining -= rxlen; address += rxlen;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read Memory: Exit\n"));
+    return 0;
+}
+
+int
+BMIWriteMemory(struct hif_device *device,
+               u32 address,
+               u8 *buffer,
+               u32 length)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+    u32 remaining, txlen;
+    const u32 header = sizeof(cid) + sizeof(address) + sizeof(length);
+    u8 alignedBuffer[BMI_DATASZ_MAX];
+    u8 *src;
+
+    A_ASSERT(BMI_COMMAND_FITS(BMI_DATASZ_MAX + header));
+    memset (pBMICmdBuf, 0, BMI_DATASZ_MAX + header);
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+         ("BMI Write Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
+         device, address, length));
+
+    cid = BMI_WRITE_MEMORY;
+
+    remaining = length;
+    while (remaining)
+    {
+        src = &buffer[length - remaining];
+        if (remaining < (BMI_DATASZ_MAX - header)) {
+            if (remaining & 3) {
+                /* align it with 4 bytes */
+                remaining = remaining + (4 - (remaining & 3));
+                memcpy(alignedBuffer, src, remaining);
+                src = alignedBuffer;
+            } 
+            txlen = remaining;
+        } else {
+            txlen = (BMI_DATASZ_MAX - header);
+        }
+        offset = 0;
+        memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+        offset += sizeof(cid);
+        memcpy(&(pBMICmdBuf[offset]), &address, sizeof(address));
+        offset += sizeof(address);
+        memcpy(&(pBMICmdBuf[offset]), &txlen, sizeof(txlen));
+        offset += sizeof(txlen);
+        memcpy(&(pBMICmdBuf[offset]), src, txlen);
+        offset += txlen;
+        status = bmiBufferSend(device, pBMICmdBuf, offset);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+            return A_ERROR;
+        }
+        remaining -= txlen; address += txlen;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Write Memory: Exit\n"));
+
+    return 0;
+}
+
+int
+BMIExecute(struct hif_device *device,
+           u32 address,
+           u32 *param)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+
+    A_ASSERT(BMI_COMMAND_FITS(sizeof(cid) + sizeof(address) + sizeof(param)));
+    memset (pBMICmdBuf, 0, sizeof(cid) + sizeof(address) + sizeof(param));
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+       ("BMI Execute: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
+        device, address, *param));
+
+    cid = BMI_EXECUTE;
+
+    offset = 0;
+    memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+    offset += sizeof(cid);
+    memcpy(&(pBMICmdBuf[offset]), &address, sizeof(address));
+    offset += sizeof(address);
+    memcpy(&(pBMICmdBuf[offset]), param, sizeof(*param));
+    offset += sizeof(*param);
+    status = bmiBufferSend(device, pBMICmdBuf, offset);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+        return A_ERROR;
+    }
+
+    status = bmiBufferReceive(device, pBMICmdBuf, sizeof(*param), false);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
+        return A_ERROR;
+    }
+
+    memcpy(param, pBMICmdBuf, sizeof(*param));
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Execute: Exit (param: %d)\n", *param));
+    return 0;
+}
+
+int
+BMISetAppStart(struct hif_device *device,
+               u32 address)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+
+    A_ASSERT(BMI_COMMAND_FITS(sizeof(cid) + sizeof(address)));
+    memset (pBMICmdBuf, 0, sizeof(cid) + sizeof(address));
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+       ("BMI Set App Start: Enter (device: 0x%p, address: 0x%x)\n",
+        device, address));
+
+    cid = BMI_SET_APP_START;
+
+    offset = 0;
+    memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+    offset += sizeof(cid);
+    memcpy(&(pBMICmdBuf[offset]), &address, sizeof(address));
+    offset += sizeof(address);
+    status = bmiBufferSend(device, pBMICmdBuf, offset);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Set App Start: Exit\n"));
+    return 0;
+}
+
+int
+BMIReadSOCRegister(struct hif_device *device,
+                   u32 address,
+                   u32 *param)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+
+    A_ASSERT(BMI_COMMAND_FITS(sizeof(cid) + sizeof(address)));
+    memset (pBMICmdBuf, 0, sizeof(cid) + sizeof(address));
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+       ("BMI Read SOC Register: Enter (device: 0x%p, address: 0x%x)\n",
+       device, address));
+
+    cid = BMI_READ_SOC_REGISTER;
+
+    offset = 0;
+    memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+    offset += sizeof(cid);
+    memcpy(&(pBMICmdBuf[offset]), &address, sizeof(address));
+    offset += sizeof(address);
+
+    status = bmiBufferSend(device, pBMICmdBuf, offset);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+        return A_ERROR;
+    }
+
+    status = bmiBufferReceive(device, pBMICmdBuf, sizeof(*param), true);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
+        return A_ERROR;
+    }
+    memcpy(param, pBMICmdBuf, sizeof(*param));
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read SOC Register: Exit (value: %d)\n", *param));
+    return 0;
+}
+
+int
+BMIWriteSOCRegister(struct hif_device *device,
+                    u32 address,
+                    u32 param)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+
+    A_ASSERT(BMI_COMMAND_FITS(sizeof(cid) + sizeof(address) + sizeof(param)));
+    memset (pBMICmdBuf, 0, sizeof(cid) + sizeof(address) + sizeof(param));
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+     ("BMI Write SOC Register: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
+     device, address, param));
+
+    cid = BMI_WRITE_SOC_REGISTER;
+
+    offset = 0;
+    memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+    offset += sizeof(cid);
+    memcpy(&(pBMICmdBuf[offset]), &address, sizeof(address));
+    offset += sizeof(address);
+    memcpy(&(pBMICmdBuf[offset]), &param, sizeof(param));
+    offset += sizeof(param);
+    status = bmiBufferSend(device, pBMICmdBuf, offset);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read SOC Register: Exit\n"));
+    return 0;
+}
+
+int
+BMIrompatchInstall(struct hif_device *device,
+                   u32 ROM_addr,
+                   u32 RAM_addr,
+                   u32 nbytes,
+                   u32 do_activate,
+                   u32 *rompatch_id)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+
+    A_ASSERT(BMI_COMMAND_FITS(sizeof(cid) + sizeof(ROM_addr) + sizeof(RAM_addr) +
+                                sizeof(nbytes) + sizeof(do_activate)));
+    memset(pBMICmdBuf, 0, sizeof(cid) + sizeof(ROM_addr) + sizeof(RAM_addr) +
+                        sizeof(nbytes) + sizeof(do_activate));
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+         ("BMI rompatch Install: Enter (device: 0x%p, ROMaddr: 0x%x, RAMaddr: 0x%x length: %d activate: %d)\n",
+         device, ROM_addr, RAM_addr, nbytes, do_activate));
+
+    cid = BMI_ROMPATCH_INSTALL;
+
+    offset = 0;
+    memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+    offset += sizeof(cid);
+    memcpy(&(pBMICmdBuf[offset]), &ROM_addr, sizeof(ROM_addr));
+    offset += sizeof(ROM_addr);
+    memcpy(&(pBMICmdBuf[offset]), &RAM_addr, sizeof(RAM_addr));
+    offset += sizeof(RAM_addr);
+    memcpy(&(pBMICmdBuf[offset]), &nbytes, sizeof(nbytes));
+    offset += sizeof(nbytes);
+    memcpy(&(pBMICmdBuf[offset]), &do_activate, sizeof(do_activate));
+    offset += sizeof(do_activate);
+    status = bmiBufferSend(device, pBMICmdBuf, offset);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+        return A_ERROR;
+    }
+
+    status = bmiBufferReceive(device, pBMICmdBuf, sizeof(*rompatch_id), true);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
+        return A_ERROR;
+    }
+    memcpy(rompatch_id, pBMICmdBuf, sizeof(*rompatch_id));
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI rompatch Install: (rompatch_id=%d)\n", *rompatch_id));
+    return 0;
+}
+
+int
+BMIrompatchUninstall(struct hif_device *device,
+                     u32 rompatch_id)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+
+    A_ASSERT(BMI_COMMAND_FITS(sizeof(cid) + sizeof(rompatch_id)));
+    memset (pBMICmdBuf, 0, sizeof(cid) + sizeof(rompatch_id));
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+         ("BMI rompatch Uninstall: Enter (device: 0x%p, rompatch_id: %d)\n",
+                                                                         device, rompatch_id));
+
+    cid = BMI_ROMPATCH_UNINSTALL;
+
+    offset = 0;
+    memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+    offset += sizeof(cid);
+    memcpy(&(pBMICmdBuf[offset]), &rompatch_id, sizeof(rompatch_id));
+    offset += sizeof(rompatch_id);
+    status = bmiBufferSend(device, pBMICmdBuf, offset);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI rompatch UNinstall: (rompatch_id=0x%x)\n", rompatch_id));
+    return 0;
+}
+
+static int
+_BMIrompatchChangeActivation(struct hif_device *device,
+                             u32 rompatch_count,
+                             u32 *rompatch_list,
+                             u32 do_activate)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+    u32 length;
+
+    A_ASSERT(BMI_COMMAND_FITS(BMI_DATASZ_MAX + sizeof(cid) + sizeof(rompatch_count)));
+    memset(pBMICmdBuf, 0, BMI_DATASZ_MAX + sizeof(cid) + sizeof(rompatch_count));
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+         ("BMI Change rompatch Activation: Enter (device: 0x%p, count: %d)\n",
+           device, rompatch_count));
+
+    cid = do_activate ? BMI_ROMPATCH_ACTIVATE : BMI_ROMPATCH_DEACTIVATE;
+
+    offset = 0;
+    memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+    offset += sizeof(cid);
+    memcpy(&(pBMICmdBuf[offset]), &rompatch_count, sizeof(rompatch_count));
+    offset += sizeof(rompatch_count);
+    length = rompatch_count * sizeof(*rompatch_list);
+    memcpy(&(pBMICmdBuf[offset]), rompatch_list, length);
+    offset += length;
+    status = bmiBufferSend(device, pBMICmdBuf, offset);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Change rompatch Activation: Exit\n"));
+
+    return 0;
+}
+
+int
+BMIrompatchActivate(struct hif_device *device,
+                    u32 rompatch_count,
+                    u32 *rompatch_list)
+{
+    return _BMIrompatchChangeActivation(device, rompatch_count, rompatch_list, 1);
+}
+
+int
+BMIrompatchDeactivate(struct hif_device *device,
+                      u32 rompatch_count,
+                      u32 *rompatch_list)
+{
+    return _BMIrompatchChangeActivation(device, rompatch_count, rompatch_list, 0);
+}
+
+int
+BMILZData(struct hif_device *device,
+          u8 *buffer,
+          u32 length)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+    u32 remaining, txlen;
+    const u32 header = sizeof(cid) + sizeof(length);
+
+    A_ASSERT(BMI_COMMAND_FITS(BMI_DATASZ_MAX+header));
+    memset (pBMICmdBuf, 0, BMI_DATASZ_MAX+header);
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+         ("BMI Send LZ Data: Enter (device: 0x%p, length: %d)\n",
+         device, length));
+
+    cid = BMI_LZ_DATA;
+
+    remaining = length;
+    while (remaining)
+    {
+        txlen = (remaining < (BMI_DATASZ_MAX - header)) ?
+                                       remaining : (BMI_DATASZ_MAX - header);
+        offset = 0;
+        memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+        offset += sizeof(cid);
+        memcpy(&(pBMICmdBuf[offset]), &txlen, sizeof(txlen));
+        offset += sizeof(txlen);
+        memcpy(&(pBMICmdBuf[offset]), &buffer[length - remaining], txlen);
+        offset += txlen;
+        status = bmiBufferSend(device, pBMICmdBuf, offset);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
+            return A_ERROR;
+        }
+        remaining -= txlen;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI LZ Data: Exit\n"));
+
+    return 0;
+}
+
+int
+BMILZStreamStart(struct hif_device *device,
+                 u32 address)
+{
+    u32 cid;
+    int status;
+    u32 offset;
+
+    A_ASSERT(BMI_COMMAND_FITS(sizeof(cid) + sizeof(address)));
+    memset (pBMICmdBuf, 0, sizeof(cid) + sizeof(address));
+
+    if (bmiDone) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
+         ("BMI LZ Stream Start: Enter (device: 0x%p, address: 0x%x)\n",
+         device, address));
+
+    cid = BMI_LZ_STREAM_START;
+    offset = 0;
+    memcpy(&(pBMICmdBuf[offset]), &cid, sizeof(cid));
+    offset += sizeof(cid);
+    memcpy(&(pBMICmdBuf[offset]), &address, sizeof(address));
+    offset += sizeof(address);
+    status = bmiBufferSend(device, pBMICmdBuf, offset);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to Start LZ Stream to the device\n"));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI LZ Stream Start: Exit\n"));
+
+    return 0;
+}
+
+/* BMI Access routines */
+int
+bmiBufferSend(struct hif_device *device,
+              u8 *buffer,
+              u32 length)
+{
+    int status;
+    u32 timeout;
+    u32 address;
+    u32 mboxAddress[HTC_MAILBOX_NUM_MAX];
+
+    HIFConfigureDevice(device, HIF_DEVICE_GET_MBOX_ADDR,
+                       &mboxAddress[0], sizeof(mboxAddress));
+
+    *pBMICmdCredits = 0;
+    timeout = BMI_COMMUNICATION_TIMEOUT;
+
+    while(timeout-- && !(*pBMICmdCredits)) {
+        /* Read the counter register to get the command credits */
+        address = COUNT_DEC_ADDRESS + (HTC_MAILBOX_NUM_MAX + ENDPOINT1) * 4;
+        /* hit the credit counter with a 4-byte access, the first byte read will hit the counter and cause
+         * a decrement, while the remaining 3 bytes has no effect.  The rationale behind this is to
+         * make all HIF accesses 4-byte aligned */
+        status = HIFReadWrite(device, address, (u8 *)pBMICmdCredits, 4,
+            HIF_RD_SYNC_BYTE_INC, NULL);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to decrement the command credit count register\n"));
+            return A_ERROR;
+        }
+        /* the counter is only 8=bits, ignore anything in the upper 3 bytes */
+        (*pBMICmdCredits) &= 0xFF;
+    }
+
+    if (*pBMICmdCredits) {
+        address = mboxAddress[ENDPOINT1];
+        status = HIFReadWrite(device, address, buffer, length,
+            HIF_WR_SYNC_BYTE_INC, NULL);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to send the BMI data to the device\n"));
+            return A_ERROR;
+        }
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI Communication timeout - bmiBufferSend\n"));
+        return A_ERROR;
+    }
+
+    return status;
+}
+
+int
+bmiBufferReceive(struct hif_device *device,
+                 u8 *buffer,
+                 u32 length,
+                 bool want_timeout)
+{
+    int status;
+    u32 address;
+    u32 mboxAddress[HTC_MAILBOX_NUM_MAX];
+    struct hif_pending_events_info     hifPendingEvents;
+    static HIF_PENDING_EVENTS_FUNC getPendingEventsFunc = NULL;
+    
+    if (!pendingEventsFuncCheck) {
+            /* see if the HIF layer implements an alternative function to get pending events
+             * do this only once! */
+        HIFConfigureDevice(device,
+                           HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
+                           &getPendingEventsFunc,
+                           sizeof(getPendingEventsFunc));
+        pendingEventsFuncCheck = true;
+    }
+                       
+    HIFConfigureDevice(device, HIF_DEVICE_GET_MBOX_ADDR,
+                       &mboxAddress[0], sizeof(mboxAddress));
+
+    /*
+     * During normal bootup, small reads may be required.
+     * Rather than issue an HIF Read and then wait as the Target
+     * adds successive bytes to the FIFO, we wait here until
+     * we know that response data is available.
+     *
+     * This allows us to cleanly timeout on an unexpected
+     * Target failure rather than risk problems at the HIF level.  In
+     * particular, this avoids SDIO timeouts and possibly garbage
+     * data on some host controllers.  And on an interconnect
+     * such as Compact Flash (as well as some SDIO masters) which
+     * does not provide any indication on data timeout, it avoids
+     * a potential hang or garbage response.
+     *
+     * Synchronization is more difficult for reads larger than the
+     * size of the MBOX FIFO (128B), because the Target is unable
+     * to push the 129th byte of data until AFTER the Host posts an
+     * HIF Read and removes some FIFO data.  So for large reads the
+     * Host proceeds to post an HIF Read BEFORE all the data is
+     * actually available to read.  Fortunately, large BMI reads do
+     * not occur in practice -- they're supported for debug/development.
+     *
+     * So Host/Target BMI synchronization is divided into these cases:
+     *  CASE 1: length < 4
+     *        Should not happen
+     *
+     *  CASE 2: 4 <= length <= 128
+     *        Wait for first 4 bytes to be in FIFO
+     *        If CONSERVATIVE_BMI_READ is enabled, also wait for
+     *        a BMI command credit, which indicates that the ENTIRE
+     *        response is available in the the FIFO
+     *
+     *  CASE 3: length > 128
+     *        Wait for the first 4 bytes to be in FIFO
+     *
+     * For most uses, a small timeout should be sufficient and we will
+     * usually see a response quickly; but there may be some unusual
+     * (debug) cases of BMI_EXECUTE where we want an larger timeout.
+     * For now, we use an unbounded busy loop while waiting for
+     * BMI_EXECUTE.
+     *
+     * If BMI_EXECUTE ever needs to support longer-latency execution,
+     * especially in production, this code needs to be enhanced to sleep
+     * and yield.  Also note that BMI_COMMUNICATION_TIMEOUT is currently
+     * a function of Host processor speed.
+     */
+    if (length >= 4) { /* NB: Currently, always true */
+        /*
+         * NB: word_available is declared static for esoteric reasons
+         * having to do with protection on some OSes.
+         */
+        static u32 word_available;
+        u32 timeout;
+
+        word_available = 0;
+        timeout = BMI_COMMUNICATION_TIMEOUT;
+        while((!want_timeout || timeout--) && !word_available) {
+            
+            if (getPendingEventsFunc != NULL) {
+                status = getPendingEventsFunc(device,
+                                              &hifPendingEvents,
+                                              NULL);
+                if (status) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMI: Failed to get pending events \n"));
+                    break;
+                }
+  
+                if (hifPendingEvents.AvailableRecvBytes >= sizeof(u32)) {
+                    word_available = 1;    
+                }
+                continue;    
+            }
+            
+            status = HIFReadWrite(device, RX_LOOKAHEAD_VALID_ADDRESS, (u8 *)&word_available,
+                sizeof(word_available), HIF_RD_SYNC_BYTE_INC, NULL);
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read RX_LOOKAHEAD_VALID register\n"));
+                return A_ERROR;
+            }
+            /* We did a 4-byte read to the same register; all we really want is one bit */ 
+            word_available &= (1 << ENDPOINT1);
+        }
+
+        if (!word_available) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI Communication timeout - bmiBufferReceive FIFO empty\n"));
+            return A_ERROR;
+        }
+    }
+
+#define CONSERVATIVE_BMI_READ 0
+#if CONSERVATIVE_BMI_READ
+    /*
+     * This is an extra-conservative CREDIT check.  It guarantees
+     * that ALL data is available in the FIFO before we start to
+     * read from the interconnect.
+     *
+     * This credit check is useless when firmware chooses to
+     * allow multiple outstanding BMI Command Credits, since the next
+     * credit will already be present.  To restrict the Target to one
+     * BMI Command Credit, see HI_OPTION_BMI_CRED_LIMIT.
+     *
+     * And for large reads (when HI_OPTION_BMI_CRED_LIMIT is set)
+     * we cannot wait for the next credit because the Target's FIFO
+     * will not hold the entire response.  So we need the Host to
+     * start to empty the FIFO sooner.  (And again, large reads are
+     * not used in practice; they are for debug/development only.)
+     *
+     * For a more conservative Host implementation (which would be
+     * safer for a Compact Flash interconnect):
+     *   Set CONSERVATIVE_BMI_READ (above) to 1
+     *   Set HI_OPTION_BMI_CRED_LIMIT and
+     *   reduce BMI_DATASZ_MAX to 32 or 64
+     */
+    if ((length > 4) && (length < 128)) { /* check against MBOX FIFO size */
+        u32 timeout;
+
+        *pBMICmdCredits = 0;
+        timeout = BMI_COMMUNICATION_TIMEOUT;
+        while((!want_timeout || timeout--) && !(*pBMICmdCredits) {
+            /* Read the counter register to get the command credits */
+            address = COUNT_ADDRESS + (HTC_MAILBOX_NUM_MAX + ENDPOINT1) * 1;
+            /* read the counter using a 4-byte read.  Since the counter is NOT auto-decrementing,
+             * we can read this counter multiple times using a non-incrementing address mode.
+             * The rationale here is to make all HIF accesses a multiple of 4 bytes */
+            status = HIFReadWrite(device, address, (u8 *)pBMICmdCredits, sizeof(*pBMICmdCredits),
+                HIF_RD_SYNC_BYTE_FIX, NULL);
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read the command credit count register\n"));
+                return A_ERROR;
+            }
+                /* we did a 4-byte read to the same count register so mask off upper bytes */
+            (*pBMICmdCredits) &= 0xFF;
+        }
+
+        if (!(*pBMICmdCredits)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI Communication timeout- bmiBufferReceive no credit\n"));
+            return A_ERROR;
+        }
+    }
+#endif
+
+    address = mboxAddress[ENDPOINT1];
+    status = HIFReadWrite(device, address, buffer, length, HIF_RD_SYNC_BYTE_INC, NULL);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read the BMI data from the device\n"));
+        return A_ERROR;
+    }
+
+    return 0;
+}
+
+int
+BMIFastDownload(struct hif_device *device, u32 address, u8 *buffer, u32 length)
+{
+    int status = A_ERROR;
+    u32 lastWord = 0;
+    u32 lastWordOffset = length & ~0x3;
+    u32 unalignedBytes = length & 0x3;
+
+    status = BMILZStreamStart (device, address);
+    if (status) {
+            return A_ERROR;
+    }
+
+    if (unalignedBytes) {
+            /* copy the last word into a zero padded buffer */
+        memcpy(&lastWord, &buffer[lastWordOffset], unalignedBytes);
+    }
+
+    status = BMILZData(device, buffer, lastWordOffset);
+
+    if (status) {
+        return A_ERROR;
+    }
+
+    if (unalignedBytes) {
+        status = BMILZData(device, (u8 *)&lastWord, 4);
+    }
+
+    if (!status) {
+        //
+        // Close compressed stream and open a new (fake) one.  This serves mainly to flush Target caches.
+        //
+        status = BMILZStreamStart (device, 0x00);
+        if (status) {
+           return A_ERROR;
+        }
+    }
+        return status;
+}
+
+int
+BMIRawWrite(struct hif_device *device, u8 *buffer, u32 length)
+{
+    return bmiBufferSend(device, buffer, length);
+}
+
+int
+BMIRawRead(struct hif_device *device, u8 *buffer, u32 length, bool want_timeout)
+{
+    return bmiBufferReceive(device, buffer, length, want_timeout);
+}
diff --git a/drivers/staging/ath6kl/hif/common/hif_sdio_common.h b/drivers/staging/ath6kl/hif/common/hif_sdio_common.h
new file mode 100644
index 00000000000..93a2adceca3
--- /dev/null
+++ b/drivers/staging/ath6kl/hif/common/hif_sdio_common.h
@@ -0,0 +1,87 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// common header file for HIF modules designed for SDIO
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef HIF_SDIO_COMMON_H_
+#define HIF_SDIO_COMMON_H_
+
+    /* SDIO manufacturer ID and Codes */
+#define MANUFACTURER_ID_AR6002_BASE        0x200
+#define MANUFACTURER_ID_AR6003_BASE        0x300
+#define MANUFACTURER_ID_AR6K_BASE_MASK     0xFF00
+#define FUNCTION_CLASS                     0x0
+#define MANUFACTURER_CODE                  0x271    /* Atheros */
+
+    /* Mailbox address in SDIO address space */
+#define HIF_MBOX_BASE_ADDR                 0x800
+#define HIF_MBOX_WIDTH                     0x800
+#define HIF_MBOX_START_ADDR(mbox)               \
+   ( HIF_MBOX_BASE_ADDR + mbox * HIF_MBOX_WIDTH)
+
+#define HIF_MBOX_END_ADDR(mbox)                 \
+    (HIF_MBOX_START_ADDR(mbox) + HIF_MBOX_WIDTH - 1)
+
+    /* extended MBOX address for larger MBOX writes to MBOX 0*/
+#define HIF_MBOX0_EXTENDED_BASE_ADDR       0x2800
+#define HIF_MBOX0_EXTENDED_WIDTH_AR6002    (6*1024)           
+#define HIF_MBOX0_EXTENDED_WIDTH_AR6003    (18*1024)   
+
+    /* version 1 of the chip has only a 12K extended mbox range */
+#define HIF_MBOX0_EXTENDED_BASE_ADDR_AR6003_V1  0x4000
+#define HIF_MBOX0_EXTENDED_WIDTH_AR6003_V1      (12*1024)  
+
+    /* GMBOX addresses */
+#define HIF_GMBOX_BASE_ADDR                0x7000
+#define HIF_GMBOX_WIDTH                    0x4000
+
+    /* for SDIO we recommend a 128-byte block size */
+#define HIF_DEFAULT_IO_BLOCK_SIZE          128
+
+    /* set extended MBOX window information for SDIO interconnects */
+static INLINE void SetExtendedMboxWindowInfo(u16 Manfid, struct hif_device_mbox_info *pInfo)
+{
+    switch (Manfid & MANUFACTURER_ID_AR6K_BASE_MASK) {                   
+        case MANUFACTURER_ID_AR6002_BASE :
+                /* MBOX 0 has an extended range */
+            pInfo->MboxProp[0].ExtendedAddress = HIF_MBOX0_EXTENDED_BASE_ADDR;             
+            pInfo->MboxProp[0].ExtendedSize = HIF_MBOX0_EXTENDED_WIDTH_AR6002;
+            break;
+        case MANUFACTURER_ID_AR6003_BASE :
+                /* MBOX 0 has an extended range */
+            pInfo->MboxProp[0].ExtendedAddress = HIF_MBOX0_EXTENDED_BASE_ADDR_AR6003_V1;             
+            pInfo->MboxProp[0].ExtendedSize = HIF_MBOX0_EXTENDED_WIDTH_AR6003_V1;
+            pInfo->GMboxAddress = HIF_GMBOX_BASE_ADDR;
+            pInfo->GMboxSize = HIF_GMBOX_WIDTH;
+            break;
+        default:
+            A_ASSERT(false);
+            break;
+    }
+}
+             
+/* special CCCR (func 0) registers */
+
+#define CCCR_SDIO_IRQ_MODE_REG         0xF0        /* interrupt mode register */
+#define SDIO_IRQ_MODE_ASYNC_4BIT_IRQ   (1 << 0)    /* mode to enable special 4-bit interrupt assertion without clock*/ 
+                        
+#endif /*HIF_SDIO_COMMON_H_*/
diff --git a/drivers/staging/ath6kl/hif/sdio/linux_sdio/include/hif_internal.h b/drivers/staging/ath6kl/hif/sdio/linux_sdio/include/hif_internal.h
new file mode 100644
index 00000000000..ed7ad4786f5
--- /dev/null
+++ b/drivers/staging/ath6kl/hif/sdio/linux_sdio/include/hif_internal.h
@@ -0,0 +1,131 @@
+//------------------------------------------------------------------------------
+// <copyright file="hif_internal.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// internal header file for hif layer
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HIF_INTERNAL_H_
+#define _HIF_INTERNAL_H_
+
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_osapi.h"
+#include "hif.h"
+#include "../../../common/hif_sdio_common.h"
+#include <linux/scatterlist.h>
+#define HIF_LINUX_MMC_SCATTER_SUPPORT
+
+#define BUS_REQUEST_MAX_NUM                64
+
+#define SDIO_CLOCK_FREQUENCY_DEFAULT       25000000
+#define SDWLAN_ENABLE_DISABLE_TIMEOUT      20
+#define FLAGS_CARD_ENAB                    0x02
+#define FLAGS_CARD_IRQ_UNMSK               0x04
+
+#define HIF_MBOX_BLOCK_SIZE                HIF_DEFAULT_IO_BLOCK_SIZE
+#define HIF_MBOX0_BLOCK_SIZE               1
+#define HIF_MBOX1_BLOCK_SIZE               HIF_MBOX_BLOCK_SIZE
+#define HIF_MBOX2_BLOCK_SIZE               HIF_MBOX_BLOCK_SIZE
+#define HIF_MBOX3_BLOCK_SIZE               HIF_MBOX_BLOCK_SIZE
+
+typedef struct bus_request {
+    struct bus_request *next;       /* link list of available requests */
+    struct bus_request *inusenext;  /* link list of in use requests */
+    struct semaphore sem_req;
+    u32 address;               /* request data */
+    u8 *buffer;
+    u32 length;
+    u32 request;
+    void *context;
+    int status;
+    struct hif_scatter_req_priv *pScatterReq;      /* this request is a scatter request */
+} BUS_REQUEST;
+
+struct hif_device {
+    struct sdio_func *func;
+    spinlock_t asynclock;
+    struct task_struct* async_task;             /* task to handle async commands */
+    struct semaphore sem_async;                 /* wake up for async task */
+    int    async_shutdown;                      /* stop the async task */
+    struct completion async_completion;          /* thread completion */
+    BUS_REQUEST   *asyncreq;                    /* request for async tasklet */
+    BUS_REQUEST *taskreq;                       /*  async tasklet data */
+    spinlock_t lock;
+    BUS_REQUEST *s_busRequestFreeQueue;         /* free list */
+    BUS_REQUEST busRequest[BUS_REQUEST_MAX_NUM]; /* available bus requests */
+    void     *claimedContext;
+    HTC_CALLBACKS htcCallbacks;
+    u8 *dma_buffer;
+    struct dl_list      ScatterReqHead;                /* scatter request list head */
+    bool       scatter_enabled;               /* scatter enabled flag */
+    bool   is_suspend;
+    bool   is_disabled;
+    atomic_t   irqHandling;
+    HIF_DEVICE_POWER_CHANGE_TYPE powerConfig;
+    const struct sdio_device_id *id;
+};
+
+#define HIF_DMA_BUFFER_SIZE (32 * 1024)
+#define CMD53_FIXED_ADDRESS 1
+#define CMD53_INCR_ADDRESS  2
+
+BUS_REQUEST *hifAllocateBusRequest(struct hif_device *device);
+void hifFreeBusRequest(struct hif_device *device, BUS_REQUEST *busrequest);
+void AddToAsyncList(struct hif_device *device, BUS_REQUEST *busrequest);
+
+#ifdef HIF_LINUX_MMC_SCATTER_SUPPORT
+
+#define MAX_SCATTER_REQUESTS             4
+#define MAX_SCATTER_ENTRIES_PER_REQ      16
+#define MAX_SCATTER_REQ_TRANSFER_SIZE    32*1024
+
+struct hif_scatter_req_priv {
+    struct hif_scatter_req     *pHifScatterReq;  /* HIF scatter request with allocated entries */   
+    struct hif_device          *device;          /* this device */
+    BUS_REQUEST         *busrequest;      /* request associated with request */
+        /* scatter list for linux */    
+    struct scatterlist  sgentries[MAX_SCATTER_ENTRIES_PER_REQ];   
+};
+
+#define ATH_DEBUG_SCATTER  ATH_DEBUG_MAKE_MODULE_MASK(0)
+
+int SetupHIFScatterSupport(struct hif_device *device, struct hif_device_scatter_support_info *pInfo);
+void CleanupHIFScatterResources(struct hif_device *device);
+int DoHifReadWriteScatter(struct hif_device *device, BUS_REQUEST *busrequest);
+
+#else  // HIF_LINUX_MMC_SCATTER_SUPPORT
+
+static inline int SetupHIFScatterSupport(struct hif_device *device, struct hif_device_scatter_support_info *pInfo)
+{
+    return A_ENOTSUP;
+}
+
+static inline int DoHifReadWriteScatter(struct hif_device *device, BUS_REQUEST *busrequest)
+{
+    return A_ENOTSUP;
+}
+
+#define CleanupHIFScatterResources(d) { }
+
+#endif // HIF_LINUX_MMC_SCATTER_SUPPORT
+
+#endif // _HIF_INTERNAL_H_
+
diff --git a/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif.c b/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif.c
new file mode 100644
index 00000000000..5f5d67720fa
--- /dev/null
+++ b/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif.c
@@ -0,0 +1,1273 @@
+//------------------------------------------------------------------------------
+// <copyright file="hif.c" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HIF layer reference implementation for Linux Native MMC stack
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#include <linux/mmc/card.h>
+#include <linux/mmc/mmc.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/sdio.h>
+#include <linux/mmc/sd.h>
+#include <linux/kthread.h>
+
+/* by default setup a bounce buffer for the data packets, if the underlying host controller driver
+   does not use DMA you may be able to skip this step and save the memory allocation and transfer time */
+#define HIF_USE_DMA_BOUNCE_BUFFER 1
+#include "hif_internal.h"
+#define ATH_MODULE_NAME hif
+#include "a_debug.h"
+#include "hw/mbox_host_reg.h"
+
+#if HIF_USE_DMA_BOUNCE_BUFFER
+/* macro to check if DMA buffer is WORD-aligned and DMA-able.  Most host controllers assume the
+ * buffer is DMA'able and will bug-check otherwise (i.e. buffers on the stack).  
+ * virt_addr_valid check fails on stack memory.  
+ */
+#define BUFFER_NEEDS_BOUNCE(buffer)  (((unsigned long)(buffer) & 0x3) || !virt_addr_valid((buffer)))
+#else
+#define BUFFER_NEEDS_BOUNCE(buffer)   (false)
+#endif
+
+/* ATHENV */
+#if defined(CONFIG_PM)
+#define dev_to_sdio_func(d)     container_of(d, struct sdio_func, dev)
+#define to_sdio_driver(d)      container_of(d, struct sdio_driver, drv)
+#endif /* CONFIG_PM */
+static void delHifDevice(struct hif_device * device);
+static int Func0_CMD52WriteByte(struct mmc_card *card, unsigned int address, unsigned char byte);
+static int Func0_CMD52ReadByte(struct mmc_card *card, unsigned int address, unsigned char *byte);
+
+static int hifEnableFunc(struct hif_device *device, struct sdio_func *func);
+static int hifDisableFunc(struct hif_device *device, struct sdio_func *func);
+OSDRV_CALLBACKS osdrvCallbacks;
+
+int reset_sdio_on_unload = 0;
+module_param(reset_sdio_on_unload, int, 0644);
+
+extern u32 nohifscattersupport;
+
+static struct hif_device *ath6kl_alloc_hifdev(struct sdio_func *func)
+{
+        struct hif_device *hifdevice;
+
+        hifdevice = kzalloc(sizeof(struct hif_device), GFP_KERNEL);
+
+#if HIF_USE_DMA_BOUNCE_BUFFER
+        hifdevice->dma_buffer = kmalloc(HIF_DMA_BUFFER_SIZE, GFP_KERNEL);
+#endif
+        hifdevice->func = func;
+        hifdevice->powerConfig = HIF_DEVICE_POWER_UP;
+        sdio_set_drvdata(func, hifdevice);
+
+        return hifdevice;
+}
+
+static struct hif_device *ath6kl_get_hifdev(struct sdio_func *func)
+{
+        return (struct hif_device *) sdio_get_drvdata(func);
+}
+
+static const struct sdio_device_id ath6kl_hifdev_ids[] = {
+        { SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6002_BASE | 0x0)) },
+        { SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6002_BASE | 0x1)) },
+        { SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6003_BASE | 0x0)) },
+        { SDIO_DEVICE(MANUFACTURER_CODE, (MANUFACTURER_ID_AR6003_BASE | 0x1)) },
+        { /* null */                                         },
+};
+
+MODULE_DEVICE_TABLE(sdio, ath6kl_hifdev_ids);
+
+static int ath6kl_hifdev_probe(struct sdio_func *func,
+                               const struct sdio_device_id *id)
+{
+        int ret;
+        struct hif_device *device;
+        int count;
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+                        ("ath6kl: Function: 0x%X, Vendor ID: 0x%X, "
+                         "Device ID: 0x%X, block size: 0x%X/0x%X\n",
+                        func->num, func->vendor, func->device,
+                        func->max_blksize, func->cur_blksize));
+
+        ath6kl_alloc_hifdev(func);
+        device = ath6kl_get_hifdev(func);
+
+        device->id = id;
+        device->is_disabled = true;
+
+        spin_lock_init(&device->lock);
+        spin_lock_init(&device->asynclock);
+
+        DL_LIST_INIT(&device->ScatterReqHead);
+
+        /* Try to allow scatter unless globally overridden */
+        if (!nohifscattersupport)
+                device->scatter_enabled = true;
+
+        A_MEMZERO(device->busRequest, sizeof(device->busRequest));
+
+        for (count = 0; count < BUS_REQUEST_MAX_NUM; count++) {
+                sema_init(&device->busRequest[count].sem_req, 0);
+                hifFreeBusRequest(device, &device->busRequest[count]);
+        }
+
+        sema_init(&device->sem_async, 0);
+
+        ret = hifEnableFunc(device, func);
+
+        return ret;
+}
+
+static void ath6kl_hifdev_remove(struct sdio_func *func)
+{
+        int status = 0;
+        struct hif_device *device;
+
+        device = ath6kl_get_hifdev(func);
+        if (device->claimedContext != NULL)
+                status = osdrvCallbacks.
+                        deviceRemovedHandler(device->claimedContext, device);
+
+        if (device->is_disabled)
+                device->is_disabled = false;
+        else
+                status = hifDisableFunc(device, func);
+
+        CleanupHIFScatterResources(device);
+
+        delHifDevice(device);
+}
+
+#if defined(CONFIG_PM)
+static int ath6kl_hifdev_suspend(struct device *dev)
+{
+        struct sdio_func *func = dev_to_sdio_func(dev);
+        int status = 0;
+        struct hif_device *device;
+
+        device = ath6kl_get_hifdev(func);
+
+        if (device && device->claimedContext &&
+            osdrvCallbacks.deviceSuspendHandler) {
+                /* set true first for PowerStateChangeNotify(..) */
+                device->is_suspend = true;
+                status = osdrvCallbacks.
+                        deviceSuspendHandler(device->claimedContext);
+                if (status)
+                        device->is_suspend = false;
+        }
+
+        CleanupHIFScatterResources(device);
+
+        switch (status) {
+        case 0:
+                return 0;
+        case A_EBUSY:
+                /* Hack for kernel in order to support deep sleep and wow */
+                return -EBUSY;
+        default:
+                return -1;
+        }
+}
+
+static int ath6kl_hifdev_resume(struct device *dev)
+{
+        struct sdio_func *func = dev_to_sdio_func(dev);
+        int status = 0;
+        struct hif_device *device;
+
+        device = ath6kl_get_hifdev(func);
+        if (device && device->claimedContext &&
+            osdrvCallbacks.deviceSuspendHandler) {
+                status = osdrvCallbacks.
+                        deviceResumeHandler(device->claimedContext);
+                if (status == 0)
+                        device->is_suspend = false;
+        }
+
+        return status;
+}
+
+static const struct dev_pm_ops ath6kl_hifdev_pmops = {
+        .suspend = ath6kl_hifdev_suspend,
+        .resume = ath6kl_hifdev_resume,
+};
+#endif /* CONFIG_PM */
+
+static struct sdio_driver ath6kl_hifdev_driver = {
+        .name = "ath6kl_hifdev",
+        .id_table = ath6kl_hifdev_ids,
+        .probe = ath6kl_hifdev_probe,
+        .remove = ath6kl_hifdev_remove,
+#if defined(CONFIG_PM)
+        .drv = {
+                .pm = &ath6kl_hifdev_pmops,
+        },
+#endif
+};
+
+/* make sure we only unregister when registered. */
+static int registered = 0;
+
+extern u32 onebitmode;
+extern u32 busspeedlow;
+extern u32 debughif;
+
+static void ResetAllCards(void);
+
+#ifdef DEBUG
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(hif,
+                                 "hif",
+                                 "(Linux MMC) Host Interconnect Framework",
+                                 ATH_DEBUG_MASK_DEFAULTS,
+                                 0,
+                                 NULL);
+                                 
+#endif
+
+
+/* ------ Functions ------ */
+int HIFInit(OSDRV_CALLBACKS *callbacks)
+{
+        int r;
+        AR_DEBUG_ASSERT(callbacks != NULL);
+
+        A_REGISTER_MODULE_DEBUG_INFO(hif);
+
+        /* store the callback handlers */
+        osdrvCallbacks = *callbacks;
+
+        /* Register with bus driver core */
+        registered = 1;
+
+        r = sdio_register_driver(&ath6kl_hifdev_driver);
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
+static int
+__HIFReadWrite(struct hif_device *device,
+             u32 address,
+             u8 *buffer,
+             u32 length,
+             u32 request,
+             void *context)
+{
+    u8 opcode;
+    int    status = 0;
+    int     ret;
+    u8 *tbuffer;
+    bool   bounced = false;
+
+    AR_DEBUG_ASSERT(device != NULL);
+    AR_DEBUG_ASSERT(device->func != NULL);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: Device: 0x%p, buffer:0x%p (addr:0x%X)\n", 
+                    device, buffer, address));
+
+    do {
+        if (request & HIF_EXTENDED_IO) {
+            //AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: Command type: CMD53\n"));
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("AR6000: Invalid command type: 0x%08x\n", request));
+            status = A_EINVAL;
+            break;
+        }
+
+        if (request & HIF_BLOCK_BASIS) {
+            /* round to whole block length size */
+            length = (length / HIF_MBOX_BLOCK_SIZE) * HIF_MBOX_BLOCK_SIZE;
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+                            ("AR6000: Block mode (BlockLen: %d)\n",
+                            length));
+        } else if (request & HIF_BYTE_BASIS) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+                            ("AR6000: Byte mode (BlockLen: %d)\n",
+                            length));
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("AR6000: Invalid data mode: 0x%08x\n", request));
+            status = A_EINVAL;
+            break;
+        }
+
+#if 0
+        /* useful for checking register accesses */
+        if (length & 0x3) {
+            A_PRINTF(KERN_ALERT"AR6000: HIF (%s) is not a multiple of 4 bytes, addr:0x%X, len:%d\n",
+                                request & HIF_WRITE ? "write":"read", address, length);
+        }
+#endif
+
+        if (request & HIF_WRITE) {
+            if ((address >= HIF_MBOX_START_ADDR(0)) &&
+                (address <= HIF_MBOX_END_ADDR(3)))
+            {
+    
+                AR_DEBUG_ASSERT(length <= HIF_MBOX_WIDTH);
+    
+                /*
+                 * Mailbox write. Adjust the address so that the last byte
+                 * falls on the EOM address.
+                 */
+                address += (HIF_MBOX_WIDTH - length);
+            }
+        }
+
+        if (request & HIF_FIXED_ADDRESS) {
+            opcode = CMD53_FIXED_ADDRESS;
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: Address mode: Fixed 0x%X\n", address));
+        } else if (request & HIF_INCREMENTAL_ADDRESS) {
+            opcode = CMD53_INCR_ADDRESS;
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: Address mode: Incremental 0x%X\n", address));
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("AR6000: Invalid address mode: 0x%08x\n", request));
+            status = A_EINVAL;
+            break;
+        }
+
+        if (request & HIF_WRITE) {
+#if HIF_USE_DMA_BOUNCE_BUFFER
+            if (BUFFER_NEEDS_BOUNCE(buffer)) {
+                AR_DEBUG_ASSERT(device->dma_buffer != NULL);
+                tbuffer = device->dma_buffer;
+                    /* copy the write data to the dma buffer */
+                AR_DEBUG_ASSERT(length <= HIF_DMA_BUFFER_SIZE);
+                memcpy(tbuffer, buffer, length);
+                bounced = true;
+            } else {
+                tbuffer = buffer;    
+            }
+#else
+                tbuffer = buffer;
+#endif
+            if (opcode == CMD53_FIXED_ADDRESS) {
+                ret = sdio_writesb(device->func, address, tbuffer, length);
+                AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: writesb ret=%d address: 0x%X, len: %d, 0x%X\n",
+                                                  ret, address, length, *(int *)tbuffer));
+            } else {
+                ret = sdio_memcpy_toio(device->func, address, tbuffer, length);
+                AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: writeio ret=%d address: 0x%X, len: %d, 0x%X\n",
+                                                  ret, address, length, *(int *)tbuffer));
+            }
+        } else if (request & HIF_READ) {
+#if HIF_USE_DMA_BOUNCE_BUFFER
+            if (BUFFER_NEEDS_BOUNCE(buffer)) {
+                AR_DEBUG_ASSERT(device->dma_buffer != NULL);
+                AR_DEBUG_ASSERT(length <= HIF_DMA_BUFFER_SIZE);
+                tbuffer = device->dma_buffer;
+                bounced = true;
+            } else {
+                tbuffer = buffer;    
+            }
+#else
+            tbuffer = buffer;
+#endif
+            if (opcode == CMD53_FIXED_ADDRESS) {
+                ret = sdio_readsb(device->func, tbuffer, address, length);
+                AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: readsb ret=%d address: 0x%X, len: %d, 0x%X\n",
+                                                  ret, address, length, *(int *)tbuffer));
+            } else {
+                ret = sdio_memcpy_fromio(device->func, tbuffer, address, length);
+                AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: readio ret=%d address: 0x%X, len: %d, 0x%X\n",
+                                                  ret, address, length, *(int *)tbuffer));
+            }
+#if HIF_USE_DMA_BOUNCE_BUFFER
+            if (bounced) {
+                   /* copy the read data from the dma buffer */
+                memcpy(buffer, tbuffer, length);
+            }
+#endif
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("AR6000: Invalid direction: 0x%08x\n", request));
+            status = A_EINVAL;
+            break;
+        }
+
+        if (ret) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("AR6000: SDIO bus operation failed! MMC stack returned : %d \n", ret));
+            status = A_ERROR;
+        }
+    } while (false);
+
+    return status;
+}
+
+void AddToAsyncList(struct hif_device *device, BUS_REQUEST *busrequest)
+{
+    unsigned long flags;
+    BUS_REQUEST *async;
+    BUS_REQUEST *active;
+    
+    spin_lock_irqsave(&device->asynclock, flags);
+    active = device->asyncreq;
+    if (active == NULL) {
+        device->asyncreq = busrequest;
+        device->asyncreq->inusenext = NULL;
+    } else {
+        for (async = device->asyncreq;
+             async != NULL;
+             async = async->inusenext) {
+             active =  async;
+        }
+        active->inusenext = busrequest;
+        busrequest->inusenext = NULL;
+    }
+    spin_unlock_irqrestore(&device->asynclock, flags);
+}
+
+
+/* queue a read/write request */
+int
+HIFReadWrite(struct hif_device *device,
+             u32 address,
+             u8 *buffer,
+             u32 length,
+             u32 request,
+             void *context)
+{
+    int    status = 0;
+    BUS_REQUEST *busrequest;
+
+
+    AR_DEBUG_ASSERT(device != NULL);
+    AR_DEBUG_ASSERT(device->func != NULL);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: Device: %p addr:0x%X\n", device,address));
+
+    do {            
+        if ((request & HIF_ASYNCHRONOUS) || (request & HIF_SYNCHRONOUS)){
+            /* serialize all requests through the async thread */
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: Execution mode: %s\n", 
+                        (request & HIF_ASYNCHRONOUS)?"Async":"Synch"));
+            busrequest = hifAllocateBusRequest(device);
+            if (busrequest == NULL) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, 
+                    ("AR6000: no async bus requests available (%s, addr:0x%X, len:%d) \n", 
+                        request & HIF_READ ? "READ":"WRITE", address, length));
+                return A_ERROR;
+            }
+            busrequest->address = address;
+            busrequest->buffer = buffer;
+            busrequest->length = length;
+            busrequest->request = request;
+            busrequest->context = context;
+            
+            AddToAsyncList(device, busrequest);
+            
+            if (request & HIF_SYNCHRONOUS) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: queued sync req: 0x%lX\n", (unsigned long)busrequest));
+
+                /* wait for completion */
+                up(&device->sem_async);
+                if (down_interruptible(&busrequest->sem_req) != 0) {
+                    /* interrupted, exit */
+                    return A_ERROR;
+                } else {
+                    int status = busrequest->status;
+                    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: sync return freeing 0x%lX: 0x%X\n", 
+                                                      (unsigned long)busrequest, busrequest->status));
+                    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: freeing req: 0x%X\n", (unsigned int)request));
+                    hifFreeBusRequest(device, busrequest);
+                    return status;
+                }
+            } else {
+                AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: queued async req: 0x%lX\n", (unsigned long)busrequest));
+                up(&device->sem_async);
+                return A_PENDING;
+            }
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("AR6000: Invalid execution mode: 0x%08x\n", (unsigned int)request));
+            status = A_EINVAL;
+            break;
+        }
+    } while(0);
+
+    return status;
+}
+/* thread to serialize all requests, both sync and async */
+static int async_task(void *param)
+ {
+    struct hif_device *device;
+    BUS_REQUEST *request;
+    int status;
+    unsigned long flags;
+
+    device = (struct hif_device *)param;
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async task\n"));
+    set_current_state(TASK_INTERRUPTIBLE);
+    while(!device->async_shutdown) {
+        /* wait for work */
+        if (down_interruptible(&device->sem_async) != 0) {
+            /* interrupted, exit */
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async task interrupted\n"));
+            break;
+        }
+        if (device->async_shutdown) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async task stopping\n"));
+            break;
+        }
+        /* we want to hold the host over multiple cmds if possible, but holding the host blocks card interrupts */
+        sdio_claim_host(device->func);
+        spin_lock_irqsave(&device->asynclock, flags);
+        /* pull the request to work on */
+        while (device->asyncreq != NULL) {
+            request = device->asyncreq;
+            if (request->inusenext != NULL) {
+                device->asyncreq = request->inusenext;
+            } else {
+                device->asyncreq = NULL;
+            }
+            spin_unlock_irqrestore(&device->asynclock, flags);
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async_task processing req: 0x%lX\n", (unsigned long)request));
+            
+            if (request->pScatterReq != NULL) {
+                A_ASSERT(device->scatter_enabled);
+                    /* this is a queued scatter request, pass the request to scatter routine which
+                     * executes it synchronously, note, no need to free the request since scatter requests
+                     * are maintained on a separate list */
+                status = DoHifReadWriteScatter(device,request);
+            } else {                
+                    /* call HIFReadWrite in sync mode to do the work */
+                status = __HIFReadWrite(device, request->address, request->buffer,
+                                      request->length, request->request & ~HIF_SYNCHRONOUS, NULL);
+                if (request->request & HIF_ASYNCHRONOUS) {
+                    void *context = request->context;
+                    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async_task freeing req: 0x%lX\n", (unsigned long)request));
+                    hifFreeBusRequest(device, request);
+                    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async_task completion routine req: 0x%lX\n", (unsigned long)request));
+                    device->htcCallbacks.rwCompletionHandler(context, status);
+                } else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: async_task upping req: 0x%lX\n", (unsigned long)request));
+                    request->status = status;
+                    up(&request->sem_req);
+                }
+            }
+            spin_lock_irqsave(&device->asynclock, flags);
+        }
+        spin_unlock_irqrestore(&device->asynclock, flags);
+        sdio_release_host(device->func);
+    }
+
+    complete_and_exit(&device->async_completion, 0);
+    return 0;
+}
+
+static s32 IssueSDCommand(struct hif_device *device, u32 opcode, u32 arg, u32 flags, u32 *resp)
+{
+    struct mmc_command cmd;
+    s32 err;
+    struct mmc_host *host;
+    struct sdio_func *func;
+
+    func = device->func;
+    host = func->card->host;
+
+    memset(&cmd, 0, sizeof(struct mmc_command)); 
+    cmd.opcode = opcode;
+    cmd.arg = arg;
+    cmd.flags = flags;
+    err = mmc_wait_for_cmd(host, &cmd, 3);
+
+    if ((!err) && (resp)) {
+        *resp = cmd.resp[0];
+    }
+
+    return err;
+}
+
+int ReinitSDIO(struct hif_device *device)
+{
+    s32 err;
+    struct mmc_host *host;
+    struct mmc_card *card;
+        struct sdio_func *func;
+    u8 cmd52_resp;
+    u32 clock;
+
+    func = device->func;
+    card = func->card;
+    host = card->host;
+   
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +ReinitSDIO \n"));
+    sdio_claim_host(func);
+
+    do {
+        if (!device->is_suspend) {
+            u32 resp;
+            u16 rca;
+            u32 i;
+            int bit = fls(host->ocr_avail) - 1;
+            /* emulate the mmc_power_up(...) */
+            host->ios.vdd = bit;
+            host->ios.chip_select = MMC_CS_DONTCARE;
+            host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN;
+            host->ios.power_mode = MMC_POWER_UP;
+            host->ios.bus_width = MMC_BUS_WIDTH_1;
+            host->ios.timing = MMC_TIMING_LEGACY;
+            host->ops->set_ios(host, &host->ios);
+            /*
+             * This delay should be sufficient to allow the power supply
+             * to reach the minimum voltage.
+             */
+            msleep(2);
+
+            host->ios.clock = host->f_min;
+            host->ios.power_mode = MMC_POWER_ON;
+            host->ops->set_ios(host, &host->ios);
+
+            /*
+             * This delay must be at least 74 clock sizes, or 1 ms, or the
+             * time required to reach a stable voltage.
+             */
+            msleep(2);
+
+            /* Issue CMD0. Goto idle state */
+                host->ios.chip_select = MMC_CS_HIGH;
+            host->ops->set_ios(host, &host->ios);
+                msleep(1);
+            err = IssueSDCommand(device, MMC_GO_IDLE_STATE, 0, (MMC_RSP_NONE | MMC_CMD_BC), NULL);
+            host->ios.chip_select = MMC_CS_DONTCARE;
+            host->ops->set_ios(host, &host->ios);
+                msleep(1);
+            host->use_spi_crc = 0;
+
+            if (err) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ReinitSDIO: CMD0 failed : %d \n",err));    
+                break;
+            }        
+
+            if (!host->ocr) {
+                /* Issue CMD5, arg = 0 */
+                err = IssueSDCommand(device, SD_IO_SEND_OP_COND, 0, (MMC_RSP_R4 | MMC_CMD_BCR), &resp);
+                if (err) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ReinitSDIO: CMD5 failed : %d \n",err));    
+                    break;
+                }
+                host->ocr = resp;
+            }
+
+            /* Issue CMD5, arg = ocr. Wait till card is ready  */
+            for (i=0;i<100;i++) {
+                err = IssueSDCommand(device, SD_IO_SEND_OP_COND, host->ocr, (MMC_RSP_R4 | MMC_CMD_BCR), &resp);
+                if (err) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ReinitSDIO: CMD5 failed : %d \n",err));    
+                    break;
+                }
+                if (resp & MMC_CARD_BUSY) {
+                    break;
+                }
+                msleep(10);
+            }
+
+            if ((i == 100) || (err)) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ReinitSDIO: card in not ready : %d %d \n",i,err));    
+                break;
+            }
+
+            /* Issue CMD3, get RCA */
+            err = IssueSDCommand(device, SD_SEND_RELATIVE_ADDR, 0, MMC_RSP_R6 | MMC_CMD_BCR, &resp);
+            if (err) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ReinitSDIO: CMD3 failed : %d \n",err));    
+                break;
+            }
+            rca = resp >> 16;
+            host->ios.bus_mode = MMC_BUSMODE_PUSHPULL;
+            host->ops->set_ios(host, &host->ios);
+
+            /* Issue CMD7, select card  */
+            err = IssueSDCommand(device, MMC_SELECT_CARD, (rca << 16), MMC_RSP_R1 | MMC_CMD_AC, NULL);
+            if (err) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ReinitSDIO: CMD7 failed : %d \n",err));    
+                break;
+            }
+        }
+        
+        /* Enable high speed */
+        if (card->host->caps & MMC_CAP_SD_HIGHSPEED) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("ReinitSDIO: Set high speed mode\n"));    
+            err = Func0_CMD52ReadByte(card, SDIO_CCCR_SPEED, &cmd52_resp);
+            if (err) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ReinitSDIO: CMD52 read to CCCR speed register failed  : %d \n",err));    
+                card->state &= ~MMC_STATE_HIGHSPEED;
+                /* no need to break */
+            } else {
+                err = Func0_CMD52WriteByte(card, SDIO_CCCR_SPEED, (cmd52_resp | SDIO_SPEED_EHS));
+                if (err) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ReinitSDIO: CMD52 write to CCCR speed register failed  : %d \n",err));    
+                    break;
+                }
+                mmc_card_set_highspeed(card);
+                host->ios.timing = MMC_TIMING_SD_HS;
+                host->ops->set_ios(host, &host->ios);
+            }
+        }
+
+        /* Set clock */
+        if (mmc_card_highspeed(card)) {
+            clock = 50000000;
+        } else {
+            clock = card->cis.max_dtr;
+        }
+        
+        if (clock > host->f_max) {
+            clock = host->f_max;
+        }
+        host->ios.clock = clock;
+        host->ops->set_ios(host, &host->ios);
+        
+
+        if (card->host->caps & MMC_CAP_4_BIT_DATA) {
+            /* CMD52: Set bus width & disable card detect resistor */
+            err = Func0_CMD52WriteByte(card, SDIO_CCCR_IF, SDIO_BUS_CD_DISABLE | SDIO_BUS_WIDTH_4BIT);
+            if (err) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ReinitSDIO: CMD52 to set bus mode failed : %d \n",err));    
+                break;
+            }
+            host->ios.bus_width = MMC_BUS_WIDTH_4;
+            host->ops->set_ios(host, &host->ios);
+        }
+    } while (0);
+
+    sdio_release_host(func);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -ReinitSDIO \n"));
+
+    return (err) ? A_ERROR : 0;
+}
+
+int
+PowerStateChangeNotify(struct hif_device *device, HIF_DEVICE_POWER_CHANGE_TYPE config)
+{
+    int status = 0;
+#if defined(CONFIG_PM)
+        struct sdio_func *func = device->func;
+    int old_reset_val;
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +PowerStateChangeNotify %d\n", config));
+    switch (config) {
+       case HIF_DEVICE_POWER_DOWN:
+       case HIF_DEVICE_POWER_CUT:
+            old_reset_val = reset_sdio_on_unload;
+            reset_sdio_on_unload = 1;
+            status = hifDisableFunc(device, func);
+            reset_sdio_on_unload = old_reset_val;
+            if (!device->is_suspend) {
+                struct mmc_host *host = func->card->host;
+                    host->ios.clock = 0;
+                    host->ios.vdd = 0;
+                host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN;
+                host->ios.chip_select = MMC_CS_DONTCARE;
+                host->ios.power_mode = MMC_POWER_OFF;
+                host->ios.bus_width = MMC_BUS_WIDTH_1;
+                host->ios.timing = MMC_TIMING_LEGACY;
+                host->ops->set_ios(host, &host->ios);
+            }
+            break;
+       case HIF_DEVICE_POWER_UP:
+            if (device->powerConfig == HIF_DEVICE_POWER_CUT) {
+                status = ReinitSDIO(device);
+            }
+            if (status == 0) {
+                status = hifEnableFunc(device, func);
+            }
+            break;
+    } 
+    device->powerConfig = config;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -PowerStateChangeNotify\n"));
+#endif
+    return status;
+}
+
+int
+HIFConfigureDevice(struct hif_device *device, HIF_DEVICE_CONFIG_OPCODE opcode,
+                   void *config, u32 configLen)
+{
+    u32 count;
+    int status = 0;
+    
+    switch(opcode) {
+        case HIF_DEVICE_GET_MBOX_BLOCK_SIZE:
+            ((u32 *)config)[0] = HIF_MBOX0_BLOCK_SIZE;
+            ((u32 *)config)[1] = HIF_MBOX1_BLOCK_SIZE;
+            ((u32 *)config)[2] = HIF_MBOX2_BLOCK_SIZE;
+            ((u32 *)config)[3] = HIF_MBOX3_BLOCK_SIZE;
+            break;
+
+        case HIF_DEVICE_GET_MBOX_ADDR:
+            for (count = 0; count < 4; count ++) {
+                ((u32 *)config)[count] = HIF_MBOX_START_ADDR(count);
+            }
+            
+            if (configLen >= sizeof(struct hif_device_mbox_info)) {    
+                SetExtendedMboxWindowInfo((u16)device->func->device,
+                                          (struct hif_device_mbox_info *)config);
+            }
+                        
+            break;
+        case HIF_DEVICE_GET_IRQ_PROC_MODE:
+            *((HIF_DEVICE_IRQ_PROCESSING_MODE *)config) = HIF_DEVICE_IRQ_SYNC_ONLY;
+            break;
+       case HIF_CONFIGURE_QUERY_SCATTER_REQUEST_SUPPORT:
+            if (!device->scatter_enabled) {
+                return A_ENOTSUP;    
+            }
+            status = SetupHIFScatterSupport(device, (struct hif_device_scatter_support_info *)config);
+            if (status) {
+                device->scatter_enabled = false;
+            }
+            break; 
+        case HIF_DEVICE_GET_OS_DEVICE:
+                /* pass back a pointer to the SDIO function's "dev" struct */
+            ((struct hif_device_os_device_info *)config)->pOSDevice = &device->func->dev;
+            break; 
+        case HIF_DEVICE_POWER_STATE_CHANGE:
+            status = PowerStateChangeNotify(device, *(HIF_DEVICE_POWER_CHANGE_TYPE *)config);
+            break;
+        default:
+            AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
+                            ("AR6000: Unsupported configuration opcode: %d\n", opcode));
+            status = A_ERROR;
+    }
+
+    return status;
+}
+
+void
+HIFShutDownDevice(struct hif_device *device)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +HIFShutDownDevice\n"));
+    if (device != NULL) {
+        AR_DEBUG_ASSERT(device->func != NULL);
+    } else {
+            /* since we are unloading the driver anyways, reset all cards in case the SDIO card
+             * is externally powered and we are unloading the SDIO stack.  This avoids the problem when
+             * the SDIO stack is reloaded and attempts are made to re-enumerate a card that is already
+             * enumerated */
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: HIFShutDownDevice, resetting\n"));
+        ResetAllCards();
+
+        /* Unregister with bus driver core */
+        if (registered) {
+            registered = 0;
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+                            ("AR6000: Unregistering with the bus driver\n"));
+            sdio_unregister_driver(&ath6kl_hifdev_driver);
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
+                            ("AR6000: Unregistered\n"));
+        }
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -HIFShutDownDevice\n"));
+}
+
+static void
+hifIRQHandler(struct sdio_func *func)
+{
+    int status;
+    struct hif_device *device;
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifIRQHandler\n"));
+
+    device = ath6kl_get_hifdev(func);
+    atomic_set(&device->irqHandling, 1);
+    /* release the host during ints so we can pick it back up when we process cmds */
+    sdio_release_host(device->func);
+    status = device->htcCallbacks.dsrHandler(device->htcCallbacks.context);
+    sdio_claim_host(device->func);
+    atomic_set(&device->irqHandling, 0);
+    AR_DEBUG_ASSERT(status == 0 || status == A_ECANCELED);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -hifIRQHandler\n"));
+}
+
+/* handle HTC startup via thread*/
+static int startup_task(void *param)
+{
+    struct hif_device *device;
+
+    device = (struct hif_device *)param;
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: call HTC from startup_task\n"));
+        /* start  up inform DRV layer */
+    if ((osdrvCallbacks.deviceInsertedHandler(osdrvCallbacks.context,device)) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: Device rejected\n"));
+    }
+    return 0;
+}
+
+#if defined(CONFIG_PM)
+static int enable_task(void *param)
+{
+    struct hif_device *device;
+    device = (struct hif_device *)param;
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: call  from resume_task\n"));
+
+        /* start  up inform DRV layer */
+    if (device && 
+        device->claimedContext && 
+        osdrvCallbacks.devicePowerChangeHandler &&
+        osdrvCallbacks.devicePowerChangeHandler(device->claimedContext, HIF_DEVICE_POWER_UP) != 0)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: Device rejected\n"));
+    }
+
+    return 0;
+}
+#endif
+
+void
+HIFAckInterrupt(struct hif_device *device)
+{
+    AR_DEBUG_ASSERT(device != NULL);
+
+    /* Acknowledge our function IRQ */
+}
+
+void
+HIFUnMaskInterrupt(struct hif_device *device)
+{
+    int ret;
+
+    AR_DEBUG_ASSERT(device != NULL);
+    AR_DEBUG_ASSERT(device->func != NULL);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: HIFUnMaskInterrupt\n"));
+
+    /* Register the IRQ Handler */
+    sdio_claim_host(device->func);
+    ret = sdio_claim_irq(device->func, hifIRQHandler);
+    sdio_release_host(device->func);
+    AR_DEBUG_ASSERT(ret == 0);
+}
+
+void HIFMaskInterrupt(struct hif_device *device)
+{
+    int ret;
+    AR_DEBUG_ASSERT(device != NULL);
+    AR_DEBUG_ASSERT(device->func != NULL);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: HIFMaskInterrupt\n"));
+
+    /* Mask our function IRQ */
+    sdio_claim_host(device->func);
+    while (atomic_read(&device->irqHandling)) {        
+        sdio_release_host(device->func);
+        schedule_timeout(HZ/10);
+        sdio_claim_host(device->func);
+    }
+    ret = sdio_release_irq(device->func);
+    sdio_release_host(device->func);
+    AR_DEBUG_ASSERT(ret == 0);
+}
+
+BUS_REQUEST *hifAllocateBusRequest(struct hif_device *device)
+{
+    BUS_REQUEST *busrequest;
+    unsigned long flag;
+
+    /* Acquire lock */
+    spin_lock_irqsave(&device->lock, flag);
+
+    /* Remove first in list */
+    if((busrequest = device->s_busRequestFreeQueue) != NULL)
+    {
+        device->s_busRequestFreeQueue = busrequest->next;
+    }
+    /* Release lock */
+    spin_unlock_irqrestore(&device->lock, flag);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: hifAllocateBusRequest: 0x%p\n", busrequest));
+    return busrequest;
+}
+
+void
+hifFreeBusRequest(struct hif_device *device, BUS_REQUEST *busrequest)
+{
+    unsigned long flag;
+
+    AR_DEBUG_ASSERT(busrequest != NULL);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: hifFreeBusRequest: 0x%p\n", busrequest));
+    /* Acquire lock */
+    spin_lock_irqsave(&device->lock, flag);
+
+
+    /* Insert first in list */
+    busrequest->next = device->s_busRequestFreeQueue;
+    busrequest->inusenext = NULL;
+    device->s_busRequestFreeQueue = busrequest;
+
+    /* Release lock */
+    spin_unlock_irqrestore(&device->lock, flag);
+}
+
+static int hifDisableFunc(struct hif_device *device, struct sdio_func *func)
+{
+    int ret;
+    int status = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifDisableFunc\n"));
+    device = ath6kl_get_hifdev(func);
+    if (!IS_ERR(device->async_task)) {
+        init_completion(&device->async_completion);
+        device->async_shutdown = 1;
+        up(&device->sem_async);
+        wait_for_completion(&device->async_completion);
+        device->async_task = NULL;
+    }
+    /* Disable the card */
+    sdio_claim_host(device->func);
+    ret = sdio_disable_func(device->func);
+    if (ret) {
+        status = A_ERROR;
+    } 
+
+    if (reset_sdio_on_unload) {
+        /* reset the SDIO interface.  This is useful in automated testing where the card
+         * does not need to be removed at the end of the test.  It is expected that the user will 
+         * also unload/reload the host controller driver to force the bus driver to re-enumerate the slot */
+        AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("AR6000: reseting SDIO card back to uninitialized state \n"));
+        
+        /* NOTE : sdio_f0_writeb() cannot be used here, that API only allows access
+         *        to undefined registers in the range of: 0xF0-0xFF */
+         
+        ret = Func0_CMD52WriteByte(device->func->card, SDIO_CCCR_ABORT, (1 << 3)); 
+        if (ret) {
+            status = A_ERROR;
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("AR6000: reset failed : %d \n",ret));    
+        }
+    }
+
+    sdio_release_host(device->func);
+
+    if (status == 0) {
+        device->is_disabled = true;
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -hifDisableFunc\n"));
+
+    return status;
+}
+
+static int hifEnableFunc(struct hif_device *device, struct sdio_func *func)
+{
+    struct task_struct* pTask;
+    const char *taskName = NULL;
+    int (*taskFunc)(void *) = NULL;
+    int ret = 0;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: +hifEnableFunc\n"));
+    device = ath6kl_get_hifdev(func);
+
+    if (device->is_disabled) {
+       /* enable the SDIO function */
+        sdio_claim_host(func);
+
+        if ((device->id->device & MANUFACTURER_ID_AR6K_BASE_MASK) >= MANUFACTURER_ID_AR6003_BASE) {
+            /* enable 4-bit ASYNC interrupt on AR6003 or later devices */
+            ret = Func0_CMD52WriteByte(func->card, CCCR_SDIO_IRQ_MODE_REG, SDIO_IRQ_MODE_ASYNC_4BIT_IRQ);
+            if (ret) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("AR6000: failed to enable 4-bit ASYNC IRQ mode %d \n",ret));
+                sdio_release_host(func);
+                return ret;
+            }
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: 4-bit ASYNC IRQ mode enabled\n"));
+        }
+        /* give us some time to enable, in ms */
+        func->enable_timeout = 100;
+        ret = sdio_enable_func(func);
+        if (ret) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("AR6000: %s(), Unable to enable AR6K: 0x%X\n",
+                                          __FUNCTION__, ret));
+            sdio_release_host(func);
+            return ret;
+        }
+        ret = sdio_set_block_size(func, HIF_MBOX_BLOCK_SIZE);
+        sdio_release_host(func);
+        if (ret) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("AR6000: %s(), Unable to set block size 0x%x  AR6K: 0x%X\n",
+                                          __FUNCTION__, HIF_MBOX_BLOCK_SIZE, ret));
+            return ret;
+        }
+        device->is_disabled = false;
+        /* create async I/O thread */
+        if (!device->async_task) {
+            device->async_shutdown = 0;
+            device->async_task = kthread_create(async_task,
+                                           (void *)device,
+                                           "AR6K Async");
+           if (IS_ERR(device->async_task)) {
+               AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("AR6000: %s(), to create async task\n", __FUNCTION__));
+                return -ENOMEM;
+           }
+           AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: start async task\n"));
+           wake_up_process(device->async_task );    
+        }
+    }
+
+    if (!device->claimedContext) {
+        taskFunc = startup_task;
+        taskName = "AR6K startup";
+        ret = 0;
+#if defined(CONFIG_PM)
+    } else {
+        taskFunc = enable_task;
+        taskName = "AR6K enable";
+        ret = -ENOMEM;
+#endif /* CONFIG_PM */
+    }
+    /* create resume thread */
+    pTask = kthread_create(taskFunc, (void *)device, taskName);
+    if (IS_ERR(pTask)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("AR6000: %s(), to create enabel task\n", __FUNCTION__));
+        return -ENOMEM;
+    }
+    wake_up_process(pTask);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: -hifEnableFunc\n"));
+
+    /* task will call the enable func, indicate pending */
+    return ret;
+}
+
+/*
+ * This should be moved to AR6K HTC layer.
+ */
+int hifWaitForPendingRecv(struct hif_device *device)
+{
+    s32 cnt = 10;
+    u8 host_int_status;
+    int status = 0;
+
+    do {                            
+        while (atomic_read(&device->irqHandling)) {
+                /* wait until irq handler finished all the jobs */
+                        schedule_timeout(HZ/10);
+            }
+                /* check if there is any pending irq due to force done */
+                host_int_status = 0;
+            status = HIFReadWrite(device, HOST_INT_STATUS_ADDRESS,
+                                    (u8 *)&host_int_status, sizeof(host_int_status),
+                                     HIF_RD_SYNC_BYTE_INC, NULL);
+            host_int_status = !status ? (host_int_status & (1 << 0)) : 0;
+                if (host_int_status) {
+                schedule(); /* schedule for next dsrHandler */
+                }
+        } while (host_int_status && --cnt > 0);
+
+    if (host_int_status && cnt == 0) {
+         AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, 
+                            ("AR6000: %s(), Unable clear up pending IRQ before the system suspended\n", __FUNCTION__));
+     }
+
+    return 0;
+}
+    
+static void
+delHifDevice(struct hif_device * device)
+{
+    AR_DEBUG_ASSERT(device!= NULL);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("AR6000: delHifDevice; 0x%p\n", device));
+    kfree(device->dma_buffer);
+    kfree(device);
+}
+
+static void ResetAllCards(void)
+{
+}
+
+void HIFClaimDevice(struct hif_device  *device, void *context)
+{
+    device->claimedContext = context;
+}
+
+void HIFReleaseDevice(struct hif_device  *device)
+{
+    device->claimedContext = NULL;
+}
+
+int HIFAttachHTC(struct hif_device *device, HTC_CALLBACKS *callbacks)
+{
+    if (device->htcCallbacks.context != NULL) {
+            /* already in use! */
+        return A_ERROR;
+    }
+    device->htcCallbacks = *callbacks;
+    return 0;
+}
+
+void HIFDetachHTC(struct hif_device *device)
+{
+    A_MEMZERO(&device->htcCallbacks,sizeof(device->htcCallbacks));
+}
+
+#define SDIO_SET_CMD52_ARG(arg,rw,func,raw,address,writedata) \
+    (arg) = (((rw) & 1) << 31)           | \
+            (((func) & 0x7) << 28)       | \
+            (((raw) & 1) << 27)          | \
+            (1 << 26)                    | \
+            (((address) & 0x1FFFF) << 9) | \
+            (1 << 8)                     | \
+            ((writedata) & 0xFF)
+            
+#define SDIO_SET_CMD52_READ_ARG(arg,func,address) \
+    SDIO_SET_CMD52_ARG(arg,0,(func),0,address,0x00)
+#define SDIO_SET_CMD52_WRITE_ARG(arg,func,address,value) \
+    SDIO_SET_CMD52_ARG(arg,1,(func),0,address,value)
+    
+static int Func0_CMD52WriteByte(struct mmc_card *card, unsigned int address, unsigned char byte)
+{
+    struct mmc_command ioCmd;
+    unsigned long      arg;
+    
+    memset(&ioCmd,0,sizeof(ioCmd));
+    SDIO_SET_CMD52_WRITE_ARG(arg,0,address,byte);
+    ioCmd.opcode = SD_IO_RW_DIRECT;
+    ioCmd.arg = arg;
+    ioCmd.flags = MMC_RSP_R5 | MMC_CMD_AC;
+    
+    return mmc_wait_for_cmd(card->host, &ioCmd, 0);
+}
+
+static int Func0_CMD52ReadByte(struct mmc_card *card, unsigned int address, unsigned char *byte)
+{
+    struct mmc_command ioCmd;
+    unsigned long      arg;
+    s32 err;
+    
+    memset(&ioCmd,0,sizeof(ioCmd));
+    SDIO_SET_CMD52_READ_ARG(arg,0,address);
+    ioCmd.opcode = SD_IO_RW_DIRECT;
+    ioCmd.arg = arg;
+    ioCmd.flags = MMC_RSP_R5 | MMC_CMD_AC;
+
+    err = mmc_wait_for_cmd(card->host, &ioCmd, 0);
+
+    if ((!err) && (byte)) {
+        *byte =  ioCmd.resp[0] & 0xFF;
+    }
+
+    return err;
+}
diff --git a/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif_scatter.c b/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif_scatter.c
new file mode 100644
index 00000000000..7516d913dab
--- /dev/null
+++ b/drivers/staging/ath6kl/hif/sdio/linux_sdio/src/hif_scatter.c
@@ -0,0 +1,393 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HIF scatter implementation
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/sdio.h>
+#include <linux/kthread.h>
+#include "hif_internal.h"
+#define ATH_MODULE_NAME hif
+#include "a_debug.h"
+
+#ifdef HIF_LINUX_MMC_SCATTER_SUPPORT
+
+#define _CMD53_ARG_READ          0
+#define _CMD53_ARG_WRITE         1
+#define _CMD53_ARG_BLOCK_BASIS   1 
+#define _CMD53_ARG_FIXED_ADDRESS 0
+#define _CMD53_ARG_INCR_ADDRESS  1
+
+#define SDIO_SET_CMD53_ARG(arg,rw,func,mode,opcode,address,bytes_blocks) \
+    (arg) = (((rw) & 1) << 31)                  | \
+            (((func) & 0x7) << 28)              | \
+            (((mode) & 1) << 27)                | \
+            (((opcode) & 1) << 26)              | \
+            (((address) & 0x1FFFF) << 9)        | \
+            ((bytes_blocks) & 0x1FF)
+            
+static void FreeScatterReq(struct hif_device *device, struct hif_scatter_req *pReq)
+{   
+    unsigned long flag;
+
+    spin_lock_irqsave(&device->lock, flag);
+
+    DL_ListInsertTail(&device->ScatterReqHead, &pReq->ListLink);
+    
+    spin_unlock_irqrestore(&device->lock, flag);
+        
+}
+
+static struct hif_scatter_req *AllocScatterReq(struct hif_device *device) 
+{
+    struct dl_list       *pItem; 
+    unsigned long flag;
+
+    spin_lock_irqsave(&device->lock, flag);
+    
+    pItem = DL_ListRemoveItemFromHead(&device->ScatterReqHead);
+    
+    spin_unlock_irqrestore(&device->lock, flag);
+    
+    if (pItem != NULL) {
+        return A_CONTAINING_STRUCT(pItem, struct hif_scatter_req, ListLink);
+    }
+    
+    return NULL;   
+}
+
+    /* called by async task to perform the operation synchronously using direct MMC APIs  */
+int DoHifReadWriteScatter(struct hif_device *device, BUS_REQUEST *busrequest)
+{
+    int                     i;
+    u8 rw;
+    u8 opcode;
+    struct mmc_request      mmcreq;
+    struct mmc_command      cmd;
+    struct mmc_data         data;
+    struct hif_scatter_req_priv   *pReqPriv;   
+    struct hif_scatter_req        *pReq;       
+    int                status = 0;
+    struct                  scatterlist *pSg;
+    
+    pReqPriv = busrequest->pScatterReq;
+    
+    A_ASSERT(pReqPriv != NULL);
+    
+    pReq = pReqPriv->pHifScatterReq;
+    
+    memset(&mmcreq, 0, sizeof(struct mmc_request));
+    memset(&cmd, 0, sizeof(struct mmc_command));
+    memset(&data, 0, sizeof(struct mmc_data));
+       
+    data.blksz = HIF_MBOX_BLOCK_SIZE;
+    data.blocks = pReq->TotalLength / HIF_MBOX_BLOCK_SIZE;
+                        
+    AR_DEBUG_PRINTF(ATH_DEBUG_SCATTER, ("HIF-SCATTER: (%s) Address: 0x%X, (BlockLen: %d, BlockCount: %d) , (tot:%d,sg:%d)\n",
+              (pReq->Request & HIF_WRITE) ? "WRITE":"READ", pReq->Address, data.blksz, data.blocks,
+              pReq->TotalLength,pReq->ValidScatterEntries));
+         
+    if (pReq->Request  & HIF_WRITE) {
+        rw = _CMD53_ARG_WRITE;
+        data.flags = MMC_DATA_WRITE;
+    } else {
+        rw = _CMD53_ARG_READ;
+        data.flags = MMC_DATA_READ;
+    }
+
+    if (pReq->Request & HIF_FIXED_ADDRESS) {
+        opcode = _CMD53_ARG_FIXED_ADDRESS;
+    } else {
+        opcode = _CMD53_ARG_INCR_ADDRESS;
+    }
+    
+        /* fill SG entries */
+    pSg = pReqPriv->sgentries;   
+    sg_init_table(pSg, pReq->ValidScatterEntries); 
+          
+        /* assemble SG list */   
+    for (i = 0 ; i < pReq->ValidScatterEntries ; i++, pSg++) {
+            /* setup each sg entry */
+        if ((unsigned long)pReq->ScatterList[i].pBuffer & 0x3) {
+                /* note some scatter engines can handle unaligned buffers, print this
+                 * as informational only */
+            AR_DEBUG_PRINTF(ATH_DEBUG_SCATTER,
+                            ("HIF: (%s) Scatter Buffer is unaligned 0x%lx\n",
+                            pReq->Request & HIF_WRITE ? "WRITE":"READ",
+                            (unsigned long)pReq->ScatterList[i].pBuffer)); 
+        }
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_SCATTER, ("  %d:  Addr:0x%lX, Len:%d \n",
+            i,(unsigned long)pReq->ScatterList[i].pBuffer,pReq->ScatterList[i].Length));
+            
+        sg_set_buf(pSg, pReq->ScatterList[i].pBuffer, pReq->ScatterList[i].Length);
+    }
+        /* set scatter-gather table for request */
+    data.sg = pReqPriv->sgentries;
+    data.sg_len = pReq->ValidScatterEntries;
+        /* set command argument */    
+    SDIO_SET_CMD53_ARG(cmd.arg, 
+                       rw, 
+                       device->func->num, 
+                       _CMD53_ARG_BLOCK_BASIS, 
+                       opcode,  
+                       pReq->Address,
+                       data.blocks);  
+                       
+    cmd.opcode = SD_IO_RW_EXTENDED;
+    cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
+    
+    mmcreq.cmd = &cmd;
+    mmcreq.data = &data;
+    
+    mmc_set_data_timeout(&data, device->func->card);    
+        /* synchronous call to process request */
+    mmc_wait_for_req(device->func->card->host, &mmcreq);
+ 
+    if (cmd.error) {
+        status = A_ERROR;   
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("HIF-SCATTER: cmd error: %d \n",cmd.error));
+    }
+               
+    if (data.error) {
+        status = A_ERROR;
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("HIF-SCATTER: data error: %d \n",data.error));   
+    }
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("HIF-SCATTER: FAILED!!! (%s) Address: 0x%X, Block mode (BlockLen: %d, BlockCount: %d)\n",
+              (pReq->Request & HIF_WRITE) ? "WRITE":"READ",pReq->Address, data.blksz, data.blocks));        
+    }
+    
+        /* set completion status, fail or success */
+    pReq->CompletionStatus = status;
+    
+    if (pReq->Request & HIF_ASYNCHRONOUS) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_SCATTER, ("HIF-SCATTER: async_task completion routine req: 0x%lX (%d)\n",(unsigned long)busrequest, status));
+            /* complete the request */
+        A_ASSERT(pReq->CompletionRoutine != NULL);
+        pReq->CompletionRoutine(pReq);
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_SCATTER, ("HIF-SCATTER async_task upping busrequest : 0x%lX (%d)\n", (unsigned long)busrequest,status));
+            /* signal wait */
+        up(&busrequest->sem_req);
+    }
+                                                               
+    return status;   
+}
+
+    /* callback to issue a read-write scatter request */
+static int HifReadWriteScatter(struct hif_device *device, struct hif_scatter_req *pReq)
+{
+    int             status = A_EINVAL;
+    u32 request = pReq->Request;
+    struct hif_scatter_req_priv *pReqPriv = (struct hif_scatter_req_priv *)pReq->HIFPrivate[0];
+    
+    do {
+        
+        A_ASSERT(pReqPriv != NULL);
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_SCATTER, ("HIF-SCATTER: total len: %d Scatter Entries: %d\n", 
+                            pReq->TotalLength, pReq->ValidScatterEntries));
+        
+        if (!(request & HIF_EXTENDED_IO)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("HIF-SCATTER: Invalid command type: 0x%08x\n", request));
+            break;
+        }
+        
+        if (!(request & (HIF_SYNCHRONOUS | HIF_ASYNCHRONOUS))) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("HIF-SCATTER: Invalid execution mode: 0x%08x\n", request));
+            break;
+        }
+        
+        if (!(request & HIF_BLOCK_BASIS)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("HIF-SCATTER: Invalid data mode: 0x%08x\n", request));
+            break;   
+        }
+        
+        if (pReq->TotalLength > MAX_SCATTER_REQ_TRANSFER_SIZE) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
+                            ("HIF-SCATTER: Invalid length: %d \n", pReq->TotalLength));
+            break;          
+        }
+        
+        if (pReq->TotalLength == 0) {
+            A_ASSERT(false);
+            break;    
+        }
+        
+            /* add bus request to the async list for the async I/O thread to process */
+        AddToAsyncList(device, pReqPriv->busrequest);
+
+        if (request & HIF_SYNCHRONOUS) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_SCATTER, ("HIF-SCATTER: queued sync req: 0x%lX\n", (unsigned long)pReqPriv->busrequest));
+            /* signal thread and wait */
+            up(&device->sem_async);
+            if (down_interruptible(&pReqPriv->busrequest->sem_req) != 0) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,("HIF-SCATTER: interrupted! \n"));
+                /* interrupted, exit */
+                status = A_ERROR;
+                break;
+            } else {
+                status = pReq->CompletionStatus;
+            }
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_SCATTER, ("HIF-SCATTER: queued async req: 0x%lX\n", (unsigned long)pReqPriv->busrequest));
+                /* wake thread, it will process and then take care of the async callback */
+            up(&device->sem_async);
+            status = 0;
+        }           
+       
+    } while (false);
+
+    if (status && (request & HIF_ASYNCHRONOUS)) {
+        pReq->CompletionStatus = status;
+        pReq->CompletionRoutine(pReq);
+        status = 0;
+    }
+        
+    return status;  
+}
+
+    /* setup of HIF scatter resources */
+int SetupHIFScatterSupport(struct hif_device *device, struct hif_device_scatter_support_info *pInfo)
+{
+    int              status = A_ERROR;
+    int                   i;
+    struct hif_scatter_req_priv *pReqPriv;
+    BUS_REQUEST          *busrequest;
+        
+    do {
+        
+            /* check if host supports scatter requests and it meets our requirements */
+        if (device->func->card->host->max_segs < MAX_SCATTER_ENTRIES_PER_REQ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HIF-SCATTER : host only supports scatter of : %d entries, need: %d \n",
+                    device->func->card->host->max_segs, MAX_SCATTER_ENTRIES_PER_REQ));
+            status = A_ENOTSUP;
+            break;    
+        }
+                    
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("HIF-SCATTER Enabled: max scatter req : %d entries: %d \n",
+                MAX_SCATTER_REQUESTS, MAX_SCATTER_ENTRIES_PER_REQ)); 
+        
+        for (i = 0; i < MAX_SCATTER_REQUESTS; i++) {    
+                /* allocate the private request blob */
+            pReqPriv = (struct hif_scatter_req_priv *)A_MALLOC(sizeof(struct hif_scatter_req_priv));
+            if (NULL == pReqPriv) {
+                break;    
+            }
+            A_MEMZERO(pReqPriv, sizeof(struct hif_scatter_req_priv));
+                /* save the device instance*/
+            pReqPriv->device = device;      
+                /* allocate the scatter request */
+            pReqPriv->pHifScatterReq = (struct hif_scatter_req *)A_MALLOC(sizeof(struct hif_scatter_req) + 
+                                         (MAX_SCATTER_ENTRIES_PER_REQ - 1) * (sizeof(struct hif_scatter_item))); 
+           
+            if (NULL == pReqPriv->pHifScatterReq) {
+                kfree(pReqPriv);
+                break;      
+            }           
+                /* just zero the main part of the scatter request */
+            A_MEMZERO(pReqPriv->pHifScatterReq, sizeof(struct hif_scatter_req));
+                /* back pointer to the private struct */
+            pReqPriv->pHifScatterReq->HIFPrivate[0] = pReqPriv;
+                /* allocate a bus request for this scatter request */
+            busrequest = hifAllocateBusRequest(device);
+            if (NULL == busrequest) {
+                kfree(pReqPriv->pHifScatterReq);
+                kfree(pReqPriv);
+                break;    
+            }
+                /* assign the scatter request to this bus request */
+            busrequest->pScatterReq = pReqPriv;
+                /* point back to the request */
+            pReqPriv->busrequest = busrequest;                           
+                /* add it to the scatter pool */
+            FreeScatterReq(device,pReqPriv->pHifScatterReq);
+        }
+        
+        if (i != MAX_SCATTER_REQUESTS) {
+            status = A_NO_MEMORY;
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HIF-SCATTER : failed to alloc scatter resources !\n"));
+            break;    
+        }
+        
+            /* set scatter function pointers */
+        pInfo->pAllocateReqFunc = AllocScatterReq;
+        pInfo->pFreeReqFunc = FreeScatterReq;
+        pInfo->pReadWriteScatterFunc = HifReadWriteScatter;   
+        pInfo->MaxScatterEntries = MAX_SCATTER_ENTRIES_PER_REQ;
+        pInfo->MaxTransferSizePerScatterReq = MAX_SCATTER_REQ_TRANSFER_SIZE;
+     
+        status = 0;
+        
+    } while (false);
+    
+    if (status) {
+        CleanupHIFScatterResources(device);   
+    }
+    
+    return status;
+}
+
+    /* clean up scatter support */
+void CleanupHIFScatterResources(struct hif_device *device)
+{
+    struct hif_scatter_req_priv    *pReqPriv;
+    struct hif_scatter_req         *pReq;
+    
+        /* empty the free list */
+        
+    while (1) {
+        
+        pReq = AllocScatterReq(device);
+                
+        if (NULL == pReq) {
+            break;    
+        }   
+        
+        pReqPriv = (struct hif_scatter_req_priv *)pReq->HIFPrivate[0];
+        A_ASSERT(pReqPriv != NULL);
+        
+        if (pReqPriv->busrequest != NULL) {
+            pReqPriv->busrequest->pScatterReq = NULL;
+                /* free bus request */
+            hifFreeBusRequest(device, pReqPriv->busrequest);
+            pReqPriv->busrequest = NULL;
+        }
+        
+        if (pReqPriv->pHifScatterReq != NULL) {
+            kfree(pReqPriv->pHifScatterReq);   
+            pReqPriv->pHifScatterReq = NULL; 
+        }
+                
+        kfree(pReqPriv);       
+    }
+}
+
+#endif // HIF_LINUX_MMC_SCATTER_SUPPORT
diff --git a/drivers/staging/ath6kl/htc2/AR6000/ar6k.c b/drivers/staging/ath6kl/htc2/AR6000/ar6k.c
new file mode 100644
index 00000000000..f8607bc0892
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/AR6000/ar6k.c
@@ -0,0 +1,1479 @@
+//------------------------------------------------------------------------------
+// <copyright file="ar6k.c" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// AR6K device layer that handles register level I/O
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include "a_config.h"
+#include "athdefs.h"
+#include "hw/mbox_host_reg.h"
+#include "a_osapi.h"
+#include "../htc_debug.h"
+#include "hif.h"
+#include "htc_packet.h"
+#include "ar6k.h"
+
+#define MAILBOX_FOR_BLOCK_SIZE          1
+
+int DevEnableInterrupts(struct ar6k_device *pDev);
+int DevDisableInterrupts(struct ar6k_device *pDev);
+
+static void DevCleanupVirtualScatterSupport(struct ar6k_device *pDev);
+
+void AR6KFreeIOPacket(struct ar6k_device *pDev, struct htc_packet *pPacket)
+{
+    LOCK_AR6K(pDev);
+    HTC_PACKET_ENQUEUE(&pDev->RegisterIOList,pPacket);
+    UNLOCK_AR6K(pDev);
+}
+
+struct htc_packet *AR6KAllocIOPacket(struct ar6k_device *pDev)
+{
+    struct htc_packet *pPacket;
+
+    LOCK_AR6K(pDev);
+    pPacket = HTC_PACKET_DEQUEUE(&pDev->RegisterIOList);
+    UNLOCK_AR6K(pDev);
+
+    return pPacket;
+}
+
+void DevCleanup(struct ar6k_device *pDev)
+{
+    DevCleanupGMbox(pDev);
+
+    if (pDev->HifAttached) {
+        HIFDetachHTC(pDev->HIFDevice);
+        pDev->HifAttached = false;
+    }
+
+    DevCleanupVirtualScatterSupport(pDev);
+
+    if (A_IS_MUTEX_VALID(&pDev->Lock)) {
+        A_MUTEX_DELETE(&pDev->Lock);
+    }
+}
+
+int DevSetup(struct ar6k_device *pDev)
+{
+    u32 blocksizes[AR6K_MAILBOXES];
+    int status = 0;
+    int      i;
+    HTC_CALLBACKS htcCallbacks;
+
+    do {
+
+        DL_LIST_INIT(&pDev->ScatterReqHead);
+           /* initialize our free list of IO packets */
+        INIT_HTC_PACKET_QUEUE(&pDev->RegisterIOList);
+        A_MUTEX_INIT(&pDev->Lock);
+
+        A_MEMZERO(&htcCallbacks, sizeof(HTC_CALLBACKS));
+            /* the device layer handles these */
+        htcCallbacks.rwCompletionHandler = DevRWCompletionHandler;
+        htcCallbacks.dsrHandler = DevDsrHandler;
+        htcCallbacks.context = pDev;
+
+        status = HIFAttachHTC(pDev->HIFDevice, &htcCallbacks);
+
+        if (status) {
+            break;
+        }
+
+        pDev->HifAttached = true;
+
+            /* get the addresses for all 4 mailboxes */
+        status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_ADDR,
+                                    &pDev->MailBoxInfo, sizeof(pDev->MailBoxInfo));
+
+        if (status) {
+            A_ASSERT(false);
+            break;
+        }
+
+            /* carve up register I/O packets (these are for ASYNC register I/O ) */
+        for (i = 0; i < AR6K_MAX_REG_IO_BUFFERS; i++) {
+            struct htc_packet *pIOPacket;
+            pIOPacket = &pDev->RegIOBuffers[i].HtcPacket;
+            SET_HTC_PACKET_INFO_RX_REFILL(pIOPacket,
+                                          pDev,
+                                          pDev->RegIOBuffers[i].Buffer,
+                                          AR6K_REG_IO_BUFFER_SIZE,
+                                          0); /* don't care */
+            AR6KFreeIOPacket(pDev,pIOPacket);
+        }
+
+            /* get the block sizes */
+        status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
+                                    blocksizes, sizeof(blocksizes));
+
+        if (status) {
+            A_ASSERT(false);
+            break;
+        }
+
+            /* note: we actually get the block size of a mailbox other than 0, for SDIO the block
+             * size on mailbox 0 is artificially set to 1.  So we use the block size that is set
+             * for the other 3 mailboxes */
+        pDev->BlockSize = blocksizes[MAILBOX_FOR_BLOCK_SIZE];
+            /* must be a power of 2 */
+        A_ASSERT((pDev->BlockSize & (pDev->BlockSize - 1)) == 0);
+
+            /* assemble mask, used for padding to a block */
+        pDev->BlockMask = pDev->BlockSize - 1;
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("BlockSize: %d, MailboxAddress:0x%X \n",
+                    pDev->BlockSize, pDev->MailBoxInfo.MboxAddresses[HTC_MAILBOX]));
+
+        pDev->GetPendingEventsFunc = NULL;
+            /* see if the HIF layer implements the get pending events function  */
+        HIFConfigureDevice(pDev->HIFDevice,
+                           HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
+                           &pDev->GetPendingEventsFunc,
+                           sizeof(pDev->GetPendingEventsFunc));
+
+            /* assume we can process HIF interrupt events asynchronously */
+        pDev->HifIRQProcessingMode = HIF_DEVICE_IRQ_ASYNC_SYNC;
+
+            /* see if the HIF layer overrides this assumption */
+        HIFConfigureDevice(pDev->HIFDevice,
+                           HIF_DEVICE_GET_IRQ_PROC_MODE,
+                           &pDev->HifIRQProcessingMode,
+                           sizeof(pDev->HifIRQProcessingMode));
+
+        switch (pDev->HifIRQProcessingMode) {
+            case HIF_DEVICE_IRQ_SYNC_ONLY:
+                AR_DEBUG_PRINTF(ATH_DEBUG_WARN,("HIF Interrupt processing is SYNC ONLY\n"));
+                    /* see if HIF layer wants HTC to yield */
+                HIFConfigureDevice(pDev->HIFDevice,
+                                   HIF_DEVICE_GET_IRQ_YIELD_PARAMS,
+                                   &pDev->HifIRQYieldParams,
+                                   sizeof(pDev->HifIRQYieldParams));
+
+                if (pDev->HifIRQYieldParams.RecvPacketYieldCount > 0) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
+                        ("HIF requests that DSR yield per %d RECV packets \n",
+                        pDev->HifIRQYieldParams.RecvPacketYieldCount));
+                    pDev->DSRCanYield = true;
+                }
+                break;
+            case HIF_DEVICE_IRQ_ASYNC_SYNC:
+                AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF Interrupt processing is ASYNC and SYNC\n"));
+                break;
+            default:
+                A_ASSERT(false);
+        }
+
+        pDev->HifMaskUmaskRecvEvent = NULL;
+
+            /* see if the HIF layer implements the mask/unmask recv events function  */
+        HIFConfigureDevice(pDev->HIFDevice,
+                           HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC,
+                           &pDev->HifMaskUmaskRecvEvent,
+                           sizeof(pDev->HifMaskUmaskRecvEvent));
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF special overrides : 0x%lX , 0x%lX\n",
+                 (unsigned long)pDev->GetPendingEventsFunc, (unsigned long)pDev->HifMaskUmaskRecvEvent));
+
+        status = DevDisableInterrupts(pDev);
+
+        if (status) {
+            break;
+        }
+
+        status = DevSetupGMbox(pDev);
+
+    } while (false);
+
+    if (status) {
+        if (pDev->HifAttached) {
+            HIFDetachHTC(pDev->HIFDevice);
+            pDev->HifAttached = false;
+        }
+    }
+
+    return status;
+
+}
+
+int DevEnableInterrupts(struct ar6k_device *pDev)
+{
+    int                  status;
+    struct ar6k_irq_enable_registers regs;
+
+    LOCK_AR6K(pDev);
+
+        /* Enable all the interrupts except for the internal AR6000 CPU interrupt */
+    pDev->IrqEnableRegisters.int_status_enable = INT_STATUS_ENABLE_ERROR_SET(0x01) |
+                                      INT_STATUS_ENABLE_CPU_SET(0x01) |
+                                      INT_STATUS_ENABLE_COUNTER_SET(0x01);
+
+    if (NULL == pDev->GetPendingEventsFunc) {
+        pDev->IrqEnableRegisters.int_status_enable |= INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
+    } else {
+        /* The HIF layer provided us with a pending events function which means that
+         * the detection of pending mbox messages is handled in the HIF layer.
+         * This is the case for the SPI2 interface.
+         * In the normal case we enable MBOX interrupts, for the case
+         * with HIFs that offer this mechanism, we keep these interrupts
+         * masked */
+        pDev->IrqEnableRegisters.int_status_enable &= ~INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
+    }
+
+
+    /* Set up the CPU Interrupt Status Register */
+    pDev->IrqEnableRegisters.cpu_int_status_enable = CPU_INT_STATUS_ENABLE_BIT_SET(0x00);
+
+    /* Set up the Error Interrupt Status Register */
+    pDev->IrqEnableRegisters.error_status_enable =
+                                  ERROR_STATUS_ENABLE_RX_UNDERFLOW_SET(0x01) |
+                                  ERROR_STATUS_ENABLE_TX_OVERFLOW_SET(0x01);
+
+    /* Set up the Counter Interrupt Status Register (only for debug interrupt to catch fatal errors) */
+    pDev->IrqEnableRegisters.counter_int_status_enable =
+        COUNTER_INT_STATUS_ENABLE_BIT_SET(AR6K_TARGET_DEBUG_INTR_MASK);
+
+        /* copy into our temp area */
+    memcpy(&regs,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
+
+    UNLOCK_AR6K(pDev);
+
+        /* always synchronous */
+    status = HIFReadWrite(pDev->HIFDevice,
+                          INT_STATUS_ENABLE_ADDRESS,
+                          &regs.int_status_enable,
+                          AR6K_IRQ_ENABLE_REGS_SIZE,
+                          HIF_WR_SYNC_BYTE_INC,
+                          NULL);
+
+    if (status) {
+        /* Can't write it for some reason */
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("Failed to update interrupt control registers err: %d\n", status));
+
+    }
+
+    return status;
+}
+
+int DevDisableInterrupts(struct ar6k_device *pDev)
+{
+    struct ar6k_irq_enable_registers regs;
+
+    LOCK_AR6K(pDev);
+        /* Disable all interrupts */
+    pDev->IrqEnableRegisters.int_status_enable = 0;
+    pDev->IrqEnableRegisters.cpu_int_status_enable = 0;
+    pDev->IrqEnableRegisters.error_status_enable = 0;
+    pDev->IrqEnableRegisters.counter_int_status_enable = 0;
+        /* copy into our temp area */
+    memcpy(&regs,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
+
+    UNLOCK_AR6K(pDev);
+
+        /* always synchronous */
+    return HIFReadWrite(pDev->HIFDevice,
+                        INT_STATUS_ENABLE_ADDRESS,
+                        &regs.int_status_enable,
+                        AR6K_IRQ_ENABLE_REGS_SIZE,
+                        HIF_WR_SYNC_BYTE_INC,
+                        NULL);
+}
+
+/* enable device interrupts */
+int DevUnmaskInterrupts(struct ar6k_device *pDev)
+{
+    /* for good measure, make sure interrupt are disabled before unmasking at the HIF
+     * layer.
+     * The rationale here is that between device insertion (where we clear the interrupts the first time)
+     * and when HTC is finally ready to handle interrupts, other software can perform target "soft" resets.
+     * The AR6K interrupt enables reset back to an "enabled" state when this happens.
+     *  */
+    int IntStatus = 0;
+    DevDisableInterrupts(pDev);
+
+#ifdef THREAD_X
+    // Tobe verified...
+    IntStatus = DevEnableInterrupts(pDev);
+    /* Unmask the host controller interrupts */
+    HIFUnMaskInterrupt(pDev->HIFDevice);
+#else
+    /* Unmask the host controller interrupts */
+    HIFUnMaskInterrupt(pDev->HIFDevice);
+    IntStatus = DevEnableInterrupts(pDev);
+#endif
+
+    return IntStatus;
+}
+
+/* disable all device interrupts */
+int DevMaskInterrupts(struct ar6k_device *pDev)
+{
+        /* mask the interrupt at the HIF layer, we don't want a stray interrupt taken while
+         * we zero out our shadow registers in DevDisableInterrupts()*/
+    HIFMaskInterrupt(pDev->HIFDevice);
+
+    return DevDisableInterrupts(pDev);
+}
+
+/* callback when our fetch to enable/disable completes */
+static void DevDoEnableDisableRecvAsyncHandler(void *Context, struct htc_packet *pPacket)
+{
+    struct ar6k_device *pDev = (struct ar6k_device *)Context;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevDoEnableDisableRecvAsyncHandler: (dev: 0x%lX)\n", (unsigned long)pDev));
+
+    if (pPacket->Status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                (" Failed to disable receiver, status:%d \n", pPacket->Status));
+    }
+        /* free this IO packet */
+    AR6KFreeIOPacket(pDev,pPacket);
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevDoEnableDisableRecvAsyncHandler \n"));
+}
+
+/* disable packet reception (used in case the host runs out of buffers)
+ * this is the "override" method when the HIF reports another methods to
+ * disable recv events */
+static int DevDoEnableDisableRecvOverride(struct ar6k_device *pDev, bool EnableRecv, bool AsyncMode)
+{
+    int                  status = 0;
+    struct htc_packet                *pIOPacket = NULL;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("DevDoEnableDisableRecvOverride: Enable:%d Mode:%d\n",
+            EnableRecv,AsyncMode));
+
+    do {
+
+        if (AsyncMode) {
+
+            pIOPacket = AR6KAllocIOPacket(pDev);
+
+            if (NULL == pIOPacket) {
+                status = A_NO_MEMORY;
+                A_ASSERT(false);
+                break;
+            }
+
+                /* stick in our completion routine when the I/O operation completes */
+            pIOPacket->Completion = DevDoEnableDisableRecvAsyncHandler;
+            pIOPacket->pContext = pDev;
+
+                /* call the HIF layer override and do this asynchronously */
+            status = pDev->HifMaskUmaskRecvEvent(pDev->HIFDevice,
+                                                 EnableRecv ? HIF_UNMASK_RECV : HIF_MASK_RECV,
+                                                 pIOPacket);
+            break;
+        }
+
+            /* if we get here we are doing it synchronously */
+        status = pDev->HifMaskUmaskRecvEvent(pDev->HIFDevice,
+                                             EnableRecv ? HIF_UNMASK_RECV : HIF_MASK_RECV,
+                                             NULL);
+
+    } while (false);
+
+    if (status && (pIOPacket != NULL)) {
+        AR6KFreeIOPacket(pDev,pIOPacket);
+    }
+
+    return status;
+}
+
+/* disable packet reception (used in case the host runs out of buffers)
+ * this is the "normal" method using the interrupt enable registers through
+ * the host I/F */
+static int DevDoEnableDisableRecvNormal(struct ar6k_device *pDev, bool EnableRecv, bool AsyncMode)
+{
+    int                  status = 0;
+    struct htc_packet                *pIOPacket = NULL;
+    struct ar6k_irq_enable_registers regs;
+
+        /* take the lock to protect interrupt enable shadows */
+    LOCK_AR6K(pDev);
+
+    if (EnableRecv) {
+        pDev->IrqEnableRegisters.int_status_enable |= INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
+    } else {
+        pDev->IrqEnableRegisters.int_status_enable &= ~INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
+    }
+
+        /* copy into our temp area */
+    memcpy(&regs,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
+    UNLOCK_AR6K(pDev);
+
+    do {
+
+        if (AsyncMode) {
+
+            pIOPacket = AR6KAllocIOPacket(pDev);
+
+            if (NULL == pIOPacket) {
+                status = A_NO_MEMORY;
+                A_ASSERT(false);
+                break;
+            }
+
+                /* copy values to write to our async I/O buffer */
+            memcpy(pIOPacket->pBuffer,&regs,AR6K_IRQ_ENABLE_REGS_SIZE);
+
+                /* stick in our completion routine when the I/O operation completes */
+            pIOPacket->Completion = DevDoEnableDisableRecvAsyncHandler;
+            pIOPacket->pContext = pDev;
+
+                /* write it out asynchronously */
+            HIFReadWrite(pDev->HIFDevice,
+                         INT_STATUS_ENABLE_ADDRESS,
+                         pIOPacket->pBuffer,
+                         AR6K_IRQ_ENABLE_REGS_SIZE,
+                         HIF_WR_ASYNC_BYTE_INC,
+                         pIOPacket);
+            break;
+        }
+
+        /* if we get here we are doing it synchronously */
+
+        status = HIFReadWrite(pDev->HIFDevice,
+                              INT_STATUS_ENABLE_ADDRESS,
+                              &regs.int_status_enable,
+                              AR6K_IRQ_ENABLE_REGS_SIZE,
+                              HIF_WR_SYNC_BYTE_INC,
+                              NULL);
+
+    } while (false);
+
+    if (status && (pIOPacket != NULL)) {
+        AR6KFreeIOPacket(pDev,pIOPacket);
+    }
+
+    return status;
+}
+
+
+int DevStopRecv(struct ar6k_device *pDev, bool AsyncMode)
+{
+    if (NULL == pDev->HifMaskUmaskRecvEvent) {
+        return DevDoEnableDisableRecvNormal(pDev,false,AsyncMode);
+    } else {
+        return DevDoEnableDisableRecvOverride(pDev,false,AsyncMode);
+    }
+}
+
+int DevEnableRecv(struct ar6k_device *pDev, bool AsyncMode)
+{
+    if (NULL == pDev->HifMaskUmaskRecvEvent) {
+        return DevDoEnableDisableRecvNormal(pDev,true,AsyncMode);
+    } else {
+        return DevDoEnableDisableRecvOverride(pDev,true,AsyncMode);
+    }
+}
+
+int DevWaitForPendingRecv(struct ar6k_device *pDev,u32 TimeoutInMs,bool *pbIsRecvPending)
+{
+    int    status          = 0;
+    u8     host_int_status = 0x0;
+    u32 counter         = 0x0;
+
+    if(TimeoutInMs < 100)
+    {
+        TimeoutInMs = 100;
+    }
+
+    counter = TimeoutInMs / 100;
+
+    do
+    {
+        //Read the Host Interrupt Status Register
+        status = HIFReadWrite(pDev->HIFDevice,
+                              HOST_INT_STATUS_ADDRESS,
+                             &host_int_status,
+                              sizeof(u8),
+                              HIF_RD_SYNC_BYTE_INC,
+                              NULL);
+        if (status)
+        {
+            AR_DEBUG_PRINTF(ATH_LOG_ERR,("DevWaitForPendingRecv:Read HOST_INT_STATUS_ADDRESS Failed 0x%X\n",status));
+            break;
+        }
+
+        host_int_status = !status ? (host_int_status & (1 << 0)):0;
+        if(!host_int_status)
+        {
+            status          = 0;
+           *pbIsRecvPending = false;
+            break;
+        }
+        else
+        {
+            *pbIsRecvPending = true;
+        }
+
+        A_MDELAY(100);
+
+        counter--;
+
+    }while(counter);
+    return status;
+}
+
+void DevDumpRegisters(struct ar6k_device               *pDev,
+                      struct ar6k_irq_proc_registers   *pIrqProcRegs,
+                      struct ar6k_irq_enable_registers *pIrqEnableRegs)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("\n<------- Register Table -------->\n"));
+
+    if (pIrqProcRegs != NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("Host Int Status:           0x%x\n",pIrqProcRegs->host_int_status));
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("CPU Int Status:            0x%x\n",pIrqProcRegs->cpu_int_status));
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("Error Int Status:          0x%x\n",pIrqProcRegs->error_int_status));
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("Counter Int Status:        0x%x\n",pIrqProcRegs->counter_int_status));
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("Mbox Frame:                0x%x\n",pIrqProcRegs->mbox_frame));
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("Rx Lookahead Valid:        0x%x\n",pIrqProcRegs->rx_lookahead_valid));
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("Rx Lookahead 0:            0x%x\n",pIrqProcRegs->rx_lookahead[0]));
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("Rx Lookahead 1:            0x%x\n",pIrqProcRegs->rx_lookahead[1]));
+
+        if (pDev->MailBoxInfo.GMboxAddress != 0) {
+                /* if the target supports GMBOX hardware, dump some additional state */
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+                ("GMBOX Host Int Status 2:   0x%x\n",pIrqProcRegs->host_int_status2));
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+                ("GMBOX RX Avail:            0x%x\n",pIrqProcRegs->gmbox_rx_avail));
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+                ("GMBOX lookahead alias 0:   0x%x\n",pIrqProcRegs->rx_gmbox_lookahead_alias[0]));
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+                ("GMBOX lookahead alias 1:   0x%x\n",pIrqProcRegs->rx_gmbox_lookahead_alias[1]));
+        }
+
+    }
+
+    if (pIrqEnableRegs != NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("Int Status Enable:         0x%x\n",pIrqEnableRegs->int_status_enable));
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("Counter Int Status Enable: 0x%x\n",pIrqEnableRegs->counter_int_status_enable));
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("<------------------------------->\n"));
+}
+
+
+#define DEV_GET_VIRT_DMA_INFO(p)  ((struct dev_scatter_dma_virtual_info *)((p)->HIFPrivate[0]))
+
+static struct hif_scatter_req *DevAllocScatterReq(struct hif_device *Context)
+{
+    struct dl_list *pItem;
+    struct ar6k_device *pDev = (struct ar6k_device *)Context;
+    LOCK_AR6K(pDev);
+    pItem = DL_ListRemoveItemFromHead(&pDev->ScatterReqHead);
+    UNLOCK_AR6K(pDev);
+    if (pItem != NULL) {
+        return A_CONTAINING_STRUCT(pItem, struct hif_scatter_req, ListLink);
+    }
+    return NULL;
+}
+
+static void DevFreeScatterReq(struct hif_device *Context, struct hif_scatter_req *pReq)
+{
+    struct ar6k_device *pDev = (struct ar6k_device *)Context;
+    LOCK_AR6K(pDev);
+    DL_ListInsertTail(&pDev->ScatterReqHead, &pReq->ListLink);
+    UNLOCK_AR6K(pDev);
+}
+
+int DevCopyScatterListToFromDMABuffer(struct hif_scatter_req *pReq, bool FromDMA)
+{
+    u8 *pDMABuffer = NULL;
+    int             i, remaining;
+    u32 length;
+
+    pDMABuffer = pReq->pScatterBounceBuffer;
+
+    if (pDMABuffer == NULL) {
+        A_ASSERT(false);
+        return A_EINVAL;
+    }
+
+    remaining = (int)pReq->TotalLength;
+
+    for (i = 0; i < pReq->ValidScatterEntries; i++) {
+
+        length = min((int)pReq->ScatterList[i].Length, remaining);
+
+        if (length != (int)pReq->ScatterList[i].Length) {
+            A_ASSERT(false);
+                /* there is a problem with the scatter list */
+            return A_EINVAL;
+        }
+
+        if (FromDMA) {
+                /* from DMA buffer */
+            memcpy(pReq->ScatterList[i].pBuffer, pDMABuffer , length);
+        } else {
+                /* to DMA buffer */
+            memcpy(pDMABuffer, pReq->ScatterList[i].pBuffer, length);
+        }
+
+        pDMABuffer += length;
+        remaining -= length;
+    }
+
+    return 0;
+}
+
+static void DevReadWriteScatterAsyncHandler(void *Context, struct htc_packet *pPacket)
+{
+    struct ar6k_device     *pDev = (struct ar6k_device *)Context;
+    struct hif_scatter_req *pReq = (struct hif_scatter_req *)pPacket->pPktContext;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+DevReadWriteScatterAsyncHandler: (dev: 0x%lX)\n", (unsigned long)pDev));
+    
+    pReq->CompletionStatus = pPacket->Status;
+
+    AR6KFreeIOPacket(pDev,pPacket);
+
+    pReq->CompletionRoutine(pReq);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-DevReadWriteScatterAsyncHandler \n"));
+}
+
+static int DevReadWriteScatter(struct hif_device *Context, struct hif_scatter_req *pReq)
+{
+    struct ar6k_device     *pDev = (struct ar6k_device *)Context;
+    int        status = 0;
+    struct htc_packet      *pIOPacket = NULL;
+    u32 request = pReq->Request;
+
+    do {
+
+        if (pReq->TotalLength > AR6K_MAX_TRANSFER_SIZE_PER_SCATTER) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                            ("Invalid length: %d \n", pReq->TotalLength));
+            break;
+        }
+
+        if (pReq->TotalLength == 0) {
+            A_ASSERT(false);
+            break;
+        }
+
+        if (request & HIF_ASYNCHRONOUS) {
+                /* use an I/O packet to carry this request */
+            pIOPacket = AR6KAllocIOPacket(pDev);
+            if (NULL == pIOPacket) {
+                status = A_NO_MEMORY;
+                break;
+            }
+
+                /* save the request */
+            pIOPacket->pPktContext = pReq;
+                /* stick in our completion routine when the I/O operation completes */
+            pIOPacket->Completion = DevReadWriteScatterAsyncHandler;
+            pIOPacket->pContext = pDev;
+        }
+
+        if (request & HIF_WRITE) {
+            /* in virtual DMA, we are issuing the requests through the legacy HIFReadWrite API
+             * this API will adjust the address automatically for the last byte to fall on the mailbox
+             * EOM. */
+
+            /* if the address is an extended address, we can adjust the address here since the extended
+             * address will bypass the normal checks in legacy HIF layers */
+            if (pReq->Address == pDev->MailBoxInfo.MboxProp[HTC_MAILBOX].ExtendedAddress) {
+                pReq->Address += pDev->MailBoxInfo.MboxProp[HTC_MAILBOX].ExtendedSize - pReq->TotalLength;
+            }
+        }
+
+            /* use legacy readwrite */
+        status = HIFReadWrite(pDev->HIFDevice,
+                              pReq->Address,
+                              DEV_GET_VIRT_DMA_INFO(pReq)->pVirtDmaBuffer,
+                              pReq->TotalLength,
+                              request,
+                              (request & HIF_ASYNCHRONOUS) ? pIOPacket : NULL);
+
+    } while (false);
+
+    if ((status != A_PENDING) && status && (request & HIF_ASYNCHRONOUS)) {
+        if (pIOPacket != NULL) {
+            AR6KFreeIOPacket(pDev,pIOPacket);
+        }
+        pReq->CompletionStatus = status;
+        pReq->CompletionRoutine(pReq);
+        status = 0;
+    }
+
+    return status;
+}
+
+
+static void DevCleanupVirtualScatterSupport(struct ar6k_device *pDev)
+{
+    struct hif_scatter_req *pReq;
+
+    while (1) {
+        pReq = DevAllocScatterReq((struct hif_device *)pDev);
+        if (NULL == pReq) {
+            break;
+        }
+        kfree(pReq);
+    }
+
+}
+
+    /* function to set up virtual scatter support if HIF layer has not implemented the interface */
+static int DevSetupVirtualScatterSupport(struct ar6k_device *pDev)
+{
+    int                     status = 0;
+    int                          bufferSize, sgreqSize;
+    int                          i;
+    struct dev_scatter_dma_virtual_info *pVirtualInfo;
+    struct hif_scatter_req              *pReq;
+
+    bufferSize = sizeof(struct dev_scatter_dma_virtual_info) +
+                2 * (A_GET_CACHE_LINE_BYTES()) + AR6K_MAX_TRANSFER_SIZE_PER_SCATTER;
+
+    sgreqSize = sizeof(struct hif_scatter_req) +
+                    (AR6K_SCATTER_ENTRIES_PER_REQ - 1) * (sizeof(struct hif_scatter_item));
+
+    for (i = 0; i < AR6K_SCATTER_REQS; i++) {
+            /* allocate the scatter request, buffer info and the actual virtual buffer itself */
+        pReq = (struct hif_scatter_req *)A_MALLOC(sgreqSize + bufferSize);
+
+        if (NULL == pReq) {
+            status = A_NO_MEMORY;
+            break;
+        }
+
+        A_MEMZERO(pReq, sgreqSize);
+
+            /* the virtual DMA starts after the scatter request struct */
+        pVirtualInfo = (struct dev_scatter_dma_virtual_info *)((u8 *)pReq + sgreqSize);
+        A_MEMZERO(pVirtualInfo, sizeof(struct dev_scatter_dma_virtual_info));
+
+        pVirtualInfo->pVirtDmaBuffer = &pVirtualInfo->DataArea[0];
+            /* align buffer to cache line in case host controller can actually DMA this */
+        pVirtualInfo->pVirtDmaBuffer = A_ALIGN_TO_CACHE_LINE(pVirtualInfo->pVirtDmaBuffer);
+            /* store the structure in the private area */
+        pReq->HIFPrivate[0] = pVirtualInfo;
+            /* we emulate a DMA bounce interface */
+        pReq->ScatterMethod = HIF_SCATTER_DMA_BOUNCE;
+        pReq->pScatterBounceBuffer = pVirtualInfo->pVirtDmaBuffer;
+            /* free request to the list */
+        DevFreeScatterReq((struct hif_device *)pDev,pReq);
+    }
+
+    if (status) {
+        DevCleanupVirtualScatterSupport(pDev);
+    } else {
+        pDev->HifScatterInfo.pAllocateReqFunc = DevAllocScatterReq;
+        pDev->HifScatterInfo.pFreeReqFunc = DevFreeScatterReq;
+        pDev->HifScatterInfo.pReadWriteScatterFunc = DevReadWriteScatter;
+        if (pDev->MailBoxInfo.MboxBusIFType == MBOX_BUS_IF_SPI) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("AR6K: SPI bus requires RX scatter limits\n"));
+            pDev->HifScatterInfo.MaxScatterEntries = AR6K_MIN_SCATTER_ENTRIES_PER_REQ;
+            pDev->HifScatterInfo.MaxTransferSizePerScatterReq = AR6K_MIN_TRANSFER_SIZE_PER_SCATTER;
+        } else {
+            pDev->HifScatterInfo.MaxScatterEntries = AR6K_SCATTER_ENTRIES_PER_REQ;
+            pDev->HifScatterInfo.MaxTransferSizePerScatterReq = AR6K_MAX_TRANSFER_SIZE_PER_SCATTER;
+        }
+        pDev->ScatterIsVirtual = true;
+    }
+
+    return status;
+}
+
+int DevCleanupMsgBundling(struct ar6k_device *pDev)
+{
+    if(NULL != pDev)
+    {
+        DevCleanupVirtualScatterSupport(pDev);
+    }
+
+    return 0;
+}
+
+int DevSetupMsgBundling(struct ar6k_device *pDev, int MaxMsgsPerTransfer)
+{
+    int status;
+
+    if (pDev->MailBoxInfo.Flags & HIF_MBOX_FLAG_NO_BUNDLING) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("HIF requires bundling disabled\n"));
+        return A_ENOTSUP;
+    }
+
+    status = HIFConfigureDevice(pDev->HIFDevice,
+                                HIF_CONFIGURE_QUERY_SCATTER_REQUEST_SUPPORT,
+                                &pDev->HifScatterInfo,
+                                sizeof(pDev->HifScatterInfo));
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
+            ("AR6K: ** HIF layer does not support scatter requests (%d) \n",status));
+
+            /* we can try to use a virtual DMA scatter mechanism using legacy HIFReadWrite() */
+        status = DevSetupVirtualScatterSupport(pDev);
+
+        if (!status) {
+             AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+                ("AR6K: virtual scatter transfers enabled (max scatter items:%d: maxlen:%d) \n",
+                    DEV_GET_MAX_MSG_PER_BUNDLE(pDev), DEV_GET_MAX_BUNDLE_LENGTH(pDev)));
+        }
+
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("AR6K: HIF layer supports scatter requests (max scatter items:%d: maxlen:%d) \n",
+                    DEV_GET_MAX_MSG_PER_BUNDLE(pDev), DEV_GET_MAX_BUNDLE_LENGTH(pDev)));
+    }
+
+    if (!status) {
+            /* for the recv path, the maximum number of bytes per recv bundle is just limited
+             * by the maximum transfer size at the HIF layer */
+        pDev->MaxRecvBundleSize = pDev->HifScatterInfo.MaxTransferSizePerScatterReq;
+
+        if (pDev->MailBoxInfo.MboxBusIFType == MBOX_BUS_IF_SPI) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("AR6K : SPI bus requires TX bundling disabled\n"));
+            pDev->MaxSendBundleSize = 0;
+        } else {
+                /* for the send path, the max transfer size is limited by the existence and size of
+                 * the extended mailbox address range */
+            if (pDev->MailBoxInfo.MboxProp[0].ExtendedAddress != 0) {
+                pDev->MaxSendBundleSize = pDev->MailBoxInfo.MboxProp[0].ExtendedSize;
+            } else {
+                    /* legacy */
+                pDev->MaxSendBundleSize = AR6K_LEGACY_MAX_WRITE_LENGTH;
+            }
+
+            if (pDev->MaxSendBundleSize > pDev->HifScatterInfo.MaxTransferSizePerScatterReq) {
+                    /* limit send bundle size to what the HIF can support for scatter requests */
+                pDev->MaxSendBundleSize = pDev->HifScatterInfo.MaxTransferSizePerScatterReq;
+            }
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+            ("AR6K: max recv: %d max send: %d \n",
+                    DEV_GET_MAX_BUNDLE_RECV_LENGTH(pDev), DEV_GET_MAX_BUNDLE_SEND_LENGTH(pDev)));
+
+    }
+    return status;
+}
+
+int DevSubmitScatterRequest(struct ar6k_device *pDev, struct hif_scatter_req *pScatterReq, bool Read, bool Async)
+{
+    int status;
+
+    if (Read) {
+            /* read operation */
+        pScatterReq->Request = (Async) ? HIF_RD_ASYNC_BLOCK_FIX : HIF_RD_SYNC_BLOCK_FIX;
+        pScatterReq->Address = pDev->MailBoxInfo.MboxAddresses[HTC_MAILBOX];
+        A_ASSERT(pScatterReq->TotalLength <= (u32)DEV_GET_MAX_BUNDLE_RECV_LENGTH(pDev));
+    } else {
+        u32 mailboxWidth;
+
+            /* write operation */
+        pScatterReq->Request = (Async) ? HIF_WR_ASYNC_BLOCK_INC : HIF_WR_SYNC_BLOCK_INC;
+        A_ASSERT(pScatterReq->TotalLength <= (u32)DEV_GET_MAX_BUNDLE_SEND_LENGTH(pDev));
+        if (pScatterReq->TotalLength > AR6K_LEGACY_MAX_WRITE_LENGTH) {
+                /* for large writes use the extended address */
+            pScatterReq->Address = pDev->MailBoxInfo.MboxProp[HTC_MAILBOX].ExtendedAddress;
+            mailboxWidth = pDev->MailBoxInfo.MboxProp[HTC_MAILBOX].ExtendedSize;
+        } else {
+            pScatterReq->Address = pDev->MailBoxInfo.MboxAddresses[HTC_MAILBOX];
+            mailboxWidth = AR6K_LEGACY_MAX_WRITE_LENGTH;
+        }
+
+        if (!pDev->ScatterIsVirtual) {
+            /* we are passing this scatter list down to the HIF layer' scatter request handler, fixup the address
+             * so that the last byte falls on the EOM, we do this for those HIFs that support the
+             * scatter API */
+            pScatterReq->Address += (mailboxWidth - pScatterReq->TotalLength);
+        }
+
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV | ATH_DEBUG_SEND,
+                ("DevSubmitScatterRequest, Entries: %d, Total Length: %d Mbox:0x%X (mode: %s : %s)\n",
+                pScatterReq->ValidScatterEntries,
+                pScatterReq->TotalLength,
+                pScatterReq->Address,
+                Async ? "ASYNC" : "SYNC",
+                (Read) ? "RD" : "WR"));
+
+    status = DEV_PREPARE_SCATTER_OPERATION(pScatterReq);
+
+    if (status) {
+        if (Async) {
+            pScatterReq->CompletionStatus = status;
+            pScatterReq->CompletionRoutine(pScatterReq);
+            return 0;
+        }
+        return status;
+    }
+
+    status = pDev->HifScatterInfo.pReadWriteScatterFunc(pDev->ScatterIsVirtual ? pDev : pDev->HIFDevice,
+                                                        pScatterReq);
+    if (!Async) {
+            /* in sync mode, we can touch the scatter request */
+        pScatterReq->CompletionStatus = status;
+        DEV_FINISH_SCATTER_OPERATION(pScatterReq);
+    } else {
+        if (status == A_PENDING) {
+            status = 0;
+        }
+    }
+
+    return status;
+}
+
+
+#ifdef MBOXHW_UNIT_TEST
+
+
+/* This is a mailbox hardware unit test that must be called in a schedulable context
+ * This test is very simple, it will send a list of buffers with a counting pattern
+ * and the target will invert the data and send the message back
+ *
+ * the unit test has the following constraints:
+ *
+ * The target has at least 8 buffers of 256 bytes each. The host will send
+ * the following pattern of buffers in rapid succession :
+ *
+ * 1 buffer - 128 bytes
+ * 1 buffer - 256 bytes
+ * 1 buffer - 512 bytes
+ * 1 buffer - 1024 bytes
+ *
+ * The host will send the buffers to one mailbox and wait for buffers to be reflected
+ * back from the same mailbox. The target sends the buffers FIFO order.
+ * Once the final buffer has been received for a mailbox, the next mailbox is tested.
+ *
+ *
+ * Note:  To simplifythe test , we assume that the chosen buffer sizes
+ *        will fall on a nice block pad
+ *
+ * It is expected that higher-order tests will be written to stress the mailboxes using
+ * a message-based protocol (with some performance timming) that can create more
+ * randomness in the packets sent over mailboxes.
+ *
+ * */
+
+#define A_ROUND_UP_PWR2(x, align)    (((int) (x) + ((align)-1)) & ~((align)-1))
+
+#define BUFFER_BLOCK_PAD 128
+
+#if 0
+#define BUFFER1 128
+#define BUFFER2 256
+#define BUFFER3 512
+#define BUFFER4 1024
+#endif
+
+#if 1
+#define BUFFER1 80
+#define BUFFER2 200
+#define BUFFER3 444
+#define BUFFER4 800
+#endif
+
+#define TOTAL_BYTES (A_ROUND_UP_PWR2(BUFFER1,BUFFER_BLOCK_PAD) + \
+                     A_ROUND_UP_PWR2(BUFFER2,BUFFER_BLOCK_PAD) + \
+                     A_ROUND_UP_PWR2(BUFFER3,BUFFER_BLOCK_PAD) + \
+                     A_ROUND_UP_PWR2(BUFFER4,BUFFER_BLOCK_PAD) )
+
+#define TEST_BYTES (BUFFER1 +  BUFFER2 + BUFFER3 + BUFFER4)
+
+#define TEST_CREDITS_RECV_TIMEOUT 100
+
+static u8 g_Buffer[TOTAL_BYTES];
+static u32 g_MailboxAddrs[AR6K_MAILBOXES];
+static u32 g_BlockSizes[AR6K_MAILBOXES];
+
+#define BUFFER_PROC_LIST_DEPTH 4
+
+struct buffer_proc_list {
+    u8 *pBuffer;
+    u32 length;
+};
+
+
+#define PUSH_BUFF_PROC_ENTRY(pList,len,pCurrpos) \
+{                                                   \
+    (pList)->pBuffer = (pCurrpos);                  \
+    (pList)->length = (len);                        \
+    (pCurrpos) += (len);                            \
+    (pList)++;                                      \
+}
+
+/* a simple and crude way to send different "message" sizes */
+static void AssembleBufferList(struct buffer_proc_list *pList)
+{
+    u8 *pBuffer = g_Buffer;
+
+#if BUFFER_PROC_LIST_DEPTH < 4
+#error "Buffer processing list depth is not deep enough!!"
+#endif
+
+    PUSH_BUFF_PROC_ENTRY(pList,BUFFER1,pBuffer);
+    PUSH_BUFF_PROC_ENTRY(pList,BUFFER2,pBuffer);
+    PUSH_BUFF_PROC_ENTRY(pList,BUFFER3,pBuffer);
+    PUSH_BUFF_PROC_ENTRY(pList,BUFFER4,pBuffer);
+
+}
+
+#define FILL_ZERO     true
+#define FILL_COUNTING false
+static void InitBuffers(bool Zero)
+{
+    u16 *pBuffer16 = (u16 *)g_Buffer;
+    int      i;
+
+        /* fill buffer with 16 bit counting pattern or zeros */
+    for (i = 0; i <  (TOTAL_BYTES / 2) ; i++) {
+        if (!Zero) {
+            pBuffer16[i] = (u16)i;
+        } else {
+            pBuffer16[i] = 0;
+        }
+    }
+}
+
+
+static bool CheckOneBuffer(u16 *pBuffer16, int Length)
+{
+    int      i;
+    u16 startCount;
+    bool   success = true;
+
+        /* get the starting count */
+    startCount = pBuffer16[0];
+        /* invert it, this is the expected value */
+    startCount = ~startCount;
+        /* scan the buffer and verify */
+    for (i = 0; i < (Length / 2) ; i++,startCount++) {
+            /* target will invert all the data */
+        if ((u16)pBuffer16[i] != (u16)~startCount) {
+            success = false;
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Invalid Data Got:0x%X, Expecting:0x%X (offset:%d, total:%d) \n",
+                        pBuffer16[i], ((u16)~startCount), i, Length));
+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("0x%X 0x%X 0x%X 0x%X \n",
+                        pBuffer16[i], pBuffer16[i + 1], pBuffer16[i + 2],pBuffer16[i+3]));
+            break;
+        }
+    }
+
+    return success;
+}
+
+static bool CheckBuffers(void)
+{
+    int      i;
+    bool   success = true;
+    struct buffer_proc_list checkList[BUFFER_PROC_LIST_DEPTH];
+
+        /* assemble the list */
+    AssembleBufferList(checkList);
+
+        /* scan the buffers and verify */
+    for (i = 0; i < BUFFER_PROC_LIST_DEPTH ; i++) {
+        success = CheckOneBuffer((u16 *)checkList[i].pBuffer, checkList[i].length);
+        if (!success) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Buffer : 0x%X, Length:%d failed verify \n",
+                        (u32)checkList[i].pBuffer, checkList[i].length));
+            break;
+        }
+    }
+
+    return success;
+}
+
+    /* find the end marker for the last buffer we will be sending */
+static u16 GetEndMarker(void)
+{
+    u8 *pBuffer;
+    struct buffer_proc_list checkList[BUFFER_PROC_LIST_DEPTH];
+
+        /* fill up buffers with the normal counting pattern */
+    InitBuffers(FILL_COUNTING);
+
+        /* assemble the list we will be sending down */
+    AssembleBufferList(checkList);
+        /* point to the last 2 bytes of the last buffer */
+    pBuffer = &(checkList[BUFFER_PROC_LIST_DEPTH - 1].pBuffer[(checkList[BUFFER_PROC_LIST_DEPTH - 1].length) - 2]);
+
+        /* the last count in the last buffer is the marker */
+    return (u16)pBuffer[0] | ((u16)pBuffer[1] << 8);
+}
+
+#define ATH_PRINT_OUT_ZONE ATH_DEBUG_ERR
+
+/* send the ordered buffers to the target */
+static int SendBuffers(struct ar6k_device *pDev, int mbox)
+{
+    int         status = 0;
+    u32 request = HIF_WR_SYNC_BLOCK_INC;
+    struct buffer_proc_list sendList[BUFFER_PROC_LIST_DEPTH];
+    int              i;
+    int              totalBytes = 0;
+    int              paddedLength;
+    int              totalwPadding = 0;
+
+    AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Sending buffers on mailbox : %d \n",mbox));
+
+        /* fill buffer with counting pattern */
+    InitBuffers(FILL_COUNTING);
+
+        /* assemble the order in which we send */
+    AssembleBufferList(sendList);
+
+    for (i = 0; i < BUFFER_PROC_LIST_DEPTH; i++) {
+
+            /* we are doing block transfers, so we need to pad everything to a block size */
+        paddedLength = (sendList[i].length + (g_BlockSizes[mbox] - 1)) &
+                       (~(g_BlockSizes[mbox] - 1));
+
+            /* send each buffer synchronously */
+        status = HIFReadWrite(pDev->HIFDevice,
+                              g_MailboxAddrs[mbox],
+                              sendList[i].pBuffer,
+                              paddedLength,
+                              request,
+                              NULL);
+        if (status) {
+            break;
+        }
+        totalBytes += sendList[i].length;
+        totalwPadding += paddedLength;
+    }
+
+    AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Sent %d bytes (%d padded bytes) to mailbox : %d \n",totalBytes,totalwPadding,mbox));
+
+    return status;
+}
+
+/* poll the mailbox credit counter until we get a credit or timeout */
+static int GetCredits(struct ar6k_device *pDev, int mbox, int *pCredits)
+{
+    int status = 0;
+    int      timeout = TEST_CREDITS_RECV_TIMEOUT;
+    u8 credits = 0;
+    u32 address;
+
+    while (true) {
+
+            /* Read the counter register to get credits, this auto-decrements  */
+        address = COUNT_DEC_ADDRESS + (AR6K_MAILBOXES + mbox) * 4;
+        status = HIFReadWrite(pDev->HIFDevice, address, &credits, sizeof(credits),
+                              HIF_RD_SYNC_BYTE_FIX, NULL);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                ("Unable to decrement the command credit count register (mbox=%d)\n",mbox));
+            status = A_ERROR;
+            break;
+        }
+
+        if (credits) {
+            break;
+        }
+
+        timeout--;
+
+        if (timeout <= 0) {
+              AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                (" Timeout reading credit registers (mbox=%d, address:0x%X) \n",mbox,address));
+            status = A_ERROR;
+            break;
+        }
+
+         /* delay a little, target may not be ready */
+         A_MDELAY(1000);
+
+    }
+
+    if (status == 0) {
+        *pCredits = credits;
+    }
+
+    return status;
+}
+
+
+/* wait for the buffers to come back */
+static int RecvBuffers(struct ar6k_device *pDev, int mbox)
+{
+    int         status = 0;
+    u32 request = HIF_RD_SYNC_BLOCK_INC;
+    struct buffer_proc_list recvList[BUFFER_PROC_LIST_DEPTH];
+    int              curBuffer;
+    int              credits;
+    int              i;
+    int              totalBytes = 0;
+    int              paddedLength;
+    int              totalwPadding = 0;
+
+    AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Waiting for buffers on mailbox : %d \n",mbox));
+
+        /* zero the buffers */
+    InitBuffers(FILL_ZERO);
+
+        /* assemble the order in which we should receive */
+    AssembleBufferList(recvList);
+
+    curBuffer = 0;
+
+    while (curBuffer < BUFFER_PROC_LIST_DEPTH) {
+
+            /* get number of buffers that have been completed, this blocks
+             * until we get at least 1 credit or it times out */
+        status = GetCredits(pDev, mbox, &credits);
+
+        if (status) {
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Got %d messages on mailbox : %d \n",credits, mbox));
+
+            /* get all the buffers that are sitting on the queue */
+        for (i = 0; i < credits; i++) {
+            A_ASSERT(curBuffer < BUFFER_PROC_LIST_DEPTH);
+                /* recv the current buffer synchronously, the buffers should come back in
+                 * order... with padding applied by the target */
+            paddedLength = (recvList[curBuffer].length + (g_BlockSizes[mbox] - 1)) &
+                       (~(g_BlockSizes[mbox] - 1));
+
+            status = HIFReadWrite(pDev->HIFDevice,
+                                  g_MailboxAddrs[mbox],
+                                  recvList[curBuffer].pBuffer,
+                                  paddedLength,
+                                  request,
+                                  NULL);
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to read %d bytes on mailbox:%d : address:0x%X \n",
+                        recvList[curBuffer].length, mbox, g_MailboxAddrs[mbox]));
+                break;
+            }
+
+            totalwPadding += paddedLength;
+            totalBytes += recvList[curBuffer].length;
+            curBuffer++;
+        }
+
+        if (status) {
+            break;
+        }
+            /* go back and get some more */
+        credits = 0;
+    }
+
+    if (totalBytes != TEST_BYTES) {
+        A_ASSERT(false);
+    }  else {
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Got all buffers on mbox:%d total recv :%d (w/Padding : %d) \n",
+            mbox, totalBytes, totalwPadding));
+    }
+
+    return status;
+
+
+}
+
+static int DoOneMboxHWTest(struct ar6k_device *pDev, int mbox)
+{
+    int status;
+
+    do {
+            /* send out buffers */
+        status = SendBuffers(pDev,mbox);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Sending buffers Failed : %d mbox:%d\n",status,mbox));
+            break;
+        }
+
+            /* go get them, this will block */
+        status =  RecvBuffers(pDev, mbox);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Recv buffers Failed : %d mbox:%d\n",status,mbox));
+            break;
+        }
+
+            /* check the returned data patterns */
+        if (!CheckBuffers()) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Buffer Verify Failed : mbox:%d\n",mbox));
+            status = A_ERROR;
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" Send/Recv success! mailbox : %d \n",mbox));
+
+    }  while (false);
+
+    return status;
+}
+
+/* here is where the test starts */
+int DoMboxHWTest(struct ar6k_device *pDev)
+{
+    int      i;
+    int status;
+    int      credits = 0;
+    u8 params[4];
+    int      numBufs;
+    int      bufferSize;
+    u16 temp;
+
+
+    AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest START -  \n"));
+
+    do {
+            /* get the addresses for all 4 mailboxes */
+        status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_ADDR,
+                                    g_MailboxAddrs, sizeof(g_MailboxAddrs));
+
+        if (status) {
+            A_ASSERT(false);
+            break;
+        }
+
+            /* get the block sizes */
+        status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
+                                    g_BlockSizes, sizeof(g_BlockSizes));
+
+        if (status) {
+            A_ASSERT(false);
+            break;
+        }
+
+            /* note, the HIF layer usually reports mbox 0 to have a block size of
+             * 1, but our test wants to run in block-mode for all mailboxes, so we treat all mailboxes
+             * the same. */
+        g_BlockSizes[0] = g_BlockSizes[1];
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Block Size to use: %d \n",g_BlockSizes[0]));
+
+        if (g_BlockSizes[1] > BUFFER_BLOCK_PAD) {
+            AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("%d Block size is too large for buffer pad %d\n",
+                g_BlockSizes[1], BUFFER_BLOCK_PAD));
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Waiting for target.... \n"));
+
+            /* the target lets us know it is ready by giving us 1 credit on
+             * mailbox 0 */
+        status = GetCredits(pDev, 0, &credits);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to wait for target ready \n"));
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Target is ready ...\n"));
+
+            /* read the first 4 scratch registers */
+        status = HIFReadWrite(pDev->HIFDevice,
+                              SCRATCH_ADDRESS,
+                              params,
+                              4,
+                              HIF_RD_SYNC_BYTE_INC,
+                              NULL);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to wait get parameters \n"));
+            break;
+        }
+
+        numBufs = params[0];
+        bufferSize = (int)(((u16)params[2] << 8) | (u16)params[1]);
+
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE,
+            ("Target parameters: bufs per mailbox:%d, buffer size:%d bytes (total space: %d, minimum required space (w/padding): %d) \n",
+            numBufs, bufferSize, (numBufs * bufferSize), TOTAL_BYTES));
+
+        if ((numBufs * bufferSize) < TOTAL_BYTES) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Not Enough buffer space to run test! need:%d, got:%d \n",
+                TOTAL_BYTES, (numBufs*bufferSize)));
+            status = A_ERROR;
+            break;
+        }
+
+        temp = GetEndMarker();
+
+        status = HIFReadWrite(pDev->HIFDevice,
+                              SCRATCH_ADDRESS + 4,
+                              (u8 *)&temp,
+                              2,
+                              HIF_WR_SYNC_BYTE_INC,
+                              NULL);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to write end marker \n"));
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("End Marker: 0x%X \n",temp));
+
+        temp = (u16)g_BlockSizes[1];
+            /* convert to a mask */
+        temp = temp - 1;
+        status = HIFReadWrite(pDev->HIFDevice,
+                              SCRATCH_ADDRESS + 6,
+                              (u8 *)&temp,
+                              2,
+                              HIF_WR_SYNC_BYTE_INC,
+                              NULL);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to write block mask \n"));
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Set Block Mask: 0x%X \n",temp));
+
+            /* execute the test on each mailbox */
+        for (i = 0; i < AR6K_MAILBOXES; i++) {
+            status = DoOneMboxHWTest(pDev, i);
+            if (status) {
+                break;
+            }
+        }
+
+    } while (false);
+
+    if (status == 0) {
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest DONE - SUCCESS! -  \n"));
+    } else {
+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest DONE - FAILED! -  \n"));
+    }
+        /* don't let HTC_Start continue, the target is actually not running any HTC code */
+    return A_ERROR;
+}
+#endif
+
+
+
diff --git a/drivers/staging/ath6kl/htc2/AR6000/ar6k.h b/drivers/staging/ath6kl/htc2/AR6000/ar6k.h
new file mode 100644
index 00000000000..e551dbe674d
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/AR6000/ar6k.h
@@ -0,0 +1,401 @@
+//------------------------------------------------------------------------------
+// <copyright file="ar6k.h" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// AR6K device layer that handles register level I/O
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef AR6K_H_
+#define AR6K_H_
+
+#include "hci_transport_api.h"
+#include "../htc_debug.h"
+
+#define AR6K_MAILBOXES 4
+
+/* HTC runs over mailbox 0 */
+#define HTC_MAILBOX          0
+
+#define AR6K_TARGET_DEBUG_INTR_MASK     0x01
+
+#define OTHER_INTS_ENABLED (INT_STATUS_ENABLE_ERROR_MASK |   \
+                            INT_STATUS_ENABLE_CPU_MASK   |   \
+                            INT_STATUS_ENABLE_COUNTER_MASK)
+
+
+//#define MBOXHW_UNIT_TEST 1
+
+PREPACK struct ar6k_irq_proc_registers {
+    u8 host_int_status;
+    u8 cpu_int_status;
+    u8 error_int_status;
+    u8 counter_int_status;
+    u8 mbox_frame;
+    u8 rx_lookahead_valid;
+    u8 host_int_status2;
+    u8 gmbox_rx_avail;
+    u32 rx_lookahead[2];
+    u32 rx_gmbox_lookahead_alias[2];
+} POSTPACK;
+
+#define AR6K_IRQ_PROC_REGS_SIZE sizeof(struct ar6k_irq_proc_registers)
+
+PREPACK struct ar6k_irq_enable_registers {
+    u8 int_status_enable;
+    u8 cpu_int_status_enable;
+    u8 error_status_enable;
+    u8 counter_int_status_enable;
+} POSTPACK;
+
+PREPACK struct ar6k_gmbox_ctrl_registers {
+    u8 int_status_enable;
+} POSTPACK;
+
+#define AR6K_IRQ_ENABLE_REGS_SIZE sizeof(struct ar6k_irq_enable_registers)
+
+#define AR6K_REG_IO_BUFFER_SIZE     32
+#define AR6K_MAX_REG_IO_BUFFERS     8
+#define FROM_DMA_BUFFER true
+#define TO_DMA_BUFFER   false
+#define AR6K_SCATTER_ENTRIES_PER_REQ            16
+#define AR6K_MAX_TRANSFER_SIZE_PER_SCATTER      16*1024
+#define AR6K_SCATTER_REQS                       4
+#define AR6K_LEGACY_MAX_WRITE_LENGTH            2048
+
+#ifndef A_CACHE_LINE_PAD
+#define A_CACHE_LINE_PAD                        128
+#endif
+#define AR6K_MIN_SCATTER_ENTRIES_PER_REQ        2
+#define AR6K_MIN_TRANSFER_SIZE_PER_SCATTER      4*1024
+
+/* buffers for ASYNC I/O */
+struct ar6k_async_reg_io_buffer {
+    struct htc_packet    HtcPacket;   /* we use an HTC packet as a wrapper for our async register-based I/O */
+    u8 _Pad1[A_CACHE_LINE_PAD];
+    u8 Buffer[AR6K_REG_IO_BUFFER_SIZE];  /* cache-line safe with pads around */
+    u8 _Pad2[A_CACHE_LINE_PAD];
+};
+
+struct ar6k_gmbox_info { 
+    void        *pProtocolContext;
+    int    (*pMessagePendingCallBack)(void *pContext, u8 LookAheadBytes[], int ValidBytes);
+    int    (*pCreditsPendingCallback)(void *pContext, int NumCredits,  bool CreditIRQEnabled);
+    void        (*pTargetFailureCallback)(void *pContext, int Status);
+    void        (*pStateDumpCallback)(void *pContext);
+    bool      CreditCountIRQEnabled;
+}; 
+
+struct ar6k_device {
+    A_MUTEX_T                   Lock;
+    u8 _Pad1[A_CACHE_LINE_PAD];
+    struct ar6k_irq_proc_registers     IrqProcRegisters;   /* cache-line safe with pads around */
+    u8 _Pad2[A_CACHE_LINE_PAD];
+    struct ar6k_irq_enable_registers   IrqEnableRegisters; /* cache-line safe with pads around */
+    u8 _Pad3[A_CACHE_LINE_PAD];
+    void                        *HIFDevice;
+    u32 BlockSize;
+    u32 BlockMask;
+    struct hif_device_mbox_info        MailBoxInfo;
+    HIF_PENDING_EVENTS_FUNC     GetPendingEventsFunc;
+    void                        *HTCContext;
+    struct htc_packet_queue            RegisterIOList;
+    struct ar6k_async_reg_io_buffer    RegIOBuffers[AR6K_MAX_REG_IO_BUFFERS];
+    void                        (*TargetFailureCallback)(void *Context);
+    int                    (*MessagePendingCallback)(void *Context,
+                                                          u32 LookAheads[],
+                                                          int NumLookAheads, 
+                                                          bool *pAsyncProc,
+                                                          int *pNumPktsFetched);
+    HIF_DEVICE_IRQ_PROCESSING_MODE  HifIRQProcessingMode;
+    HIF_MASK_UNMASK_RECV_EVENT      HifMaskUmaskRecvEvent;
+    bool                          HifAttached;
+    struct hif_device_irq_yield_params     HifIRQYieldParams;
+    bool                          DSRCanYield;
+    int                             CurrentDSRRecvCount;
+    struct hif_device_scatter_support_info HifScatterInfo;
+    struct dl_list                         ScatterReqHead; 
+    bool                          ScatterIsVirtual;
+    int                             MaxRecvBundleSize;
+    int                             MaxSendBundleSize;
+    struct ar6k_gmbox_info                 GMboxInfo;
+    bool                          GMboxEnabled;
+    struct ar6k_gmbox_ctrl_registers       GMboxControlRegisters;
+    int                             RecheckIRQStatusCnt;
+};
+
+#define LOCK_AR6K(p)      A_MUTEX_LOCK(&(p)->Lock);
+#define UNLOCK_AR6K(p)    A_MUTEX_UNLOCK(&(p)->Lock);
+#define REF_IRQ_STATUS_RECHECK(p) (p)->RecheckIRQStatusCnt = 1  /* note: no need to lock this, it only gets set */
+
+int DevSetup(struct ar6k_device *pDev);
+void     DevCleanup(struct ar6k_device *pDev);
+int DevUnmaskInterrupts(struct ar6k_device *pDev);
+int DevMaskInterrupts(struct ar6k_device *pDev);
+int DevPollMboxMsgRecv(struct ar6k_device *pDev,
+                            u32 *pLookAhead,
+                            int          TimeoutMS);
+int DevRWCompletionHandler(void *context, int status);
+int DevDsrHandler(void *context);
+int DevCheckPendingRecvMsgsAsync(void *context);
+void     DevAsyncIrqProcessComplete(struct ar6k_device *pDev);
+void     DevDumpRegisters(struct ar6k_device               *pDev,
+                          struct ar6k_irq_proc_registers   *pIrqProcRegs,
+                          struct ar6k_irq_enable_registers *pIrqEnableRegs);
+
+#define DEV_STOP_RECV_ASYNC true
+#define DEV_STOP_RECV_SYNC  false
+#define DEV_ENABLE_RECV_ASYNC true
+#define DEV_ENABLE_RECV_SYNC  false
+int DevStopRecv(struct ar6k_device *pDev, bool ASyncMode);
+int DevEnableRecv(struct ar6k_device *pDev, bool ASyncMode);
+int DevEnableInterrupts(struct ar6k_device *pDev);
+int DevDisableInterrupts(struct ar6k_device *pDev);
+int DevWaitForPendingRecv(struct ar6k_device *pDev,u32 TimeoutInMs,bool *pbIsRecvPending);
+
+#define DEV_CALC_RECV_PADDED_LEN(pDev, length) (((length) + (pDev)->BlockMask) & (~((pDev)->BlockMask)))
+#define DEV_CALC_SEND_PADDED_LEN(pDev, length) DEV_CALC_RECV_PADDED_LEN(pDev,length)
+#define DEV_IS_LEN_BLOCK_ALIGNED(pDev, length) (((length) % (pDev)->BlockSize) == 0)
+
+static INLINE int DevSendPacket(struct ar6k_device *pDev, struct htc_packet *pPacket, u32 SendLength) {
+    u32 paddedLength;
+    bool   sync = (pPacket->Completion == NULL) ? true : false;
+    int status;
+
+       /* adjust the length to be a multiple of block size if appropriate */
+    paddedLength = DEV_CALC_SEND_PADDED_LEN(pDev, SendLength);
+
+#if 0                    
+    if (paddedLength > pPacket->BufferLength) {
+        A_ASSERT(false);
+        if (pPacket->Completion != NULL) {
+            COMPLETE_HTC_PACKET(pPacket,A_EINVAL);
+            return 0;
+        }
+        return A_EINVAL;
+    }
+#endif
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
+                ("DevSendPacket, Padded Length: %d Mbox:0x%X (mode:%s)\n",
+                paddedLength,
+                pDev->MailBoxInfo.MboxAddresses[HTC_MAILBOX],
+                sync ? "SYNC" : "ASYNC"));
+
+    status = HIFReadWrite(pDev->HIFDevice,
+                          pDev->MailBoxInfo.MboxAddresses[HTC_MAILBOX],
+                          pPacket->pBuffer,
+                          paddedLength,     /* the padded length */
+                          sync ? HIF_WR_SYNC_BLOCK_INC : HIF_WR_ASYNC_BLOCK_INC,
+                          sync ? NULL : pPacket);  /* pass the packet as the context to the HIF request */
+
+    if (sync) {
+        pPacket->Status = status;
+    } else {
+        if (status == A_PENDING) {
+            status = 0;
+        }    
+    }
+
+    return status;
+}
+                    
+static INLINE int DevRecvPacket(struct ar6k_device *pDev, struct htc_packet *pPacket, u32 RecvLength) {
+    u32 paddedLength;
+    int status;
+    bool   sync = (pPacket->Completion == NULL) ? true : false;
+
+        /* adjust the length to be a multiple of block size if appropriate */
+    paddedLength = DEV_CALC_RECV_PADDED_LEN(pDev, RecvLength);
+                    
+    if (paddedLength > pPacket->BufferLength) {
+        A_ASSERT(false);
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                ("DevRecvPacket, Not enough space for padlen:%d recvlen:%d bufferlen:%d \n",
+                    paddedLength,RecvLength,pPacket->BufferLength));
+        if (pPacket->Completion != NULL) {
+            COMPLETE_HTC_PACKET(pPacket,A_EINVAL);
+            return 0;
+        }
+        return A_EINVAL;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                ("DevRecvPacket (0x%lX : hdr:0x%X) Padded Length: %d Mbox:0x%X (mode:%s)\n",
+                (unsigned long)pPacket, pPacket->PktInfo.AsRx.ExpectedHdr,
+                paddedLength,
+                pDev->MailBoxInfo.MboxAddresses[HTC_MAILBOX],
+                sync ? "SYNC" : "ASYNC"));
+
+    status = HIFReadWrite(pDev->HIFDevice,
+                          pDev->MailBoxInfo.MboxAddresses[HTC_MAILBOX],
+                          pPacket->pBuffer,
+                          paddedLength,
+                          sync ? HIF_RD_SYNC_BLOCK_FIX : HIF_RD_ASYNC_BLOCK_FIX,
+                          sync ? NULL : pPacket);  /* pass the packet as the context to the HIF request */
+
+    if (sync) {
+        pPacket->Status = status;
+    }
+
+    return status;
+}
+
+#define DEV_CHECK_RECV_YIELD(pDev) \
+            ((pDev)->CurrentDSRRecvCount >= (pDev)->HifIRQYieldParams.RecvPacketYieldCount)
+            
+#define IS_DEV_IRQ_PROC_SYNC_MODE(pDev) (HIF_DEVICE_IRQ_SYNC_ONLY == (pDev)->HifIRQProcessingMode)
+#define IS_DEV_IRQ_PROCESSING_ASYNC_ALLOWED(pDev) ((pDev)->HifIRQProcessingMode != HIF_DEVICE_IRQ_SYNC_ONLY)
+
+/**************************************************/
+/****** Scatter Function and Definitions
+ * 
+ *  
+ */
+  
+int DevCopyScatterListToFromDMABuffer(struct hif_scatter_req *pReq, bool FromDMA);
+    
+    /* copy any READ data back into scatter list */        
+#define DEV_FINISH_SCATTER_OPERATION(pR)                                \
+do {                                                                    \
+        if (!((pR)->CompletionStatus) &&                                \
+            !((pR)->Request & HIF_WRITE) &&                             \
+            ((pR)->ScatterMethod == HIF_SCATTER_DMA_BOUNCE)) {          \
+                (pR)->CompletionStatus =                                \
+                        DevCopyScatterListToFromDMABuffer((pR),         \
+                                                          FROM_DMA_BUFFER); \
+        }                                                               \
+} while (0)
+    
+    /* copy any WRITE data to bounce buffer */
+static INLINE int DEV_PREPARE_SCATTER_OPERATION(struct hif_scatter_req *pReq)  {
+    if ((pReq->Request & HIF_WRITE) && (pReq->ScatterMethod == HIF_SCATTER_DMA_BOUNCE)) {
+        return DevCopyScatterListToFromDMABuffer(pReq,TO_DMA_BUFFER);    
+    } else {
+        return 0;
+    }
+}
+        
+    
+int DevSetupMsgBundling(struct ar6k_device *pDev, int MaxMsgsPerTransfer);
+
+int DevCleanupMsgBundling(struct ar6k_device *pDev);
+                                  
+#define DEV_GET_MAX_MSG_PER_BUNDLE(pDev)        (pDev)->HifScatterInfo.MaxScatterEntries
+#define DEV_GET_MAX_BUNDLE_LENGTH(pDev)         (pDev)->HifScatterInfo.MaxTransferSizePerScatterReq
+#define DEV_ALLOC_SCATTER_REQ(pDev)             \
+    (pDev)->HifScatterInfo.pAllocateReqFunc((pDev)->ScatterIsVirtual ? (pDev) : (pDev)->HIFDevice)
+    
+#define DEV_FREE_SCATTER_REQ(pDev,pR)           \
+    (pDev)->HifScatterInfo.pFreeReqFunc((pDev)->ScatterIsVirtual ? (pDev) : (pDev)->HIFDevice,(pR))
+
+#define DEV_GET_MAX_BUNDLE_RECV_LENGTH(pDev)   (pDev)->MaxRecvBundleSize
+#define DEV_GET_MAX_BUNDLE_SEND_LENGTH(pDev)   (pDev)->MaxSendBundleSize
+
+#define DEV_SCATTER_READ  true
+#define DEV_SCATTER_WRITE false
+#define DEV_SCATTER_ASYNC true
+#define DEV_SCATTER_SYNC  false
+int DevSubmitScatterRequest(struct ar6k_device *pDev, struct hif_scatter_req *pScatterReq, bool Read, bool Async);
+
+#ifdef MBOXHW_UNIT_TEST
+int DoMboxHWTest(struct ar6k_device *pDev);
+#endif
+
+    /* completely virtual */
+struct dev_scatter_dma_virtual_info {
+    u8 *pVirtDmaBuffer;      /* dma-able buffer - CPU accessible address */
+    u8 DataArea[1];      /* start of data area */
+};
+
+
+
+void     DumpAR6KDevState(struct ar6k_device *pDev);
+
+/**************************************************/
+/****** GMBOX functions and definitions
+ * 
+ *  
+ */
+
+#ifdef ATH_AR6K_ENABLE_GMBOX
+
+void     DevCleanupGMbox(struct ar6k_device *pDev);
+int DevSetupGMbox(struct ar6k_device *pDev);
+int DevCheckGMboxInterrupts(struct ar6k_device *pDev);
+void     DevNotifyGMboxTargetFailure(struct ar6k_device *pDev);
+
+#else
+
+    /* compiled out */
+#define DevCleanupGMbox(p)
+#define DevCheckGMboxInterrupts(p) 0
+#define DevNotifyGMboxTargetFailure(p)
+
+static INLINE int DevSetupGMbox(struct ar6k_device *pDev) {
+    pDev->GMboxEnabled = false;
+    return 0;
+}
+
+#endif
+
+#ifdef ATH_AR6K_ENABLE_GMBOX
+
+    /* GMBOX protocol modules must expose each of these internal APIs */
+HCI_TRANSPORT_HANDLE GMboxAttachProtocol(struct ar6k_device *pDev, struct hci_transport_config_info *pInfo);
+int             GMboxProtocolInstall(struct ar6k_device *pDev);
+void                 GMboxProtocolUninstall(struct ar6k_device *pDev);
+
+    /* API used by GMBOX protocol modules */
+struct ar6k_device  *HTCGetAR6KDevice(void *HTCHandle);
+#define DEV_GMBOX_SET_PROTOCOL(pDev,recv_callback,credits_pending,failure,statedump,context) \
+{                                                                  \
+    (pDev)->GMboxInfo.pProtocolContext = (context);                \
+    (pDev)->GMboxInfo.pMessagePendingCallBack = (recv_callback);   \
+    (pDev)->GMboxInfo.pCreditsPendingCallback = (credits_pending); \
+    (pDev)->GMboxInfo.pTargetFailureCallback = (failure);          \
+    (pDev)->GMboxInfo.pStateDumpCallback = (statedump);            \
+}
+
+#define DEV_GMBOX_GET_PROTOCOL(pDev)  (pDev)->GMboxInfo.pProtocolContext
+
+int DevGMboxWrite(struct ar6k_device *pDev, struct htc_packet *pPacket, u32 WriteLength);
+int DevGMboxRead(struct ar6k_device *pDev, struct htc_packet *pPacket, u32 ReadLength);
+
+#define PROC_IO_ASYNC true
+#define PROC_IO_SYNC  false
+typedef enum GMBOX_IRQ_ACTION_TYPE {
+    GMBOX_ACTION_NONE = 0,
+    GMBOX_DISABLE_ALL,
+    GMBOX_ERRORS_IRQ_ENABLE,
+    GMBOX_RECV_IRQ_ENABLE,
+    GMBOX_RECV_IRQ_DISABLE,
+    GMBOX_CREDIT_IRQ_ENABLE,
+    GMBOX_CREDIT_IRQ_DISABLE,
+} GMBOX_IRQ_ACTION_TYPE;
+
+int DevGMboxIRQAction(struct ar6k_device *pDev, GMBOX_IRQ_ACTION_TYPE, bool AsyncMode);
+int DevGMboxReadCreditCounter(struct ar6k_device *pDev, bool AsyncMode, int *pCredits);
+int DevGMboxReadCreditSize(struct ar6k_device *pDev, int *pCreditSize);
+int DevGMboxRecvLookAheadPeek(struct ar6k_device *pDev, u8 *pLookAheadBuffer, int *pLookAheadBytes);
+int DevGMboxSetTargetInterrupt(struct ar6k_device *pDev, int SignalNumber, int AckTimeoutMS);
+
+#endif
+
+#endif /*AR6K_H_*/
diff --git a/drivers/staging/ath6kl/htc2/AR6000/ar6k_events.c b/drivers/staging/ath6kl/htc2/AR6000/ar6k_events.c
new file mode 100644
index 00000000000..d7af68f7056
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/AR6000/ar6k_events.c
@@ -0,0 +1,783 @@
+//------------------------------------------------------------------------------
+// <copyright file="ar6k_events.c" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// AR6K Driver layer event handling (i.e. interrupts, message polling)
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include "a_config.h"
+#include "athdefs.h"
+#include "hw/mbox_host_reg.h"
+#include "a_osapi.h"
+#include "../htc_debug.h"
+#include "hif.h"
+#include "htc_packet.h"
+#include "ar6k.h"
+
+extern void AR6KFreeIOPacket(struct ar6k_device *pDev, struct htc_packet *pPacket);
+extern struct htc_packet *AR6KAllocIOPacket(struct ar6k_device *pDev);
+
+static int DevServiceDebugInterrupt(struct ar6k_device *pDev);
+
+#define DELAY_PER_INTERVAL_MS 10  /* 10 MS delay per polling interval */
+
+/* completion routine for ALL HIF layer async I/O */
+int DevRWCompletionHandler(void *context, int status)
+{
+    struct htc_packet *pPacket = (struct htc_packet *)context;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                ("+DevRWCompletionHandler (Pkt:0x%lX) , Status: %d \n",
+                (unsigned long)pPacket,
+                status));
+
+    COMPLETE_HTC_PACKET(pPacket,status);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                ("-DevRWCompletionHandler\n"));
+
+    return 0;
+}
+
+/* mailbox recv message polling */
+int DevPollMboxMsgRecv(struct ar6k_device *pDev,
+                            u32 *pLookAhead,
+                            int          TimeoutMS)
+{
+    int status = 0;
+    int      timeout = TimeoutMS/DELAY_PER_INTERVAL_MS;
+
+    A_ASSERT(timeout > 0);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+DevPollMboxMsgRecv \n"));
+
+    while (true) {
+
+        if (pDev->GetPendingEventsFunc != NULL) {
+
+            struct hif_pending_events_info events;
+
+#ifdef THREAD_X
+                        events.Polling =1;
+#endif
+
+            /* the HIF layer uses a special mechanism to get events, do this
+             * synchronously */
+            status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
+                                            &events,
+                                            NULL);
+            if (status)
+            {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to get pending events \n"));
+                break;
+            }
+
+            if (events.Events & HIF_RECV_MSG_AVAIL)
+            {
+                    /*  there is a message available, the lookahead should be valid now */
+                *pLookAhead = events.LookAhead;
+
+                break;
+            }
+        } else {
+
+                /* this is the standard HIF way.... */
+                /* load the register table */
+            status = HIFReadWrite(pDev->HIFDevice,
+                                  HOST_INT_STATUS_ADDRESS,
+                                  (u8 *)&pDev->IrqProcRegisters,
+                                  AR6K_IRQ_PROC_REGS_SIZE,
+                                  HIF_RD_SYNC_BYTE_INC,
+                                  NULL);
+
+            if (status){
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to read register table \n"));
+                break;
+            }
+
+                /* check for MBOX data and valid lookahead */
+            if (pDev->IrqProcRegisters.host_int_status & (1 << HTC_MAILBOX)) {
+                if (pDev->IrqProcRegisters.rx_lookahead_valid & (1 << HTC_MAILBOX))
+                {
+                    /* mailbox has a message and the look ahead is valid */
+                    *pLookAhead = pDev->IrqProcRegisters.rx_lookahead[HTC_MAILBOX];
+                    break;
+                }
+            }
+
+        }
+
+        timeout--;
+
+        if (timeout <= 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" Timeout waiting for recv message \n"));
+            status = A_ERROR;
+
+                /* check if the target asserted */
+            if ( pDev->IrqProcRegisters.counter_int_status & AR6K_TARGET_DEBUG_INTR_MASK) {
+                    /* target signaled an assert, process this pending interrupt
+                     * this will call the target failure handler */
+                DevServiceDebugInterrupt(pDev);
+            }
+
+            break;
+        }
+
+            /* delay a little  */
+        A_MDELAY(DELAY_PER_INTERVAL_MS);
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("  Retry Mbox Poll : %d \n",timeout));
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-DevPollMboxMsgRecv \n"));
+
+    return status;
+}
+
+static int DevServiceCPUInterrupt(struct ar6k_device *pDev)
+{
+    int status;
+    u8 cpu_int_status;
+    u8 regBuffer[4];
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("CPU Interrupt\n"));
+    cpu_int_status = pDev->IrqProcRegisters.cpu_int_status &
+                     pDev->IrqEnableRegisters.cpu_int_status_enable;
+    A_ASSERT(cpu_int_status);
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
+                    ("Valid interrupt source(s) in CPU_INT_STATUS: 0x%x\n",
+                    cpu_int_status));
+
+        /* Clear the interrupt */
+    pDev->IrqProcRegisters.cpu_int_status &= ~cpu_int_status; /* W1C */
+
+        /* set up the register transfer buffer to hit the register 4 times , this is done
+         * to make the access 4-byte aligned to mitigate issues with host bus interconnects that
+         * restrict bus transfer lengths to be a multiple of 4-bytes */
+
+        /* set W1C value to clear the interrupt, this hits the register first */
+    regBuffer[0] = cpu_int_status;
+        /* the remaining 4 values are set to zero which have no-effect  */
+    regBuffer[1] = 0;
+    regBuffer[2] = 0;
+    regBuffer[3] = 0;
+
+    status = HIFReadWrite(pDev->HIFDevice,
+                          CPU_INT_STATUS_ADDRESS,
+                          regBuffer,
+                          4,
+                          HIF_WR_SYNC_BYTE_FIX,
+                          NULL);
+
+    A_ASSERT(status == 0);
+    return status;
+}
+
+
+static int DevServiceErrorInterrupt(struct ar6k_device *pDev)
+{
+    int status;
+    u8 error_int_status;
+    u8 regBuffer[4];
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Error Interrupt\n"));
+    error_int_status = pDev->IrqProcRegisters.error_int_status & 0x0F;
+    A_ASSERT(error_int_status);
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
+                    ("Valid interrupt source(s) in ERROR_INT_STATUS: 0x%x\n",
+                    error_int_status));
+
+    if (ERROR_INT_STATUS_WAKEUP_GET(error_int_status)) {
+        /* Wakeup */
+        AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Error : Wakeup\n"));
+    }
+
+    if (ERROR_INT_STATUS_RX_UNDERFLOW_GET(error_int_status)) {
+        /* Rx Underflow */
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Error : Rx Underflow\n"));
+    }
+
+    if (ERROR_INT_STATUS_TX_OVERFLOW_GET(error_int_status)) {
+        /* Tx Overflow */
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Error : Tx Overflow\n"));
+    }
+
+        /* Clear the interrupt */
+    pDev->IrqProcRegisters.error_int_status &= ~error_int_status; /* W1C */
+
+        /* set up the register transfer buffer to hit the register 4 times , this is done
+         * to make the access 4-byte aligned to mitigate issues with host bus interconnects that
+         * restrict bus transfer lengths to be a multiple of 4-bytes */
+
+        /* set W1C value to clear the interrupt, this hits the register first */
+    regBuffer[0] = error_int_status;
+        /* the remaining 4 values are set to zero which have no-effect  */
+    regBuffer[1] = 0;
+    regBuffer[2] = 0;
+    regBuffer[3] = 0;
+
+    status = HIFReadWrite(pDev->HIFDevice,
+                          ERROR_INT_STATUS_ADDRESS,
+                          regBuffer,
+                          4,
+                          HIF_WR_SYNC_BYTE_FIX,
+                          NULL);
+
+    A_ASSERT(status == 0);
+    return status;
+}
+
+static int DevServiceDebugInterrupt(struct ar6k_device *pDev)
+{
+    u32 dummy;
+    int status;
+
+    /* Send a target failure event to the application */
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Target debug interrupt\n"));
+
+    if (pDev->TargetFailureCallback != NULL) {
+        pDev->TargetFailureCallback(pDev->HTCContext);
+    }
+
+    if (pDev->GMboxEnabled) {
+        DevNotifyGMboxTargetFailure(pDev);
+    }
+
+    /* clear the interrupt , the debug error interrupt is
+     * counter 0 */
+        /* read counter to clear interrupt */
+    status = HIFReadWrite(pDev->HIFDevice,
+                          COUNT_DEC_ADDRESS,
+                          (u8 *)&dummy,
+                          4,
+                          HIF_RD_SYNC_BYTE_INC,
+                          NULL);
+
+    A_ASSERT(status == 0);
+    return status;
+}
+
+static int DevServiceCounterInterrupt(struct ar6k_device *pDev)
+{
+    u8 counter_int_status;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Counter Interrupt\n"));
+
+    counter_int_status = pDev->IrqProcRegisters.counter_int_status &
+                         pDev->IrqEnableRegisters.counter_int_status_enable;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
+                    ("Valid interrupt source(s) in COUNTER_INT_STATUS: 0x%x\n",
+                    counter_int_status));
+
+        /* Check if the debug interrupt is pending
+         * NOTE: other modules like GMBOX may use the counter interrupt for
+         * credit flow control on other counters, we only need to check for the debug assertion
+         * counter interrupt */
+    if (counter_int_status & AR6K_TARGET_DEBUG_INTR_MASK) {
+        return DevServiceDebugInterrupt(pDev);
+    }
+
+    return 0;
+}
+
+/* callback when our fetch to get interrupt status registers completes */
+static void DevGetEventAsyncHandler(void *Context, struct htc_packet *pPacket)
+{
+    struct ar6k_device *pDev = (struct ar6k_device *)Context;
+    u32 lookAhead = 0;
+    bool      otherInts = false;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevGetEventAsyncHandler: (dev: 0x%lX)\n", (unsigned long)pDev));
+
+    do {
+
+        if (pPacket->Status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    (" GetEvents I/O request failed, status:%d \n", pPacket->Status));
+            /* bail out, don't unmask HIF interrupt */
+            break;
+        }
+
+        if (pDev->GetPendingEventsFunc != NULL) {
+                /* the HIF layer collected the information for us */
+            struct hif_pending_events_info *pEvents = (struct hif_pending_events_info *)pPacket->pBuffer;
+            if (pEvents->Events & HIF_RECV_MSG_AVAIL) {
+                lookAhead = pEvents->LookAhead;
+                if (0 == lookAhead) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" DevGetEventAsyncHandler1, lookAhead is zero! \n"));
+                }
+            }
+            if (pEvents->Events & HIF_OTHER_EVENTS) {
+                otherInts = true;
+            }
+        } else {
+                /* standard interrupt table handling.... */
+            struct ar6k_irq_proc_registers *pReg = (struct ar6k_irq_proc_registers *)pPacket->pBuffer;
+            u8 host_int_status;
+
+            host_int_status = pReg->host_int_status & pDev->IrqEnableRegisters.int_status_enable;
+
+            if (host_int_status & (1 << HTC_MAILBOX)) {
+                host_int_status &= ~(1 << HTC_MAILBOX);
+                if (pReg->rx_lookahead_valid & (1 << HTC_MAILBOX)) {
+                        /* mailbox has a message and the look ahead is valid */
+                    lookAhead = pReg->rx_lookahead[HTC_MAILBOX];
+                    if (0 == lookAhead) {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" DevGetEventAsyncHandler2, lookAhead is zero! \n"));
+                    }
+                }
+            }
+
+            if (host_int_status) {
+                    /* there are other interrupts to handle */
+                otherInts = true;
+            }
+        }
+
+        if (otherInts || (lookAhead == 0)) {
+            /* if there are other interrupts to process, we cannot do this in the async handler so
+             * ack the interrupt which will cause our sync handler to run again
+             * if however there are no more messages, we can now ack the interrupt  */
+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
+                (" Acking interrupt from DevGetEventAsyncHandler (otherints:%d, lookahead:0x%X)\n",
+                otherInts, lookAhead));
+            HIFAckInterrupt(pDev->HIFDevice);
+        } else {
+            int      fetched = 0;
+            int status;
+
+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
+                    (" DevGetEventAsyncHandler : detected another message, lookahead :0x%X \n",
+                    lookAhead));
+                /* lookahead is non-zero and there are no other interrupts to service,
+                 * go get the next message */
+            status = pDev->MessagePendingCallback(pDev->HTCContext, &lookAhead, 1, NULL, &fetched);
+
+            if (!status && !fetched) {
+                    /* HTC layer could not pull out messages due to lack of resources, stop IRQ processing */
+                AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("MessagePendingCallback did not pull any messages, force-ack \n"));
+                DevAsyncIrqProcessComplete(pDev);
+            }
+        }
+
+    } while (false);
+
+        /* free this IO packet */
+    AR6KFreeIOPacket(pDev,pPacket);
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevGetEventAsyncHandler \n"));
+}
+
+/* called by the HTC layer when it wants us to check if the device has any more pending
+ * recv messages, this starts off a series of async requests to read interrupt registers  */
+int DevCheckPendingRecvMsgsAsync(void *context)
+{
+    struct ar6k_device  *pDev = (struct ar6k_device *)context;
+    int      status = 0;
+    struct htc_packet   *pIOPacket;
+
+    /* this is called in an ASYNC only context, we may NOT block, sleep or call any apis that can
+     * cause us to switch contexts */
+
+   AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevCheckPendingRecvMsgsAsync: (dev: 0x%lX)\n", (unsigned long)pDev));
+
+   do {
+
+        if (HIF_DEVICE_IRQ_SYNC_ONLY == pDev->HifIRQProcessingMode) {
+                /* break the async processing chain right here, no need to continue.
+                 * The DevDsrHandler() will handle things in a loop when things are driven
+                 * synchronously  */
+            break;
+        }
+
+            /* an optimization to bypass reading the IRQ status registers unecessarily which can re-wake
+             * the target, if upper layers determine that we are in a low-throughput mode, we can
+             * rely on taking another interrupt rather than re-checking the status registers which can
+             * re-wake the target */
+        if (pDev->RecheckIRQStatusCnt == 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("Bypassing IRQ Status re-check, re-acking HIF interrupts\n"));
+                /* ack interrupt */
+            HIFAckInterrupt(pDev->HIFDevice);
+            break;
+        }
+
+            /* first allocate one of our HTC packets we created for async I/O
+             * we reuse HTC packet definitions so that we can use the completion mechanism
+             * in DevRWCompletionHandler() */
+        pIOPacket = AR6KAllocIOPacket(pDev);
+
+        if (NULL == pIOPacket) {
+                /* there should be only 1 asynchronous request out at a time to read these registers
+                 * so this should actually never happen */
+            status = A_NO_MEMORY;
+            A_ASSERT(false);
+            break;
+        }
+
+            /* stick in our completion routine when the I/O operation completes */
+        pIOPacket->Completion = DevGetEventAsyncHandler;
+        pIOPacket->pContext = pDev;
+
+        if (pDev->GetPendingEventsFunc) {
+                /* HIF layer has it's own mechanism, pass the IO to it.. */
+            status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
+                                                (struct hif_pending_events_info *)pIOPacket->pBuffer,
+                                                pIOPacket);
+
+        } else {
+                /* standard way, read the interrupt register table asynchronously again */
+            status = HIFReadWrite(pDev->HIFDevice,
+                                  HOST_INT_STATUS_ADDRESS,
+                                  pIOPacket->pBuffer,
+                                  AR6K_IRQ_PROC_REGS_SIZE,
+                                  HIF_RD_ASYNC_BYTE_INC,
+                                  pIOPacket);
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,(" Async IO issued to get interrupt status...\n"));
+   } while (false);
+
+   AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevCheckPendingRecvMsgsAsync \n"));
+
+   return status;
+}
+
+void DevAsyncIrqProcessComplete(struct ar6k_device *pDev)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("DevAsyncIrqProcessComplete - forcing HIF IRQ ACK \n"));
+    HIFAckInterrupt(pDev->HIFDevice);
+}
+
+/* process pending interrupts synchronously */
+static int ProcessPendingIRQs(struct ar6k_device *pDev, bool *pDone, bool *pASyncProcessing)
+{
+    int    status = 0;
+    u8 host_int_status = 0;
+    u32 lookAhead = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+ProcessPendingIRQs: (dev: 0x%lX)\n", (unsigned long)pDev));
+
+    /*** NOTE: the HIF implementation guarantees that the context of this call allows
+     *         us to perform SYNCHRONOUS I/O, that is we can block, sleep or call any API that
+     *         can block or switch thread/task ontexts.
+     *         This is a fully schedulable context.
+     * */
+    do {
+
+            if (pDev->IrqEnableRegisters.int_status_enable == 0) {
+                /* interrupt enables have been cleared, do not try to process any pending interrupts that
+                 * may result in more bus transactions.  The target may be unresponsive at this
+                 * point. */
+                 break;
+            }
+
+            if (pDev->GetPendingEventsFunc != NULL) {
+                struct hif_pending_events_info events;
+
+#ifdef THREAD_X
+            events.Polling= 0;
+#endif
+                /* the HIF layer uses a special mechanism to get events
+                 * get this synchronously  */
+            status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
+                                                &events,
+                                                NULL);
+
+            if (status) {
+                break;
+            }
+
+            if (events.Events & HIF_RECV_MSG_AVAIL) {
+                lookAhead = events.LookAhead;
+                if (0 == lookAhead) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" ProcessPendingIRQs1 lookAhead is zero! \n"));
+                }
+            }
+
+            if (!(events.Events & HIF_OTHER_EVENTS) ||
+                !(pDev->IrqEnableRegisters.int_status_enable & OTHER_INTS_ENABLED)) {
+                    /* no need to read the register table, no other interesting interrupts.
+                     * Some interfaces (like SPI) can shadow interrupt sources without
+                     * requiring the host to do a full table read */
+                break;
+            }
+
+            /* otherwise fall through and read the register table */
+        }
+
+        /*
+         * Read the first 28 bytes of the HTC register table. This will yield us
+         * the value of different int status registers and the lookahead
+         * registers.
+         *    length = sizeof(int_status) + sizeof(cpu_int_status) +
+         *             sizeof(error_int_status) + sizeof(counter_int_status) +
+         *             sizeof(mbox_frame) + sizeof(rx_lookahead_valid) +
+         *             sizeof(hole) +  sizeof(rx_lookahead) +
+         *             sizeof(int_status_enable) + sizeof(cpu_int_status_enable) +
+         *             sizeof(error_status_enable) +
+         *             sizeof(counter_int_status_enable);
+         *
+        */
+#ifdef CONFIG_MMC_SDHCI_S3C
+            pDev->IrqProcRegisters.host_int_status = 0;
+            pDev->IrqProcRegisters.rx_lookahead_valid = 0;
+            pDev->IrqProcRegisters.host_int_status2 = 0;
+            pDev->IrqProcRegisters.rx_lookahead[0] = 0;
+            pDev->IrqProcRegisters.rx_lookahead[1] = 0xaaa5555;
+#endif /* CONFIG_MMC_SDHCI_S3C */
+        status = HIFReadWrite(pDev->HIFDevice,
+                              HOST_INT_STATUS_ADDRESS,
+                              (u8 *)&pDev->IrqProcRegisters,
+                              AR6K_IRQ_PROC_REGS_SIZE,
+                              HIF_RD_SYNC_BYTE_INC,
+                              NULL);
+
+        if (status) {
+            break;
+        }
+
+#ifdef ATH_DEBUG_MODULE
+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_IRQ)) {
+            DevDumpRegisters(pDev,
+                             &pDev->IrqProcRegisters,
+                             &pDev->IrqEnableRegisters);
+        }
+#endif
+
+            /* Update only those registers that are enabled */
+        host_int_status = pDev->IrqProcRegisters.host_int_status &
+                          pDev->IrqEnableRegisters.int_status_enable;
+
+        if (NULL == pDev->GetPendingEventsFunc) {
+                /* only look at mailbox status if the HIF layer did not provide this function,
+                 * on some HIF interfaces reading the RX lookahead is not valid to do */
+            if (host_int_status & (1 << HTC_MAILBOX)) {
+                    /* mask out pending mailbox value, we use "lookAhead" as the real flag for
+                     * mailbox processing below */
+                host_int_status &= ~(1 << HTC_MAILBOX);
+                if (pDev->IrqProcRegisters.rx_lookahead_valid & (1 << HTC_MAILBOX)) {
+                        /* mailbox has a message and the look ahead is valid */
+                    lookAhead = pDev->IrqProcRegisters.rx_lookahead[HTC_MAILBOX];
+                    if (0 == lookAhead) {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" ProcessPendingIRQs2, lookAhead is zero! \n"));
+                    }
+                }
+            }
+        } else {
+                /* not valid to check if the HIF has another mechanism for reading mailbox pending status*/
+            host_int_status &= ~(1 << HTC_MAILBOX);
+        }
+
+        if (pDev->GMboxEnabled) {
+                /*call GMBOX layer to process any interrupts of interest */
+            status = DevCheckGMboxInterrupts(pDev);
+        }
+
+    } while (false);
+
+
+    do {
+
+            /* did the interrupt status fetches succeed? */
+        if (status) {
+            break;
+        }
+
+        if ((0 == host_int_status) && (0 == lookAhead)) {
+                /* nothing to process, the caller can use this to break out of a loop */
+            *pDone = true;
+            break;
+        }
+
+        if (lookAhead != 0) {
+            int fetched = 0;
+
+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("Pending mailbox message, LookAhead: 0x%X\n",lookAhead));
+                /* Mailbox Interrupt, the HTC layer may issue async requests to empty the
+                 * mailbox...
+                 * When emptying the recv mailbox we use the async handler above called from the
+                 * completion routine of the callers read request. This can improve performance
+                 * by reducing context switching when we rapidly pull packets */
+            status = pDev->MessagePendingCallback(pDev->HTCContext, &lookAhead, 1, pASyncProcessing, &fetched);
+            if (status) {
+                break;
+            }
+
+            if (!fetched) {
+                    /* HTC could not pull any messages out due to lack of resources */
+                    /* force DSR handler to ack the interrupt */
+                *pASyncProcessing = false;
+                pDev->RecheckIRQStatusCnt = 0;
+            }
+        }
+
+            /* now handle the rest of them */
+        AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
+                            (" Valid interrupt source(s) for OTHER interrupts: 0x%x\n",
+                            host_int_status));
+
+        if (HOST_INT_STATUS_CPU_GET(host_int_status)) {
+                /* CPU Interrupt */
+            status = DevServiceCPUInterrupt(pDev);
+            if (status){
+                break;
+            }
+        }
+
+        if (HOST_INT_STATUS_ERROR_GET(host_int_status)) {
+                /* Error Interrupt */
+            status = DevServiceErrorInterrupt(pDev);
+            if (status){
+                break;
+            }
+        }
+
+        if (HOST_INT_STATUS_COUNTER_GET(host_int_status)) {
+                /* Counter Interrupt */
+            status = DevServiceCounterInterrupt(pDev);
+            if (status){
+                break;
+            }
+        }
+
+    } while (false);
+
+        /* an optimization to bypass reading the IRQ status registers unecessarily which can re-wake
+         * the target, if upper layers determine that we are in a low-throughput mode, we can
+         * rely on taking another interrupt rather than re-checking the status registers which can
+         * re-wake the target.
+         *
+         * NOTE : for host interfaces that use the special GetPendingEventsFunc, this optimization cannot
+         * be used due to possible side-effects.  For example, SPI requires the host to drain all
+         * messages from the mailbox before exiting the ISR routine. */
+    if (!(*pASyncProcessing) && (pDev->RecheckIRQStatusCnt == 0) && (pDev->GetPendingEventsFunc == NULL)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("Bypassing IRQ Status re-check, forcing done \n"));
+        *pDone = true;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-ProcessPendingIRQs: (done:%d, async:%d) status=%d \n",
+                *pDone, *pASyncProcessing, status));
+
+    return status;
+}
+
+
+/* Synchronousinterrupt handler, this handler kicks off all interrupt processing.*/
+int DevDsrHandler(void *context)
+{
+    struct ar6k_device *pDev = (struct ar6k_device *)context;
+    int    status = 0;
+    bool      done = false;
+    bool      asyncProc = false;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevDsrHandler: (dev: 0x%lX)\n", (unsigned long)pDev));
+
+        /* reset the recv counter that tracks when we need to yield from the DSR */
+    pDev->CurrentDSRRecvCount = 0;
+        /* reset counter used to flag a re-scan of IRQ status registers on the target */
+    pDev->RecheckIRQStatusCnt = 0;
+
+    while (!done) {
+        status = ProcessPendingIRQs(pDev, &done, &asyncProc);
+        if (status) {
+            break;
+        }
+
+        if (HIF_DEVICE_IRQ_SYNC_ONLY == pDev->HifIRQProcessingMode) {
+            /* the HIF layer does not allow async IRQ processing, override the asyncProc flag */
+            asyncProc = false;
+            /* this will cause us to re-enter ProcessPendingIRQ() and re-read interrupt status registers.
+             * this has a nice side effect of blocking us until all async read requests are completed.
+             * This behavior is required on some HIF implementations that do not allow ASYNC
+             * processing in interrupt handlers (like Windows CE) */
+
+            if (pDev->DSRCanYield && DEV_CHECK_RECV_YIELD(pDev)) {
+                /* ProcessPendingIRQs() pulled enough recv messages to satisfy the yield count, stop
+                 * checking for more messages and return */
+                break;
+            }
+        }
+
+        if (asyncProc) {
+                /* the function performed some async I/O for performance, we
+                   need to exit the ISR immediately, the check below will prevent the interrupt from being
+                   Ack'd while we handle it asynchronously */
+            break;
+        }
+
+    }
+
+    if (!status && !asyncProc) {
+            /* Ack the interrupt only if :
+             *  1. we did not get any errors in processing interrupts
+             *  2. there are no outstanding async processing requests */
+        if (pDev->DSRCanYield) {
+                /* if the DSR can yield do not ACK the interrupt, there could be more pending messages.
+                 * The HIF layer must ACK the interrupt on behalf of HTC */
+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,(" Yield in effect (cur RX count: %d) \n", pDev->CurrentDSRRecvCount));
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,(" Acking interrupt from DevDsrHandler \n"));
+            HIFAckInterrupt(pDev->HIFDevice);
+        }
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevDsrHandler \n"));
+    return status;
+}
+
+#ifdef ATH_DEBUG_MODULE
+void DumpAR6KDevState(struct ar6k_device *pDev)
+{
+    int                    status;
+    struct ar6k_irq_enable_registers   regs;
+    struct ar6k_irq_proc_registers     procRegs;
+
+    LOCK_AR6K(pDev);
+        /* copy into our temp area */
+    memcpy(&regs,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
+    UNLOCK_AR6K(pDev);
+
+        /* load the register table from the device */
+    status = HIFReadWrite(pDev->HIFDevice,
+                          HOST_INT_STATUS_ADDRESS,
+                          (u8 *)&procRegs,
+                          AR6K_IRQ_PROC_REGS_SIZE,
+                          HIF_RD_SYNC_BYTE_INC,
+                          NULL);
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+            ("DumpAR6KDevState : Failed to read register table (%d) \n",status));
+        return;
+    }
+
+    DevDumpRegisters(pDev,&procRegs,&regs);
+
+    if (pDev->GMboxInfo.pStateDumpCallback != NULL) {
+        pDev->GMboxInfo.pStateDumpCallback(pDev->GMboxInfo.pProtocolContext);
+    }
+
+        /* dump any bus state at the HIF layer */
+    HIFConfigureDevice(pDev->HIFDevice,HIF_DEVICE_DEBUG_BUS_STATE,NULL,0);
+
+}
+#endif
+
+
diff --git a/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox.c b/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox.c
new file mode 100644
index 00000000000..725540f9add
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox.c
@@ -0,0 +1,755 @@
+//------------------------------------------------------------------------------
+// <copyright file="ar6k_gmbox.c" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Generic MBOX API implementation
+// 
+// Author(s): ="Atheros"
+//==============================================================================
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_osapi.h"
+#include "../htc_debug.h"
+#include "hif.h"
+#include "htc_packet.h"
+#include "ar6k.h"
+#include "hw/mbox_host_reg.h"
+#include "gmboxif.h"
+
+/* 
+ * This file provides management functions and a toolbox for GMBOX protocol modules.  
+ * Only one protocol module can be installed at a time. The determination of which protocol
+ * module is installed is determined at compile time.  
+ * 
+ */
+#ifdef ATH_AR6K_ENABLE_GMBOX
+     /* GMBOX definitions */
+#define GMBOX_INT_STATUS_ENABLE_REG     0x488
+#define GMBOX_INT_STATUS_RX_DATA        (1 << 0)
+#define GMBOX_INT_STATUS_TX_OVERFLOW    (1 << 1)
+#define GMBOX_INT_STATUS_RX_OVERFLOW    (1 << 2)
+
+#define GMBOX_LOOKAHEAD_MUX_REG         0x498
+#define GMBOX_LA_MUX_OVERRIDE_2_3       (1 << 0)
+
+#define AR6K_GMBOX_CREDIT_DEC_ADDRESS   (COUNT_DEC_ADDRESS + 4 * AR6K_GMBOX_CREDIT_COUNTER)
+#define AR6K_GMBOX_CREDIT_SIZE_ADDRESS  (COUNT_ADDRESS     + AR6K_GMBOX_CREDIT_SIZE_COUNTER)
+
+
+    /* external APIs for allocating and freeing internal I/O packets to handle ASYNC I/O */ 
+extern void AR6KFreeIOPacket(struct ar6k_device *pDev, struct htc_packet *pPacket);
+extern struct htc_packet *AR6KAllocIOPacket(struct ar6k_device *pDev);
+
+
+/* callback when our fetch to enable/disable completes */
+static void DevGMboxIRQActionAsyncHandler(void *Context, struct htc_packet *pPacket)
+{
+    struct ar6k_device *pDev = (struct ar6k_device *)Context;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevGMboxIRQActionAsyncHandler: (dev: 0x%lX)\n", (unsigned long)pDev));
+
+    if (pPacket->Status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                ("IRQAction Operation (%d) failed! status:%d \n", pPacket->PktInfo.AsRx.HTCRxFlags,pPacket->Status));
+    }
+        /* free this IO packet */
+    AR6KFreeIOPacket(pDev,pPacket);
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevGMboxIRQActionAsyncHandler \n"));
+}
+
+static int DevGMboxCounterEnableDisable(struct ar6k_device *pDev, GMBOX_IRQ_ACTION_TYPE IrqAction, bool AsyncMode)
+{
+    int                  status = 0;
+    struct ar6k_irq_enable_registers regs;
+    struct htc_packet                *pIOPacket = NULL;  
+    
+    LOCK_AR6K(pDev);
+    
+    if (GMBOX_CREDIT_IRQ_ENABLE == IrqAction) {
+        pDev->GMboxInfo.CreditCountIRQEnabled = true;
+        pDev->IrqEnableRegisters.counter_int_status_enable |=
+            COUNTER_INT_STATUS_ENABLE_BIT_SET(1 << AR6K_GMBOX_CREDIT_COUNTER);
+        pDev->IrqEnableRegisters.int_status_enable |= INT_STATUS_ENABLE_COUNTER_SET(0x01);
+    } else {
+        pDev->GMboxInfo.CreditCountIRQEnabled = false;
+        pDev->IrqEnableRegisters.counter_int_status_enable &=
+            ~(COUNTER_INT_STATUS_ENABLE_BIT_SET(1 << AR6K_GMBOX_CREDIT_COUNTER));    
+    }
+        /* copy into our temp area */
+    memcpy(&regs,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
+
+    UNLOCK_AR6K(pDev);
+
+    do {
+
+        if (AsyncMode) {
+
+            pIOPacket = AR6KAllocIOPacket(pDev);
+
+            if (NULL == pIOPacket) {
+                status = A_NO_MEMORY;
+                A_ASSERT(false);
+                break;
+            }
+
+                /* copy values to write to our async I/O buffer */
+            memcpy(pIOPacket->pBuffer,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
+
+                /* stick in our completion routine when the I/O operation completes */
+            pIOPacket->Completion = DevGMboxIRQActionAsyncHandler;
+            pIOPacket->pContext = pDev;
+            pIOPacket->PktInfo.AsRx.HTCRxFlags = IrqAction;
+                /* write it out asynchronously */
+            HIFReadWrite(pDev->HIFDevice,
+                         INT_STATUS_ENABLE_ADDRESS,
+                         pIOPacket->pBuffer,
+                         AR6K_IRQ_ENABLE_REGS_SIZE,
+                         HIF_WR_ASYNC_BYTE_INC,
+                         pIOPacket);
+                         
+            pIOPacket = NULL; 
+            break;
+        } 
+
+            /* if we get here we are doing it synchronously */
+        status = HIFReadWrite(pDev->HIFDevice,
+                              INT_STATUS_ENABLE_ADDRESS,
+                              &regs.int_status_enable,
+                              AR6K_IRQ_ENABLE_REGS_SIZE,
+                              HIF_WR_SYNC_BYTE_INC,
+                              NULL);    
+    } while (false);
+    
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                (" IRQAction Operation (%d) failed! status:%d \n", IrqAction, status));    
+    } else {
+        if (!AsyncMode) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
+                    (" IRQAction Operation (%d) success \n", IrqAction)); 
+        }       
+    }
+    
+    if (pIOPacket != NULL) {
+        AR6KFreeIOPacket(pDev,pIOPacket);
+    }
+        
+    return status;
+}
+
+
+int DevGMboxIRQAction(struct ar6k_device *pDev, GMBOX_IRQ_ACTION_TYPE IrqAction, bool AsyncMode)
+{
+    int      status = 0;
+    struct htc_packet    *pIOPacket = NULL;   
+    u8 GMboxIntControl[4];
+
+    if (GMBOX_CREDIT_IRQ_ENABLE == IrqAction) {
+        return DevGMboxCounterEnableDisable(pDev, GMBOX_CREDIT_IRQ_ENABLE, AsyncMode);
+    } else if(GMBOX_CREDIT_IRQ_DISABLE == IrqAction) {
+        return DevGMboxCounterEnableDisable(pDev, GMBOX_CREDIT_IRQ_DISABLE, AsyncMode);
+    }
+    
+    if (GMBOX_DISABLE_ALL == IrqAction) {
+            /* disable credit IRQ, those are on a different set of registers */
+        DevGMboxCounterEnableDisable(pDev, GMBOX_CREDIT_IRQ_DISABLE, AsyncMode);    
+    }
+            
+        /* take the lock to protect interrupt enable shadows */
+    LOCK_AR6K(pDev);
+
+    switch (IrqAction) {
+        
+        case GMBOX_DISABLE_ALL:
+            pDev->GMboxControlRegisters.int_status_enable = 0;
+            break;
+        case GMBOX_ERRORS_IRQ_ENABLE:
+            pDev->GMboxControlRegisters.int_status_enable |= GMBOX_INT_STATUS_TX_OVERFLOW |
+                                                             GMBOX_INT_STATUS_RX_OVERFLOW;
+            break;
+        case GMBOX_RECV_IRQ_ENABLE:
+            pDev->GMboxControlRegisters.int_status_enable |= GMBOX_INT_STATUS_RX_DATA;
+            break;
+        case GMBOX_RECV_IRQ_DISABLE:
+            pDev->GMboxControlRegisters.int_status_enable &= ~GMBOX_INT_STATUS_RX_DATA;
+            break;
+        case GMBOX_ACTION_NONE:
+        default:
+            A_ASSERT(false);
+            break;
+    }
+    
+    GMboxIntControl[0] = pDev->GMboxControlRegisters.int_status_enable;
+    GMboxIntControl[1] = GMboxIntControl[0];
+    GMboxIntControl[2] = GMboxIntControl[0];
+    GMboxIntControl[3] = GMboxIntControl[0];
+    
+    UNLOCK_AR6K(pDev);
+
+    do {
+
+        if (AsyncMode) {
+
+            pIOPacket = AR6KAllocIOPacket(pDev);
+
+            if (NULL == pIOPacket) {
+                status = A_NO_MEMORY;
+                A_ASSERT(false);
+                break;
+            }
+
+                /* copy values to write to our async I/O buffer */
+            memcpy(pIOPacket->pBuffer,GMboxIntControl,sizeof(GMboxIntControl));
+
+                /* stick in our completion routine when the I/O operation completes */
+            pIOPacket->Completion = DevGMboxIRQActionAsyncHandler;
+            pIOPacket->pContext = pDev;
+            pIOPacket->PktInfo.AsRx.HTCRxFlags = IrqAction;
+                /* write it out asynchronously */
+            HIFReadWrite(pDev->HIFDevice,
+                         GMBOX_INT_STATUS_ENABLE_REG,
+                         pIOPacket->pBuffer,
+                         sizeof(GMboxIntControl),
+                         HIF_WR_ASYNC_BYTE_FIX,
+                         pIOPacket);
+            pIOPacket = NULL;
+            break;
+        }
+
+        /* if we get here we are doing it synchronously */
+
+        status = HIFReadWrite(pDev->HIFDevice,
+                              GMBOX_INT_STATUS_ENABLE_REG,
+                              GMboxIntControl,
+                              sizeof(GMboxIntControl),
+                              HIF_WR_SYNC_BYTE_FIX,
+                              NULL);
+
+    } while (false);
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                (" IRQAction Operation (%d) failed! status:%d \n", IrqAction, status));    
+    } else {
+        if (!AsyncMode) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
+                    (" IRQAction Operation (%d) success \n", IrqAction)); 
+        }      
+    }
+    
+    if (pIOPacket != NULL) {
+        AR6KFreeIOPacket(pDev,pIOPacket);
+    }
+
+    return status;
+}
+
+void DevCleanupGMbox(struct ar6k_device *pDev)
+{
+    if (pDev->GMboxEnabled) {
+        pDev->GMboxEnabled = false;
+        GMboxProtocolUninstall(pDev);        
+    }
+}
+
+int DevSetupGMbox(struct ar6k_device *pDev)
+{
+    int    status = 0;
+    u8 muxControl[4];
+    
+    do {
+        
+        if (0 == pDev->MailBoxInfo.GMboxAddress) {
+            break;    
+        }
+    
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,(" GMBOX Advertised: Address:0x%X , size:%d \n",
+                    pDev->MailBoxInfo.GMboxAddress, pDev->MailBoxInfo.GMboxSize));
+                    
+        status = DevGMboxIRQAction(pDev, GMBOX_DISABLE_ALL, PROC_IO_SYNC);
+        
+        if (status) {
+            break;    
+        }
+       
+            /* write to mailbox look ahead mux control register, we want the
+             * GMBOX lookaheads to appear on lookaheads 2 and 3 
+             * the register is 1-byte wide so we need to hit it 4 times to align the operation 
+             * to 4-bytes */            
+        muxControl[0] = GMBOX_LA_MUX_OVERRIDE_2_3;
+        muxControl[1] = GMBOX_LA_MUX_OVERRIDE_2_3;
+        muxControl[2] = GMBOX_LA_MUX_OVERRIDE_2_3;
+        muxControl[3] = GMBOX_LA_MUX_OVERRIDE_2_3;
+                
+        status = HIFReadWrite(pDev->HIFDevice,
+                              GMBOX_LOOKAHEAD_MUX_REG,
+                              muxControl,
+                              sizeof(muxControl),
+                              HIF_WR_SYNC_BYTE_FIX,  /* hit this register 4 times */
+                              NULL);
+        
+        if (status) {
+            break;    
+        }
+        
+        status = GMboxProtocolInstall(pDev);
+        
+        if (status) {
+            break;    
+        }
+        
+        pDev->GMboxEnabled = true;
+        
+    } while (false);
+    
+    return status;
+}
+
+int DevCheckGMboxInterrupts(struct ar6k_device *pDev)
+{
+    int status = 0;
+    u8 counter_int_status;
+    int      credits;
+    u8 host_int_status2;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("+DevCheckGMboxInterrupts \n"));
+     
+    /* the caller guarantees that this is a context that allows for blocking I/O */
+    
+    do {
+        
+        host_int_status2 = pDev->IrqProcRegisters.host_int_status2 &
+                           pDev->GMboxControlRegisters.int_status_enable; 
+                
+        if (host_int_status2 & GMBOX_INT_STATUS_TX_OVERFLOW) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("GMBOX : TX Overflow \n"));  
+            status = A_ECOMM;   
+        }
+        
+        if (host_int_status2 & GMBOX_INT_STATUS_RX_OVERFLOW) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("GMBOX : RX Overflow \n"));  
+            status = A_ECOMM;    
+        }
+        
+        if (status) {
+            if (pDev->GMboxInfo.pTargetFailureCallback != NULL) {
+                pDev->GMboxInfo.pTargetFailureCallback(pDev->GMboxInfo.pProtocolContext, status);        
+            }
+            break;
+        }
+    
+        if (host_int_status2 & GMBOX_INT_STATUS_RX_DATA) {
+            if (pDev->IrqProcRegisters.gmbox_rx_avail > 0) {
+                A_ASSERT(pDev->GMboxInfo.pMessagePendingCallBack != NULL);
+                status = pDev->GMboxInfo.pMessagePendingCallBack(
+                                pDev->GMboxInfo.pProtocolContext,
+                                (u8 *)&pDev->IrqProcRegisters.rx_gmbox_lookahead_alias[0],
+                                pDev->IrqProcRegisters.gmbox_rx_avail);
+            }
+        } 
+        
+        if (status) {
+           break;                
+        }
+        
+        counter_int_status = pDev->IrqProcRegisters.counter_int_status &
+                             pDev->IrqEnableRegisters.counter_int_status_enable;
+    
+            /* check if credit interrupt is pending */
+        if (counter_int_status & (COUNTER_INT_STATUS_ENABLE_BIT_SET(1 << AR6K_GMBOX_CREDIT_COUNTER))) {
+            
+                /* do synchronous read */
+            status = DevGMboxReadCreditCounter(pDev, PROC_IO_SYNC, &credits);
+            
+            if (status) {
+                break;    
+            }
+            
+            A_ASSERT(pDev->GMboxInfo.pCreditsPendingCallback != NULL);
+            status = pDev->GMboxInfo.pCreditsPendingCallback(pDev->GMboxInfo.pProtocolContext,
+                                                             credits,
+                                                             pDev->GMboxInfo.CreditCountIRQEnabled);
+        }
+        
+    } while (false);
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("-DevCheckGMboxInterrupts (%d) \n",status));
+    
+    return status;
+}
+
+
+int DevGMboxWrite(struct ar6k_device *pDev, struct htc_packet *pPacket, u32 WriteLength)
+{
+    u32 paddedLength;
+    bool   sync = (pPacket->Completion == NULL) ? true : false;
+    int status;
+    u32 address;
+    
+       /* adjust the length to be a multiple of block size if appropriate */
+    paddedLength = DEV_CALC_SEND_PADDED_LEN(pDev, WriteLength);
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
+                ("DevGMboxWrite, Padded Length: %d Mbox:0x%X (mode:%s)\n",
+                WriteLength,
+                pDev->MailBoxInfo.GMboxAddress,
+                sync ? "SYNC" : "ASYNC"));
+                
+        /* last byte of packet has to hit the EOM marker */
+    address = pDev->MailBoxInfo.GMboxAddress + pDev->MailBoxInfo.GMboxSize - paddedLength;
+    
+    status = HIFReadWrite(pDev->HIFDevice,
+                          address,
+                          pPacket->pBuffer,
+                          paddedLength,     /* the padded length */
+                          sync ? HIF_WR_SYNC_BLOCK_INC : HIF_WR_ASYNC_BLOCK_INC,
+                          sync ? NULL : pPacket);  /* pass the packet as the context to the HIF request */
+
+    if (sync) {
+        pPacket->Status = status;
+    } else {
+        if (status == A_PENDING) {
+            status = 0;
+        }    
+    }
+
+    return status;
+}
+
+int DevGMboxRead(struct ar6k_device *pDev, struct htc_packet *pPacket, u32 ReadLength)
+{
+    
+    u32 paddedLength;
+    int status;
+    bool   sync = (pPacket->Completion == NULL) ? true : false;
+
+        /* adjust the length to be a multiple of block size if appropriate */
+    paddedLength = DEV_CALC_RECV_PADDED_LEN(pDev, ReadLength);
+                    
+    if (paddedLength > pPacket->BufferLength) {
+        A_ASSERT(false);
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                ("DevGMboxRead, Not enough space for padlen:%d recvlen:%d bufferlen:%d \n",
+                    paddedLength,ReadLength,pPacket->BufferLength));
+        if (pPacket->Completion != NULL) {
+            COMPLETE_HTC_PACKET(pPacket,A_EINVAL);
+            return 0;
+        }
+        return A_EINVAL;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                ("DevGMboxRead (0x%lX : hdr:0x%X) Padded Length: %d Mbox:0x%X (mode:%s)\n",
+                (unsigned long)pPacket, pPacket->PktInfo.AsRx.ExpectedHdr,
+                paddedLength,
+                pDev->MailBoxInfo.GMboxAddress,
+                sync ? "SYNC" : "ASYNC"));
+
+    status = HIFReadWrite(pDev->HIFDevice,
+                          pDev->MailBoxInfo.GMboxAddress,
+                          pPacket->pBuffer,
+                          paddedLength,
+                          sync ? HIF_RD_SYNC_BLOCK_FIX : HIF_RD_ASYNC_BLOCK_FIX,
+                          sync ? NULL : pPacket);  /* pass the packet as the context to the HIF request */
+
+    if (sync) {
+        pPacket->Status = status;
+    }
+
+    return status;
+}
+
+
+static int ProcessCreditCounterReadBuffer(u8 *pBuffer, int Length)
+{
+    int     credits = 0;
+    
+    /* theory of how this works:
+     * We read the credit decrement register multiple times on a byte-wide basis. 
+     * The number of times (32) aligns the I/O operation to be a multiple of 4 bytes and provides a 
+     * reasonable chance to acquire "all" pending credits in a single I/O operation. 
+     * 
+     * Once we obtain the filled buffer, we can walk through it looking for credit decrement transitions.
+     * Each non-zero byte represents a single credit decrement (which is a credit given back to the host)
+     * For example if the target provides 3 credits and added 4 more during the 32-byte read operation the following
+     * pattern "could" appear:
+     * 
+     *    0x3 0x2 0x1 0x0 0x0 0x0 0x0 0x0 0x1 0x0 0x1 0x0 0x1 0x0 0x1 0x0 ......rest zeros
+     *    <--------->                     <----------------------------->
+     *         \_ credits aleady there              \_ target adding 4 more credits
+     * 
+     *    The total available credits would be 7, since there are 7 non-zero bytes in the buffer.
+     * 
+     * */
+    
+    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
+        DebugDumpBytes(pBuffer, Length, "GMBOX Credit read buffer");
+    } 
+        
+    while (Length) {
+        if (*pBuffer != 0) {
+            credits++;    
+        }
+        Length--;
+        pBuffer++;   
+    }  
+    
+    return credits;
+}
+   
+
+/* callback when our fetch to enable/disable completes */
+static void DevGMboxReadCreditsAsyncHandler(void *Context, struct htc_packet *pPacket)
+{
+    struct ar6k_device *pDev = (struct ar6k_device *)Context;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevGMboxReadCreditsAsyncHandler: (dev: 0x%lX)\n", (unsigned long)pDev));
+
+    if (pPacket->Status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                ("Read Credit Operation failed! status:%d \n", pPacket->Status));
+    } else {
+        int credits = 0;
+        credits = ProcessCreditCounterReadBuffer(pPacket->pBuffer, AR6K_REG_IO_BUFFER_SIZE);
+        pDev->GMboxInfo.pCreditsPendingCallback(pDev->GMboxInfo.pProtocolContext,
+                                                credits,
+                                                pDev->GMboxInfo.CreditCountIRQEnabled);
+        
+        
+    }
+        /* free this IO packet */
+    AR6KFreeIOPacket(pDev,pPacket);
+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevGMboxReadCreditsAsyncHandler \n"));
+}
+
+int DevGMboxReadCreditCounter(struct ar6k_device *pDev, bool AsyncMode, int *pCredits)
+{
+    int    status = 0;
+    struct htc_packet  *pIOPacket = NULL;  
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+DevGMboxReadCreditCounter (%s) \n", AsyncMode ? "ASYNC" : "SYNC"));
+                                            
+    do {
+        
+        pIOPacket = AR6KAllocIOPacket(pDev);
+
+        if (NULL == pIOPacket) {
+            status = A_NO_MEMORY;
+            A_ASSERT(false);
+            break;
+        }
+        
+        A_MEMZERO(pIOPacket->pBuffer,AR6K_REG_IO_BUFFER_SIZE);
+      
+        if (AsyncMode) {   
+                /* stick in our completion routine when the I/O operation completes */
+            pIOPacket->Completion = DevGMboxReadCreditsAsyncHandler;
+            pIOPacket->pContext = pDev;
+                /* read registers asynchronously */
+            HIFReadWrite(pDev->HIFDevice,
+                         AR6K_GMBOX_CREDIT_DEC_ADDRESS,
+                         pIOPacket->pBuffer,
+                         AR6K_REG_IO_BUFFER_SIZE,  /* hit the register multiple times */
+                         HIF_RD_ASYNC_BYTE_FIX,
+                         pIOPacket);
+            pIOPacket = NULL;
+            break;
+        } 
+
+        pIOPacket->Completion = NULL;
+            /* if we get here we are doing it synchronously */
+        status = HIFReadWrite(pDev->HIFDevice,
+                              AR6K_GMBOX_CREDIT_DEC_ADDRESS,
+                              pIOPacket->pBuffer,
+                              AR6K_REG_IO_BUFFER_SIZE,
+                              HIF_RD_SYNC_BYTE_FIX,
+                              NULL);    
+    } while (false);
+    
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                (" DevGMboxReadCreditCounter failed! status:%d \n", status));          
+    }
+    
+    if (pIOPacket != NULL) {
+        if (!status) {
+                /* sync mode processing */
+            *pCredits = ProcessCreditCounterReadBuffer(pIOPacket->pBuffer, AR6K_REG_IO_BUFFER_SIZE);     
+        }
+        AR6KFreeIOPacket(pDev,pIOPacket);
+    }
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-DevGMboxReadCreditCounter (%s) (%d) \n", 
+            AsyncMode ? "ASYNC" : "SYNC", status));
+    
+    return status;
+}
+
+int DevGMboxReadCreditSize(struct ar6k_device *pDev, int *pCreditSize)
+{
+    int    status;
+    u8 buffer[4];
+       
+    status = HIFReadWrite(pDev->HIFDevice,
+                          AR6K_GMBOX_CREDIT_SIZE_ADDRESS,
+                          buffer,
+                          sizeof(buffer),
+                          HIF_RD_SYNC_BYTE_FIX, /* hit the register 4 times to align the I/O */
+                          NULL);    
+    
+    if (!status) {
+        if (buffer[0] == 0) {
+            *pCreditSize = 256;    
+        } else {   
+            *pCreditSize = buffer[0];
+        } 
+           
+    } 
+    
+    return status;
+}
+
+void DevNotifyGMboxTargetFailure(struct ar6k_device *pDev)
+{
+        /* Target ASSERTED!!! */
+    if (pDev->GMboxInfo.pTargetFailureCallback != NULL) {
+        pDev->GMboxInfo.pTargetFailureCallback(pDev->GMboxInfo.pProtocolContext, A_HARDWARE);        
+    }
+}
+
+int DevGMboxRecvLookAheadPeek(struct ar6k_device *pDev, u8 *pLookAheadBuffer, int *pLookAheadBytes)
+{
+
+    int                    status = 0;
+    struct ar6k_irq_proc_registers     procRegs;
+    int                         maxCopy;
+  
+    do {
+            /* on entry the caller provides the length of the lookahead buffer */
+        if (*pLookAheadBytes > sizeof(procRegs.rx_gmbox_lookahead_alias)) {
+            A_ASSERT(false);
+            status = A_EINVAL;
+            break;    
+        }
+        
+        maxCopy = *pLookAheadBytes;
+        *pLookAheadBytes = 0;
+            /* load the register table from the device */
+        status = HIFReadWrite(pDev->HIFDevice,
+                              HOST_INT_STATUS_ADDRESS,
+                              (u8 *)&procRegs,
+                              AR6K_IRQ_PROC_REGS_SIZE,
+                              HIF_RD_SYNC_BYTE_INC,
+                              NULL);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                ("DevGMboxRecvLookAheadPeek : Failed to read register table (%d) \n",status));
+            break;
+        }
+        
+        if (procRegs.gmbox_rx_avail > 0) {
+            int bytes = procRegs.gmbox_rx_avail > maxCopy ? maxCopy : procRegs.gmbox_rx_avail;
+            memcpy(pLookAheadBuffer,&procRegs.rx_gmbox_lookahead_alias[0],bytes);
+            *pLookAheadBytes = bytes;
+        }
+        
+    } while (false);
+       
+    return status; 
+}
+
+int DevGMboxSetTargetInterrupt(struct ar6k_device *pDev, int Signal, int AckTimeoutMS)
+{
+    int status = 0;
+    int      i;
+    u8 buffer[4];
+    
+    A_MEMZERO(buffer, sizeof(buffer));
+    
+    do {
+        
+        if (Signal >= MBOX_SIG_HCI_BRIDGE_MAX) {
+            status = A_EINVAL;
+            break;    
+        }
+        
+            /* set the last buffer to do the actual signal trigger */
+        buffer[3] = (1 << Signal);
+        
+        status = HIFReadWrite(pDev->HIFDevice,
+                              INT_WLAN_ADDRESS,
+                              buffer,
+                              sizeof(buffer),
+                              HIF_WR_SYNC_BYTE_FIX, /* hit the register 4 times to align the I/O */
+                              NULL);    
+                          
+        if (status) {
+            break;    
+        }
+        
+    } while (false);
+    
+    
+    if (!status) {
+            /* now read back the register to see if the bit cleared */
+        while (AckTimeoutMS) {        
+            status = HIFReadWrite(pDev->HIFDevice,
+                                  INT_WLAN_ADDRESS,
+                                  buffer,
+                                  sizeof(buffer),
+                                  HIF_RD_SYNC_BYTE_FIX,
+                                  NULL);    
+                          
+            if (status) {
+                break;    
+            }
+                            
+            for (i = 0; i < sizeof(buffer); i++) {
+                if (buffer[i] & (1 << Signal)) {
+                    /* bit is still set */
+                    break;    
+                }   
+            }
+            
+            if (i >= sizeof(buffer)) {
+                /* done */
+                break;    
+            }
+            
+            AckTimeoutMS--;
+            A_MDELAY(1);  
+        }
+        
+        if (0 == AckTimeoutMS) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                ("DevGMboxSetTargetInterrupt : Ack Timed-out (sig:%d) \n",Signal));
+            status = A_ERROR;    
+        }        
+    }
+    
+    return status;
+    
+}
+
+#endif  //ATH_AR6K_ENABLE_GMBOX
+
+
+
+
diff --git a/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox_hciuart.c b/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox_hciuart.c
new file mode 100644
index 00000000000..56a0d714380
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/AR6000/ar6k_gmbox_hciuart.c
@@ -0,0 +1,1284 @@
+//------------------------------------------------------------------------------
+// <copyright file="ar6k_prot_hciUart.c" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Protocol module for use in bridging HCI-UART packets over the GMBOX interface
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_osapi.h"
+#include "../htc_debug.h"
+#include "hif.h"
+#include "htc_packet.h"
+#include "ar6k.h"
+#include "hci_transport_api.h"
+#include "gmboxif.h"
+#include "ar6000_diag.h"
+#include "hw/apb_map.h"
+#include "hw/mbox_reg.h"
+
+#ifdef ATH_AR6K_ENABLE_GMBOX
+#define HCI_UART_COMMAND_PKT 0x01
+#define HCI_UART_ACL_PKT     0x02
+#define HCI_UART_SCO_PKT     0x03
+#define HCI_UART_EVENT_PKT   0x04
+
+#define HCI_RECV_WAIT_BUFFERS (1 << 0)
+
+#define HCI_SEND_WAIT_CREDITS (1 << 0)
+
+#define HCI_UART_BRIDGE_CREDIT_SIZE     128
+
+#define CREDIT_POLL_COUNT       256
+
+#define HCI_DELAY_PER_INTERVAL_MS 10 
+#define BTON_TIMEOUT_MS           500
+#define BTOFF_TIMEOUT_MS          500
+#define BAUD_TIMEOUT_MS           1
+#define BTPWRSAV_TIMEOUT_MS       1  
+
+struct gmbox_proto_hci_uart {
+    struct hci_transport_config_info   HCIConfig;
+    bool                      HCIAttached;
+    bool                      HCIStopped;
+    u32 RecvStateFlags;
+    u32 SendStateFlags;
+    HCI_TRANSPORT_PACKET_TYPE   WaitBufferType;
+    struct htc_packet_queue            SendQueue;         /* write queue holding HCI Command and ACL packets */
+    struct htc_packet_queue            HCIACLRecvBuffers;  /* recv queue holding buffers for incomming ACL packets */
+    struct htc_packet_queue            HCIEventBuffers;    /* recv queue holding buffers for incomming event packets */
+    struct ar6k_device                 *pDev;
+    A_MUTEX_T                   HCIRxLock;
+    A_MUTEX_T                   HCITxLock;
+    int                         CreditsMax;
+    int                         CreditsConsumed;
+    int                         CreditsAvailable;
+    int                         CreditSize;
+    int                         CreditsCurrentSeek;
+    int                         SendProcessCount;
+};
+
+#define LOCK_HCI_RX(t)   A_MUTEX_LOCK(&(t)->HCIRxLock);
+#define UNLOCK_HCI_RX(t) A_MUTEX_UNLOCK(&(t)->HCIRxLock);
+#define LOCK_HCI_TX(t)   A_MUTEX_LOCK(&(t)->HCITxLock);
+#define UNLOCK_HCI_TX(t) A_MUTEX_UNLOCK(&(t)->HCITxLock);
+
+#define DO_HCI_RECV_INDICATION(p, pt)                           \
+do {                                                            \
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,                                 \
+                        ("HCI: Indicate Recv on packet:0x%lX status:%d len:%d type:%d \n", \
+                         (unsigned long)(pt),                           \
+                         (pt)->Status,                                  \
+                         !(pt)->Status ? (pt)->ActualLength : 0,        \
+                         HCI_GET_PACKET_TYPE(pt)));                     \
+        (p)->HCIConfig.pHCIPktRecv((p)->HCIConfig.pContext, (pt));      \
+} while (0)
+
+#define DO_HCI_SEND_INDICATION(p,pt) \
+{   AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("HCI: Indicate Send on packet:0x%lX status:%d type:%d \n",  \
+            (unsigned long)(pt),(pt)->Status,HCI_GET_PACKET_TYPE(pt)));                             \
+    (p)->HCIConfig.pHCISendComplete((p)->HCIConfig.pContext, (pt));                            \
+}
+    
+static int HCITrySend(struct gmbox_proto_hci_uart *pProt, struct htc_packet *pPacket, bool Synchronous);
+
+static void HCIUartCleanup(struct gmbox_proto_hci_uart *pProtocol)
+{
+    A_ASSERT(pProtocol != NULL);
+    
+    A_MUTEX_DELETE(&pProtocol->HCIRxLock);
+    A_MUTEX_DELETE(&pProtocol->HCITxLock);
+        
+    kfree(pProtocol);    
+}
+
+static int InitTxCreditState(struct gmbox_proto_hci_uart *pProt)
+{
+    int    status;
+    int         credits;
+    int         creditPollCount = CREDIT_POLL_COUNT;
+    bool      gotCredits = false;
+
+    pProt->CreditsConsumed = 0;
+    
+    do {    
+        
+        if (pProt->CreditsMax != 0) {
+            /* we can only call this only once per target reset */
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HCI: InitTxCreditState - already called!  \n"));
+            A_ASSERT(false);
+            status = A_EINVAL;
+            break; 
+        }
+        
+        /* read the credit counter. At startup the target will set the credit counter
+         * to the max available, we read this in a loop because it may take
+         * multiple credit counter reads to get all credits  */
+                 
+        while (creditPollCount) {
+            
+            credits = 0;
+
+            status = DevGMboxReadCreditCounter(pProt->pDev, PROC_IO_SYNC, &credits);
+    
+            if (status) {
+                break;    
+            }
+            
+            if (!gotCredits && (0 == credits)) {
+                creditPollCount--;
+                AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("HCI: credit is 0, retrying (%d)  \n",creditPollCount));
+                A_MDELAY(HCI_DELAY_PER_INTERVAL_MS);
+                continue;  
+            } else {
+                gotCredits = true;
+            }
+            
+            if (0 == credits) {
+                break;    
+            }
+            
+            pProt->CreditsMax += credits;
+        }
+        
+        if (status) {
+            break;    
+        }
+        
+        if (0 == creditPollCount) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    ("** HCI : Failed to get credits! GMBOX Target was not available \n"));        
+            status = A_ERROR;
+            break;
+        }
+        
+            /* now get the size */
+        status = DevGMboxReadCreditSize(pProt->pDev, &pProt->CreditSize);
+        
+        if (status) {
+            break;    
+        }
+               
+    } while (false);
+    
+    if (!status) {
+        pProt->CreditsAvailable = pProt->CreditsMax;
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("HCI : InitTxCreditState - credits avail: %d, size: %d \n",
+            pProt->CreditsAvailable, pProt->CreditSize));    
+    }    
+    
+    return status;
+}
+
+static int CreditsAvailableCallback(void *pContext, int Credits, bool CreditIRQEnabled)
+{
+    struct gmbox_proto_hci_uart *pProt = (struct gmbox_proto_hci_uart *)pContext;    
+    bool               enableCreditIrq = false;
+    bool               disableCreditIrq = false;
+    bool               doPendingSends = false;
+    int             status = 0;
+    
+    /** this callback is called under 2 conditions:
+     *   1. The credit IRQ interrupt was enabled and signaled.
+     *   2. A credit counter read completed.
+     * 
+     *   The function must not assume that the calling context can block !
+     */
+     
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+CreditsAvailableCallback (Credits:%d, IRQ:%s) \n",
+                Credits, CreditIRQEnabled ? "ON" : "OFF"));
+    
+    LOCK_HCI_TX(pProt);
+    
+    do {
+        
+        if (0 == Credits) {
+            if (!CreditIRQEnabled) {
+                    /* enable credit IRQ */
+                enableCreditIrq = true;
+            }
+            break;
+        }
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("HCI: current credit state, consumed:%d available:%d max:%d seek:%d\n",
+                         pProt->CreditsConsumed, 
+                         pProt->CreditsAvailable,  
+                         pProt->CreditsMax,
+                         pProt->CreditsCurrentSeek));
+                         
+        pProt->CreditsAvailable += Credits;
+        A_ASSERT(pProt->CreditsAvailable <= pProt->CreditsMax);
+        pProt->CreditsConsumed  -= Credits;
+        A_ASSERT(pProt->CreditsConsumed >= 0);
+            
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("HCI: new credit state, consumed:%d available:%d max:%d seek:%d\n",
+                         pProt->CreditsConsumed, 
+                         pProt->CreditsAvailable,  
+                         pProt->CreditsMax,
+                         pProt->CreditsCurrentSeek));
+        
+        if (pProt->CreditsAvailable >= pProt->CreditsCurrentSeek) {
+                /* we have enough credits to fulfill at least 1 packet waiting in the queue */
+            pProt->CreditsCurrentSeek = 0;
+            pProt->SendStateFlags &= ~HCI_SEND_WAIT_CREDITS;  
+            doPendingSends = true;
+            if (CreditIRQEnabled) {
+                    /* credit IRQ was enabled, we shouldn't need it anymore */
+                disableCreditIrq = true;
+            }      
+        } else {
+                /* not enough credits yet, enable credit IRQ if we haven't already */
+            if (!CreditIRQEnabled) {               
+                enableCreditIrq = true;
+            }    
+        }
+                      
+    } while (false);
+    
+    UNLOCK_HCI_TX(pProt);
+
+    if (enableCreditIrq) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" Enabling credit count IRQ...\n"));
+            /* must use async only */
+        status = DevGMboxIRQAction(pProt->pDev, GMBOX_CREDIT_IRQ_ENABLE, PROC_IO_ASYNC);    
+    } else if (disableCreditIrq) {
+            /* must use async only */
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" Disabling credit count IRQ...\n"));
+        status = DevGMboxIRQAction(pProt->pDev, GMBOX_CREDIT_IRQ_DISABLE, PROC_IO_ASYNC); 
+    }
+       
+    if (doPendingSends) {
+        HCITrySend(pProt, NULL, false);
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+CreditsAvailableCallback \n"));
+    return status;
+}
+
+static INLINE void NotifyTransportFailure(struct gmbox_proto_hci_uart  *pProt, int status)
+{
+    if (pProt->HCIConfig.TransportFailure != NULL) {
+        pProt->HCIConfig.TransportFailure(pProt->HCIConfig.pContext, status);
+    }
+}
+
+static void FailureCallback(void *pContext, int Status)
+{
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)pContext; 
+    
+        /* target assertion occurred */           
+    NotifyTransportFailure(pProt, Status);  
+}
+
+static void StateDumpCallback(void *pContext)
+{
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)pContext;
+   
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("============ HCIUart State ======================\n"));    
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("RecvStateFlags   :  0x%X \n",pProt->RecvStateFlags));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("SendStateFlags   :  0x%X \n",pProt->SendStateFlags));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("WaitBufferType   :  %d   \n",pProt->WaitBufferType));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("SendQueue Depth  :  %d   \n",HTC_PACKET_QUEUE_DEPTH(&pProt->SendQueue)));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("CreditsMax       :  %d   \n",pProt->CreditsMax));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("CreditsConsumed  :  %d   \n",pProt->CreditsConsumed));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("CreditsAvailable :  %d   \n",pProt->CreditsAvailable));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("==================================================\n"));
+}
+
+static int HCIUartMessagePending(void *pContext, u8 LookAheadBytes[], int ValidBytes)
+{
+    struct gmbox_proto_hci_uart        *pProt = (struct gmbox_proto_hci_uart *)pContext;
+    int                    status = 0;
+    int                         totalRecvLength = 0;
+    HCI_TRANSPORT_PACKET_TYPE   pktType = HCI_PACKET_INVALID;
+    bool                      recvRefillCalled = false;
+    bool                      blockRecv = false;
+    struct htc_packet                  *pPacket = NULL;
+    
+    /** caller guarantees that this is a fully block-able context (synch I/O is allowed) */
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HCIUartMessagePending Lookahead Bytes:%d \n",ValidBytes));
+    
+    LOCK_HCI_RX(pProt);
+        
+    do {
+    
+        if (ValidBytes < 3) {
+                /* not enough for ACL or event header */
+            break;    
+        }    
+        
+        if ((LookAheadBytes[0] == HCI_UART_ACL_PKT) && (ValidBytes < 5)) {
+                /* not enough for ACL data header */
+            break;    
+        }
+                
+        switch (LookAheadBytes[0]) {       
+            case HCI_UART_EVENT_PKT:
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("HCI Event: %d param length: %d \n",
+                        LookAheadBytes[1], LookAheadBytes[2]));
+                totalRecvLength = LookAheadBytes[2];
+                totalRecvLength += 3; /* add type + event code + length field */
+                pktType = HCI_EVENT_TYPE;      
+                break;
+            case HCI_UART_ACL_PKT:                
+                totalRecvLength = (LookAheadBytes[4] << 8) | LookAheadBytes[3];                
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("HCI ACL: conn:0x%X length: %d \n",
+                        ((LookAheadBytes[2] & 0xF0) << 8) | LookAheadBytes[1], totalRecvLength));
+                totalRecvLength += 5; /* add type + connection handle + length field */
+                pktType = HCI_ACL_TYPE;           
+                break;        
+            default:
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("**Invalid HCI packet type: %d \n",LookAheadBytes[0]));
+                status = A_EPROTO;
+                break;
+        }
+        
+        if (status) {
+            break;    
+        }
+                
+        if (pProt->HCIConfig.pHCIPktRecvAlloc != NULL) {
+            UNLOCK_HCI_RX(pProt);
+                /* user is using a per-packet allocation callback */
+            pPacket = pProt->HCIConfig.pHCIPktRecvAlloc(pProt->HCIConfig.pContext,
+                                                        pktType,
+                                                        totalRecvLength);
+            LOCK_HCI_RX(pProt);
+    
+        } else {
+            struct htc_packet_queue *pQueue;
+                /* user is using a refill handler that can refill multiple HTC buffers */
+            
+                /* select buffer queue */
+            if (pktType == HCI_ACL_TYPE) {
+                pQueue = &pProt->HCIACLRecvBuffers;    
+            } else {
+                pQueue = &pProt->HCIEventBuffers;              
+            }    
+            
+            if (HTC_QUEUE_EMPTY(pQueue)) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                    ("** HCI pkt type: %d has no buffers available calling allocation handler \n", 
+                    pktType));
+                    /* check for refill handler */
+                if (pProt->HCIConfig.pHCIPktRecvRefill != NULL) {
+                    recvRefillCalled = true;
+                    UNLOCK_HCI_RX(pProt);
+                        /* call the re-fill handler */
+                    pProt->HCIConfig.pHCIPktRecvRefill(pProt->HCIConfig.pContext,
+                                                       pktType,
+                                                       0);
+                    LOCK_HCI_RX(pProt);
+                        /* check if we have more buffers */
+                    pPacket = HTC_PACKET_DEQUEUE(pQueue);
+                        /* fall through */
+                }
+            } else {
+                pPacket = HTC_PACKET_DEQUEUE(pQueue);
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                    ("HCI pkt type: %d now has %d recv buffers left \n", 
+                            pktType, HTC_PACKET_QUEUE_DEPTH(pQueue)));    
+            }
+        }
+     
+        if (NULL == pPacket) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                    ("** HCI pkt type: %d has no buffers available stopping recv...\n", pktType));
+                /* this is not an error, we simply need to mark that we are waiting for buffers.*/
+            pProt->RecvStateFlags |= HCI_RECV_WAIT_BUFFERS;
+            pProt->WaitBufferType = pktType;
+            blockRecv = true;
+            break;
+        }
+        
+        if (totalRecvLength > (int)pPacket->BufferLength) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("** HCI-UART pkt: %d requires %d bytes (%d buffer bytes avail) ! \n",
+                LookAheadBytes[0], totalRecvLength, pPacket->BufferLength));
+            status = A_EINVAL;
+            break;
+        }
+        
+    } while (false);
+    
+    UNLOCK_HCI_RX(pProt);
+    
+        /* locks are released, we can go fetch the packet */
+        
+    do {
+        
+        if (status || (NULL == pPacket)) {
+            break;    
+        } 
+        
+            /* do this synchronously, we don't need to be fast here */
+        pPacket->Completion = NULL;
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("HCI : getting recv packet len:%d hci-uart-type: %s \n",
+                totalRecvLength, (LookAheadBytes[0] == HCI_UART_EVENT_PKT) ? "EVENT" : "ACL"));
+                
+        status = DevGMboxRead(pProt->pDev, pPacket, totalRecvLength);     
+        
+        if (status) {
+            break;    
+        }
+        
+        if (pPacket->pBuffer[0] != LookAheadBytes[0]) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("** HCI buffer does not contain expected packet type: %d ! \n",
+                        pPacket->pBuffer[0]));
+            status = A_EPROTO;
+            break;   
+        }
+        
+        if (pPacket->pBuffer[0] == HCI_UART_EVENT_PKT) {
+                /* validate event header fields */
+            if ((pPacket->pBuffer[1] != LookAheadBytes[1]) ||
+                (pPacket->pBuffer[2] != LookAheadBytes[2])) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("** HCI buffer does not match lookahead! \n"));
+                DebugDumpBytes(LookAheadBytes, 3, "Expected HCI-UART Header");  
+                DebugDumpBytes(pPacket->pBuffer, 3, "** Bad HCI-UART Header");  
+                status = A_EPROTO;
+                break;       
+            }   
+        } else if (pPacket->pBuffer[0] == HCI_UART_ACL_PKT) {
+                /* validate acl header fields */
+            if ((pPacket->pBuffer[1] != LookAheadBytes[1]) ||
+                (pPacket->pBuffer[2] != LookAheadBytes[2]) ||
+                (pPacket->pBuffer[3] != LookAheadBytes[3]) ||
+                (pPacket->pBuffer[4] != LookAheadBytes[4])) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("** HCI buffer does not match lookahead! \n"));
+                DebugDumpBytes(LookAheadBytes, 5, "Expected HCI-UART Header");  
+                DebugDumpBytes(pPacket->pBuffer, 5, "** Bad HCI-UART Header");  
+                status = A_EPROTO;
+                break;       
+            }   
+        }
+        
+            /* adjust buffer to move past packet ID */
+        pPacket->pBuffer++;
+        pPacket->ActualLength = totalRecvLength - 1;
+        pPacket->Status = 0;
+            /* indicate packet */
+        DO_HCI_RECV_INDICATION(pProt,pPacket);
+        pPacket = NULL;
+        
+            /* check if we need to refill recv buffers */        
+        if ((pProt->HCIConfig.pHCIPktRecvRefill != NULL) && !recvRefillCalled) {           
+            struct htc_packet_queue *pQueue;
+            int              watermark;
+
+            if (pktType == HCI_ACL_TYPE) {
+                watermark = pProt->HCIConfig.ACLRecvBufferWaterMark;
+                pQueue = &pProt->HCIACLRecvBuffers;    
+            } else {
+                watermark = pProt->HCIConfig.EventRecvBufferWaterMark;     
+                pQueue = &pProt->HCIEventBuffers;        
+            }    
+            
+            if (HTC_PACKET_QUEUE_DEPTH(pQueue) < watermark) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                    ("** HCI pkt type: %d watermark hit (%d) current:%d \n", 
+                    pktType, watermark, HTC_PACKET_QUEUE_DEPTH(pQueue)));
+                    /* call the re-fill handler */
+                pProt->HCIConfig.pHCIPktRecvRefill(pProt->HCIConfig.pContext,
+                                                   pktType,
+                                                   HTC_PACKET_QUEUE_DEPTH(pQueue));
+            }
+        }   
+        
+    } while (false);
+        
+        /* check if we need to disable the receiver */
+    if (status || blockRecv) {
+        DevGMboxIRQAction(pProt->pDev, GMBOX_RECV_IRQ_DISABLE, PROC_IO_SYNC); 
+    }
+    
+        /* see if we need to recycle the recv buffer */    
+    if (status && (pPacket != NULL)) {
+        struct htc_packet_queue queue;
+        
+        if (A_EPROTO == status) {
+            DebugDumpBytes(pPacket->pBuffer, totalRecvLength, "Bad HCI-UART Recv packet");    
+        }
+            /* recycle packet */
+        HTC_PACKET_RESET_RX(pPacket);
+        INIT_HTC_PACKET_QUEUE_AND_ADD(&queue,pPacket);
+        HCI_TransportAddReceivePkts(pProt,&queue);
+        NotifyTransportFailure(pProt,status);    
+    }
+    
+ 
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HCIUartMessagePending \n"));
+    
+    return status;
+}
+
+static void HCISendPacketCompletion(void *Context, struct htc_packet *pPacket)
+{
+    struct gmbox_proto_hci_uart *pProt = (struct gmbox_proto_hci_uart *)Context;
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HCISendPacketCompletion (pPacket:0x%lX) \n",(unsigned long)pPacket));
+    
+    if (pPacket->Status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" Send Packet (0x%lX) failed: %d , len:%d \n",
+            (unsigned long)pPacket, pPacket->Status, pPacket->ActualLength));        
+    }
+    
+    DO_HCI_SEND_INDICATION(pProt,pPacket);
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HCISendPacketCompletion \n"));
+}
+
+static int SeekCreditsSynch(struct gmbox_proto_hci_uart *pProt)
+{
+    int status = 0;
+    int      credits;
+    int      retry = 100;
+    
+    while (true) {
+        credits = 0;
+        status =  DevGMboxReadCreditCounter(pProt->pDev, PROC_IO_SYNC, &credits);   
+        if (status) {
+            break;    
+        }
+        LOCK_HCI_TX(pProt);
+        pProt->CreditsAvailable += credits;        
+        pProt->CreditsConsumed -= credits;        
+        if (pProt->CreditsAvailable >= pProt->CreditsCurrentSeek) {
+            pProt->CreditsCurrentSeek = 0;
+            UNLOCK_HCI_TX(pProt);
+            break;    
+        }
+        UNLOCK_HCI_TX(pProt);
+        retry--;
+        if (0 == retry) {
+            status = A_EBUSY;
+            break;    
+        }
+        A_MDELAY(20);
+    }   
+    
+    return status;
+}
+
+static int HCITrySend(struct gmbox_proto_hci_uart *pProt, struct htc_packet *pPacket, bool Synchronous)
+{   
+    int    status = 0;
+    int         transferLength;
+    int         creditsRequired, remainder;
+    u8 hciUartType;
+    bool      synchSendComplete = false;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HCITrySend (pPacket:0x%lX) %s \n",(unsigned long)pPacket,
+            Synchronous ? "SYNC" :"ASYNC"));
+    
+    LOCK_HCI_TX(pProt);
+     
+        /* increment write processing count on entry */    
+    pProt->SendProcessCount++;
+        
+    do {
+                                             
+        if (pProt->HCIStopped) {
+            status = A_ECANCELED;
+            break;     
+        }   
+         
+        if (pPacket != NULL) {  
+                /* packet was supplied */     
+            if (Synchronous) {
+                    /* in synchronous mode, the send queue can only hold 1 packet */
+                if (!HTC_QUEUE_EMPTY(&pProt->SendQueue)) {
+                    status = A_EBUSY;
+                    A_ASSERT(false);
+                    break;    
+                }             
+                
+                if (pProt->SendProcessCount > 1) {
+                        /* another thread or task is draining the TX queues  */
+                    status = A_EBUSY;
+                    A_ASSERT(false);
+                    break;
+                } 
+                  
+                HTC_PACKET_ENQUEUE(&pProt->SendQueue,pPacket);
+                
+            } else {
+                    /* see if adding this packet hits the max depth (asynchronous mode only) */
+                if ((pProt->HCIConfig.MaxSendQueueDepth > 0) && 
+                    ((HTC_PACKET_QUEUE_DEPTH(&pProt->SendQueue) + 1) >= pProt->HCIConfig.MaxSendQueueDepth)) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("HCI Send queue is full, Depth:%d, Max:%d \n",
+                            HTC_PACKET_QUEUE_DEPTH(&pProt->SendQueue), 
+                            pProt->HCIConfig.MaxSendQueueDepth));
+                        /* queue will be full, invoke any callbacks to determine what action to take */
+                    if (pProt->HCIConfig.pHCISendFull != NULL) {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_SEND, 
+                                    ("HCI : Calling driver's send full callback.... \n"));
+                        if (pProt->HCIConfig.pHCISendFull(pProt->HCIConfig.pContext,
+                                                          pPacket) == HCI_SEND_FULL_DROP) {
+                                /* drop it */
+                            status = A_NO_RESOURCE;      
+                            break;
+                        }
+                    }               
+                }
+          
+                HTC_PACKET_ENQUEUE(&pProt->SendQueue,pPacket);
+            }
+
+        }
+               
+        if (pProt->SendStateFlags & HCI_SEND_WAIT_CREDITS) {
+            break;   
+        }
+
+        if (pProt->SendProcessCount > 1) {
+                /* another thread or task is draining the TX queues  */
+            break;
+        }
+    
+        /***** beyond this point only 1 thread may enter ******/
+           
+        /* now drain the send queue for transmission as long as we have enough
+         * credits */
+        while (!HTC_QUEUE_EMPTY(&pProt->SendQueue)) {
+            
+            pPacket = HTC_PACKET_DEQUEUE(&pProt->SendQueue);
+
+            switch (HCI_GET_PACKET_TYPE(pPacket)) {            
+                case HCI_COMMAND_TYPE:
+                    hciUartType = HCI_UART_COMMAND_PKT;
+                    break;
+                case HCI_ACL_TYPE:
+                    hciUartType = HCI_UART_ACL_PKT;
+                    break;
+                default:
+                    status = A_EINVAL;
+                    A_ASSERT(false);
+                    break;
+            }
+                       
+            if (status) {
+                break;   
+            }
+            
+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("HCI: Got head packet:0x%lX , Type:%d  Length: %d Remaining Queue Depth: %d\n",
+                (unsigned long)pPacket, HCI_GET_PACKET_TYPE(pPacket), pPacket->ActualLength, 
+                HTC_PACKET_QUEUE_DEPTH(&pProt->SendQueue)));
+        
+            transferLength = 1;  /* UART type header is 1 byte */
+            transferLength += pPacket->ActualLength;
+            transferLength = DEV_CALC_SEND_PADDED_LEN(pProt->pDev, transferLength);
+                   
+                /* figure out how many credits this message requires */
+            creditsRequired = transferLength / pProt->CreditSize;
+            remainder = transferLength % pProt->CreditSize;
+
+            if (remainder) {
+                creditsRequired++;
+            }
+
+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("HCI: Creds Required:%d   Got:%d\n",
+                            creditsRequired, pProt->CreditsAvailable));
+            
+            if (creditsRequired > pProt->CreditsAvailable) {
+                if (Synchronous) {
+                        /* in synchronous mode we need to seek credits in synchronously */
+                    pProt->CreditsCurrentSeek = creditsRequired;
+                    UNLOCK_HCI_TX(pProt);
+                    status = SeekCreditsSynch(pProt);
+                    LOCK_HCI_TX(pProt);
+                    if (status) {
+                        break;    
+                    }                    
+                    /* fall through and continue processing this send op */                    
+                } else {
+                        /* not enough credits, queue back to the head */
+                    HTC_PACKET_ENQUEUE_TO_HEAD(&pProt->SendQueue,pPacket);
+                        /* waiting for credits */
+                    pProt->SendStateFlags |= HCI_SEND_WAIT_CREDITS;
+                        /* provide a hint to reduce attempts to re-send if credits are dribbling back
+                         * this hint is the short fall of credits */
+                    pProt->CreditsCurrentSeek = creditsRequired;
+                    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("HCI: packet:0x%lX placed back in queue. head packet needs: %d credits \n",
+                                        (unsigned long)pPacket, pProt->CreditsCurrentSeek));
+                    pPacket = NULL;
+                    UNLOCK_HCI_TX(pProt);
+                    
+                        /* schedule a credit counter read, our CreditsAvailableCallback callback will be called
+                         * with the result */   
+                    DevGMboxReadCreditCounter(pProt->pDev, PROC_IO_ASYNC, NULL);
+                             
+                    LOCK_HCI_TX(pProt);
+                    break;              
+                }          
+            }
+        
+                /* caller guarantees some head room */
+            pPacket->pBuffer--;
+            pPacket->pBuffer[0] = hciUartType;
+            
+            pProt->CreditsAvailable -= creditsRequired;
+            pProt->CreditsConsumed  += creditsRequired;
+            A_ASSERT(pProt->CreditsConsumed <= pProt->CreditsMax);
+            
+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("HCI: new credit state: consumed:%d   available:%d max:%d\n",
+                             pProt->CreditsConsumed, pProt->CreditsAvailable,  pProt->CreditsMax));
+            
+            UNLOCK_HCI_TX(pProt);   
+            
+                /* write it out */   
+            if (Synchronous) {                            
+                pPacket->Completion = NULL;
+                pPacket->pContext = NULL;         
+            } else {                       
+                pPacket->Completion = HCISendPacketCompletion;
+                pPacket->pContext = pProt;    
+            }
+            
+            status = DevGMboxWrite(pProt->pDev,pPacket,transferLength);            
+            if (Synchronous) {            
+                synchSendComplete = true;
+            } else {
+                pPacket = NULL;    
+            }
+            
+            LOCK_HCI_TX(pProt);
+              
+        }
+        
+    } while (false);
+        
+    pProt->SendProcessCount--;
+    A_ASSERT(pProt->SendProcessCount >= 0);
+    UNLOCK_HCI_TX(pProt);
+    
+    if (Synchronous) {
+        A_ASSERT(pPacket != NULL);
+        if (!status && (!synchSendComplete)) {
+            status = A_EBUSY;
+            A_ASSERT(false);
+            LOCK_HCI_TX(pProt);
+            if (pPacket->ListLink.pNext != NULL) {
+                    /* remove from the queue */
+                HTC_PACKET_REMOVE(&pProt->SendQueue,pPacket);
+            }
+            UNLOCK_HCI_TX(pProt);
+        }
+    } else {   
+        if (status && (pPacket != NULL)) {
+            pPacket->Status = status;
+            DO_HCI_SEND_INDICATION(pProt,pPacket); 
+        }
+    }
+        
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-HCITrySend:  \n"));
+    return status;    
+}
+
+static void FlushSendQueue(struct gmbox_proto_hci_uart *pProt)
+{
+    struct htc_packet          *pPacket;
+    struct htc_packet_queue    discardQueue;
+    
+    INIT_HTC_PACKET_QUEUE(&discardQueue);
+    
+    LOCK_HCI_TX(pProt);
+    
+    if (!HTC_QUEUE_EMPTY(&pProt->SendQueue)) {
+        HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&discardQueue,&pProt->SendQueue);    
+    }
+    
+    UNLOCK_HCI_TX(pProt);
+    
+        /* discard packets */
+    while (!HTC_QUEUE_EMPTY(&discardQueue)) {
+        pPacket = HTC_PACKET_DEQUEUE(&discardQueue);   
+        pPacket->Status = A_ECANCELED;
+        DO_HCI_SEND_INDICATION(pProt,pPacket);
+    }
+    
+}
+
+static void FlushRecvBuffers(struct gmbox_proto_hci_uart *pProt)
+{
+    struct htc_packet_queue discardQueue;
+    struct htc_packet *pPacket;
+    
+    INIT_HTC_PACKET_QUEUE(&discardQueue);
+    
+    LOCK_HCI_RX(pProt);
+        /*transfer list items from ACL and event buffer queues to the discard queue */       
+    if (!HTC_QUEUE_EMPTY(&pProt->HCIACLRecvBuffers)) {
+        HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&discardQueue,&pProt->HCIACLRecvBuffers);    
+    }
+    if (!HTC_QUEUE_EMPTY(&pProt->HCIEventBuffers)) {
+        HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&discardQueue,&pProt->HCIEventBuffers);    
+    }
+    UNLOCK_HCI_RX(pProt);
+    
+        /* now empty the discard queue */
+    while (!HTC_QUEUE_EMPTY(&discardQueue)) {
+        pPacket = HTC_PACKET_DEQUEUE(&discardQueue);      
+        pPacket->Status = A_ECANCELED;
+        DO_HCI_RECV_INDICATION(pProt,pPacket);
+    }
+    
+}
+
+/*** protocol module install entry point ***/
+
+int GMboxProtocolInstall(struct ar6k_device *pDev)
+{
+    int                status = 0;
+    struct gmbox_proto_hci_uart    *pProtocol = NULL;
+        
+    do {
+        
+        pProtocol = A_MALLOC(sizeof(struct gmbox_proto_hci_uart));
+        
+        if (NULL == pProtocol) {
+            status = A_NO_MEMORY;
+            break;    
+        }
+        
+        A_MEMZERO(pProtocol, sizeof(*pProtocol));
+        pProtocol->pDev = pDev;
+        INIT_HTC_PACKET_QUEUE(&pProtocol->SendQueue);
+        INIT_HTC_PACKET_QUEUE(&pProtocol->HCIACLRecvBuffers);
+        INIT_HTC_PACKET_QUEUE(&pProtocol->HCIEventBuffers);
+        A_MUTEX_INIT(&pProtocol->HCIRxLock);
+        A_MUTEX_INIT(&pProtocol->HCITxLock);
+     
+    } while (false);
+    
+    if (!status) {
+        LOCK_AR6K(pDev);
+        DEV_GMBOX_SET_PROTOCOL(pDev,
+                               HCIUartMessagePending,
+                               CreditsAvailableCallback,
+                               FailureCallback,
+                               StateDumpCallback,
+                               pProtocol);
+        UNLOCK_AR6K(pDev);
+    } else {
+        if (pProtocol != NULL) {
+            HCIUartCleanup(pProtocol);    
+        }    
+    }
+    
+    return status;    
+}
+
+/*** protocol module uninstall entry point ***/
+void GMboxProtocolUninstall(struct ar6k_device *pDev)
+{
+    struct gmbox_proto_hci_uart *pProtocol = (struct gmbox_proto_hci_uart *)DEV_GMBOX_GET_PROTOCOL(pDev);
+    
+    if (pProtocol != NULL) {
+        
+            /* notify anyone attached */    
+        if (pProtocol->HCIAttached) {
+            A_ASSERT(pProtocol->HCIConfig.TransportRemoved != NULL);
+            pProtocol->HCIConfig.TransportRemoved(pProtocol->HCIConfig.pContext);
+            pProtocol->HCIAttached = false;
+        }
+        
+        HCIUartCleanup(pProtocol);
+        DEV_GMBOX_SET_PROTOCOL(pDev,NULL,NULL,NULL,NULL,NULL);       
+    }
+    
+}
+
+static int NotifyTransportReady(struct gmbox_proto_hci_uart  *pProt)
+{
+    struct hci_transport_properties props;
+    int                 status = 0;
+    
+    do {
+        
+        A_MEMZERO(&props,sizeof(props));
+        
+            /* HCI UART only needs one extra byte at the head to indicate the packet TYPE */
+        props.HeadRoom = 1;
+        props.TailRoom = 0;
+        props.IOBlockPad = pProt->pDev->BlockSize;
+        if (pProt->HCIAttached) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("HCI: notifying attached client to transport... \n"));    
+            A_ASSERT(pProt->HCIConfig.TransportReady != NULL);
+            status = pProt->HCIConfig.TransportReady(pProt,
+                                                    &props,
+                                                    pProt->HCIConfig.pContext);
+        }
+        
+    } while (false);
+    
+    return status;
+}
+
+/***********  HCI UART protocol implementation ************************************************/
+
+HCI_TRANSPORT_HANDLE HCI_TransportAttach(void *HTCHandle, struct hci_transport_config_info *pInfo)
+{
+    struct gmbox_proto_hci_uart  *pProtocol = NULL; 
+    struct ar6k_device           *pDev;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("+HCI_TransportAttach \n"));
+    
+    pDev = HTCGetAR6KDevice(HTCHandle);
+    
+    LOCK_AR6K(pDev);
+    
+    do {
+        
+        pProtocol = (struct gmbox_proto_hci_uart *)DEV_GMBOX_GET_PROTOCOL(pDev);
+        
+        if (NULL == pProtocol) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("GMBOX protocol not installed! \n"));
+            break;
+        }
+        
+        if (pProtocol->HCIAttached) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("GMBOX protocol already attached! \n"));
+            break;    
+        }
+        
+        memcpy(&pProtocol->HCIConfig, pInfo, sizeof(struct hci_transport_config_info));
+        
+        A_ASSERT(pProtocol->HCIConfig.pHCIPktRecv != NULL);
+        A_ASSERT(pProtocol->HCIConfig.pHCISendComplete != NULL);
+        
+        pProtocol->HCIAttached = true;
+        
+    } while (false);
+    
+    UNLOCK_AR6K(pDev);
+    
+    if (pProtocol != NULL) {
+            /* TODO ... should we use a worker? */
+        NotifyTransportReady(pProtocol);
+    }
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("-HCI_TransportAttach (0x%lX) \n",(unsigned long)pProtocol));
+    return (HCI_TRANSPORT_HANDLE)pProtocol;
+}
+
+void HCI_TransportDetach(HCI_TRANSPORT_HANDLE HciTrans)
+{
+    struct gmbox_proto_hci_uart  *pProtocol = (struct gmbox_proto_hci_uart *)HciTrans; 
+    struct ar6k_device           *pDev = pProtocol->pDev;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("+HCI_TransportDetach \n"));
+    
+    LOCK_AR6K(pDev);
+    if (!pProtocol->HCIAttached) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("GMBOX protocol not attached! \n"));
+        UNLOCK_AR6K(pDev);
+        return;
+    }
+    pProtocol->HCIAttached = false;
+    UNLOCK_AR6K(pDev);
+    
+    HCI_TransportStop(HciTrans);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("-HCI_TransportAttach \n"));
+}
+
+int HCI_TransportAddReceivePkts(HCI_TRANSPORT_HANDLE HciTrans, struct htc_packet_queue *pQueue)
+{
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)HciTrans; 
+    int              status = 0;
+    bool                unblockRecv = false;
+    struct htc_packet            *pPacket;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HCI_TransportAddReceivePkt \n"));
+    
+    LOCK_HCI_RX(pProt);
+   
+    do {
+         
+        if (pProt->HCIStopped) {
+            status = A_ECANCELED;
+            break;    
+        }
+        
+        pPacket = HTC_GET_PKT_AT_HEAD(pQueue);
+        
+        if (NULL == pPacket) {
+            status = A_EINVAL;
+            break;    
+        }
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" HCI recv packet added, type :%d, len:%d num:%d \n",
+                        HCI_GET_PACKET_TYPE(pPacket), pPacket->BufferLength, HTC_PACKET_QUEUE_DEPTH(pQueue)));
+                        
+        if (HCI_GET_PACKET_TYPE(pPacket) == HCI_EVENT_TYPE) {
+            HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&pProt->HCIEventBuffers, pQueue);
+        } else if (HCI_GET_PACKET_TYPE(pPacket) == HCI_ACL_TYPE) {
+            HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&pProt->HCIACLRecvBuffers, pQueue);    
+        } else {
+            status = A_EINVAL;
+            break;    
+        }
+        
+        if (pProt->RecvStateFlags & HCI_RECV_WAIT_BUFFERS) {
+            if (pProt->WaitBufferType == HCI_GET_PACKET_TYPE(pPacket)) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" HCI recv was blocked on packet type :%d, unblocking.. \n",
+                        pProt->WaitBufferType));
+                pProt->RecvStateFlags &= ~HCI_RECV_WAIT_BUFFERS;
+                pProt->WaitBufferType = HCI_PACKET_INVALID;
+                unblockRecv = true;
+            }
+        }
+        
+    } while (false);
+    
+    UNLOCK_HCI_RX(pProt);
+    
+    if (status) {
+        while (!HTC_QUEUE_EMPTY(pQueue)) {
+            pPacket = HTC_PACKET_DEQUEUE(pQueue);      
+            pPacket->Status = A_ECANCELED;
+            DO_HCI_RECV_INDICATION(pProt,pPacket);
+        }   
+    }
+    
+    if (unblockRecv) {
+        DevGMboxIRQAction(pProt->pDev, GMBOX_RECV_IRQ_ENABLE, PROC_IO_ASYNC);
+    }
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HCI_TransportAddReceivePkt \n"));
+    
+    return 0;
+}
+
+int HCI_TransportSendPkt(HCI_TRANSPORT_HANDLE HciTrans, struct htc_packet *pPacket, bool Synchronous)
+{
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)HciTrans;  
+    
+    return HCITrySend(pProt,pPacket,Synchronous);
+}
+
+void HCI_TransportStop(HCI_TRANSPORT_HANDLE HciTrans)
+{
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)HciTrans; 
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("+HCI_TransportStop \n"));
+     
+    LOCK_AR6K(pProt->pDev);
+    if (pProt->HCIStopped) {
+        UNLOCK_AR6K(pProt->pDev);
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("-HCI_TransportStop \n"));
+        return;    
+    }
+    pProt->HCIStopped = true;
+    UNLOCK_AR6K(pProt->pDev);
+     
+        /* disable interrupts */
+    DevGMboxIRQAction(pProt->pDev, GMBOX_DISABLE_ALL, PROC_IO_SYNC);
+    FlushSendQueue(pProt);
+    FlushRecvBuffers(pProt);
+    
+        /* signal bridge side to power down BT */
+    DevGMboxSetTargetInterrupt(pProt->pDev, MBOX_SIG_HCI_BRIDGE_BT_OFF, BTOFF_TIMEOUT_MS);
+           
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("-HCI_TransportStop \n"));
+}
+
+int HCI_TransportStart(HCI_TRANSPORT_HANDLE HciTrans)
+{
+    int              status;
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)HciTrans;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("+HCI_TransportStart \n"));
+    
+        /* set stopped in case we have a problem in starting */
+    pProt->HCIStopped = true;
+    
+    do {
+        
+        status = InitTxCreditState(pProt);   
+        
+        if (status) {
+            break;    
+        }     
+        
+        status = DevGMboxIRQAction(pProt->pDev, GMBOX_ERRORS_IRQ_ENABLE, PROC_IO_SYNC);   
+        
+        if (status) {
+            break;   
+        } 
+            /* enable recv */   
+        status = DevGMboxIRQAction(pProt->pDev, GMBOX_RECV_IRQ_ENABLE, PROC_IO_SYNC);
+        
+        if (status) {
+            break;   
+        } 
+            /* signal bridge side to power up BT */
+        status = DevGMboxSetTargetInterrupt(pProt->pDev, MBOX_SIG_HCI_BRIDGE_BT_ON, BTON_TIMEOUT_MS);
+        
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HCI_TransportStart : Failed to trigger BT ON \n"));
+            break;   
+        } 
+        
+            /* we made it */
+        pProt->HCIStopped = false;
+        
+    } while (false);
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("-HCI_TransportStart \n"));
+    
+    return status;
+}
+
+int HCI_TransportEnableDisableAsyncRecv(HCI_TRANSPORT_HANDLE HciTrans, bool Enable)
+{
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)HciTrans;
+    return DevGMboxIRQAction(pProt->pDev, 
+                             Enable ? GMBOX_RECV_IRQ_ENABLE : GMBOX_RECV_IRQ_DISABLE, 
+                             PROC_IO_SYNC);
+                             
+}
+
+int HCI_TransportRecvHCIEventSync(HCI_TRANSPORT_HANDLE HciTrans,
+                                       struct htc_packet           *pPacket,
+                                       int                  MaxPollMS)
+{
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)HciTrans;
+    int              status = 0;
+    u8 lookAhead[8];
+    int                   bytes;
+    int                   totalRecvLength;
+    
+    MaxPollMS = MaxPollMS / 16;
+    
+    if (MaxPollMS < 2) {
+        MaxPollMS = 2;    
+    }
+    
+    while (MaxPollMS) {
+        
+        bytes = sizeof(lookAhead);
+        status = DevGMboxRecvLookAheadPeek(pProt->pDev,lookAhead,&bytes);
+        if (status) {
+            break;    
+        }        
+                
+        if (bytes < 3) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("HCI recv poll got bytes: %d, retry : %d \n",
+                        bytes, MaxPollMS));
+            A_MDELAY(16);
+            MaxPollMS--;        
+            continue;
+        }
+        
+        totalRecvLength = 0;
+        switch (lookAhead[0]) {       
+            case HCI_UART_EVENT_PKT:
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("HCI Event: %d param length: %d \n",
+                        lookAhead[1], lookAhead[2]));
+                totalRecvLength = lookAhead[2];
+                totalRecvLength += 3; /* add type + event code + length field */
+                break;
+            default:
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("**Invalid HCI packet type: %d \n",lookAhead[0]));
+                status = A_EPROTO;
+                break;
+        }
+        
+        if (status) {
+            break;    
+        }
+        
+        pPacket->Completion = NULL;
+        status = DevGMboxRead(pProt->pDev,pPacket,totalRecvLength); 
+        if (status) {
+            break;    
+        }
+        
+        pPacket->pBuffer++;
+        pPacket->ActualLength = totalRecvLength - 1;
+        pPacket->Status = 0;
+        break; 
+    }
+    
+    if (MaxPollMS == 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HCI recv poll timeout! \n"));
+        status = A_ERROR;    
+    }
+    
+    return status;
+}
+
+#define LSB_SCRATCH_IDX     4
+#define MSB_SCRATCH_IDX     5
+int HCI_TransportSetBaudRate(HCI_TRANSPORT_HANDLE HciTrans, u32 Baud)
+{
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)HciTrans;
+    struct hif_device *pHIFDevice = (struct hif_device *)(pProt->pDev->HIFDevice);
+    u32 scaledBaud, scratchAddr;
+    int status = 0;
+
+    /* Divide the desired baud rate by 100
+     * Store the LSB in the local scratch register 4 and the MSB in the local
+     * scratch register 5 for the target to read
+     */
+    scratchAddr = MBOX_BASE_ADDRESS | (LOCAL_SCRATCH_ADDRESS + 4 * LSB_SCRATCH_IDX);
+    scaledBaud = (Baud / 100) & LOCAL_SCRATCH_VALUE_MASK;
+    status = ar6000_WriteRegDiag(pHIFDevice, &scratchAddr, &scaledBaud);                     
+    scratchAddr = MBOX_BASE_ADDRESS | (LOCAL_SCRATCH_ADDRESS + 4 * MSB_SCRATCH_IDX);
+    scaledBaud = ((Baud / 100) >> (LOCAL_SCRATCH_VALUE_MSB+1)) & LOCAL_SCRATCH_VALUE_MASK;
+    status |= ar6000_WriteRegDiag(pHIFDevice, &scratchAddr, &scaledBaud);                     
+    if (0 != status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to set up baud rate in scratch register!"));            
+        return status;
+    }
+
+    /* Now interrupt the target to tell it about the baud rate */
+    status = DevGMboxSetTargetInterrupt(pProt->pDev, MBOX_SIG_HCI_BRIDGE_BAUD_SET, BAUD_TIMEOUT_MS);
+    if (0 != status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to tell target to change baud rate!"));            
+    }
+    
+    return status;
+}
+
+int HCI_TransportEnablePowerMgmt(HCI_TRANSPORT_HANDLE HciTrans, bool Enable)
+{
+    int status;
+    struct gmbox_proto_hci_uart  *pProt = (struct gmbox_proto_hci_uart *)HciTrans;
+                             
+    if (Enable) {
+        status = DevGMboxSetTargetInterrupt(pProt->pDev, MBOX_SIG_HCI_BRIDGE_PWR_SAV_ON, BTPWRSAV_TIMEOUT_MS);
+    } else {
+        status = DevGMboxSetTargetInterrupt(pProt->pDev, MBOX_SIG_HCI_BRIDGE_PWR_SAV_OFF, BTPWRSAV_TIMEOUT_MS);
+    }
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to enable/disable HCI power management!\n"));
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HCI power management enabled/disabled!\n"));
+    }
+
+    return status;
+}
+
+#endif  //ATH_AR6K_ENABLE_GMBOX
+
diff --git a/drivers/staging/ath6kl/htc2/htc.c b/drivers/staging/ath6kl/htc2/htc.c
new file mode 100644
index 00000000000..ae54e64b624
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/htc.c
@@ -0,0 +1,575 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc.c" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#include "htc_internal.h"
+
+#ifdef ATH_DEBUG_MODULE
+static struct ath_debug_mask_description g_HTCDebugDescription[] = {
+    { ATH_DEBUG_SEND , "Send"},
+    { ATH_DEBUG_RECV , "Recv"},
+    { ATH_DEBUG_SYNC , "Sync"},
+    { ATH_DEBUG_DUMP , "Dump Data (RX or TX)"},
+    { ATH_DEBUG_IRQ  , "Interrupt Processing"}
+};
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(htc,
+                                 "htc",
+                                 "Host Target Communications",
+                                 ATH_DEBUG_MASK_DEFAULTS,
+                                 ATH_DEBUG_DESCRIPTION_COUNT(g_HTCDebugDescription),
+                                 g_HTCDebugDescription);
+                                 
+#endif
+
+static void HTCReportFailure(void *Context);
+static void ResetEndpointStates(struct htc_target *target);
+
+void HTCFreeControlBuffer(struct htc_target *target, struct htc_packet *pPacket, struct htc_packet_queue *pList)
+{
+    LOCK_HTC(target);
+    HTC_PACKET_ENQUEUE(pList,pPacket);
+    UNLOCK_HTC(target);
+}
+
+struct htc_packet *HTCAllocControlBuffer(struct htc_target *target,  struct htc_packet_queue *pList)
+{
+    struct htc_packet *pPacket;
+
+    LOCK_HTC(target);
+    pPacket = HTC_PACKET_DEQUEUE(pList);
+    UNLOCK_HTC(target);
+
+    return pPacket;
+}
+
+/* cleanup the HTC instance */
+static void HTCCleanup(struct htc_target *target)
+{
+    s32 i;
+
+    DevCleanup(&target->Device);
+    
+    for (i = 0;i < NUM_CONTROL_BUFFERS;i++) {
+        if (target->HTCControlBuffers[i].Buffer) {
+            kfree(target->HTCControlBuffers[i].Buffer);
+        }
+    }
+    
+    if (A_IS_MUTEX_VALID(&target->HTCLock)) {
+        A_MUTEX_DELETE(&target->HTCLock);
+    }
+
+    if (A_IS_MUTEX_VALID(&target->HTCRxLock)) {
+        A_MUTEX_DELETE(&target->HTCRxLock);
+    }
+
+    if (A_IS_MUTEX_VALID(&target->HTCTxLock)) {
+        A_MUTEX_DELETE(&target->HTCTxLock);
+    }
+        /* free our instance */
+    kfree(target);
+}
+
+/* registered target arrival callback from the HIF layer */
+HTC_HANDLE HTCCreate(void *hif_handle, struct htc_init_info *pInfo)
+{
+    struct htc_target              *target = NULL;
+    int                 status = 0;
+    int                      i;
+    u32 ctrl_bufsz;
+    u32 blocksizes[HTC_MAILBOX_NUM_MAX];
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCCreate - Enter\n"));
+
+    A_REGISTER_MODULE_DEBUG_INFO(htc);
+    
+    do {
+
+            /* allocate target memory */
+        if ((target = (struct htc_target *)A_MALLOC(sizeof(struct htc_target))) == NULL) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to allocate memory\n"));
+            status = A_ERROR;
+            break;
+        }
+
+        A_MEMZERO(target, sizeof(struct htc_target));
+        A_MUTEX_INIT(&target->HTCLock);
+        A_MUTEX_INIT(&target->HTCRxLock);
+        A_MUTEX_INIT(&target->HTCTxLock);
+        INIT_HTC_PACKET_QUEUE(&target->ControlBufferTXFreeList);
+        INIT_HTC_PACKET_QUEUE(&target->ControlBufferRXFreeList);
+        
+            /* give device layer the hif device handle */
+        target->Device.HIFDevice = hif_handle;
+            /* give the device layer our context (for event processing)
+             * the device layer will register it's own context with HIF
+             * so we need to set this so we can fetch it in the target remove handler */
+        target->Device.HTCContext = target;
+            /* set device layer target failure callback */
+        target->Device.TargetFailureCallback = HTCReportFailure;
+            /* set device layer recv message pending callback */
+        target->Device.MessagePendingCallback = HTCRecvMessagePendingHandler;
+        target->EpWaitingForBuffers = ENDPOINT_MAX;
+
+        memcpy(&target->HTCInitInfo,pInfo,sizeof(struct htc_init_info));
+        
+        ResetEndpointStates(target);
+          
+            /* setup device layer */
+        status = DevSetup(&target->Device);
+
+        if (status) {
+            break;
+        }
+
+
+        /* get the block sizes */
+        status = HIFConfigureDevice(hif_handle, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
+                                    blocksizes, sizeof(blocksizes));
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to get block size info from HIF layer...\n"));
+            break;
+        }
+
+        /* Set the control buffer size based on the block size */
+        if (blocksizes[1] > HTC_MAX_CONTROL_MESSAGE_LENGTH) {
+            ctrl_bufsz = blocksizes[1] + HTC_HDR_LENGTH;
+        } else {
+            ctrl_bufsz = HTC_MAX_CONTROL_MESSAGE_LENGTH + HTC_HDR_LENGTH;
+        }
+        for (i = 0;i < NUM_CONTROL_BUFFERS;i++) {
+            target->HTCControlBuffers[i].Buffer = A_MALLOC(ctrl_bufsz);
+            if (target->HTCControlBuffers[i].Buffer == NULL) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to allocate memory\n"));
+                status = A_ERROR;
+                break;
+            }
+        }
+
+        if (status) {
+            break;
+        }
+
+            /* carve up buffers/packets for control messages */
+        for (i = 0; i < NUM_CONTROL_RX_BUFFERS; i++) {
+            struct htc_packet *pControlPacket;
+            pControlPacket = &target->HTCControlBuffers[i].HtcPacket;
+            SET_HTC_PACKET_INFO_RX_REFILL(pControlPacket,
+                                          target,
+                                          target->HTCControlBuffers[i].Buffer,
+                                          ctrl_bufsz,
+                                          ENDPOINT_0);
+            HTC_FREE_CONTROL_RX(target,pControlPacket);
+        }
+
+        for (;i < NUM_CONTROL_BUFFERS;i++) {
+             struct htc_packet *pControlPacket;
+             pControlPacket = &target->HTCControlBuffers[i].HtcPacket;
+             INIT_HTC_PACKET_INFO(pControlPacket,
+                                  target->HTCControlBuffers[i].Buffer,
+                                  ctrl_bufsz);
+             HTC_FREE_CONTROL_TX(target,pControlPacket);
+        }
+
+    } while (false);
+
+    if (status) {
+        if (target != NULL) {
+            HTCCleanup(target);
+            target = NULL;
+        }
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCCreate - Exit\n"));
+
+    return target;
+}
+
+void  HTCDestroy(HTC_HANDLE HTCHandle)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCDestroy ..  Destroying :0x%lX \n",(unsigned long)target));
+    HTCCleanup(target);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCDestroy \n"));
+}
+
+/* get the low level HIF device for the caller , the caller may wish to do low level
+ * HIF requests */
+void *HTCGetHifDevice(HTC_HANDLE HTCHandle)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    return target->Device.HIFDevice;
+}
+
+/* wait for the target to arrive (sends HTC Ready message)
+ * this operation is fully synchronous and the message is polled for */
+int HTCWaitTarget(HTC_HANDLE HTCHandle)
+{
+    struct htc_target              *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    int                 status;
+    struct htc_packet              *pPacket = NULL;
+    HTC_READY_EX_MSG        *pRdyMsg;
+
+    struct htc_service_connect_req  connect;
+    struct htc_service_connect_resp resp;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Enter (target:0x%lX) \n", (unsigned long)target));
+
+    do {
+
+#ifdef MBOXHW_UNIT_TEST
+
+        status = DoMboxHWTest(&target->Device);
+
+        if (status) {
+            break;
+        }
+
+#endif
+
+            /* we should be getting 1 control message that the target is ready */
+        status = HTCWaitforControlMessage(target, &pPacket);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" Target Not Available!!\n"));
+            break;
+        }
+
+            /* we controlled the buffer creation so it has to be properly aligned */
+        pRdyMsg = (HTC_READY_EX_MSG *)pPacket->pBuffer;
+
+        if ((pRdyMsg->Version2_0_Info.MessageID != HTC_MSG_READY_ID) ||
+            (pPacket->ActualLength < sizeof(HTC_READY_MSG))) {
+                /* this message is not valid */
+            AR_DEBUG_ASSERT(false);
+            status = A_EPROTO;
+            break;
+        }
+
+        
+        if (pRdyMsg->Version2_0_Info.CreditCount == 0 || pRdyMsg->Version2_0_Info.CreditSize == 0) {
+              /* this message is not valid */
+            AR_DEBUG_ASSERT(false);
+            status = A_EPROTO;
+            break;
+        }
+
+        target->TargetCredits = pRdyMsg->Version2_0_Info.CreditCount;
+        target->TargetCreditSize = pRdyMsg->Version2_0_Info.CreditSize;
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_WARN, (" Target Ready: credits: %d credit size: %d\n",
+                target->TargetCredits, target->TargetCreditSize));
+        
+            /* check if this is an extended ready message */        
+        if (pPacket->ActualLength >= sizeof(HTC_READY_EX_MSG)) {
+                /* this is an extended message */    
+            target->HTCTargetVersion = pRdyMsg->HTCVersion;   
+            target->MaxMsgPerBundle = pRdyMsg->MaxMsgsPerHTCBundle;     
+        } else {
+                /* legacy */
+            target->HTCTargetVersion = HTC_VERSION_2P0;
+            target->MaxMsgPerBundle = 0;    
+        }
+        
+#ifdef HTC_FORCE_LEGACY_2P0   
+            /* for testing and comparison...*/     
+        target->HTCTargetVersion = HTC_VERSION_2P0;
+        target->MaxMsgPerBundle = 0;
+#endif
+           
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, 
+                    ("Using HTC Protocol Version : %s (%d)\n ", 
+                    (target->HTCTargetVersion == HTC_VERSION_2P0) ? "2.0" : ">= 2.1",
+                    target->HTCTargetVersion));
+                    
+        if (target->MaxMsgPerBundle > 0) {
+                /* limit what HTC can handle */
+            target->MaxMsgPerBundle = min(HTC_HOST_MAX_MSG_PER_BUNDLE, target->MaxMsgPerBundle);          
+                /* target supports message bundling, setup device layer */
+            if (DevSetupMsgBundling(&target->Device,target->MaxMsgPerBundle)) {
+                    /* device layer can't handle bundling */
+                target->MaxMsgPerBundle = 0;        
+            } else {
+                    /* limit bundle what the device layer can handle */
+                target->MaxMsgPerBundle = min(DEV_GET_MAX_MSG_PER_BUNDLE(&target->Device),
+                                              target->MaxMsgPerBundle);     
+            }
+        }
+        
+        if (target->MaxMsgPerBundle > 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_TRC, 
+                    (" HTC bundling allowed. Max Msg Per HTC Bundle: %d\n", target->MaxMsgPerBundle));    
+           
+            if (DEV_GET_MAX_BUNDLE_SEND_LENGTH(&target->Device) != 0) {           
+                target->SendBundlingEnabled = true;
+            }            
+            if (DEV_GET_MAX_BUNDLE_RECV_LENGTH(&target->Device) != 0) {    
+                target->RecvBundlingEnabled = true;
+            }
+                            
+            if (!DEV_IS_LEN_BLOCK_ALIGNED(&target->Device,target->TargetCreditSize)) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("*** Credit size: %d is not block aligned! Disabling send bundling \n",
+                        target->TargetCreditSize));    
+                    /* disallow send bundling since the credit size is not aligned to a block size
+                     * the I/O block padding will spill into the next credit buffer which is fatal */
+                target->SendBundlingEnabled = false;
+            }
+        }
+           
+            /* setup our pseudo HTC control endpoint connection */
+        A_MEMZERO(&connect,sizeof(connect));
+        A_MEMZERO(&resp,sizeof(resp));
+        connect.EpCallbacks.pContext = target;
+        connect.EpCallbacks.EpTxComplete = HTCControlTxComplete;
+        connect.EpCallbacks.EpRecv = HTCControlRecv;
+        connect.EpCallbacks.EpRecvRefill = NULL;  /* not needed */
+        connect.EpCallbacks.EpSendFull = NULL;    /* not nedded */
+        connect.MaxSendQueueDepth = NUM_CONTROL_BUFFERS;
+        connect.ServiceID = HTC_CTRL_RSVD_SVC;
+
+            /* connect fake service */
+        status = HTCConnectService((HTC_HANDLE)target,
+                                   &connect,
+                                   &resp);
+
+        if (!status) {
+            break;
+        }
+
+    } while (false);
+
+    if (pPacket != NULL) {
+        HTC_FREE_CONTROL_RX(target,pPacket);
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Exit\n"));
+
+    return status;
+}
+
+
+
+/* Start HTC, enable interrupts and let the target know host has finished setup */
+int HTCStart(HTC_HANDLE HTCHandle)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    struct htc_packet *pPacket;
+    int   status;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCStart Enter\n"));
+
+        /* make sure interrupts are disabled at the chip level,
+         * this function can be called again from a reboot of the target without shutting down HTC */
+    DevDisableInterrupts(&target->Device);
+        /* make sure state is cleared again */
+    target->OpStateFlags = 0;
+    target->RecvStateFlags = 0;
+      
+        /* now that we are starting, push control receive buffers into the
+         * HTC control endpoint */
+
+    while (1) {
+        pPacket = HTC_ALLOC_CONTROL_RX(target);
+        if (NULL == pPacket) {
+            break;
+        }
+        HTCAddReceivePkt((HTC_HANDLE)target,pPacket);
+    }
+
+    do {
+
+        AR_DEBUG_ASSERT(target->InitCredits != NULL);
+        AR_DEBUG_ASSERT(target->EpCreditDistributionListHead != NULL);
+        AR_DEBUG_ASSERT(target->EpCreditDistributionListHead->pNext != NULL);
+
+            /* call init credits callback to do the distribution ,
+             * NOTE: the first entry in the distribution list is ENDPOINT_0, so
+             * we pass the start of the list after this one. */
+        target->InitCredits(target->pCredDistContext,
+                            target->EpCreditDistributionListHead->pNext,
+                            target->TargetCredits);
+
+#ifdef ATH_DEBUG_MODULE
+
+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_TRC)) {
+            DumpCreditDistStates(target);
+        }
+#endif
+
+            /* the caller is done connecting to services, so we can indicate to the
+            * target that the setup phase is complete */
+        status = HTCSendSetupComplete(target);
+
+        if (status) {
+            break;
+        }
+
+            /* unmask interrupts */
+        status = DevUnmaskInterrupts(&target->Device);
+
+        if (status) {
+            HTCStop(target);
+        }
+
+    } while (false);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCStart Exit\n"));
+    return status;
+}
+
+static void ResetEndpointStates(struct htc_target *target)
+{
+    struct htc_endpoint        *pEndpoint;
+    int                  i;
+
+    for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
+        pEndpoint = &target->EndPoint[i];
+        
+        A_MEMZERO(&pEndpoint->CreditDist, sizeof(pEndpoint->CreditDist));
+        pEndpoint->ServiceID = 0;
+        pEndpoint->MaxMsgLength = 0;
+        pEndpoint->MaxTxQueueDepth = 0;
+        A_MEMZERO(&pEndpoint->EndPointStats,sizeof(pEndpoint->EndPointStats));
+        INIT_HTC_PACKET_QUEUE(&pEndpoint->RxBuffers);
+        INIT_HTC_PACKET_QUEUE(&pEndpoint->TxQueue);
+        INIT_HTC_PACKET_QUEUE(&pEndpoint->RecvIndicationQueue);
+        pEndpoint->target = target;
+    }
+        /* reset distribution list */
+    target->EpCreditDistributionListHead = NULL;
+}
+
+/* stop HTC communications, i.e. stop interrupt reception, and flush all queued buffers */
+void HTCStop(HTC_HANDLE HTCHandle)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCStop \n"));
+
+    LOCK_HTC(target);
+        /* mark that we are shutting down .. */
+    target->OpStateFlags |= HTC_OP_STATE_STOPPING;
+    UNLOCK_HTC(target);
+    
+        /* Masking interrupts is a synchronous operation, when this function returns
+         * all pending HIF I/O has completed, we can safely flush the queues */
+    DevMaskInterrupts(&target->Device);
+
+#ifdef THREAD_X
+        //
+        //      Is this delay required
+        //
+    A_MDELAY(200); // wait for IRQ process done
+#endif
+        /* flush all send packets */
+    HTCFlushSendPkts(target);
+        /* flush all recv buffers */
+    HTCFlushRecvBuffers(target);
+
+    DevCleanupMsgBundling(&target->Device);
+
+    ResetEndpointStates(target);
+   
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCStop \n"));
+}
+
+#ifdef ATH_DEBUG_MODULE
+void HTCDumpCreditStates(HTC_HANDLE HTCHandle)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+
+    LOCK_HTC_TX(target);
+
+    DumpCreditDistStates(target);
+
+    UNLOCK_HTC_TX(target);
+    
+    DumpAR6KDevState(&target->Device);
+}
+#endif
+/* report a target failure from the device, this is a callback from the device layer
+ * which uses a mechanism to report errors from the target (i.e. special interrupts) */
+static void HTCReportFailure(void *Context)
+{
+    struct htc_target *target = (struct htc_target *)Context;
+
+    target->TargetFailure = true;
+
+    if (target->HTCInitInfo.TargetFailure != NULL) {
+            /* let upper layer know, it needs to call HTCStop() */
+        target->HTCInitInfo.TargetFailure(target->HTCInitInfo.pContext, A_ERROR);
+    }
+}
+
+bool HTCGetEndpointStatistics(HTC_HANDLE               HTCHandle,
+                                HTC_ENDPOINT_ID          Endpoint,
+                                HTC_ENDPOINT_STAT_ACTION Action,
+                                struct htc_endpoint_stats       *pStats)
+{
+
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    bool     clearStats = false;
+    bool     sample = false;
+
+    switch (Action) {
+        case HTC_EP_STAT_SAMPLE :
+            sample = true;
+            break;
+        case HTC_EP_STAT_SAMPLE_AND_CLEAR :
+            sample = true;
+            clearStats = true;
+            break;
+        case HTC_EP_STAT_CLEAR :
+            clearStats = true;
+            break;
+        default:
+            break;
+    }
+
+    A_ASSERT(Endpoint < ENDPOINT_MAX);
+
+        /* lock out TX and RX while we sample and/or clear */
+    LOCK_HTC_TX(target);
+    LOCK_HTC_RX(target);
+
+    if (sample) {
+        A_ASSERT(pStats != NULL);
+            /* return the stats to the caller */
+        memcpy(pStats, &target->EndPoint[Endpoint].EndPointStats, sizeof(struct htc_endpoint_stats));
+    }
+
+    if (clearStats) {
+            /* reset stats */
+        A_MEMZERO(&target->EndPoint[Endpoint].EndPointStats, sizeof(struct htc_endpoint_stats));
+    }
+
+    UNLOCK_HTC_RX(target);
+    UNLOCK_HTC_TX(target);
+
+    return true;
+}
+
+struct ar6k_device  *HTCGetAR6KDevice(void *HTCHandle)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    return &target->Device;
+}
+
diff --git a/drivers/staging/ath6kl/htc2/htc_debug.h b/drivers/staging/ath6kl/htc2/htc_debug.h
new file mode 100644
index 00000000000..8455703e221
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/htc_debug.h
@@ -0,0 +1,38 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_debug.h" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef HTC_DEBUG_H_
+#define HTC_DEBUG_H_
+
+#define ATH_MODULE_NAME htc
+#include "a_debug.h"
+
+/* ------- Debug related stuff ------- */
+
+#define  ATH_DEBUG_SEND ATH_DEBUG_MAKE_MODULE_MASK(0)
+#define  ATH_DEBUG_RECV ATH_DEBUG_MAKE_MODULE_MASK(1)
+#define  ATH_DEBUG_SYNC ATH_DEBUG_MAKE_MODULE_MASK(2)
+#define  ATH_DEBUG_DUMP ATH_DEBUG_MAKE_MODULE_MASK(3)
+#define  ATH_DEBUG_IRQ  ATH_DEBUG_MAKE_MODULE_MASK(4)
+
+
+#endif /*HTC_DEBUG_H_*/
diff --git a/drivers/staging/ath6kl/htc2/htc_internal.h b/drivers/staging/ath6kl/htc2/htc_internal.h
new file mode 100644
index 00000000000..cac97351769
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/htc_internal.h
@@ -0,0 +1,211 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_internal.h" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HTC_INTERNAL_H_
+#define _HTC_INTERNAL_H_
+
+/* for debugging, uncomment this to capture the last frame header, on frame header
+ * processing errors, the last frame header is dump for comparison */
+//#define HTC_CAPTURE_LAST_FRAME
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/* Header files */
+
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_osapi.h"
+#include "htc_debug.h"
+#include "htc.h"
+#include "htc_api.h"
+#include "bmi_msg.h"
+#include "hif.h"
+#include "AR6000/ar6k.h"
+
+/* HTC operational parameters */
+#define HTC_TARGET_RESPONSE_TIMEOUT        2000 /* in ms */
+#define HTC_TARGET_DEBUG_INTR_MASK         0x01
+#define HTC_TARGET_CREDIT_INTR_MASK        0xF0
+
+#define HTC_HOST_MAX_MSG_PER_BUNDLE        8
+#define HTC_MIN_HTC_MSGS_TO_BUNDLE         2
+
+/* packet flags */
+
+#define HTC_RX_PKT_IGNORE_LOOKAHEAD      (1 << 0)
+#define HTC_RX_PKT_REFRESH_HDR           (1 << 1)
+#define HTC_RX_PKT_PART_OF_BUNDLE        (1 << 2)
+#define HTC_RX_PKT_NO_RECYCLE            (1 << 3)
+
+/* scatter request flags */
+
+#define HTC_SCATTER_REQ_FLAGS_PARTIAL_BUNDLE  (1 << 0)
+
+struct htc_endpoint {
+    HTC_ENDPOINT_ID             Id;
+    HTC_SERVICE_ID              ServiceID;      /* service ID this endpoint is bound to
+                                                   non-zero value means this endpoint is in use */
+    struct htc_packet_queue            TxQueue;        /* HTC frame buffer TX queue */
+    struct htc_packet_queue            RxBuffers;      /* HTC frame buffer RX list */
+    struct htc_endpoint_credit_dist    CreditDist;     /* credit distribution structure (exposed to driver layer) */
+    struct htc_ep_callbacks            EpCallBacks;    /* callbacks associated with this endpoint */
+    int                         MaxTxQueueDepth;   /* max depth of the TX queue before we need to
+                                                      call driver's full handler */
+    int                         MaxMsgLength;        /* max length of endpoint message */
+    int                         TxProcessCount;  /* reference count to continue tx processing */
+    struct htc_packet_queue            RecvIndicationQueue;    /* recv packets ready to be indicated */
+    int                         RxProcessCount;         /* reference count to allow single processing context */
+    struct htc_target           *target;                /* back pointer to target */
+    u8 SeqNo;                  /* TX seq no (helpful) for debugging */
+    u32 LocalConnectionFlags;   /* local connection flags */
+    struct htc_endpoint_stats          EndPointStats;          /* endpoint statistics */
+};
+
+#define INC_HTC_EP_STAT(p,stat,count) (p)->EndPointStats.stat += (count);
+#define HTC_SERVICE_TX_PACKET_TAG  HTC_TX_PACKET_TAG_INTERNAL
+
+#define NUM_CONTROL_BUFFERS     8
+#define NUM_CONTROL_TX_BUFFERS  2
+#define NUM_CONTROL_RX_BUFFERS  (NUM_CONTROL_BUFFERS - NUM_CONTROL_TX_BUFFERS)
+
+struct htc_control_buffer {
+    struct htc_packet    HtcPacket;
+    u8 *Buffer;
+};
+
+#define HTC_RECV_WAIT_BUFFERS        (1 << 0)
+#define HTC_OP_STATE_STOPPING        (1 << 0)
+
+/* our HTC target state */
+struct htc_target {
+    struct htc_endpoint                EndPoint[ENDPOINT_MAX];
+    struct htc_control_buffer          HTCControlBuffers[NUM_CONTROL_BUFFERS];
+    struct htc_endpoint_credit_dist   *EpCreditDistributionListHead;
+    struct htc_packet_queue            ControlBufferTXFreeList;
+    struct htc_packet_queue            ControlBufferRXFreeList;
+    HTC_CREDIT_DIST_CALLBACK    DistributeCredits;
+    HTC_CREDIT_INIT_CALLBACK    InitCredits;
+    void                       *pCredDistContext;
+    int                         TargetCredits;
+    unsigned int                TargetCreditSize;
+    A_MUTEX_T                   HTCLock;
+    A_MUTEX_T                   HTCRxLock;
+    A_MUTEX_T                   HTCTxLock;
+    struct ar6k_device                 Device;         /* AR6K - specific state */
+    u32 OpStateFlags;
+    u32 RecvStateFlags;
+    HTC_ENDPOINT_ID             EpWaitingForBuffers;
+    bool                      TargetFailure;
+#ifdef HTC_CAPTURE_LAST_FRAME
+    struct htc_frame_hdr               LastFrameHdr;  /* useful for debugging */
+    u8 LastTrailer[256];
+    u8 LastTrailerLength;
+#endif
+    struct htc_init_info               HTCInitInfo;
+    u8 HTCTargetVersion;
+    int                         MaxMsgPerBundle;       /* max messages per bundle for HTC */
+    bool                      SendBundlingEnabled;   /* run time enable for send bundling (dynamic) */
+    int                         RecvBundlingEnabled;   /* run time enable for recv bundling (dynamic) */
+};
+
+#define HTC_STOPPING(t) ((t)->OpStateFlags & HTC_OP_STATE_STOPPING)
+#define LOCK_HTC(t)      A_MUTEX_LOCK(&(t)->HTCLock);
+#define UNLOCK_HTC(t)    A_MUTEX_UNLOCK(&(t)->HTCLock);
+#define LOCK_HTC_RX(t)   A_MUTEX_LOCK(&(t)->HTCRxLock);
+#define UNLOCK_HTC_RX(t) A_MUTEX_UNLOCK(&(t)->HTCRxLock);
+#define LOCK_HTC_TX(t)   A_MUTEX_LOCK(&(t)->HTCTxLock);
+#define UNLOCK_HTC_TX(t) A_MUTEX_UNLOCK(&(t)->HTCTxLock);
+
+#define GET_HTC_TARGET_FROM_HANDLE(hnd) ((struct htc_target *)(hnd))
+#define HTC_RECYCLE_RX_PKT(target,p,e)                           \
+{                                                                \
+    if ((p)->PktInfo.AsRx.HTCRxFlags & HTC_RX_PKT_NO_RECYCLE) {  \
+         HTC_PACKET_RESET_RX(pPacket);                           \
+         pPacket->Status = A_ECANCELED;                          \
+         (e)->EpCallBacks.EpRecv((e)->EpCallBacks.pContext,      \
+                                 (p));                           \
+    } else {                                                     \
+        HTC_PACKET_RESET_RX(pPacket);                            \
+        HTCAddReceivePkt((HTC_HANDLE)(target),(p));              \
+    }                                                            \
+}
+
+/* internal HTC functions */
+void        HTCControlTxComplete(void *Context, struct htc_packet *pPacket);
+void        HTCControlRecv(void *Context, struct htc_packet *pPacket);
+int    HTCWaitforControlMessage(struct htc_target *target, struct htc_packet **ppControlPacket);
+struct htc_packet *HTCAllocControlBuffer(struct htc_target *target, struct htc_packet_queue *pList);
+void        HTCFreeControlBuffer(struct htc_target *target, struct htc_packet *pPacket, struct htc_packet_queue *pList);
+int    HTCIssueSend(struct htc_target *target, struct htc_packet *pPacket);
+void        HTCRecvCompleteHandler(void *Context, struct htc_packet *pPacket);
+int    HTCRecvMessagePendingHandler(void *Context, u32 MsgLookAheads[], int NumLookAheads, bool *pAsyncProc, int *pNumPktsFetched);
+void        HTCProcessCreditRpt(struct htc_target *target, HTC_CREDIT_REPORT *pRpt, int NumEntries, HTC_ENDPOINT_ID FromEndpoint);
+int    HTCSendSetupComplete(struct htc_target *target);
+void        HTCFlushRecvBuffers(struct htc_target *target);
+void        HTCFlushSendPkts(struct htc_target *target);
+
+#ifdef ATH_DEBUG_MODULE
+void        DumpCreditDist(struct htc_endpoint_credit_dist *pEPDist);
+void        DumpCreditDistStates(struct htc_target *target);
+void            DebugDumpBytes(u8 *buffer, u16 length, char *pDescription);
+#endif
+
+static INLINE struct htc_packet *HTC_ALLOC_CONTROL_TX(struct htc_target *target) {
+    struct htc_packet *pPacket = HTCAllocControlBuffer(target,&target->ControlBufferTXFreeList);
+    if (pPacket != NULL) {
+            /* set payload pointer area with some headroom */
+        pPacket->pBuffer = pPacket->pBufferStart + HTC_HDR_LENGTH;
+    }
+    return pPacket;
+}
+
+#define HTC_FREE_CONTROL_TX(t,p) HTCFreeControlBuffer((t),(p),&(t)->ControlBufferTXFreeList)
+#define HTC_ALLOC_CONTROL_RX(t)  HTCAllocControlBuffer((t),&(t)->ControlBufferRXFreeList)
+#define HTC_FREE_CONTROL_RX(t,p) \
+{                                                                \
+    HTC_PACKET_RESET_RX(p);                                      \
+    HTCFreeControlBuffer((t),(p),&(t)->ControlBufferRXFreeList); \
+}
+
+#define HTC_PREPARE_SEND_PKT(pP,sendflags,ctrl0,ctrl1)       \
+{                                                   \
+    u8 *pHdrBuf;                               \
+    (pP)->pBuffer -= HTC_HDR_LENGTH;                \
+    pHdrBuf = (pP)->pBuffer;                        \
+    A_SET_UINT16_FIELD(pHdrBuf,struct htc_frame_hdr,PayloadLen,(u16)(pP)->ActualLength);  \
+    A_SET_UINT8_FIELD(pHdrBuf,struct htc_frame_hdr,Flags,(sendflags));                         \
+    A_SET_UINT8_FIELD(pHdrBuf,struct htc_frame_hdr,EndpointID, (u8)(pP)->Endpoint); \
+    A_SET_UINT8_FIELD(pHdrBuf,struct htc_frame_hdr,ControlBytes[0], (u8)(ctrl0));   \
+    A_SET_UINT8_FIELD(pHdrBuf,struct htc_frame_hdr,ControlBytes[1], (u8)(ctrl1));   \
+}
+
+#define HTC_UNPREPARE_SEND_PKT(pP)     \
+    (pP)->pBuffer += HTC_HDR_LENGTH;   \
+    
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HTC_INTERNAL_H_ */
diff --git a/drivers/staging/ath6kl/htc2/htc_recv.c b/drivers/staging/ath6kl/htc2/htc_recv.c
new file mode 100644
index 00000000000..974cc8cd693
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/htc_recv.c
@@ -0,0 +1,1572 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_recv.c" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#include "htc_internal.h"
+
+#define HTCIssueRecv(t, p) \
+    DevRecvPacket(&(t)->Device,  \
+                  (p),          \
+                  (p)->ActualLength)
+
+#define DO_RCV_COMPLETION(e,q)  DoRecvCompletion(e,q)
+
+#define DUMP_RECV_PKT_INFO(pP) \
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" HTC RECV packet 0x%lX (%d bytes) (hdr:0x%X) on ep : %d \n", \
+                        (unsigned long)(pP),                   \
+                        (pP)->ActualLength,                    \
+                        (pP)->PktInfo.AsRx.ExpectedHdr,        \
+                        (pP)->Endpoint))                         
+                        
+#define HTC_RX_STAT_PROFILE(t,ep,numLookAheads)        \
+{                                                      \
+    INC_HTC_EP_STAT((ep), RxReceived, 1);              \
+    if ((numLookAheads) == 1) {                        \
+        INC_HTC_EP_STAT((ep), RxLookAheads, 1);        \
+    } else if ((numLookAheads) > 1) {                  \
+        INC_HTC_EP_STAT((ep), RxBundleLookAheads, 1);  \
+    }                                                  \
+}
+
+static void DoRecvCompletion(struct htc_endpoint     *pEndpoint,
+                             struct htc_packet_queue *pQueueToIndicate)
+{           
+    
+    do {
+        
+        if (HTC_QUEUE_EMPTY(pQueueToIndicate)) {
+                /* nothing to indicate */
+            break;    
+        }
+ 
+        if (pEndpoint->EpCallBacks.EpRecvPktMultiple != NULL) {    
+            AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" HTC calling ep %d, recv multiple callback (%d pkts) \n",
+                     pEndpoint->Id, HTC_PACKET_QUEUE_DEPTH(pQueueToIndicate)));
+                /* a recv multiple handler is being used, pass the queue to the handler */                             
+            pEndpoint->EpCallBacks.EpRecvPktMultiple(pEndpoint->EpCallBacks.pContext,
+                                                     pQueueToIndicate);
+            INIT_HTC_PACKET_QUEUE(pQueueToIndicate);        
+        } else {
+            struct htc_packet *pPacket;  
+            /* using legacy EpRecv */         
+            do {
+                pPacket = HTC_PACKET_DEQUEUE(pQueueToIndicate);
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" HTC calling ep %d recv callback on packet 0x%lX \n", \
+                        pEndpoint->Id, (unsigned long)(pPacket)));
+                pEndpoint->EpCallBacks.EpRecv(pEndpoint->EpCallBacks.pContext, pPacket);                                              
+            } while (!HTC_QUEUE_EMPTY(pQueueToIndicate));                                              
+        }
+        
+    } while (false);
+
+}
+
+static INLINE int HTCProcessTrailer(struct htc_target *target,
+                                         u8 *pBuffer,
+                                         int         Length,
+                                         u32 *pNextLookAheads,
+                                         int        *pNumLookAheads,
+                                         HTC_ENDPOINT_ID FromEndpoint)
+{
+    HTC_RECORD_HDR          *pRecord;
+    u8 *pRecordBuf;
+    HTC_LOOKAHEAD_REPORT    *pLookAhead;
+    u8 *pOrigBuffer;
+    int                     origLength;
+    int                status;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCProcessTrailer (length:%d) \n", Length));
+
+    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
+        AR_DEBUG_PRINTBUF(pBuffer,Length,"Recv Trailer");
+    }
+
+    pOrigBuffer = pBuffer;
+    origLength = Length;
+    status = 0;
+    
+    while (Length > 0) {
+
+        if (Length < sizeof(HTC_RECORD_HDR)) {
+            status = A_EPROTO;
+            break;
+        }
+            /* these are byte aligned structs */
+        pRecord = (HTC_RECORD_HDR *)pBuffer;
+        Length -= sizeof(HTC_RECORD_HDR);
+        pBuffer += sizeof(HTC_RECORD_HDR);
+
+        if (pRecord->Length > Length) {
+                /* no room left in buffer for record */
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                (" invalid record length: %d (id:%d) buffer has: %d bytes left \n",
+                        pRecord->Length, pRecord->RecordID, Length));
+            status = A_EPROTO;
+            break;
+        }
+            /* start of record follows the header */
+        pRecordBuf = pBuffer;
+
+        switch (pRecord->RecordID) {
+            case HTC_RECORD_CREDITS:
+                AR_DEBUG_ASSERT(pRecord->Length >= sizeof(HTC_CREDIT_REPORT));
+                HTCProcessCreditRpt(target,
+                                    (HTC_CREDIT_REPORT *)pRecordBuf,
+                                    pRecord->Length / (sizeof(HTC_CREDIT_REPORT)),
+                                    FromEndpoint);
+                break;
+            case HTC_RECORD_LOOKAHEAD:
+                AR_DEBUG_ASSERT(pRecord->Length >= sizeof(HTC_LOOKAHEAD_REPORT));
+                pLookAhead = (HTC_LOOKAHEAD_REPORT *)pRecordBuf;
+                if ((pLookAhead->PreValid == ((~pLookAhead->PostValid) & 0xFF)) &&
+                    (pNextLookAheads != NULL)) {
+
+                    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                                (" LookAhead Report Found (pre valid:0x%X, post valid:0x%X) \n",
+                                pLookAhead->PreValid,
+                                pLookAhead->PostValid));
+
+                        /* look ahead bytes are valid, copy them over */
+                    ((u8 *)(&pNextLookAheads[0]))[0] = pLookAhead->LookAhead[0];
+                    ((u8 *)(&pNextLookAheads[0]))[1] = pLookAhead->LookAhead[1];
+                    ((u8 *)(&pNextLookAheads[0]))[2] = pLookAhead->LookAhead[2];
+                    ((u8 *)(&pNextLookAheads[0]))[3] = pLookAhead->LookAhead[3];
+
+#ifdef ATH_DEBUG_MODULE
+                    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
+                        DebugDumpBytes((u8 *)pNextLookAheads,4,"Next Look Ahead");
+                    }
+#endif
+                        /* just one normal lookahead */
+                    *pNumLookAheads = 1;
+                }
+                break;
+            case HTC_RECORD_LOOKAHEAD_BUNDLE:
+                AR_DEBUG_ASSERT(pRecord->Length >= sizeof(HTC_BUNDLED_LOOKAHEAD_REPORT));
+                if (pRecord->Length >= sizeof(HTC_BUNDLED_LOOKAHEAD_REPORT) &&
+                    (pNextLookAheads != NULL)) {                   
+                    HTC_BUNDLED_LOOKAHEAD_REPORT    *pBundledLookAheadRpt;
+                    int                             i;
+                    
+                    pBundledLookAheadRpt = (HTC_BUNDLED_LOOKAHEAD_REPORT *)pRecordBuf;
+                    
+#ifdef ATH_DEBUG_MODULE
+                    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
+                        DebugDumpBytes(pRecordBuf,pRecord->Length,"Bundle LookAhead");
+                    }
+#endif
+                    
+                    if ((pRecord->Length / (sizeof(HTC_BUNDLED_LOOKAHEAD_REPORT))) >
+                            HTC_HOST_MAX_MSG_PER_BUNDLE) {
+                            /* this should never happen, the target restricts the number
+                             * of messages per bundle configured by the host */        
+                        A_ASSERT(false);
+                        status = A_EPROTO;
+                        break;        
+                    }
+                                         
+                    for (i = 0; i < (int)(pRecord->Length / (sizeof(HTC_BUNDLED_LOOKAHEAD_REPORT))); i++) {
+                        ((u8 *)(&pNextLookAheads[i]))[0] = pBundledLookAheadRpt->LookAhead[0];
+                        ((u8 *)(&pNextLookAheads[i]))[1] = pBundledLookAheadRpt->LookAhead[1];
+                        ((u8 *)(&pNextLookAheads[i]))[2] = pBundledLookAheadRpt->LookAhead[2];
+                        ((u8 *)(&pNextLookAheads[i]))[3] = pBundledLookAheadRpt->LookAhead[3];
+                        pBundledLookAheadRpt++;
+                    }
+                    
+                    *pNumLookAheads = i;
+                }               
+                break;
+            default:
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" unhandled record: id:%d length:%d \n",
+                        pRecord->RecordID, pRecord->Length));
+                break;
+        }
+
+        if (status) {
+            break;
+        }
+
+            /* advance buffer past this record for next time around */
+        pBuffer += pRecord->Length;
+        Length -= pRecord->Length;
+    }
+
+#ifdef ATH_DEBUG_MODULE
+    if (status) {
+        DebugDumpBytes(pOrigBuffer,origLength,"BAD Recv Trailer");
+    }
+#endif
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCProcessTrailer \n"));
+    return status;
+
+}
+
+/* process a received message (i.e. strip off header, process any trailer data)
+ * note : locks must be released when this function is called */
+static int HTCProcessRecvHeader(struct htc_target *target,
+                                     struct htc_packet *pPacket, 
+                                     u32 *pNextLookAheads,
+                                     int        *pNumLookAheads)
+{
+    u8 temp;
+    u8 *pBuf;
+    int  status = 0;
+    u16 payloadLen;
+    u32 lookAhead;
+
+    pBuf = pPacket->pBuffer;
+    
+    if (pNumLookAheads != NULL) {
+        *pNumLookAheads = 0;
+    }
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCProcessRecvHeader \n"));
+
+    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
+        AR_DEBUG_PRINTBUF(pBuf,pPacket->ActualLength,"HTC Recv PKT");
+    }
+
+    do {
+        /* note, we cannot assume the alignment of pBuffer, so we use the safe macros to
+         * retrieve 16 bit fields */
+        payloadLen = A_GET_UINT16_FIELD(pBuf, struct htc_frame_hdr, PayloadLen);
+        
+        ((u8 *)&lookAhead)[0] = pBuf[0];
+        ((u8 *)&lookAhead)[1] = pBuf[1];
+        ((u8 *)&lookAhead)[2] = pBuf[2];
+        ((u8 *)&lookAhead)[3] = pBuf[3];
+
+        if (pPacket->PktInfo.AsRx.HTCRxFlags & HTC_RX_PKT_REFRESH_HDR) {
+                /* refresh expected hdr, since this was unknown at the time we grabbed the packets
+                 * as part of a bundle */
+            pPacket->PktInfo.AsRx.ExpectedHdr = lookAhead;
+                /* refresh actual length since we now have the real header */
+            pPacket->ActualLength = payloadLen + HTC_HDR_LENGTH;
+            
+                /* validate the actual header that was refreshed  */ 
+            if (pPacket->ActualLength > pPacket->BufferLength) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    ("Refreshed HDR payload length (%d) in bundled RECV is invalid (hdr: 0x%X) \n", 
+                    payloadLen, lookAhead));
+                    /* limit this to max buffer just to print out some of the buffer */    
+                pPacket->ActualLength = min(pPacket->ActualLength, pPacket->BufferLength);
+                status = A_EPROTO;
+                break;    
+            }
+            
+            if (pPacket->Endpoint != A_GET_UINT8_FIELD(pBuf, struct htc_frame_hdr, EndpointID)) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    ("Refreshed HDR endpoint (%d) does not match expected endpoint (%d) \n", 
+                    A_GET_UINT8_FIELD(pBuf, struct htc_frame_hdr, EndpointID), pPacket->Endpoint));
+                status = A_EPROTO;
+                break;      
+            }   
+        }
+                
+        if (lookAhead != pPacket->PktInfo.AsRx.ExpectedHdr) {
+            /* somehow the lookahead that gave us the full read length did not
+             * reflect the actual header in the pending message */
+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    ("HTCProcessRecvHeader, lookahead mismatch! (pPkt:0x%lX flags:0x%X) \n", 
+                        (unsigned long)pPacket, pPacket->PktInfo.AsRx.HTCRxFlags));
+#ifdef ATH_DEBUG_MODULE
+             DebugDumpBytes((u8 *)&pPacket->PktInfo.AsRx.ExpectedHdr,4,"Expected Message LookAhead");
+             DebugDumpBytes(pBuf,sizeof(struct htc_frame_hdr),"Current Frame Header");
+#ifdef HTC_CAPTURE_LAST_FRAME
+            DebugDumpBytes((u8 *)&target->LastFrameHdr,sizeof(struct htc_frame_hdr),"Last Frame Header");
+            if (target->LastTrailerLength != 0) {
+                DebugDumpBytes(target->LastTrailer,
+                               target->LastTrailerLength,
+                               "Last trailer");
+            }
+#endif
+#endif
+            status = A_EPROTO;
+            break;
+        }
+
+            /* get flags */
+        temp = A_GET_UINT8_FIELD(pBuf, struct htc_frame_hdr, Flags);
+
+        if (temp & HTC_FLAGS_RECV_TRAILER) {
+            /* this packet has a trailer */
+
+                /* extract the trailer length in control byte 0 */
+            temp = A_GET_UINT8_FIELD(pBuf, struct htc_frame_hdr, ControlBytes[0]);
+
+            if ((temp < sizeof(HTC_RECORD_HDR)) || (temp > payloadLen)) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    ("HTCProcessRecvHeader, invalid header (payloadlength should be :%d, CB[0] is:%d) \n",
+                        payloadLen, temp));
+                status = A_EPROTO;
+                break;
+            }
+
+            if (pPacket->PktInfo.AsRx.HTCRxFlags & HTC_RX_PKT_IGNORE_LOOKAHEAD) {
+                    /* this packet was fetched as part of an HTC bundle, the embedded lookahead is
+                     * not valid since the next packet may have already been fetched as part of the
+                     * bundle */
+                pNextLookAheads = NULL;   
+                pNumLookAheads = NULL;     
+            }
+            
+                /* process trailer data that follows HDR + application payload */
+            status = HTCProcessTrailer(target,
+                                       (pBuf + HTC_HDR_LENGTH + payloadLen - temp),
+                                       temp,
+                                       pNextLookAheads,
+                                       pNumLookAheads,
+                                       pPacket->Endpoint);
+
+            if (status) {
+                break;
+            }
+
+#ifdef HTC_CAPTURE_LAST_FRAME
+            memcpy(target->LastTrailer, (pBuf + HTC_HDR_LENGTH + payloadLen - temp), temp);
+            target->LastTrailerLength = temp;
+#endif
+                /* trim length by trailer bytes */
+            pPacket->ActualLength -= temp;
+        }
+#ifdef HTC_CAPTURE_LAST_FRAME
+         else {
+            target->LastTrailerLength = 0;
+        }
+#endif
+
+            /* if we get to this point, the packet is good */
+            /* remove header and adjust length */
+        pPacket->pBuffer += HTC_HDR_LENGTH;
+        pPacket->ActualLength -= HTC_HDR_LENGTH;
+
+    } while (false);
+
+    if (status) {
+            /* dump the whole packet */
+#ifdef ATH_DEBUG_MODULE
+        DebugDumpBytes(pBuf,pPacket->ActualLength < 256 ? pPacket->ActualLength : 256 ,"BAD HTC Recv PKT");
+#endif
+    } else {
+#ifdef HTC_CAPTURE_LAST_FRAME
+        memcpy(&target->LastFrameHdr,pBuf,sizeof(struct htc_frame_hdr));
+#endif
+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
+            if (pPacket->ActualLength > 0) {
+                AR_DEBUG_PRINTBUF(pPacket->pBuffer,pPacket->ActualLength,"HTC - Application Msg");
+            }
+        }
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCProcessRecvHeader \n"));
+    return status;
+}
+
+static INLINE void HTCAsyncRecvCheckMorePackets(struct htc_target  *target, 
+                                                u32 NextLookAheads[],
+                                                int         NumLookAheads,
+                                                bool      CheckMoreMsgs)
+{
+        /* was there a lookahead for the next packet? */
+    if (NumLookAheads > 0) {
+        int nextStatus;
+        int      fetched = 0;
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                        ("HTCAsyncRecvCheckMorePackets - num lookaheads were non-zero : %d \n",
+                         NumLookAheads));
+            /* force status re-check */                    
+        REF_IRQ_STATUS_RECHECK(&target->Device);
+            /* we have more packets, get the next packet fetch started */
+        nextStatus = HTCRecvMessagePendingHandler(target, NextLookAheads, NumLookAheads, NULL, &fetched);
+        if (A_EPROTO == nextStatus) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("Next look ahead from recv header was INVALID\n"));
+#ifdef ATH_DEBUG_MODULE
+            DebugDumpBytes((u8 *)NextLookAheads,
+                            NumLookAheads * (sizeof(u32)),
+                            "BAD lookaheads from lookahead report");
+#endif
+        }
+        if (!nextStatus && !fetched) {
+                /* we could not fetch any more packets due to resources */
+            DevAsyncIrqProcessComplete(&target->Device);        
+        }
+    } else {
+        if (CheckMoreMsgs) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                ("HTCAsyncRecvCheckMorePackets - rechecking for more messages...\n"));
+            /* if we did not get anything on the look-ahead,
+             * call device layer to asynchronously re-check for messages. If we can keep the async
+             * processing going we get better performance.  If there is a pending message we will keep processing
+             * messages asynchronously which should pipeline things nicely */
+            DevCheckPendingRecvMsgsAsync(&target->Device);
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("HTCAsyncRecvCheckMorePackets - no check \n"));    
+        }
+    }
+    
+     
+}      
+
+    /* unload the recv completion queue */
+static INLINE void DrainRecvIndicationQueue(struct htc_target *target, struct htc_endpoint *pEndpoint)
+{
+    struct htc_packet_queue     recvCompletions;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+DrainRecvIndicationQueue \n"));
+                
+    INIT_HTC_PACKET_QUEUE(&recvCompletions);
+    
+    LOCK_HTC_RX(target);
+    
+            /* increment rx processing count on entry */    
+    pEndpoint->RxProcessCount++;
+    if (pEndpoint->RxProcessCount > 1) {
+         pEndpoint->RxProcessCount--;
+            /* another thread or task is draining the RX completion queue on this endpoint
+             * that thread will reset the rx processing count when the queue is drained */
+         UNLOCK_HTC_RX(target);
+         return;
+    }
+    
+    /******* at this point only 1 thread may enter ******/
+     
+    while (true) {
+                
+            /* transfer items from main recv queue to the local one so we can release the lock */ 
+        HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&recvCompletions, &pEndpoint->RecvIndicationQueue);
+            
+        if (HTC_QUEUE_EMPTY(&recvCompletions)) {
+                /* all drained */
+            break;    
+        }
+        
+            /* release lock while we do the recv completions 
+             * other threads can now queue more recv completions */
+        UNLOCK_HTC_RX(target);
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV, 
+                ("DrainRecvIndicationQueue : completing %d RECV packets \n",
+                                        HTC_PACKET_QUEUE_DEPTH(&recvCompletions)));
+            /* do completion */
+        DO_RCV_COMPLETION(pEndpoint,&recvCompletions);     
+              
+            /* re-acquire lock to grab some more completions */
+        LOCK_HTC_RX(target);    
+    }
+    
+        /* reset count */
+    pEndpoint->RxProcessCount = 0;       
+    UNLOCK_HTC_RX(target);
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-DrainRecvIndicationQueue \n"));
+  
+}
+
+    /* optimization for recv packets, we can indicate a "hint" that there are more
+     * single-packets to fetch on this endpoint */
+#define SET_MORE_RX_PACKET_INDICATION_FLAG(L,N,E,P) \
+    if ((N) > 0) { SetRxPacketIndicationFlags((L)[0],(E),(P)); }
+
+    /* for bundled frames, we can force the flag to indicate there are more packets */
+#define FORCE_MORE_RX_PACKET_INDICATION_FLAG(P) \
+    (P)->PktInfo.AsRx.IndicationFlags |= HTC_RX_FLAGS_INDICATE_MORE_PKTS; 
+   
+   /* note: this function can be called with the RX lock held */     
+static INLINE void SetRxPacketIndicationFlags(u32 LookAhead,
+                                              struct htc_endpoint  *pEndpoint, 
+                                              struct htc_packet    *pPacket)
+{
+    struct htc_frame_hdr *pHdr = (struct htc_frame_hdr *)&LookAhead;
+        /* check to see if the "next" packet is from the same endpoint of the
+           completing packet */
+    if (pHdr->EndpointID == pPacket->Endpoint) {
+            /* check that there is a buffer available to actually fetch it */
+        if (!HTC_QUEUE_EMPTY(&pEndpoint->RxBuffers)) {                        
+                /* provide a hint that there are more RX packets to fetch */
+            FORCE_MORE_RX_PACKET_INDICATION_FLAG(pPacket);        
+        }             
+    }                  
+}
+
+     
+/* asynchronous completion handler for recv packet fetching, when the device layer
+ * completes a read request, it will call this completion handler */
+void HTCRecvCompleteHandler(void *Context, struct htc_packet *pPacket)
+{
+    struct htc_target      *target = (struct htc_target *)Context;
+    struct htc_endpoint    *pEndpoint;
+    u32 nextLookAheads[HTC_HOST_MAX_MSG_PER_BUNDLE];
+    int             numLookAheads = 0;
+    int        status;
+    bool          checkMorePkts = true;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCRecvCompleteHandler (pkt:0x%lX, status:%d, ep:%d) \n",
+                (unsigned long)pPacket, pPacket->Status, pPacket->Endpoint));
+
+    A_ASSERT(!IS_DEV_IRQ_PROC_SYNC_MODE(&target->Device));
+    AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
+    pEndpoint = &target->EndPoint[pPacket->Endpoint];
+    pPacket->Completion = NULL;
+
+        /* get completion status */
+    status = pPacket->Status;
+
+    do {
+        
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HTCRecvCompleteHandler: request failed (status:%d, ep:%d) \n",
+                pPacket->Status, pPacket->Endpoint));
+            break;
+        }
+            /* process the header for any trailer data */
+        status = HTCProcessRecvHeader(target,pPacket,nextLookAheads,&numLookAheads);
+
+        if (status) {
+            break;
+        }
+        
+        if (pPacket->PktInfo.AsRx.HTCRxFlags & HTC_RX_PKT_IGNORE_LOOKAHEAD) {
+                /* this packet was part of a bundle that had to be broken up. 
+                 * It was fetched one message at a time.  There may be other asynchronous reads queued behind this one.
+                 * Do no issue another check for more packets since the last one in the series of requests
+                 * will handle it */
+            checkMorePkts = false;
+        }
+          
+        DUMP_RECV_PKT_INFO(pPacket);    
+        LOCK_HTC_RX(target);
+        SET_MORE_RX_PACKET_INDICATION_FLAG(nextLookAheads,numLookAheads,pEndpoint,pPacket);
+            /* we have a good packet, queue it to the completion queue */
+        HTC_PACKET_ENQUEUE(&pEndpoint->RecvIndicationQueue,pPacket);
+        HTC_RX_STAT_PROFILE(target,pEndpoint,numLookAheads);
+        UNLOCK_HTC_RX(target);     
+       
+            /* check for more recv packets before indicating */
+        HTCAsyncRecvCheckMorePackets(target,nextLookAheads,numLookAheads,checkMorePkts);
+
+    } while (false);
+
+    if (status) {
+         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                         ("HTCRecvCompleteHandler , message fetch failed (status = %d) \n",
+                         status));
+            /* recycle this packet */
+        HTC_RECYCLE_RX_PKT(target, pPacket, pEndpoint);
+    } else {
+            /* a good packet was queued, drain the queue */
+        DrainRecvIndicationQueue(target,pEndpoint);     
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCRecvCompleteHandler\n"));
+}
+
+/* synchronously wait for a control message from the target,
+ * This function is used at initialization time ONLY.  At init messages
+ * on ENDPOINT 0 are expected. */
+int HTCWaitforControlMessage(struct htc_target *target, struct htc_packet **ppControlPacket)
+{
+    int        status;
+    u32 lookAhead;
+    struct htc_packet      *pPacket = NULL;
+    struct htc_frame_hdr   *pHdr;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCWaitforControlMessage \n"));
+
+    do  {
+
+        *ppControlPacket = NULL;
+
+            /* call the polling function to see if we have a message */
+        status = DevPollMboxMsgRecv(&target->Device,
+                                    &lookAhead,
+                                    HTC_TARGET_RESPONSE_TIMEOUT);
+
+        if (status) {
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                ("HTCWaitforControlMessage : lookAhead : 0x%X \n", lookAhead));
+
+            /* check the lookahead */
+        pHdr = (struct htc_frame_hdr *)&lookAhead;
+
+        if (pHdr->EndpointID != ENDPOINT_0) {
+                /* unexpected endpoint number, should be zero */
+            AR_DEBUG_ASSERT(false);
+            status = A_EPROTO;
+            break;
+        }
+
+        if (status) {
+                /* bad message */
+            AR_DEBUG_ASSERT(false);
+            status = A_EPROTO;
+            break;
+        }
+
+        pPacket = HTC_ALLOC_CONTROL_RX(target);
+
+        if (pPacket == NULL) {
+            AR_DEBUG_ASSERT(false);
+            status = A_NO_MEMORY;
+            break;
+        }
+        
+        pPacket->PktInfo.AsRx.HTCRxFlags = 0;
+        pPacket->PktInfo.AsRx.ExpectedHdr = lookAhead;
+        pPacket->ActualLength = pHdr->PayloadLen + HTC_HDR_LENGTH;
+
+        if (pPacket->ActualLength > pPacket->BufferLength) {
+            AR_DEBUG_ASSERT(false);
+            status = A_EPROTO;
+            break;
+        }
+
+            /* we want synchronous operation */
+        pPacket->Completion = NULL;
+
+            /* get the message from the device, this will block */
+        status = HTCIssueRecv(target, pPacket);
+
+        if (status) {
+            break;
+        }
+
+            /* process receive header */
+        status = HTCProcessRecvHeader(target,pPacket,NULL,NULL);
+
+        pPacket->Status = status;
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    ("HTCWaitforControlMessage, HTCProcessRecvHeader failed (status = %d) \n",
+                     status));
+            break;
+        }
+
+            /* give the caller this control message packet, they are responsible to free */
+        *ppControlPacket = pPacket;
+
+    } while (false);
+
+    if (status) {
+        if (pPacket != NULL) {
+                /* cleanup buffer on error */
+            HTC_FREE_CONTROL_RX(target,pPacket);
+        }
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCWaitforControlMessage \n"));
+
+    return status;
+}
+
+static int AllocAndPrepareRxPackets(struct htc_target       *target,
+                                         u32 LookAheads[],
+                                         int              Messages,                                        
+                                         struct htc_endpoint     *pEndpoint, 
+                                         struct htc_packet_queue *pQueue)
+{
+    int         status = 0;
+    struct htc_packet      *pPacket;
+    struct htc_frame_hdr   *pHdr;
+    int              i,j;
+    int              numMessages;
+    int              fullLength;
+    bool           noRecycle;
+            
+        /* lock RX while we assemble the packet buffers */
+    LOCK_HTC_RX(target);
+                        
+    for (i = 0; i < Messages; i++) {   
+         
+        pHdr = (struct htc_frame_hdr *)&LookAheads[i];
+
+        if (pHdr->EndpointID >= ENDPOINT_MAX) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid Endpoint in look-ahead: %d \n",pHdr->EndpointID));
+                /* invalid endpoint */
+            status = A_EPROTO;
+            break;
+        }
+
+        if (pHdr->EndpointID != pEndpoint->Id) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid Endpoint in look-ahead: %d should be : %d (index:%d)\n",
+                pHdr->EndpointID, pEndpoint->Id, i));
+                /* invalid endpoint */
+            status = A_EPROTO;
+            break;    
+        }    
+       
+        if (pHdr->PayloadLen > HTC_MAX_PAYLOAD_LENGTH) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Payload length %d exceeds max HTC : %d !\n",
+                    pHdr->PayloadLen, (u32)HTC_MAX_PAYLOAD_LENGTH));
+            status = A_EPROTO;
+            break;
+        }
+
+        if (0 == pEndpoint->ServiceID) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Endpoint %d is not connected !\n",pHdr->EndpointID));
+                /* endpoint isn't even connected */
+            status = A_EPROTO;
+            break;
+        }
+
+        if ((pHdr->Flags & HTC_FLAGS_RECV_BUNDLE_CNT_MASK) == 0) {
+                /* HTC header only indicates 1 message to fetch */
+            numMessages = 1;
+        } else {
+                /* HTC header indicates that every packet to follow has the same padded length so that it can
+                 * be optimally fetched as a full bundle */
+            numMessages = (pHdr->Flags & HTC_FLAGS_RECV_BUNDLE_CNT_MASK) >> HTC_FLAGS_RECV_BUNDLE_CNT_SHIFT;
+                /* the count doesn't include the starter frame, just a count of frames to follow */
+            numMessages++;
+            A_ASSERT(numMessages <= target->MaxMsgPerBundle);          
+            INC_HTC_EP_STAT(pEndpoint, RxBundleIndFromHdr, 1);
+            AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                ("HTC header indicates :%d messages can be fetched as a bundle \n",numMessages));           
+        }
+     
+        fullLength = DEV_CALC_RECV_PADDED_LEN(&target->Device,pHdr->PayloadLen + sizeof(struct htc_frame_hdr));
+            
+            /* get packet buffers for each message, if there was a bundle detected in the header,
+             * use pHdr as a template to fetch all packets in the bundle */        
+        for (j = 0; j < numMessages; j++) {  
+            
+                /* reset flag, any packets allocated using the RecvAlloc() API cannot be recycled on cleanup,
+                 * they must be explicitly returned */
+            noRecycle = false;
+                                                                                   
+            if (pEndpoint->EpCallBacks.EpRecvAlloc != NULL) {
+                UNLOCK_HTC_RX(target);
+                noRecycle = true;
+                    /* user is using a per-packet allocation callback */
+                pPacket = pEndpoint->EpCallBacks.EpRecvAlloc(pEndpoint->EpCallBacks.pContext,
+                                                             pEndpoint->Id,
+                                                             fullLength);
+                LOCK_HTC_RX(target);
+    
+            } else if ((pEndpoint->EpCallBacks.EpRecvAllocThresh != NULL) &&
+                       (fullLength > pEndpoint->EpCallBacks.RecvAllocThreshold)) { 
+                INC_HTC_EP_STAT(pEndpoint,RxAllocThreshHit,1);
+                INC_HTC_EP_STAT(pEndpoint,RxAllocThreshBytes,pHdr->PayloadLen);                
+                    /* threshold was hit, call the special recv allocation callback */        
+                UNLOCK_HTC_RX(target);
+                noRecycle = true;
+                    /* user wants to allocate packets above a certain threshold */
+                pPacket = pEndpoint->EpCallBacks.EpRecvAllocThresh(pEndpoint->EpCallBacks.pContext,
+                                                                   pEndpoint->Id,
+                                                                   fullLength);
+                LOCK_HTC_RX(target);        
+                        
+            } else {
+                    /* user is using a refill handler that can refill multiple HTC buffers */
+                    
+                    /* get a packet from the endpoint recv queue */
+                pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
+    
+                if (NULL == pPacket) {
+                        /* check for refill handler */
+                    if (pEndpoint->EpCallBacks.EpRecvRefill != NULL) {
+                        UNLOCK_HTC_RX(target);
+                            /* call the re-fill handler */
+                        pEndpoint->EpCallBacks.EpRecvRefill(pEndpoint->EpCallBacks.pContext,
+                                                            pEndpoint->Id);
+                        LOCK_HTC_RX(target);
+                            /* check if we have more buffers */
+                        pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
+                            /* fall through */
+                    }
+                }
+            }
+    
+            if (NULL == pPacket) {
+                    /* this is not an error, we simply need to mark that we are waiting for buffers.*/
+                target->RecvStateFlags |= HTC_RECV_WAIT_BUFFERS;
+                target->EpWaitingForBuffers = pEndpoint->Id;
+                status = A_NO_RESOURCE;
+                break;
+            }
+                             
+            AR_DEBUG_ASSERT(pPacket->Endpoint == pEndpoint->Id);
+                /* clear flags */
+            pPacket->PktInfo.AsRx.HTCRxFlags = 0;
+            pPacket->PktInfo.AsRx.IndicationFlags = 0;
+            pPacket->Status = 0;
+            
+            if (noRecycle) {
+                    /* flag that these packets cannot be recycled, they have to be returned to the 
+                     * user */
+                pPacket->PktInfo.AsRx.HTCRxFlags |= HTC_RX_PKT_NO_RECYCLE; 
+            }
+                /* add packet to queue (also incase we need to cleanup down below)  */
+            HTC_PACKET_ENQUEUE(pQueue,pPacket);
+            
+            if (HTC_STOPPING(target)) {
+                status = A_ECANCELED;
+                break;
+            }
+    
+                /* make sure this message can fit in the endpoint buffer */
+            if ((u32)fullLength > pPacket->BufferLength) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("Payload Length Error : header reports payload of: %d (%d) endpoint buffer size: %d \n",
+                        pHdr->PayloadLen, fullLength, pPacket->BufferLength));
+                status = A_EPROTO;
+                break;
+            }
+            
+            if (j > 0) {
+                    /* for messages fetched in a bundle the expected lookahead is unknown since we
+                     * are only using the lookahead of the first packet as a template of what to
+                     * expect for lengths */
+                    /* flag that once we get the real HTC header we need to refesh the information */     
+                pPacket->PktInfo.AsRx.HTCRxFlags |= HTC_RX_PKT_REFRESH_HDR;
+                    /* set it to something invalid */
+                pPacket->PktInfo.AsRx.ExpectedHdr = 0xFFFFFFFF;    
+            } else {
+            
+                pPacket->PktInfo.AsRx.ExpectedHdr = LookAheads[i]; /* set expected look ahead */
+            }
+                /* set the amount of data to fetch */
+            pPacket->ActualLength = pHdr->PayloadLen + HTC_HDR_LENGTH;
+        }
+        
+        if (status) {
+            if (A_NO_RESOURCE == status) {
+                    /* this is actually okay */
+                status = 0;
+            }
+            break;    
+        }
+                
+    }
+    
+    UNLOCK_HTC_RX(target);
+    
+    if (status) {
+        while (!HTC_QUEUE_EMPTY(pQueue)) {
+            pPacket = HTC_PACKET_DEQUEUE(pQueue);
+                /* recycle all allocated packets */
+            HTC_RECYCLE_RX_PKT(target,pPacket,&target->EndPoint[pPacket->Endpoint]);
+        }        
+    }
+        
+    return status; 
+}
+
+static void HTCAsyncRecvScatterCompletion(struct hif_scatter_req *pScatterReq)
+{
+    int                 i;    
+    struct htc_packet          *pPacket;
+    struct htc_endpoint        *pEndpoint;
+    u32 lookAheads[HTC_HOST_MAX_MSG_PER_BUNDLE];
+    int                 numLookAheads = 0;
+    struct htc_target          *target = (struct htc_target *)pScatterReq->Context;
+    int            status;
+    bool              partialBundle = false;
+    struct htc_packet_queue    localRecvQueue;
+    bool              procError = false;
+           
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCAsyncRecvScatterCompletion  TotLen: %d  Entries: %d\n",
+        pScatterReq->TotalLength, pScatterReq->ValidScatterEntries));
+    
+    A_ASSERT(!IS_DEV_IRQ_PROC_SYNC_MODE(&target->Device));
+           
+    if (pScatterReq->CompletionStatus) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("** Recv Scatter Request Failed: %d \n",pScatterReq->CompletionStatus));            
+    }
+    
+    if (pScatterReq->CallerFlags & HTC_SCATTER_REQ_FLAGS_PARTIAL_BUNDLE) {
+        partialBundle = true;
+    }
+    
+    DEV_FINISH_SCATTER_OPERATION(pScatterReq);
+    
+    INIT_HTC_PACKET_QUEUE(&localRecvQueue);
+        
+    pPacket = (struct htc_packet *)pScatterReq->ScatterList[0].pCallerContexts[0];
+        /* note: all packets in a scatter req are for the same endpoint ! */
+    pEndpoint = &target->EndPoint[pPacket->Endpoint];
+         
+        /* walk through the scatter list and process */
+        /* **** NOTE: DO NOT HOLD ANY LOCKS here, HTCProcessRecvHeader can take the TX lock
+         * as it processes credit reports */
+    for (i = 0; i < pScatterReq->ValidScatterEntries; i++) {
+        pPacket = (struct htc_packet *)pScatterReq->ScatterList[i].pCallerContexts[0];
+        A_ASSERT(pPacket != NULL);       
+            /* reset count, we are only interested in the look ahead in the last packet when we
+             * break out of this loop */
+        numLookAheads = 0;
+        
+        if (!pScatterReq->CompletionStatus) {
+                /* process header for each of the recv packets */            
+            status = HTCProcessRecvHeader(target,pPacket,lookAheads,&numLookAheads);
+        } else {
+            status = A_ERROR;    
+        }
+        
+        if (!status) {
+            LOCK_HTC_RX(target);              
+            HTC_RX_STAT_PROFILE(target,pEndpoint,numLookAheads);
+            INC_HTC_EP_STAT(pEndpoint, RxPacketsBundled, 1);
+            UNLOCK_HTC_RX(target);
+            if (i == (pScatterReq->ValidScatterEntries - 1)) {
+                    /* last packet's more packets flag is set based on the lookahead */
+                SET_MORE_RX_PACKET_INDICATION_FLAG(lookAheads,numLookAheads,pEndpoint,pPacket);
+            } else {
+                    /* packets in a bundle automatically have this flag set */
+                FORCE_MORE_RX_PACKET_INDICATION_FLAG(pPacket);
+            }
+             
+            DUMP_RECV_PKT_INFO(pPacket);            
+                /* since we can't hold a lock in this loop, we insert into our local recv queue for
+                 * storage until we can transfer them to the recv completion queue */
+            HTC_PACKET_ENQUEUE(&localRecvQueue,pPacket);
+            
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" Recv packet scatter entry %d failed (out of %d) \n",
+                    i, pScatterReq->ValidScatterEntries));
+                /* recycle failed recv */
+            HTC_RECYCLE_RX_PKT(target, pPacket, pEndpoint);
+                /* set flag and continue processing the remaining scatter entries */
+            procError = true;
+        }   
+    
+    }
+  
+        /* free scatter request */
+    DEV_FREE_SCATTER_REQ(&target->Device,pScatterReq);
+   
+    LOCK_HTC_RX(target);   
+        /* transfer the packets in the local recv queue to the recv completion queue */
+    HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&pEndpoint->RecvIndicationQueue, &localRecvQueue);  
+    
+    UNLOCK_HTC_RX(target);
+    
+    if (!procError) {  
+            /* pipeline the next check (asynchronously) for more packets */           
+        HTCAsyncRecvCheckMorePackets(target,
+                                     lookAheads,
+                                     numLookAheads,
+                                     partialBundle ? false : true);
+    }
+    
+        /* now drain the indication queue */
+    DrainRecvIndicationQueue(target,pEndpoint);
+          
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCAsyncRecvScatterCompletion \n"));
+}
+
+static int HTCIssueRecvPacketBundle(struct htc_target        *target,
+                                         struct htc_packet_queue  *pRecvPktQueue, 
+                                         struct htc_packet_queue  *pSyncCompletionQueue,
+                                         int               *pNumPacketsFetched,
+                                         bool             PartialBundle)
+{
+    int        status = 0;
+    struct hif_scatter_req *pScatterReq;
+    int             i, totalLength;
+    int             pktsToScatter;
+    struct htc_packet      *pPacket;
+    bool          asyncMode = (pSyncCompletionQueue == NULL) ? true : false;
+    int             scatterSpaceRemaining = DEV_GET_MAX_BUNDLE_RECV_LENGTH(&target->Device);
+        
+    pktsToScatter = HTC_PACKET_QUEUE_DEPTH(pRecvPktQueue);
+    pktsToScatter = min(pktsToScatter, target->MaxMsgPerBundle);
+        
+    if ((HTC_PACKET_QUEUE_DEPTH(pRecvPktQueue) - pktsToScatter) > 0) {
+            /* we were forced to split this bundle receive operation
+             * all packets in this partial bundle must have their lookaheads ignored */
+        PartialBundle = true;
+            /* this would only happen if the target ignored our max bundle limit */
+        AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
+                         ("HTCIssueRecvPacketBundle : partial bundle detected num:%d , %d \n",
+                         HTC_PACKET_QUEUE_DEPTH(pRecvPktQueue), pktsToScatter));       
+    }
+    
+    totalLength = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCIssueRecvPacketBundle (Numpackets: %d , actual : %d) \n", 
+        HTC_PACKET_QUEUE_DEPTH(pRecvPktQueue), pktsToScatter));
+    
+    do {
+        
+        pScatterReq = DEV_ALLOC_SCATTER_REQ(&target->Device); 
+        
+        if (pScatterReq == NULL) {
+                /* no scatter resources left, just let caller handle it the legacy way */
+            break;    
+        }        
+    
+        pScatterReq->CallerFlags = 0;
+             
+        if (PartialBundle) {
+                /* mark that this is a partial bundle, this has special ramifications to the
+                 * scatter completion routine */
+            pScatterReq->CallerFlags |= HTC_SCATTER_REQ_FLAGS_PARTIAL_BUNDLE;
+        }
+                   
+            /* convert HTC packets to scatter list */                   
+        for (i = 0; i < pktsToScatter; i++) {
+            int paddedLength;
+            
+            pPacket = HTC_PACKET_DEQUEUE(pRecvPktQueue);
+            A_ASSERT(pPacket != NULL);
+            
+            paddedLength = DEV_CALC_RECV_PADDED_LEN(&target->Device, pPacket->ActualLength);
+     
+            if ((scatterSpaceRemaining - paddedLength) < 0) {
+                    /* exceeds what we can transfer, put the packet back */  
+                HTC_PACKET_ENQUEUE_TO_HEAD(pRecvPktQueue,pPacket);
+                break;    
+            }
+                        
+            scatterSpaceRemaining -= paddedLength;
+                       
+            if (PartialBundle || (i < (pktsToScatter - 1))) {
+                    /* packet 0..n-1 cannot be checked for look-aheads since we are fetching a bundle
+                     * the last packet however can have it's lookahead used */
+                pPacket->PktInfo.AsRx.HTCRxFlags |= HTC_RX_PKT_IGNORE_LOOKAHEAD;
+            }
+            
+            /* note: 1 HTC packet per scatter entry */           
+                /* setup packet into */   
+            pScatterReq->ScatterList[i].pBuffer = pPacket->pBuffer;
+            pScatterReq->ScatterList[i].Length = paddedLength;
+            
+            pPacket->PktInfo.AsRx.HTCRxFlags |= HTC_RX_PKT_PART_OF_BUNDLE;
+            
+            if (asyncMode) {
+                    /* save HTC packet for async completion routine */
+                pScatterReq->ScatterList[i].pCallerContexts[0] = pPacket;
+            } else {
+                    /* queue to caller's sync completion queue, caller will unload this when we return */
+                HTC_PACKET_ENQUEUE(pSyncCompletionQueue,pPacket);    
+            }             
+                   
+            A_ASSERT(pScatterReq->ScatterList[i].Length);
+            totalLength += pScatterReq->ScatterList[i].Length;
+        }            
+        
+        pScatterReq->TotalLength = totalLength;
+        pScatterReq->ValidScatterEntries = i;
+        
+        if (asyncMode) {
+            pScatterReq->CompletionRoutine = HTCAsyncRecvScatterCompletion;
+            pScatterReq->Context = target;
+        }
+        
+        status = DevSubmitScatterRequest(&target->Device, pScatterReq, DEV_SCATTER_READ, asyncMode);
+        
+        if (!status) {
+            *pNumPacketsFetched = i;    
+        }
+        
+        if (!asyncMode) {
+                /* free scatter request */
+            DEV_FREE_SCATTER_REQ(&target->Device, pScatterReq);   
+        }
+        
+    } while (false);
+   
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCIssueRecvPacketBundle (status:%d) (fetched:%d) \n",
+            status,*pNumPacketsFetched));
+        
+    return status;
+}
+
+static INLINE void CheckRecvWaterMark(struct htc_endpoint    *pEndpoint)
+{  
+        /* see if endpoint is using a refill watermark 
+         * ** no need to use a lock here, since we are only inspecting...
+         * caller may must not hold locks when calling this function */
+    if (pEndpoint->EpCallBacks.RecvRefillWaterMark > 0) {
+        if (HTC_PACKET_QUEUE_DEPTH(&pEndpoint->RxBuffers) < pEndpoint->EpCallBacks.RecvRefillWaterMark) {
+                /* call the re-fill handler before we continue */
+            pEndpoint->EpCallBacks.EpRecvRefill(pEndpoint->EpCallBacks.pContext,
+                                                pEndpoint->Id);
+        }
+    }  
+}
+
+/* callback when device layer or lookahead report parsing detects a pending message */
+int HTCRecvMessagePendingHandler(void *Context, u32 MsgLookAheads[], int NumLookAheads, bool *pAsyncProc, int *pNumPktsFetched)
+{
+    struct htc_target      *target = (struct htc_target *)Context;
+    int         status = 0;
+    struct htc_packet      *pPacket;
+    struct htc_endpoint    *pEndpoint;
+    bool          asyncProc = false;
+    u32 lookAheads[HTC_HOST_MAX_MSG_PER_BUNDLE];
+    int             pktsFetched;
+    struct htc_packet_queue recvPktQueue, syncCompletedPktsQueue;
+    bool          partialBundle;
+    HTC_ENDPOINT_ID id;
+    int             totalFetched = 0;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCRecvMessagePendingHandler NumLookAheads: %d \n",NumLookAheads));
+    
+    if (pNumPktsFetched != NULL) {
+        *pNumPktsFetched = 0;    
+    }
+    
+    if (IS_DEV_IRQ_PROCESSING_ASYNC_ALLOWED(&target->Device)) {
+            /* We use async mode to get the packets if the device layer supports it.
+             * The device layer interfaces with HIF in which HIF may have restrictions on
+             * how interrupts are processed */
+        asyncProc = true;
+    }
+
+    if (pAsyncProc != NULL) {
+            /* indicate to caller how we decided to process this */
+        *pAsyncProc = asyncProc;
+    }
+    
+    if (NumLookAheads > HTC_HOST_MAX_MSG_PER_BUNDLE) {
+        A_ASSERT(false);
+        return A_EPROTO; 
+    }
+        
+        /* on first entry copy the lookaheads into our temp array for processing */
+    memcpy(lookAheads, MsgLookAheads, (sizeof(u32)) * NumLookAheads);
+            
+    while (true) {
+        
+            /* reset packets queues */
+        INIT_HTC_PACKET_QUEUE(&recvPktQueue);
+        INIT_HTC_PACKET_QUEUE(&syncCompletedPktsQueue);
+        
+        if (NumLookAheads > HTC_HOST_MAX_MSG_PER_BUNDLE) {
+            status = A_EPROTO;
+            A_ASSERT(false);
+            break;    
+        }
+   
+            /* first lookahead sets the expected endpoint IDs for all packets in a bundle */
+        id = ((struct htc_frame_hdr *)&lookAheads[0])->EndpointID;
+        pEndpoint = &target->EndPoint[id];
+        
+        if (id >= ENDPOINT_MAX) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("MsgPend, Invalid Endpoint in look-ahead: %d \n",id));
+            status = A_EPROTO;
+            break;
+        }
+        
+            /* try to allocate as many HTC RX packets indicated by the lookaheads
+             * these packets are stored in the recvPkt queue */
+        status = AllocAndPrepareRxPackets(target, 
+                                          lookAheads, 
+                                          NumLookAheads,
+                                          pEndpoint, 
+                                          &recvPktQueue);        
+        if (status) {
+            break;    
+        }
+ 
+        if (HTC_PACKET_QUEUE_DEPTH(&recvPktQueue) >= 2) {
+                /* a recv bundle was detected, force IRQ status re-check again */
+            REF_IRQ_STATUS_RECHECK(&target->Device);
+        }
+        
+        totalFetched += HTC_PACKET_QUEUE_DEPTH(&recvPktQueue);
+               
+            /* we've got packet buffers for all we can currently fetch, 
+             * this count is not valid anymore  */
+        NumLookAheads = 0;
+        partialBundle = false;
+       
+            /* now go fetch the list of HTC packets */
+        while (!HTC_QUEUE_EMPTY(&recvPktQueue)) {   
+            
+            pktsFetched = 0;
+                       
+            if (target->RecvBundlingEnabled && (HTC_PACKET_QUEUE_DEPTH(&recvPktQueue) > 1)) {             
+                    /* there are enough packets to attempt a bundle transfer and recv bundling is allowed  */
+                status = HTCIssueRecvPacketBundle(target,
+                                                  &recvPktQueue,
+                                                  asyncProc ? NULL : &syncCompletedPktsQueue,
+                                                  &pktsFetched,
+                                                  partialBundle);                                                   
+                if (status) {
+                    break;
+                }
+                
+                if (HTC_PACKET_QUEUE_DEPTH(&recvPktQueue) != 0) {
+                        /* we couldn't fetch all packets at one time, this creates a broken
+                         * bundle  */
+                    partialBundle = true;
+                }                                                                     
+            }
+            
+                /* see if the previous operation fetched any packets using bundling */
+            if (0 == pktsFetched) {  
+                    /* dequeue one packet */
+                pPacket = HTC_PACKET_DEQUEUE(&recvPktQueue);
+                A_ASSERT(pPacket != NULL);                 
+                                     
+                if (asyncProc) {
+                        /* we use async mode to get the packet if the device layer supports it
+                         * set our callback and context */
+                    pPacket->Completion = HTCRecvCompleteHandler;
+                    pPacket->pContext = target;
+                } else {
+                        /* fully synchronous */
+                    pPacket->Completion = NULL;
+                }
+                
+                if (HTC_PACKET_QUEUE_DEPTH(&recvPktQueue) > 0) {
+                        /* lookaheads in all packets except the last one in the bundle must be ignored */
+                    pPacket->PktInfo.AsRx.HTCRxFlags |= HTC_RX_PKT_IGNORE_LOOKAHEAD;
+                }
+                                    
+                    /* go fetch the packet */
+                status = HTCIssueRecv(target, pPacket);              
+                if (status) {
+                    break;
+                }  
+                               
+                if (!asyncProc) {               
+                        /* sent synchronously, queue this packet for synchronous completion */
+                    HTC_PACKET_ENQUEUE(&syncCompletedPktsQueue,pPacket);
+                } 
+                               
+            }
+            
+        }
+
+        if (!status) {
+            CheckRecvWaterMark(pEndpoint);
+        }
+            
+        if (asyncProc) {
+                /* we did this asynchronously so we can get out of the loop, the asynch processing
+                 * creates a chain of requests to continue processing pending messages in the
+                 * context of callbacks  */
+            break;
+        }
+
+            /* synchronous handling */
+        if (target->Device.DSRCanYield) {
+                /* for the SYNC case, increment count that tracks when the DSR should yield */
+            target->Device.CurrentDSRRecvCount++;    
+        }
+            
+            /* in the sync case, all packet buffers are now filled, 
+             * we can process each packet, check lookaheads and then repeat */ 
+             
+             /* unload sync completion queue */      
+        while (!HTC_QUEUE_EMPTY(&syncCompletedPktsQueue)) {
+            struct htc_packet_queue    container;
+           
+            pPacket = HTC_PACKET_DEQUEUE(&syncCompletedPktsQueue);
+            A_ASSERT(pPacket != NULL);
+            
+            pEndpoint = &target->EndPoint[pPacket->Endpoint];           
+                /* reset count on each iteration, we are only interested in the last packet's lookahead
+                 * information when we break out of this loop */
+            NumLookAheads = 0;
+                /* process header for each of the recv packets
+                 * note: the lookahead of the last packet is useful for us to continue in this loop */            
+            status = HTCProcessRecvHeader(target,pPacket,lookAheads,&NumLookAheads);
+            if (status) {
+                break;
+            }
+            
+            if (HTC_QUEUE_EMPTY(&syncCompletedPktsQueue)) {
+                    /* last packet's more packets flag is set based on the lookahead */
+                SET_MORE_RX_PACKET_INDICATION_FLAG(lookAheads,NumLookAheads,pEndpoint,pPacket);
+            } else {
+                    /* packets in a bundle automatically have this flag set */
+                FORCE_MORE_RX_PACKET_INDICATION_FLAG(pPacket);
+            }
+                /* good packet, indicate it */
+            HTC_RX_STAT_PROFILE(target,pEndpoint,NumLookAheads);
+            
+            if (pPacket->PktInfo.AsRx.HTCRxFlags & HTC_RX_PKT_PART_OF_BUNDLE) {
+                INC_HTC_EP_STAT(pEndpoint, RxPacketsBundled, 1);
+            }
+            
+            INIT_HTC_PACKET_QUEUE_AND_ADD(&container,pPacket);
+            DO_RCV_COMPLETION(pEndpoint,&container);
+        }
+
+        if (status) {
+            break;
+        }
+            
+        if (NumLookAheads == 0) {
+                /* no more look aheads */
+            break;    
+        }
+
+            /* when we process recv synchronously we need to check if we should yield and stop
+             * fetching more packets indicated by the embedded lookaheads */
+        if (target->Device.DSRCanYield) {
+            if (DEV_CHECK_RECV_YIELD(&target->Device)) {
+                    /* break out, don't fetch any more packets */
+                break;  
+            }  
+        }
+            
+
+        /* check whether other OS contexts have queued any WMI command/data for WLAN. 
+         * This check is needed only if WLAN Tx and Rx happens in same thread context */
+        A_CHECK_DRV_TX();
+        
+            /* for SYNCH processing, if we get here, we are running through the loop again due to a detected lookahead.
+             * Set flag that we should re-check IRQ status registers again before leaving IRQ processing,
+             * this can net better performance in high throughput situations */
+        REF_IRQ_STATUS_RECHECK(&target->Device);
+    }
+    
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("Failed to get pending recv messages (%d) \n",status));
+            /* cleanup any packets we allocated but didn't use to actually fetch any packets */                        
+        while (!HTC_QUEUE_EMPTY(&recvPktQueue)) {   
+            pPacket = HTC_PACKET_DEQUEUE(&recvPktQueue);
+                /* clean up packets */
+            HTC_RECYCLE_RX_PKT(target, pPacket, &target->EndPoint[pPacket->Endpoint]);
+        }
+            /* cleanup any packets in sync completion queue */
+        while (!HTC_QUEUE_EMPTY(&syncCompletedPktsQueue)) {   
+            pPacket = HTC_PACKET_DEQUEUE(&syncCompletedPktsQueue);
+                /* clean up packets */
+            HTC_RECYCLE_RX_PKT(target, pPacket, &target->EndPoint[pPacket->Endpoint]);
+        }
+        if  (HTC_STOPPING(target)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
+                (" Host is going to stop. blocking receiver for HTCStop.. \n"));
+            DevStopRecv(&target->Device, asyncProc ? DEV_STOP_RECV_ASYNC : DEV_STOP_RECV_SYNC);
+        }
+    }
+        /* before leaving, check to see if host ran out of buffers and needs to stop the
+         * receiver */
+    if (target->RecvStateFlags & HTC_RECV_WAIT_BUFFERS) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
+                (" Host has no RX buffers, blocking receiver to prevent overrun.. \n"));
+            /* try to stop receive at the device layer */
+        DevStopRecv(&target->Device, asyncProc ? DEV_STOP_RECV_ASYNC : DEV_STOP_RECV_SYNC);
+    }
+    
+    if (pNumPktsFetched != NULL) {
+        *pNumPktsFetched = totalFetched;    
+    }
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCRecvMessagePendingHandler \n"));
+
+    return status;
+}
+
+int HTCAddReceivePktMultiple(HTC_HANDLE HTCHandle, struct htc_packet_queue *pPktQueue)
+{
+    struct htc_target      *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    struct htc_endpoint    *pEndpoint;
+    bool          unblockRecv = false;
+    int        status = 0;
+    struct htc_packet      *pFirstPacket;
+
+    pFirstPacket = HTC_GET_PKT_AT_HEAD(pPktQueue);
+    
+    if (NULL == pFirstPacket) {
+        A_ASSERT(false);
+        return A_EINVAL;    
+    }
+    
+    AR_DEBUG_ASSERT(pFirstPacket->Endpoint < ENDPOINT_MAX);
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
+                    ("+- HTCAddReceivePktMultiple : endPointId: %d, cnt:%d, length: %d\n",
+                    pFirstPacket->Endpoint,
+                    HTC_PACKET_QUEUE_DEPTH(pPktQueue), 
+                    pFirstPacket->BufferLength));
+
+    do {
+
+        pEndpoint = &target->EndPoint[pFirstPacket->Endpoint];
+
+        LOCK_HTC_RX(target);
+
+        if (HTC_STOPPING(target)) {
+            struct htc_packet *pPacket;
+            
+            UNLOCK_HTC_RX(target);
+            
+                /* walk through queue and mark each one canceled */
+            HTC_PACKET_QUEUE_ITERATE_ALLOW_REMOVE(pPktQueue,pPacket) {
+                pPacket->Status = A_ECANCELED;    
+            } HTC_PACKET_QUEUE_ITERATE_END;
+            
+            DO_RCV_COMPLETION(pEndpoint,pPktQueue);
+            break;
+        }
+
+            /* store receive packets */
+        HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&pEndpoint->RxBuffers, pPktQueue);
+
+            /* check if we are blocked waiting for a new buffer */
+        if (target->RecvStateFlags & HTC_RECV_WAIT_BUFFERS) {
+            if (target->EpWaitingForBuffers == pFirstPacket->Endpoint) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" receiver was blocked on ep:%d, unblocking.. \n",
+                    target->EpWaitingForBuffers));
+                target->RecvStateFlags &= ~HTC_RECV_WAIT_BUFFERS;
+                target->EpWaitingForBuffers = ENDPOINT_MAX;
+                unblockRecv = true;
+            }
+        }
+
+        UNLOCK_HTC_RX(target);
+
+        if (unblockRecv && !HTC_STOPPING(target)) {
+                /* TODO : implement a buffer threshold count? */
+            DevEnableRecv(&target->Device,DEV_ENABLE_RECV_SYNC);
+        }
+
+    } while (false);
+
+    return status;
+}
+
+/* Makes a buffer available to the HTC module */
+int HTCAddReceivePkt(HTC_HANDLE HTCHandle, struct htc_packet *pPacket)
+{
+    struct htc_packet_queue queue;
+    INIT_HTC_PACKET_QUEUE_AND_ADD(&queue,pPacket); 
+    return HTCAddReceivePktMultiple(HTCHandle, &queue);       
+}
+
+void HTCUnblockRecv(HTC_HANDLE HTCHandle)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    bool      unblockRecv = false;
+
+    LOCK_HTC_RX(target);
+
+        /* check if we are blocked waiting for a new buffer */
+    if (target->RecvStateFlags & HTC_RECV_WAIT_BUFFERS) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("HTCUnblockRx : receiver was blocked on ep:%d, unblocking.. \n",
+            target->EpWaitingForBuffers));
+        target->RecvStateFlags &= ~HTC_RECV_WAIT_BUFFERS;
+        target->EpWaitingForBuffers = ENDPOINT_MAX;
+        unblockRecv = true;
+    }
+
+    UNLOCK_HTC_RX(target);
+
+    if (unblockRecv && !HTC_STOPPING(target)) {
+            /* re-enable */
+        DevEnableRecv(&target->Device,DEV_ENABLE_RECV_ASYNC);
+    }
+}
+
+static void HTCFlushRxQueue(struct htc_target *target, struct htc_endpoint *pEndpoint, struct htc_packet_queue *pQueue)
+{
+    struct htc_packet  *pPacket;
+    struct htc_packet_queue container;
+    
+    LOCK_HTC_RX(target);
+
+    while (1) {
+        pPacket = HTC_PACKET_DEQUEUE(pQueue);
+        if (NULL == pPacket) {
+            break;
+        }
+        UNLOCK_HTC_RX(target);
+        pPacket->Status = A_ECANCELED;
+        pPacket->ActualLength = 0;
+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("  Flushing RX packet:0x%lX, length:%d, ep:%d \n",
+                (unsigned long)pPacket, pPacket->BufferLength, pPacket->Endpoint));
+        INIT_HTC_PACKET_QUEUE_AND_ADD(&container,pPacket);
+            /* give the packet back */
+        DO_RCV_COMPLETION(pEndpoint,&container);
+        LOCK_HTC_RX(target);
+    }
+    
+    UNLOCK_HTC_RX(target);
+}
+
+static void HTCFlushEndpointRX(struct htc_target *target, struct htc_endpoint *pEndpoint)
+{
+        /* flush any recv indications not already made */
+    HTCFlushRxQueue(target,pEndpoint,&pEndpoint->RecvIndicationQueue);
+        /* flush any rx buffers */
+    HTCFlushRxQueue(target,pEndpoint,&pEndpoint->RxBuffers);
+}
+
+void HTCFlushRecvBuffers(struct htc_target *target)
+{
+    struct htc_endpoint    *pEndpoint;
+    int             i;
+
+    for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
+        pEndpoint = &target->EndPoint[i];
+        if (pEndpoint->ServiceID == 0) {
+                /* not in use.. */
+            continue;
+        }
+        HTCFlushEndpointRX(target,pEndpoint);
+    }
+}
+
+
+void HTCEnableRecv(HTC_HANDLE HTCHandle)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+
+    if (!HTC_STOPPING(target)) {
+            /* re-enable */
+        DevEnableRecv(&target->Device,DEV_ENABLE_RECV_SYNC);
+    }
+}
+
+void HTCDisableRecv(HTC_HANDLE HTCHandle)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+
+    if (!HTC_STOPPING(target)) {
+            /* disable */
+        DevStopRecv(&target->Device,DEV_ENABLE_RECV_SYNC);
+    }
+}
+
+int HTCGetNumRecvBuffers(HTC_HANDLE      HTCHandle,
+                         HTC_ENDPOINT_ID Endpoint)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);    
+    return HTC_PACKET_QUEUE_DEPTH(&(target->EndPoint[Endpoint].RxBuffers));
+}
+
+int HTCWaitForPendingRecv(HTC_HANDLE   HTCHandle,
+                               u32 TimeoutInMs,
+                               bool      *pbIsRecvPending)
+{
+    int    status  = 0;
+    struct htc_target *target  = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+
+    status = DevWaitForPendingRecv(&target->Device,
+                                    TimeoutInMs,
+                                    pbIsRecvPending);
+
+    return status;
+}
diff --git a/drivers/staging/ath6kl/htc2/htc_send.c b/drivers/staging/ath6kl/htc2/htc_send.c
new file mode 100644
index 00000000000..9310d4d5c99
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/htc_send.c
@@ -0,0 +1,1018 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_send.c" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#include "htc_internal.h"
+
+typedef enum _HTC_SEND_QUEUE_RESULT {
+    HTC_SEND_QUEUE_OK = 0,    /* packet was queued */
+    HTC_SEND_QUEUE_DROP = 1,  /* this packet should be dropped */
+} HTC_SEND_QUEUE_RESULT;
+
+#define DO_EP_TX_COMPLETION(ep,q)  DoSendCompletion(ep,q)
+
+/* call the distribute credits callback with the distribution */
+#define DO_DISTRIBUTION(t,reason,description,pList) \
+{                                             \
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,           \
+        ("  calling distribute function (%s) (dfn:0x%lX, ctxt:0x%lX, dist:0x%lX) \n", \
+                (description),                                           \
+                (unsigned long)(t)->DistributeCredits,                   \
+                (unsigned long)(t)->pCredDistContext,                    \
+                (unsigned long)pList));                                  \
+    (t)->DistributeCredits((t)->pCredDistContext,                        \
+                           (pList),                                      \
+                           (reason));                                    \
+}
+
+static void DoSendCompletion(struct htc_endpoint       *pEndpoint,
+                             struct htc_packet_queue   *pQueueToIndicate)
+{           
+    do {
+                
+        if (HTC_QUEUE_EMPTY(pQueueToIndicate)) {
+                /* nothing to indicate */
+            break;    
+        }
+ 
+        if (pEndpoint->EpCallBacks.EpTxCompleteMultiple != NULL) {    
+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" HTC calling ep %d, send complete multiple callback (%d pkts) \n",
+                     pEndpoint->Id, HTC_PACKET_QUEUE_DEPTH(pQueueToIndicate)));
+                /* a multiple send complete handler is being used, pass the queue to the handler */                             
+            pEndpoint->EpCallBacks.EpTxCompleteMultiple(pEndpoint->EpCallBacks.pContext,
+                                                        pQueueToIndicate);
+                /* all packets are now owned by the callback, reset queue to be safe */
+            INIT_HTC_PACKET_QUEUE(pQueueToIndicate);                                                      
+        } else {
+            struct htc_packet *pPacket;  
+            /* using legacy EpTxComplete */         
+            do {
+                pPacket = HTC_PACKET_DEQUEUE(pQueueToIndicate);
+                AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" HTC calling ep %d send complete callback on packet 0x%lX \n", \
+                        pEndpoint->Id, (unsigned long)(pPacket)));
+                pEndpoint->EpCallBacks.EpTxComplete(pEndpoint->EpCallBacks.pContext, pPacket);                                              
+            } while (!HTC_QUEUE_EMPTY(pQueueToIndicate));                                              
+        }
+        
+    } while (false);
+
+}
+
+/* do final completion on sent packet */
+static INLINE void CompleteSentPacket(struct htc_target *target, struct htc_endpoint *pEndpoint, struct htc_packet *pPacket)
+{
+    pPacket->Completion = NULL;  
+    
+    if (pPacket->Status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+            ("CompleteSentPacket: request failed (status:%d, ep:%d, length:%d creds:%d) \n",
+                pPacket->Status, pPacket->Endpoint, pPacket->ActualLength, pPacket->PktInfo.AsTx.CreditsUsed));                
+            /* on failure to submit, reclaim credits for this packet */        
+        LOCK_HTC_TX(target);        
+        pEndpoint->CreditDist.TxCreditsToDist += pPacket->PktInfo.AsTx.CreditsUsed;
+        pEndpoint->CreditDist.TxQueueDepth = HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue);
+        DO_DISTRIBUTION(target,
+                        HTC_CREDIT_DIST_SEND_COMPLETE,
+                        "Send Complete",
+                        target->EpCreditDistributionListHead->pNext);
+        UNLOCK_HTC_TX(target);            
+    }
+        /* first, fixup the head room we allocated */
+    pPacket->pBuffer += HTC_HDR_LENGTH; 
+}
+
+/* our internal send packet completion handler when packets are submited to the AR6K device
+ * layer */
+static void HTCSendPktCompletionHandler(void *Context, struct htc_packet *pPacket)
+{
+    struct htc_target      *target = (struct htc_target *)Context;
+    struct htc_endpoint    *pEndpoint = &target->EndPoint[pPacket->Endpoint];
+    struct htc_packet_queue container;
+    
+    CompleteSentPacket(target,pEndpoint,pPacket);
+    INIT_HTC_PACKET_QUEUE_AND_ADD(&container,pPacket);
+        /* do completion */
+    DO_EP_TX_COMPLETION(pEndpoint,&container);
+}
+
+int HTCIssueSend(struct htc_target *target, struct htc_packet *pPacket)
+{
+    int status;
+    bool   sync = false;
+
+    if (pPacket->Completion == NULL) {
+            /* mark that this request was synchronously issued */
+        sync = true;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
+                    ("+-HTCIssueSend: transmit length : %d (%s) \n",
+                    pPacket->ActualLength + (u32)HTC_HDR_LENGTH,
+                    sync ? "SYNC" : "ASYNC" ));
+
+        /* send message to device */
+    status = DevSendPacket(&target->Device,
+                           pPacket,
+                           pPacket->ActualLength + HTC_HDR_LENGTH);
+
+    if (sync) {
+            /* use local sync variable.  If this was issued asynchronously, pPacket is no longer
+             * safe to access. */
+        pPacket->pBuffer += HTC_HDR_LENGTH;
+    }
+    
+    /* if this request was asynchronous, the packet completion routine will be invoked by
+     * the device layer when the HIF layer completes the request */
+
+    return status;
+}
+
+    /* get HTC send packets from the TX queue on an endpoint */
+static INLINE void GetHTCSendPackets(struct htc_target        *target, 
+                                     struct htc_endpoint      *pEndpoint, 
+                                     struct htc_packet_queue  *pQueue)
+{
+    int          creditsRequired;
+    int          remainder;
+    u8 sendFlags;
+    struct htc_packet   *pPacket;
+    unsigned int transferLength;
+
+    /****** NOTE : the TX lock is held when this function is called *****************/
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+GetHTCSendPackets \n"));
+     
+        /* loop until we can grab as many packets out of the queue as we can */       
+    while (true) {
+        
+        sendFlags = 0;   
+            /* get packet at head, but don't remove it */
+        pPacket = HTC_GET_PKT_AT_HEAD(&pEndpoint->TxQueue);       
+        if (pPacket == NULL) {
+            break;    
+        }
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Got head packet:0x%lX , Queue Depth: %d\n",
+                (unsigned long)pPacket, HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue)));
+        
+        transferLength = DEV_CALC_SEND_PADDED_LEN(&target->Device, pPacket->ActualLength + HTC_HDR_LENGTH);       
+       
+        if (transferLength <= target->TargetCreditSize) {
+            creditsRequired = 1;    
+        } else {
+                /* figure out how many credits this message requires */
+            creditsRequired = transferLength / target->TargetCreditSize;
+            remainder = transferLength % target->TargetCreditSize;
+            
+            if (remainder) {
+                creditsRequired++;
+            }
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Creds Required:%d   Got:%d\n",
+                            creditsRequired, pEndpoint->CreditDist.TxCredits));
+
+        if (pEndpoint->CreditDist.TxCredits < creditsRequired) {
+
+                /* not enough credits */
+            if (pPacket->Endpoint == ENDPOINT_0) {
+                    /* leave it in the queue */
+                break;
+            }
+                /* invoke the registered distribution function only if this is not
+                 * endpoint 0, we let the driver layer provide more credits if it can.
+                 * We pass the credit distribution list starting at the endpoint in question
+                 * */
+
+                /* set how many credits we need  */
+            pEndpoint->CreditDist.TxCreditsSeek =
+                                    creditsRequired - pEndpoint->CreditDist.TxCredits;
+            DO_DISTRIBUTION(target,
+                            HTC_CREDIT_DIST_SEEK_CREDITS,
+                            "Seek Credits",
+                            &pEndpoint->CreditDist);
+            pEndpoint->CreditDist.TxCreditsSeek = 0;
+
+            if (pEndpoint->CreditDist.TxCredits < creditsRequired) {
+                    /* still not enough credits to send, leave packet in the queue */
+                AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
+                    (" Not enough credits for ep %d leaving packet in queue..\n",
+                    pPacket->Endpoint));
+                break;
+            }
+
+        }
+
+        pEndpoint->CreditDist.TxCredits -= creditsRequired;
+        INC_HTC_EP_STAT(pEndpoint, TxCreditsConsummed, creditsRequired);
+
+            /* check if we need credits back from the target */
+        if (pEndpoint->CreditDist.TxCredits < pEndpoint->CreditDist.TxCreditsPerMaxMsg) {
+                /* we are getting low on credits, see if we can ask for more from the distribution function */
+            pEndpoint->CreditDist.TxCreditsSeek =
+                        pEndpoint->CreditDist.TxCreditsPerMaxMsg - pEndpoint->CreditDist.TxCredits;
+
+            DO_DISTRIBUTION(target,
+                            HTC_CREDIT_DIST_SEEK_CREDITS,
+                            "Seek Credits",
+                            &pEndpoint->CreditDist);
+
+            pEndpoint->CreditDist.TxCreditsSeek = 0;
+                /* see if we were successful in getting more */
+            if (pEndpoint->CreditDist.TxCredits < pEndpoint->CreditDist.TxCreditsPerMaxMsg) {
+                    /* tell the target we need credits ASAP! */
+                sendFlags |= HTC_FLAGS_NEED_CREDIT_UPDATE;
+                INC_HTC_EP_STAT(pEndpoint, TxCreditLowIndications, 1);
+                AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Host Needs Credits  \n"));
+            }
+        }
+                        
+            /* now we can fully dequeue */
+        pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->TxQueue); 
+            /* save the number of credits this packet consumed */
+        pPacket->PktInfo.AsTx.CreditsUsed = creditsRequired;
+            /* all TX packets are handled asynchronously */
+        pPacket->Completion = HTCSendPktCompletionHandler;
+        pPacket->pContext = target;
+        INC_HTC_EP_STAT(pEndpoint, TxIssued, 1);
+            /* save send flags */
+        pPacket->PktInfo.AsTx.SendFlags = sendFlags;
+        pPacket->PktInfo.AsTx.SeqNo = pEndpoint->SeqNo;         
+        pEndpoint->SeqNo++;
+            /* queue this packet into the caller's queue */
+        HTC_PACKET_ENQUEUE(pQueue,pPacket);
+    }
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-GetHTCSendPackets \n"));
+     
+}
+
+static void HTCAsyncSendScatterCompletion(struct hif_scatter_req *pScatterReq)
+{
+    int                 i;    
+    struct htc_packet          *pPacket;
+    struct htc_endpoint        *pEndpoint = (struct htc_endpoint *)pScatterReq->Context;
+    struct htc_target          *target = (struct htc_target *)pEndpoint->target;
+    int            status = 0;
+    struct htc_packet_queue    sendCompletes;
+    
+    INIT_HTC_PACKET_QUEUE(&sendCompletes);
+          
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HTCAsyncSendScatterCompletion  TotLen: %d  Entries: %d\n",
+        pScatterReq->TotalLength, pScatterReq->ValidScatterEntries));
+    
+    DEV_FINISH_SCATTER_OPERATION(pScatterReq);
+           
+    if (pScatterReq->CompletionStatus) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("** Send Scatter Request Failed: %d \n",pScatterReq->CompletionStatus));            
+        status = A_ERROR;
+    }
+    
+        /* walk through the scatter list and process */
+    for (i = 0; i < pScatterReq->ValidScatterEntries; i++) {
+        pPacket = (struct htc_packet *)(pScatterReq->ScatterList[i].pCallerContexts[0]);
+        A_ASSERT(pPacket != NULL);
+        pPacket->Status = status;
+        CompleteSentPacket(target,pEndpoint,pPacket);
+            /* add it to the completion queue */
+        HTC_PACKET_ENQUEUE(&sendCompletes, pPacket);      
+    }
+    
+        /* free scatter request */
+    DEV_FREE_SCATTER_REQ(&target->Device,pScatterReq);
+        /* complete all packets */
+    DO_EP_TX_COMPLETION(pEndpoint,&sendCompletes);
+               
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-HTCAsyncSendScatterCompletion \n"));
+}
+
+    /* drain a queue and send as bundles 
+     * this function may return without fully draining the queue under the following conditions :
+     *    - scatter resources are exhausted
+     *    - a message that will consume a partial credit will stop the bundling process early 
+     *    - we drop below the minimum number of messages for a bundle 
+     * */
+static void HTCIssueSendBundle(struct htc_endpoint      *pEndpoint, 
+                               struct htc_packet_queue  *pQueue, 
+                               int               *pBundlesSent, 
+                               int               *pTotalBundlesPkts)
+{
+    int                 pktsToScatter;
+    unsigned int        scatterSpaceRemaining;
+    struct hif_scatter_req     *pScatterReq = NULL;
+    int                 i, packetsInScatterReq;
+    unsigned int        transferLength;
+    struct htc_packet          *pPacket;
+    bool              done = false;
+    int                 bundlesSent = 0;
+    int                 totalPktsInBundle = 0;
+    struct htc_target          *target = pEndpoint->target;
+    int                 creditRemainder = 0;
+    int                 creditPad;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HTCIssueSendBundle \n"));
+    
+    while (!done) {
+          
+        pktsToScatter = HTC_PACKET_QUEUE_DEPTH(pQueue);
+        pktsToScatter = min(pktsToScatter, target->MaxMsgPerBundle);
+        
+        if (pktsToScatter < HTC_MIN_HTC_MSGS_TO_BUNDLE) {
+                /* not enough to bundle */
+            break;    
+        }
+        
+        pScatterReq = DEV_ALLOC_SCATTER_REQ(&target->Device); 
+        
+        if (pScatterReq == NULL) {
+                /* no scatter resources  */
+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("   No more scatter resources \n"));
+            break;    
+        }       
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("   pkts to scatter: %d \n", pktsToScatter));
+        
+        pScatterReq->TotalLength = 0;
+        pScatterReq->ValidScatterEntries = 0;  
+        
+        packetsInScatterReq = 0;
+        scatterSpaceRemaining = DEV_GET_MAX_BUNDLE_SEND_LENGTH(&target->Device);
+        
+        for (i = 0; i < pktsToScatter; i++) {
+            
+            pScatterReq->ScatterList[i].pCallerContexts[0] = NULL;
+            
+            pPacket = HTC_GET_PKT_AT_HEAD(pQueue);        
+            if (pPacket == NULL) {
+                A_ASSERT(false);
+                break;    
+            }
+            
+            creditPad = 0;
+            transferLength = DEV_CALC_SEND_PADDED_LEN(&target->Device, 
+                                                      pPacket->ActualLength + HTC_HDR_LENGTH);               
+                /* see if the padded transfer length falls on a credit boundary */         
+            creditRemainder = transferLength % target->TargetCreditSize;
+                                
+            if (creditRemainder != 0) {
+                    /* the transfer consumes a "partial" credit, this packet cannot be bundled unless
+                     * we add additional "dummy" padding (max 255 bytes) to consume the entire credit 
+                     *** NOTE: only allow the send padding if the endpoint is allowed to */
+                if (pEndpoint->LocalConnectionFlags & HTC_LOCAL_CONN_FLAGS_ENABLE_SEND_BUNDLE_PADDING) {
+                    if (transferLength < target->TargetCreditSize) {
+                            /* special case where the transfer is less than a credit */
+                        creditPad = target->TargetCreditSize - transferLength;                    
+                    } else {
+                        creditPad = creditRemainder;    
+                    }
+                                    
+                        /* now check to see if we can indicate padding in the HTC header */
+                    if ((creditPad > 0) && (creditPad <= 255)) {
+                            /* adjust the transferlength of this packet with the new credit padding */
+                        transferLength += creditPad;            
+                    } else {
+                            /* the amount to pad is too large, bail on this packet, we have to 
+                             * send it using the non-bundled method */
+                        pPacket = NULL;
+                    }
+                } else {
+                        /* bail on this packet, user does not want padding applied */
+                    pPacket = NULL;    
+                }
+            }                       
+                       
+            if (NULL == pPacket) {
+                    /* can't bundle */
+                done = true;
+                break;    
+            }         
+               
+            if (scatterSpaceRemaining < transferLength) {
+                    /* exceeds what we can transfer */
+                break;    
+            }
+            
+            scatterSpaceRemaining -= transferLength;
+                /* now remove it from the queue */ 
+            pPacket = HTC_PACKET_DEQUEUE(pQueue);           
+                /* save it in the scatter list */
+            pScatterReq->ScatterList[i].pCallerContexts[0] = pPacket;            
+                /* prepare packet and flag message as part of a send bundle */               
+            HTC_PREPARE_SEND_PKT(pPacket,
+                                 pPacket->PktInfo.AsTx.SendFlags | HTC_FLAGS_SEND_BUNDLE, 
+                                 creditPad,                                 
+                                 pPacket->PktInfo.AsTx.SeqNo); 
+            pScatterReq->ScatterList[i].pBuffer = pPacket->pBuffer;
+            pScatterReq->ScatterList[i].Length = transferLength;
+            A_ASSERT(transferLength);
+            pScatterReq->TotalLength += transferLength;
+            pScatterReq->ValidScatterEntries++;
+            packetsInScatterReq++;             
+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("  %d, Adding packet : 0x%lX, len:%d (remaining space:%d) \n", 
+                    i, (unsigned long)pPacket,transferLength,scatterSpaceRemaining));                                                      
+        }
+                    
+        if (packetsInScatterReq >= HTC_MIN_HTC_MSGS_TO_BUNDLE) {          
+                /* send path is always asynchronous */
+            pScatterReq->CompletionRoutine = HTCAsyncSendScatterCompletion;
+            pScatterReq->Context = pEndpoint;
+            bundlesSent++;
+            totalPktsInBundle += packetsInScatterReq;
+            packetsInScatterReq = 0;
+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Send Scatter total bytes: %d , entries: %d\n",
+                                pScatterReq->TotalLength,pScatterReq->ValidScatterEntries));
+            DevSubmitScatterRequest(&target->Device, pScatterReq, DEV_SCATTER_WRITE, DEV_SCATTER_ASYNC);
+                /* we don't own this anymore */
+            pScatterReq = NULL;
+                /* try to send some more */
+            continue;               
+        } 
+        
+            /* not enough packets to use the scatter request, cleanup */
+        if (pScatterReq != NULL) {
+            if (packetsInScatterReq > 0) {
+                    /* work backwards to requeue requests */
+                for (i = (packetsInScatterReq - 1); i >= 0; i--) {
+                    pPacket = (struct htc_packet *)(pScatterReq->ScatterList[i].pCallerContexts[0]);
+                    if (pPacket != NULL) {
+                            /* undo any prep */
+                        HTC_UNPREPARE_SEND_PKT(pPacket);
+                            /* queue back to the head */
+                        HTC_PACKET_ENQUEUE_TO_HEAD(pQueue,pPacket);   
+                    }  
+                }  
+            }               
+            DEV_FREE_SCATTER_REQ(&target->Device,pScatterReq);    
+        }  
+        
+        /* if we get here, we sent all that we could, get out */
+        break;  
+        
+    }
+    
+    *pBundlesSent = bundlesSent;
+    *pTotalBundlesPkts = totalPktsInBundle;
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-HTCIssueSendBundle (sent:%d) \n",bundlesSent));  
+     
+    return; 
+}
+
+/*
+ * if there are no credits, the packet(s) remains in the queue.
+ * this function returns the result of the attempt to send a queue of HTC packets */
+static HTC_SEND_QUEUE_RESULT HTCTrySend(struct htc_target       *target,
+                                        struct htc_endpoint     *pEndpoint,
+                                        struct htc_packet_queue *pCallersSendQueue)
+{
+    struct htc_packet_queue      sendQueue; /* temp queue to hold packets at various stages */
+    struct htc_packet            *pPacket;
+    int                   bundlesSent;
+    int                   pktsInBundles;
+    int                   overflow;
+    HTC_SEND_QUEUE_RESULT result = HTC_SEND_QUEUE_OK;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HTCTrySend (Queue:0x%lX Depth:%d)\n",
+            (unsigned long)pCallersSendQueue, 
+            (pCallersSendQueue == NULL) ? 0 : HTC_PACKET_QUEUE_DEPTH(pCallersSendQueue)));
+
+        /* init the local send queue */
+    INIT_HTC_PACKET_QUEUE(&sendQueue);
+    
+    do {
+        
+        if (NULL == pCallersSendQueue) {
+                /* caller didn't provide a queue, just wants us to check queues and send */
+            break;    
+        }
+        
+        if (HTC_QUEUE_EMPTY(pCallersSendQueue)) {
+                /* empty queue */
+            result = HTC_SEND_QUEUE_DROP;
+            break;    
+        }
+  
+        if (HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue) >= pEndpoint->MaxTxQueueDepth) {
+                    /* we've already overflowed */
+            overflow = HTC_PACKET_QUEUE_DEPTH(pCallersSendQueue);    
+        } else {
+                /* figure out how much we will overflow by */
+            overflow = HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue);
+            overflow += HTC_PACKET_QUEUE_DEPTH(pCallersSendQueue); 
+                /* figure out how much we will overflow the TX queue by */
+            overflow -= pEndpoint->MaxTxQueueDepth;     
+        }
+                     
+            /* if overflow is negative or zero, we are okay */    
+        if (overflow > 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND, 
+                (" Endpoint %d, TX queue will overflow :%d , Tx Depth:%d, Max:%d \n",
+                pEndpoint->Id, overflow, HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue), pEndpoint->MaxTxQueueDepth));      
+        }   
+        if ((overflow <= 0) || (pEndpoint->EpCallBacks.EpSendFull == NULL)) {
+                /* all packets will fit or caller did not provide send full indication handler
+                 * --  just move all of them to the local sendQueue object */
+            HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&sendQueue, pCallersSendQueue);           
+        } else {
+            int               i;
+            int               goodPkts = HTC_PACKET_QUEUE_DEPTH(pCallersSendQueue) - overflow;
+                        
+            A_ASSERT(goodPkts >= 0);
+                /* we have overflowed, and a callback is provided */        
+                /* dequeue all non-overflow packets into the sendqueue */
+            for (i = 0; i < goodPkts; i++) {
+                    /* pop off caller's queue*/
+                pPacket = HTC_PACKET_DEQUEUE(pCallersSendQueue);
+                A_ASSERT(pPacket != NULL);
+                    /* insert into local queue */
+                HTC_PACKET_ENQUEUE(&sendQueue,pPacket);
+            }
+            
+                /* the caller's queue has all the packets that won't fit*/                
+                /* walk through the caller's queue and indicate each one to the send full handler */            
+            ITERATE_OVER_LIST_ALLOW_REMOVE(&pCallersSendQueue->QueueHead, pPacket, struct htc_packet, ListLink) {            
+                
+                AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Indicating overflowed TX packet: 0x%lX \n", 
+                                            (unsigned long)pPacket));    
+                if (pEndpoint->EpCallBacks.EpSendFull(pEndpoint->EpCallBacks.pContext,
+                                                      pPacket) == HTC_SEND_FULL_DROP) {
+                        /* callback wants the packet dropped */
+                    INC_HTC_EP_STAT(pEndpoint, TxDropped, 1);
+                        /* leave this one in the caller's queue for cleanup */
+                } else {
+                        /* callback wants to keep this packet, remove from caller's queue */
+                    HTC_PACKET_REMOVE(pCallersSendQueue, pPacket);
+                        /* put it in the send queue */
+                    HTC_PACKET_ENQUEUE(&sendQueue,pPacket);                                      
+                }
+                
+            } ITERATE_END;
+            
+            if (HTC_QUEUE_EMPTY(&sendQueue)) {
+                    /* no packets made it in, caller will cleanup */
+                result = HTC_SEND_QUEUE_DROP;
+                break;   
+            } 
+        }
+        
+    } while (false);
+    
+    if (result != HTC_SEND_QUEUE_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-HTCTrySend:  \n"));
+        return result;
+    }
+
+    LOCK_HTC_TX(target);
+    
+    if (!HTC_QUEUE_EMPTY(&sendQueue)) {
+            /* transfer packets */
+        HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(&pEndpoint->TxQueue,&sendQueue);
+        A_ASSERT(HTC_QUEUE_EMPTY(&sendQueue));
+        INIT_HTC_PACKET_QUEUE(&sendQueue); 
+    }
+    
+        /* increment tx processing count on entry */    
+    pEndpoint->TxProcessCount++;
+    if (pEndpoint->TxProcessCount > 1) {
+            /* another thread or task is draining the TX queues on this endpoint
+             * that thread will reset the tx processing count when the queue is drained */
+        pEndpoint->TxProcessCount--;
+        UNLOCK_HTC_TX(target);
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-HTCTrySend (busy) \n"));
+        return HTC_SEND_QUEUE_OK; 
+    }
+    
+    /***** beyond this point only 1 thread may enter ******/
+            
+        /* now drain the endpoint TX queue for transmission as long as we have enough
+         * credits */
+    while (true) {
+          
+        if (HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue) == 0) {
+            break;
+        }
+                
+            /* get all the packets for this endpoint that we can for this pass */
+        GetHTCSendPackets(target, pEndpoint, &sendQueue);        
+     
+        if (HTC_PACKET_QUEUE_DEPTH(&sendQueue) == 0) {
+                /* didn't get any packets due to a lack of credits */
+            break;    
+        }
+        
+        UNLOCK_HTC_TX(target);
+        
+            /* any packets to send are now in our local send queue */    
+         
+        bundlesSent = 0;
+        pktsInBundles = 0;
+     
+        while (true) {
+            
+                /* try to send a bundle on each pass */            
+            if ((target->SendBundlingEnabled) &&
+                    (HTC_PACKET_QUEUE_DEPTH(&sendQueue) >= HTC_MIN_HTC_MSGS_TO_BUNDLE)) {
+                 int temp1,temp2;       
+                    /* bundling is enabled and there is at least a minimum number of packets in the send queue
+                     * send what we can in this pass */                       
+                 HTCIssueSendBundle(pEndpoint, &sendQueue, &temp1, &temp2);
+                 bundlesSent += temp1;
+                 pktsInBundles += temp2;
+            }
+        
+                /* if not bundling or there was a packet that could not be placed in a bundle, pull it out
+                 * and send it the normal way */
+            pPacket = HTC_PACKET_DEQUEUE(&sendQueue);
+            if (NULL == pPacket) {
+                    /* local queue is fully drained */
+                break;    
+            }
+            HTC_PREPARE_SEND_PKT(pPacket,
+                                 pPacket->PktInfo.AsTx.SendFlags,
+                                 0,
+                                 pPacket->PktInfo.AsTx.SeqNo);  
+            HTCIssueSend(target, pPacket);
+            
+                /* go back and see if we can bundle some more */
+        }
+        
+        LOCK_HTC_TX(target);
+        
+        INC_HTC_EP_STAT(pEndpoint, TxBundles, bundlesSent);
+        INC_HTC_EP_STAT(pEndpoint, TxPacketsBundled, pktsInBundles);
+        
+    }
+        
+        /* done with this endpoint, we can clear the count */
+    pEndpoint->TxProcessCount = 0;
+    UNLOCK_HTC_TX(target);
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-HTCTrySend:  \n"));
+
+    return HTC_SEND_QUEUE_OK;
+}
+
+int  HTCSendPktsMultiple(HTC_HANDLE HTCHandle, struct htc_packet_queue *pPktQueue)
+{
+    struct htc_target      *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    struct htc_endpoint    *pEndpoint;
+    struct htc_packet      *pPacket;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCSendPktsMultiple: Queue: 0x%lX, Pkts %d \n",
+                    (unsigned long)pPktQueue, HTC_PACKET_QUEUE_DEPTH(pPktQueue)));
+    
+        /* get packet at head to figure out which endpoint these packets will go into */
+    pPacket = HTC_GET_PKT_AT_HEAD(pPktQueue);
+    if (NULL == pPacket) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCSendPktsMultiple \n"));
+        return A_EINVAL;   
+    }
+    
+    AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
+    pEndpoint = &target->EndPoint[pPacket->Endpoint];
+    
+    HTCTrySend(target, pEndpoint, pPktQueue);
+
+        /* do completion on any packets that couldn't get in */
+    if (!HTC_QUEUE_EMPTY(pPktQueue)) {        
+        
+        HTC_PACKET_QUEUE_ITERATE_ALLOW_REMOVE(pPktQueue,pPacket) {
+            if (HTC_STOPPING(target)) {
+                pPacket->Status = A_ECANCELED;
+            } else {
+                pPacket->Status = A_NO_RESOURCE;
+            } 
+        } HTC_PACKET_QUEUE_ITERATE_END;
+                   
+        DO_EP_TX_COMPLETION(pEndpoint,pPktQueue);
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCSendPktsMultiple \n"));
+
+    return 0;
+}
+
+/* HTC API - HTCSendPkt */
+int HTCSendPkt(HTC_HANDLE HTCHandle, struct htc_packet *pPacket)
+{
+    struct htc_packet_queue queue;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
+                    ("+-HTCSendPkt: Enter endPointId: %d, buffer: 0x%lX, length: %d \n",
+                    pPacket->Endpoint, (unsigned long)pPacket->pBuffer, pPacket->ActualLength));                   
+    INIT_HTC_PACKET_QUEUE_AND_ADD(&queue,pPacket); 
+    return HTCSendPktsMultiple(HTCHandle, &queue);
+}
+
+/* check TX queues to drain because of credit distribution update */
+static INLINE void HTCCheckEndpointTxQueues(struct htc_target *target)
+{
+    struct htc_endpoint                *pEndpoint;
+    struct htc_endpoint_credit_dist    *pDistItem;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCCheckEndpointTxQueues \n"));
+    pDistItem = target->EpCreditDistributionListHead;
+
+        /* run through the credit distribution list to see
+         * if there are packets queued
+         * NOTE: no locks need to be taken since the distribution list
+         * is not dynamic (cannot be re-ordered) and we are not modifying any state */
+    while (pDistItem != NULL) {
+        pEndpoint = (struct htc_endpoint *)pDistItem->pHTCReserved;
+
+        if (HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue) > 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Ep %d has %d credits and %d Packets in TX Queue \n",
+                    pDistItem->Endpoint, pEndpoint->CreditDist.TxCredits, HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue)));
+                /* try to start the stalled queue, this list is ordered by priority.
+                 * Highest priority queue get's processed first, if there are credits available the
+                 * highest priority queue will get a chance to reclaim credits from lower priority
+                 * ones */
+            HTCTrySend(target, pEndpoint, NULL);
+        }
+
+        pDistItem = pDistItem->pNext;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCCheckEndpointTxQueues \n"));
+}
+
+/* process credit reports and call distribution function */
+void HTCProcessCreditRpt(struct htc_target *target, HTC_CREDIT_REPORT *pRpt, int NumEntries, HTC_ENDPOINT_ID FromEndpoint)
+{
+    int             i;
+    struct htc_endpoint    *pEndpoint;
+    int             totalCredits = 0;
+    bool          doDist = false;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCProcessCreditRpt, Credit Report Entries:%d \n", NumEntries));
+
+        /* lock out TX while we update credits */
+    LOCK_HTC_TX(target);
+
+    for (i = 0; i < NumEntries; i++, pRpt++) {
+        if (pRpt->EndpointID >= ENDPOINT_MAX) {
+            AR_DEBUG_ASSERT(false);
+            break;
+        }
+
+        pEndpoint = &target->EndPoint[pRpt->EndpointID];
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("  Endpoint %d got %d credits \n",
+                pRpt->EndpointID, pRpt->Credits));
+
+        INC_HTC_EP_STAT(pEndpoint, TxCreditRpts, 1);
+        INC_HTC_EP_STAT(pEndpoint, TxCreditsReturned, pRpt->Credits);
+
+        if (FromEndpoint == pRpt->EndpointID) {
+                /* this credit report arrived on the same endpoint indicating it arrived in an RX
+                 * packet */
+            INC_HTC_EP_STAT(pEndpoint, TxCreditsFromRx, pRpt->Credits);
+            INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromRx, 1);
+        } else if (FromEndpoint == ENDPOINT_0) {
+                /* this credit arrived on endpoint 0 as a NULL message */
+            INC_HTC_EP_STAT(pEndpoint, TxCreditsFromEp0, pRpt->Credits);
+            INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromEp0, 1);
+        } else {
+                /* arrived on another endpoint */
+            INC_HTC_EP_STAT(pEndpoint, TxCreditsFromOther, pRpt->Credits);
+            INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromOther, 1);
+        }
+
+        if (ENDPOINT_0 == pRpt->EndpointID) {
+                /* always give endpoint 0 credits back */
+            pEndpoint->CreditDist.TxCredits += pRpt->Credits;
+        } else {
+                /* for all other endpoints, update credits to distribute, the distribution function
+                 * will handle giving out credits back to the endpoints */
+            pEndpoint->CreditDist.TxCreditsToDist += pRpt->Credits;
+                /* flag that we have to do the distribution */
+            doDist = true;
+        }
+        
+            /* refresh tx depth for distribution function that will recover these credits
+             * NOTE: this is only valid when there are credits to recover! */
+        pEndpoint->CreditDist.TxQueueDepth = HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue);
+        
+        totalCredits += pRpt->Credits;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("  Report indicated %d credits to distribute \n", totalCredits));
+
+    if (doDist) {
+            /* this was a credit return based on a completed send operations
+             * note, this is done with the lock held */
+        DO_DISTRIBUTION(target,
+                        HTC_CREDIT_DIST_SEND_COMPLETE,
+                        "Send Complete",
+                        target->EpCreditDistributionListHead->pNext);
+    }
+
+    UNLOCK_HTC_TX(target);
+
+    if (totalCredits) {
+        HTCCheckEndpointTxQueues(target);
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCProcessCreditRpt \n"));
+}
+
+/* flush endpoint TX queue */
+static void HTCFlushEndpointTX(struct htc_target *target, struct htc_endpoint *pEndpoint, HTC_TX_TAG Tag)
+{
+    struct htc_packet          *pPacket;
+    struct htc_packet_queue    discardQueue;
+    struct htc_packet_queue    container;
+
+        /* initialize the discard queue */
+    INIT_HTC_PACKET_QUEUE(&discardQueue);
+
+    LOCK_HTC_TX(target);
+
+        /* interate from the front of the TX queue and flush out packets */
+    ITERATE_OVER_LIST_ALLOW_REMOVE(&pEndpoint->TxQueue.QueueHead, pPacket, struct htc_packet, ListLink) {
+
+            /* check for removal */
+        if ((HTC_TX_PACKET_TAG_ALL == Tag) || (Tag == pPacket->PktInfo.AsTx.Tag)) {
+                /* remove from queue */
+            HTC_PACKET_REMOVE(&pEndpoint->TxQueue, pPacket);
+                /* add it to the discard pile */
+            HTC_PACKET_ENQUEUE(&discardQueue, pPacket);
+        }
+
+    } ITERATE_END;
+
+    UNLOCK_HTC_TX(target);
+
+        /* empty the discard queue */
+    while (1) {
+        pPacket = HTC_PACKET_DEQUEUE(&discardQueue);
+        if (NULL == pPacket) {
+            break;
+        }
+        pPacket->Status = A_ECANCELED;
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("  Flushing TX packet:0x%lX, length:%d, ep:%d tag:0x%X \n",
+                (unsigned long)pPacket, pPacket->ActualLength, pPacket->Endpoint, pPacket->PktInfo.AsTx.Tag));
+        INIT_HTC_PACKET_QUEUE_AND_ADD(&container,pPacket);
+        DO_EP_TX_COMPLETION(pEndpoint,&container);
+    }
+
+}
+
+void DumpCreditDist(struct htc_endpoint_credit_dist *pEPDist)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("--- EP : %d  ServiceID: 0x%X    --------------\n",
+                        pEPDist->Endpoint, pEPDist->ServiceID));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" this:0x%lX next:0x%lX prev:0x%lX\n",
+                (unsigned long)pEPDist, (unsigned long)pEPDist->pNext, (unsigned long)pEPDist->pPrev));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" DistFlags          : 0x%X \n", pEPDist->DistFlags));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsNorm      : %d \n", pEPDist->TxCreditsNorm));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsMin       : %d \n", pEPDist->TxCreditsMin));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCredits          : %d \n", pEPDist->TxCredits));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsAssigned  : %d \n", pEPDist->TxCreditsAssigned));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsSeek      : %d \n", pEPDist->TxCreditsSeek));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditSize       : %d \n", pEPDist->TxCreditSize));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsPerMaxMsg : %d \n", pEPDist->TxCreditsPerMaxMsg));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsToDist    : %d \n", pEPDist->TxCreditsToDist));
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxQueueDepth       : %d \n", 
+                    HTC_PACKET_QUEUE_DEPTH(&((struct htc_endpoint *)pEPDist->pHTCReserved)->TxQueue)));                                      
+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("----------------------------------------------------\n"));
+}
+
+void DumpCreditDistStates(struct htc_target *target)
+{
+    struct htc_endpoint_credit_dist *pEPList = target->EpCreditDistributionListHead;
+
+    while (pEPList != NULL) {
+        DumpCreditDist(pEPList);
+        pEPList = pEPList->pNext;
+    }
+
+    if (target->DistributeCredits != NULL) {
+        DO_DISTRIBUTION(target,
+                        HTC_DUMP_CREDIT_STATE,
+                        "Dump State",
+                        NULL);
+    }
+}
+
+/* flush all send packets from all endpoint queues */
+void HTCFlushSendPkts(struct htc_target *target)
+{
+    struct htc_endpoint    *pEndpoint;
+    int             i;
+
+    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_TRC)) {
+        DumpCreditDistStates(target);
+    }
+
+    for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
+        pEndpoint = &target->EndPoint[i];
+        if (pEndpoint->ServiceID == 0) {
+                /* not in use.. */
+            continue;
+        }
+        HTCFlushEndpointTX(target,pEndpoint,HTC_TX_PACKET_TAG_ALL);
+    }
+
+
+}
+
+/* HTC API to flush an endpoint's TX queue*/
+void HTCFlushEndpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint, HTC_TX_TAG Tag)
+{
+    struct htc_target      *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    struct htc_endpoint    *pEndpoint = &target->EndPoint[Endpoint];
+
+    if (pEndpoint->ServiceID == 0) {
+        AR_DEBUG_ASSERT(false);
+        /* not in use.. */
+        return;
+    }
+
+    HTCFlushEndpointTX(target, pEndpoint, Tag);
+}
+
+/* HTC API to indicate activity to the credit distribution function */
+void HTCIndicateActivityChange(HTC_HANDLE      HTCHandle,
+                               HTC_ENDPOINT_ID Endpoint,
+                               bool          Active)
+{
+    struct htc_target      *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    struct htc_endpoint    *pEndpoint = &target->EndPoint[Endpoint];
+    bool          doDist = false;
+
+    if (pEndpoint->ServiceID == 0) {
+        AR_DEBUG_ASSERT(false);
+        /* not in use.. */
+        return;
+    }
+
+    LOCK_HTC_TX(target);
+
+    if (Active) {
+        if (!(pEndpoint->CreditDist.DistFlags & HTC_EP_ACTIVE)) {
+                /* mark active now */
+            pEndpoint->CreditDist.DistFlags |= HTC_EP_ACTIVE;
+            doDist = true;
+        }
+    } else {
+        if (pEndpoint->CreditDist.DistFlags & HTC_EP_ACTIVE) {
+                /* mark inactive now */
+            pEndpoint->CreditDist.DistFlags &= ~HTC_EP_ACTIVE;
+            doDist = true;
+        }
+    }
+
+    if (doDist) {
+            /* indicate current Tx Queue depth to the credit distribution function */
+        pEndpoint->CreditDist.TxQueueDepth = HTC_PACKET_QUEUE_DEPTH(&pEndpoint->TxQueue);
+        /* do distribution again based on activity change
+         * note, this is done with the lock held */
+        DO_DISTRIBUTION(target,
+                        HTC_CREDIT_DIST_ACTIVITY_CHANGE,
+                        "Activity Change",
+                        target->EpCreditDistributionListHead->pNext);
+    }
+
+    UNLOCK_HTC_TX(target);
+
+    if (doDist && !Active) {
+        /* if a stream went inactive and this resulted in a credit distribution change,
+         * some credits may now be available for HTC packets that are stuck in
+         * HTC queues */
+        HTCCheckEndpointTxQueues(target);
+    }
+}
+
+bool HTCIsEndpointActive(HTC_HANDLE      HTCHandle,
+                           HTC_ENDPOINT_ID Endpoint)
+{
+    struct htc_target      *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    struct htc_endpoint    *pEndpoint = &target->EndPoint[Endpoint];
+
+    if (pEndpoint->ServiceID == 0) {
+        return false;
+    }
+    
+    if (pEndpoint->CreditDist.DistFlags & HTC_EP_ACTIVE) {
+        return true;
+    }
+    
+    return false;
+}
diff --git a/drivers/staging/ath6kl/htc2/htc_services.c b/drivers/staging/ath6kl/htc2/htc_services.c
new file mode 100644
index 00000000000..c48070cbd54
--- /dev/null
+++ b/drivers/staging/ath6kl/htc2/htc_services.c
@@ -0,0 +1,450 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_services.c" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#include "htc_internal.h"
+
+void HTCControlTxComplete(void *Context, struct htc_packet *pPacket)
+{
+        /* not implemented
+         * we do not send control TX frames during normal runtime, only during setup  */
+    AR_DEBUG_ASSERT(false);
+}
+
+    /* callback when a control message arrives on this endpoint */
+void HTCControlRecv(void *Context, struct htc_packet *pPacket)
+{
+    AR_DEBUG_ASSERT(pPacket->Endpoint == ENDPOINT_0);
+
+    if (pPacket->Status == A_ECANCELED) {
+        /* this is a flush operation, return the control packet back to the pool */
+        HTC_FREE_CONTROL_RX((struct htc_target*)Context,pPacket);    
+        return;
+    }  
+    
+        /* the only control messages we are expecting are NULL messages (credit resports) */   
+    if (pPacket->ActualLength > 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("HTCControlRecv, got message with length:%d \n",
+                        pPacket->ActualLength + (u32)HTC_HDR_LENGTH));
+
+#ifdef ATH_DEBUG_MODULE
+            /* dump header and message */
+        DebugDumpBytes(pPacket->pBuffer - HTC_HDR_LENGTH,
+                       pPacket->ActualLength + HTC_HDR_LENGTH,
+                       "Unexpected ENDPOINT 0 Message");
+#endif
+    }
+
+    HTC_RECYCLE_RX_PKT((struct htc_target*)Context,pPacket,&((struct htc_target*)Context)->EndPoint[0]);
+}
+
+int HTCSendSetupComplete(struct htc_target *target)
+{
+    struct htc_packet             *pSendPacket = NULL;
+    int                status;
+
+    do {
+           /* allocate a packet to send to the target */
+        pSendPacket = HTC_ALLOC_CONTROL_TX(target);
+
+        if (NULL == pSendPacket) {
+            status = A_NO_MEMORY;
+            break;
+        }
+
+        if (target->HTCTargetVersion >= HTC_VERSION_2P1) {
+            HTC_SETUP_COMPLETE_EX_MSG *pSetupCompleteEx;
+            u32 setupFlags = 0;
+                   
+            pSetupCompleteEx = (HTC_SETUP_COMPLETE_EX_MSG *)pSendPacket->pBuffer;
+            A_MEMZERO(pSetupCompleteEx, sizeof(HTC_SETUP_COMPLETE_EX_MSG));
+            pSetupCompleteEx->MessageID = HTC_MSG_SETUP_COMPLETE_EX_ID;   
+            if (target->MaxMsgPerBundle > 0) {
+                    /* host can do HTC bundling, indicate this to the target */
+                setupFlags |= HTC_SETUP_COMPLETE_FLAGS_ENABLE_BUNDLE_RECV; 
+                pSetupCompleteEx->MaxMsgsPerBundledRecv = target->MaxMsgPerBundle;
+            }    
+            memcpy(&pSetupCompleteEx->SetupFlags, &setupFlags, sizeof(pSetupCompleteEx->SetupFlags));            
+            SET_HTC_PACKET_INFO_TX(pSendPacket,
+                                   NULL,
+                                   (u8 *)pSetupCompleteEx,
+                                   sizeof(HTC_SETUP_COMPLETE_EX_MSG),
+                                   ENDPOINT_0,
+                                   HTC_SERVICE_TX_PACKET_TAG);
+      
+        }  else {            
+            HTC_SETUP_COMPLETE_MSG *pSetupComplete;
+                /* assemble setup complete message */
+            pSetupComplete = (HTC_SETUP_COMPLETE_MSG *)pSendPacket->pBuffer;
+            A_MEMZERO(pSetupComplete, sizeof(HTC_SETUP_COMPLETE_MSG));
+            pSetupComplete->MessageID = HTC_MSG_SETUP_COMPLETE_ID;   
+            SET_HTC_PACKET_INFO_TX(pSendPacket,
+                                   NULL,
+                                   (u8 *)pSetupComplete,
+                                   sizeof(HTC_SETUP_COMPLETE_MSG),
+                                   ENDPOINT_0,
+                                   HTC_SERVICE_TX_PACKET_TAG);
+        }
+
+            /* we want synchronous operation */
+        pSendPacket->Completion = NULL;
+        HTC_PREPARE_SEND_PKT(pSendPacket,0,0,0);
+            /* send the message */
+        status = HTCIssueSend(target,pSendPacket);
+
+    } while (false);
+
+    if (pSendPacket != NULL) {
+        HTC_FREE_CONTROL_TX(target,pSendPacket);
+    }
+
+    return status;
+}
+
+
+int HTCConnectService(HTC_HANDLE               HTCHandle,
+                           struct htc_service_connect_req  *pConnectReq,
+                           struct htc_service_connect_resp *pConnectResp)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    int                            status = 0;
+    struct htc_packet                          *pRecvPacket = NULL;
+    struct htc_packet                          *pSendPacket = NULL;
+    HTC_CONNECT_SERVICE_RESPONSE_MSG    *pResponseMsg;
+    HTC_CONNECT_SERVICE_MSG             *pConnectMsg;
+    HTC_ENDPOINT_ID                     assignedEndpoint = ENDPOINT_MAX;
+    struct htc_endpoint                        *pEndpoint;
+    unsigned int                        maxMsgSize = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCConnectService, target:0x%lX SvcID:0x%X \n",
+               (unsigned long)target, pConnectReq->ServiceID));
+
+    do {
+
+        AR_DEBUG_ASSERT(pConnectReq->ServiceID != 0);
+
+        if (HTC_CTRL_RSVD_SVC == pConnectReq->ServiceID) {
+                /* special case for pseudo control service */
+            assignedEndpoint = ENDPOINT_0;
+            maxMsgSize = HTC_MAX_CONTROL_MESSAGE_LENGTH;
+        } else {
+                /* allocate a packet to send to the target */
+            pSendPacket = HTC_ALLOC_CONTROL_TX(target);
+
+            if (NULL == pSendPacket) {
+                AR_DEBUG_ASSERT(false);
+                status = A_NO_MEMORY;
+                break;
+            }
+                /* assemble connect service message */
+            pConnectMsg = (HTC_CONNECT_SERVICE_MSG *)pSendPacket->pBuffer;
+            AR_DEBUG_ASSERT(pConnectMsg != NULL);
+            A_MEMZERO(pConnectMsg,sizeof(HTC_CONNECT_SERVICE_MSG));
+            pConnectMsg->MessageID = HTC_MSG_CONNECT_SERVICE_ID;
+            pConnectMsg->ServiceID = pConnectReq->ServiceID;
+            pConnectMsg->ConnectionFlags = pConnectReq->ConnectionFlags;
+                /* check caller if it wants to transfer meta data */
+            if ((pConnectReq->pMetaData != NULL) &&
+                (pConnectReq->MetaDataLength <= HTC_SERVICE_META_DATA_MAX_LENGTH)) {
+                    /* copy meta data into message buffer (after header ) */
+                memcpy((u8 *)pConnectMsg + sizeof(HTC_CONNECT_SERVICE_MSG),
+                         pConnectReq->pMetaData,
+                         pConnectReq->MetaDataLength);
+                pConnectMsg->ServiceMetaLength = pConnectReq->MetaDataLength;
+            }
+
+            SET_HTC_PACKET_INFO_TX(pSendPacket,
+                                   NULL,
+                                   (u8 *)pConnectMsg,
+                                   sizeof(HTC_CONNECT_SERVICE_MSG) + pConnectMsg->ServiceMetaLength,
+                                   ENDPOINT_0,
+                                   HTC_SERVICE_TX_PACKET_TAG);
+
+                /* we want synchronous operation */
+            pSendPacket->Completion = NULL;
+            HTC_PREPARE_SEND_PKT(pSendPacket,0,0,0);
+            status = HTCIssueSend(target,pSendPacket);
+
+            if (status) {
+                break;
+            }
+
+                /* wait for response */
+            status = HTCWaitforControlMessage(target, &pRecvPacket);
+
+            if (status) {
+                break;
+            }
+                /* we controlled the buffer creation so it has to be properly aligned */
+            pResponseMsg = (HTC_CONNECT_SERVICE_RESPONSE_MSG *)pRecvPacket->pBuffer;
+
+            if ((pResponseMsg->MessageID != HTC_MSG_CONNECT_SERVICE_RESPONSE_ID) ||
+                (pRecvPacket->ActualLength < sizeof(HTC_CONNECT_SERVICE_RESPONSE_MSG))) {
+                    /* this message is not valid */
+                AR_DEBUG_ASSERT(false);
+                status = A_EPROTO;
+                break;
+            }
+
+            pConnectResp->ConnectRespCode = pResponseMsg->Status;
+                /* check response status */
+            if (pResponseMsg->Status != HTC_SERVICE_SUCCESS) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    (" Target failed service 0x%X connect request (status:%d)\n",
+                                pResponseMsg->ServiceID, pResponseMsg->Status));
+                status = A_EPROTO;
+                break;
+            }
+
+            assignedEndpoint = (HTC_ENDPOINT_ID) pResponseMsg->EndpointID;
+            maxMsgSize = pResponseMsg->MaxMsgSize;
+
+            if ((pConnectResp->pMetaData != NULL) &&
+                (pResponseMsg->ServiceMetaLength > 0) &&
+                (pResponseMsg->ServiceMetaLength <= HTC_SERVICE_META_DATA_MAX_LENGTH)) {
+                    /* caller supplied a buffer and the target responded with data */
+                int copyLength = min((int)pConnectResp->BufferLength, (int)pResponseMsg->ServiceMetaLength);
+                    /* copy the meta data */
+                memcpy(pConnectResp->pMetaData,
+                         ((u8 *)pResponseMsg) + sizeof(HTC_CONNECT_SERVICE_RESPONSE_MSG),
+                         copyLength);
+                pConnectResp->ActualLength = copyLength;
+            }
+
+        }
+
+            /* the rest of these are parameter checks so set the error status */
+        status = A_EPROTO;
+
+        if (assignedEndpoint >= ENDPOINT_MAX) {
+            AR_DEBUG_ASSERT(false);
+            break;
+        }
+
+        if (0 == maxMsgSize) {
+            AR_DEBUG_ASSERT(false);
+            break;
+        }
+
+        pEndpoint = &target->EndPoint[assignedEndpoint];
+        pEndpoint->Id = assignedEndpoint;
+        if (pEndpoint->ServiceID != 0) {
+            /* endpoint already in use! */
+            AR_DEBUG_ASSERT(false);
+            break;
+        }
+
+            /* return assigned endpoint to caller */
+        pConnectResp->Endpoint = assignedEndpoint;
+        pConnectResp->MaxMsgLength = maxMsgSize;
+
+            /* setup the endpoint */
+        pEndpoint->ServiceID = pConnectReq->ServiceID; /* this marks the endpoint in use */
+        pEndpoint->MaxTxQueueDepth = pConnectReq->MaxSendQueueDepth;
+        pEndpoint->MaxMsgLength = maxMsgSize;
+            /* copy all the callbacks */
+        pEndpoint->EpCallBacks = pConnectReq->EpCallbacks;
+            /* set the credit distribution info for this endpoint, this information is
+             * passed back to the credit distribution callback function */
+        pEndpoint->CreditDist.ServiceID = pConnectReq->ServiceID;
+        pEndpoint->CreditDist.pHTCReserved = pEndpoint;
+        pEndpoint->CreditDist.Endpoint = assignedEndpoint;
+        pEndpoint->CreditDist.TxCreditSize = target->TargetCreditSize;
+        
+        if (pConnectReq->MaxSendMsgSize != 0) {
+                /* override TxCreditsPerMaxMsg calculation, this optimizes the credit-low indications
+                 * since the host will actually issue smaller messages in the Send path */
+            if (pConnectReq->MaxSendMsgSize > maxMsgSize) {
+                    /* can't be larger than the maximum the target can support */
+                AR_DEBUG_ASSERT(false);
+                break;       
+            }
+            pEndpoint->CreditDist.TxCreditsPerMaxMsg = pConnectReq->MaxSendMsgSize / target->TargetCreditSize;
+        } else {
+            pEndpoint->CreditDist.TxCreditsPerMaxMsg = maxMsgSize / target->TargetCreditSize;
+        }
+        
+        if (0 == pEndpoint->CreditDist.TxCreditsPerMaxMsg) {
+            pEndpoint->CreditDist.TxCreditsPerMaxMsg = 1;
+        }
+        
+            /* save local connection flags */
+        pEndpoint->LocalConnectionFlags = pConnectReq->LocalConnectionFlags;
+        
+        status = 0;
+
+    } while (false);
+
+    if (pSendPacket != NULL) {
+        HTC_FREE_CONTROL_TX(target,pSendPacket);
+    }
+
+    if (pRecvPacket != NULL) {
+        HTC_FREE_CONTROL_RX(target,pRecvPacket);
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCConnectService \n"));
+
+    return status;
+}
+
+static void AddToEndpointDistList(struct htc_target *target, struct htc_endpoint_credit_dist *pEpDist)
+{
+    struct htc_endpoint_credit_dist *pCurEntry,*pLastEntry;
+
+    if (NULL == target->EpCreditDistributionListHead) {
+        target->EpCreditDistributionListHead = pEpDist;
+        pEpDist->pNext = NULL;
+        pEpDist->pPrev = NULL;
+        return;
+    }
+
+        /* queue to the end of the list, this does not have to be very
+         * fast since this list is built at startup time */
+    pCurEntry = target->EpCreditDistributionListHead;
+
+    while (pCurEntry) {
+        pLastEntry = pCurEntry;
+        pCurEntry = pCurEntry->pNext;
+    }
+
+    pLastEntry->pNext = pEpDist;
+    pEpDist->pPrev = pLastEntry;
+    pEpDist->pNext = NULL;
+}
+
+
+
+/* default credit init callback */
+static void HTCDefaultCreditInit(void                     *Context,
+                                 struct htc_endpoint_credit_dist *pEPList,
+                                 int                      TotalCredits)
+{
+    struct htc_endpoint_credit_dist *pCurEpDist;
+    int                      totalEps = 0;
+    int                      creditsPerEndpoint;
+
+    pCurEpDist = pEPList;
+        /* first run through the list and figure out how many endpoints we are dealing with */
+    while (pCurEpDist != NULL) {
+        pCurEpDist = pCurEpDist->pNext;
+        totalEps++;
+    }
+
+        /* even distribution */
+    creditsPerEndpoint = TotalCredits/totalEps;
+
+    pCurEpDist = pEPList;
+        /* run through the list and set minimum and normal credits and
+         * provide the endpoint with some credits to start */
+    while (pCurEpDist != NULL) {
+
+        if (creditsPerEndpoint < pCurEpDist->TxCreditsPerMaxMsg) {
+                /* too many endpoints and not enough credits */
+            AR_DEBUG_ASSERT(false);
+            break;
+        }
+            /* our minimum is set for at least 1 max message */
+        pCurEpDist->TxCreditsMin = pCurEpDist->TxCreditsPerMaxMsg;
+            /* this value is ignored by our credit alg, since we do
+             * not dynamically adjust credits, this is the policy of
+             * the "default" credit distribution, something simple and easy */
+        pCurEpDist->TxCreditsNorm = 0xFFFF;
+            /* give the endpoint minimum credits */
+        pCurEpDist->TxCredits = creditsPerEndpoint;
+        pCurEpDist->TxCreditsAssigned = creditsPerEndpoint;
+        pCurEpDist = pCurEpDist->pNext;
+    }
+
+}
+
+/* default credit distribution callback, NOTE, this callback holds the TX lock */
+void HTCDefaultCreditDist(void                     *Context,
+                          struct htc_endpoint_credit_dist *pEPDistList,
+                          HTC_CREDIT_DIST_REASON   Reason)
+{
+    struct htc_endpoint_credit_dist *pCurEpDist;
+
+    if (Reason == HTC_CREDIT_DIST_SEND_COMPLETE) {
+        pCurEpDist = pEPDistList;
+            /* simple distribution */
+        while (pCurEpDist != NULL) {
+            if (pCurEpDist->TxCreditsToDist > 0) {
+                    /* just give the endpoint back the credits */
+                pCurEpDist->TxCredits += pCurEpDist->TxCreditsToDist;
+                pCurEpDist->TxCreditsToDist = 0;
+            }
+            pCurEpDist = pCurEpDist->pNext;
+        }
+    }
+
+    /* note we do not need to handle the other reason codes as this is a very
+     * simple distribution scheme, no need to seek for more credits or handle inactivity */
+}
+
+void HTCSetCreditDistribution(HTC_HANDLE               HTCHandle,
+                              void                     *pCreditDistContext,
+                              HTC_CREDIT_DIST_CALLBACK CreditDistFunc,
+                              HTC_CREDIT_INIT_CALLBACK CreditInitFunc,
+                              HTC_SERVICE_ID           ServicePriorityOrder[],
+                              int                      ListLength)
+{
+    struct htc_target *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+    int i;
+    int ep;
+
+    if (CreditInitFunc != NULL) {
+            /* caller has supplied their own distribution functions */
+        target->InitCredits = CreditInitFunc;
+        AR_DEBUG_ASSERT(CreditDistFunc != NULL);
+        target->DistributeCredits = CreditDistFunc;
+        target->pCredDistContext = pCreditDistContext;
+    } else {
+        /* caller wants HTC to do distribution */
+        /* if caller wants service to handle distributions then
+         * it must set both of these to NULL! */
+        AR_DEBUG_ASSERT(CreditDistFunc == NULL);
+        target->InitCredits = HTCDefaultCreditInit;
+        target->DistributeCredits = HTCDefaultCreditDist;
+        target->pCredDistContext = target;
+    }
+
+        /* always add HTC control endpoint first, we only expose the list after the
+         * first one, this is added for TX queue checking */
+    AddToEndpointDistList(target, &target->EndPoint[ENDPOINT_0].CreditDist);
+
+        /* build the list of credit distribution structures in priority order
+         * supplied by the caller, these will follow endpoint 0 */
+    for (i = 0; i < ListLength; i++) {
+            /* match services with endpoints and add the endpoints to the distribution list
+             * in FIFO order */
+        for (ep = ENDPOINT_1; ep < ENDPOINT_MAX; ep++) {
+            if (target->EndPoint[ep].ServiceID == ServicePriorityOrder[i]) {
+                    /* queue this one to the list */
+                AddToEndpointDistList(target, &target->EndPoint[ep].CreditDist);
+                break;
+            }
+        }
+        AR_DEBUG_ASSERT(ep < ENDPOINT_MAX);
+    }
+
+}
diff --git a/drivers/staging/ath6kl/include/a_config.h b/drivers/staging/ath6kl/include/a_config.h
new file mode 100644
index 00000000000..f7c09319433
--- /dev/null
+++ b/drivers/staging/ath6kl/include/a_config.h
@@ -0,0 +1,31 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_config.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains software configuration options that enables
+// specific software "features"
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_CONFIG_H_
+#define _A_CONFIG_H_
+
+#include "../os/linux/include/config_linux.h"
+
+#endif
diff --git a/drivers/staging/ath6kl/include/a_debug.h b/drivers/staging/ath6kl/include/a_debug.h
new file mode 100644
index 00000000000..5154fcb1ca6
--- /dev/null
+++ b/drivers/staging/ath6kl/include/a_debug.h
@@ -0,0 +1,195 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_debug.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_DEBUG_H_
+#define _A_DEBUG_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+#include <a_osapi.h>
+
+    /* standard debug print masks bits 0..7 */
+#define ATH_DEBUG_ERR   (1 << 0)   /* errors */
+#define ATH_DEBUG_WARN  (1 << 1)   /* warnings */
+#define ATH_DEBUG_INFO  (1 << 2)   /* informational (module startup info) */
+#define ATH_DEBUG_TRC   (1 << 3)   /* generic function call tracing */
+#define ATH_DEBUG_RSVD1 (1 << 4)
+#define ATH_DEBUG_RSVD2 (1 << 5)
+#define ATH_DEBUG_RSVD3 (1 << 6)
+#define ATH_DEBUG_RSVD4 (1 << 7)
+
+#define ATH_DEBUG_MASK_DEFAULTS  (ATH_DEBUG_ERR | ATH_DEBUG_WARN)
+#define ATH_DEBUG_ANY  0xFFFF
+
+    /* other aliases used throughout */
+#define ATH_DEBUG_ERROR   ATH_DEBUG_ERR
+#define ATH_LOG_ERR       ATH_DEBUG_ERR
+#define ATH_LOG_INF       ATH_DEBUG_INFO
+#define ATH_LOG_TRC       ATH_DEBUG_TRC
+#define ATH_DEBUG_TRACE   ATH_DEBUG_TRC
+#define ATH_DEBUG_INIT    ATH_DEBUG_INFO
+
+    /* bits 8..31 are module-specific masks */
+#define ATH_DEBUG_MODULE_MASK_SHIFT   8
+
+    /* macro to make a module-specific masks */
+#define ATH_DEBUG_MAKE_MODULE_MASK(index)  (1 << (ATH_DEBUG_MODULE_MASK_SHIFT + (index)))
+
+void DebugDumpBytes(u8 *buffer, u16 length, char *pDescription);
+
+/* Debug support on a per-module basis
+ *
+ * Usage:
+ *
+ *   Each module can utilize it's own debug mask variable.  A set of commonly used
+ *   masks are provided (ERRORS, WARNINGS, TRACE etc..).  It is up to each module
+ *   to define module-specific masks using the macros above.
+ *
+ *   Each module defines a single debug mask variable debug_XXX where the "name" of the module is
+ *   common to all C-files within that module.  This requires every C-file that includes a_debug.h
+ *   to define the module name in that file.
+ *
+ *   Example:
+ *
+ *   #define ATH_MODULE_NAME htc
+ *   #include "a_debug.h"
+ *
+ *   This will define a debug mask structure called debug_htc and all debug macros will reference this
+ *   variable.
+ *
+ *   A module can define module-specific bit masks using the ATH_DEBUG_MAKE_MODULE_MASK() macro:
+ *
+ *      #define ATH_DEBUG_MY_MASK1  ATH_DEBUG_MAKE_MODULE_MASK(0)
+ *      #define ATH_DEBUG_MY_MASK2  ATH_DEBUG_MAKE_MODULE_MASK(1)
+ *
+ *   The instantiation of the debug structure should be made by the module.  When a module is
+ *   instantiated, the module can set a description string, a default mask and an array of description
+ *   entries containing information on each module-defined debug mask.
+ *   NOTE: The instantiation is statically allocated, only one instance can exist per module.
+ *
+ *   Example:
+ *
+ *
+ *   #define ATH_DEBUG_BMI  ATH_DEBUG_MAKE_MODULE_MASK(0)
+ *
+ *   #ifdef DEBUG
+ *   static struct ath_debug_mask_description bmi_debug_desc[] = {
+ *       { ATH_DEBUG_BMI , "BMI Tracing"},   <== description of the module specific mask
+ *   };
+ *
+ *   ATH_DEBUG_INSTANTIATE_MODULE_VAR(bmi,
+ *                                    "bmi"  <== module name
+ *                                    "Boot Manager Interface",  <== description of module
+ *                                    ATH_DEBUG_MASK_DEFAULTS,          <== defaults
+ *                                    ATH_DEBUG_DESCRIPTION_COUNT(bmi_debug_desc),
+ *                                    bmi_debug_desc);
+ *
+ *   #endif
+ *
+ *  A module can optionally register it's debug module information in order for other tools to change the
+ *  bit mask at runtime.  A module can call  A_REGISTER_MODULE_DEBUG_INFO() in it's module
+ *  init code.  This macro can be called multiple times without consequence.  The debug info maintains
+ *  state to indicate whether the information was previously registered.
+ *
+ * */
+
+#define ATH_DEBUG_MAX_MASK_DESC_LENGTH   32
+#define ATH_DEBUG_MAX_MOD_DESC_LENGTH    64
+
+struct ath_debug_mask_description {
+    u32 Mask;
+    char Description[ATH_DEBUG_MAX_MASK_DESC_LENGTH];
+};
+
+#define ATH_DEBUG_INFO_FLAGS_REGISTERED (1 << 0)
+
+typedef struct  _ATH_DEBUG_MODULE_DBG_INFO{
+    struct _ATH_DEBUG_MODULE_DBG_INFO *pNext;
+    char ModuleName[16];
+    char ModuleDescription[ATH_DEBUG_MAX_MOD_DESC_LENGTH];
+    u32 Flags;
+    u32 CurrentMask;
+    int                         MaxDescriptions;
+    struct ath_debug_mask_description  *pMaskDescriptions; /* pointer to array of descriptions */
+} ATH_DEBUG_MODULE_DBG_INFO;
+
+#define ATH_DEBUG_DESCRIPTION_COUNT(d)  (int)((sizeof((d))) / (sizeof(struct ath_debug_mask_description)))
+
+#define GET_ATH_MODULE_DEBUG_VAR_NAME(s) _XGET_ATH_MODULE_NAME_DEBUG_(s)
+#define GET_ATH_MODULE_DEBUG_VAR_MASK(s) _XGET_ATH_MODULE_NAME_DEBUG_(s).CurrentMask
+#define _XGET_ATH_MODULE_NAME_DEBUG_(s) debug_ ## s
+
+#ifdef ATH_DEBUG_MODULE
+
+    /* for source files that will instantiate the debug variables */
+#define ATH_DEBUG_INSTANTIATE_MODULE_VAR(s,name,moddesc,initmask,count,descriptions) \
+ATH_DEBUG_MODULE_DBG_INFO GET_ATH_MODULE_DEBUG_VAR_NAME(s) = \
+            {NULL,(name),(moddesc),0,(initmask),count,(descriptions)}
+
+#ifdef ATH_MODULE_NAME
+extern ATH_DEBUG_MODULE_DBG_INFO GET_ATH_MODULE_DEBUG_VAR_NAME(ATH_MODULE_NAME);
+#define AR_DEBUG_LVL_CHECK(lvl) (GET_ATH_MODULE_DEBUG_VAR_MASK(ATH_MODULE_NAME) & (lvl))
+#endif /* ATH_MODULE_NAME */
+
+#define ATH_DEBUG_SET_DEBUG_MASK(s,lvl) GET_ATH_MODULE_DEBUG_VAR_MASK(s) = (lvl)
+
+#define ATH_DEBUG_DECLARE_EXTERN(s) \
+    extern ATH_DEBUG_MODULE_DBG_INFO GET_ATH_MODULE_DEBUG_VAR_NAME(s)
+
+#define AR_DEBUG_PRINTBUF(buffer, length, desc) DebugDumpBytes(buffer,length,desc)
+
+
+#define AR_DEBUG_ASSERT A_ASSERT
+
+void a_dump_module_debug_info(ATH_DEBUG_MODULE_DBG_INFO *pInfo);
+void a_register_module_debug_info(ATH_DEBUG_MODULE_DBG_INFO *pInfo);
+#define A_DUMP_MODULE_DEBUG_INFO(s) a_dump_module_debug_info(&(GET_ATH_MODULE_DEBUG_VAR_NAME(s)))
+#define A_REGISTER_MODULE_DEBUG_INFO(s) a_register_module_debug_info(&(GET_ATH_MODULE_DEBUG_VAR_NAME(s)))
+
+#else /* !ATH_DEBUG_MODULE */
+    /* NON ATH_DEBUG_MODULE */
+#define ATH_DEBUG_INSTANTIATE_MODULE_VAR(s,name,moddesc,initmask,count,descriptions)
+#define AR_DEBUG_LVL_CHECK(lvl) 0
+#define AR_DEBUG_PRINTBUF(buffer, length, desc)
+#define AR_DEBUG_ASSERT(test)
+#define ATH_DEBUG_DECLARE_EXTERN(s)
+#define ATH_DEBUG_SET_DEBUG_MASK(s,lvl)
+#define A_DUMP_MODULE_DEBUG_INFO(s)
+#define A_REGISTER_MODULE_DEBUG_INFO(s)
+
+#endif
+
+int a_get_module_mask(char *module_name, u32 *pMask);
+int a_set_module_mask(char *module_name, u32 Mask);
+void a_dump_module_debug_info_by_name(char *module_name);
+void a_module_debug_support_init(void);
+void a_module_debug_support_cleanup(void);
+
+#include "../os/linux/include/debug_linux.h"
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif
diff --git a/drivers/staging/ath6kl/include/a_drv.h b/drivers/staging/ath6kl/include/a_drv.h
new file mode 100644
index 00000000000..1548604e846
--- /dev/null
+++ b/drivers/staging/ath6kl/include/a_drv.h
@@ -0,0 +1,32 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_drv.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_DRV_H_
+#define _A_DRV_H_
+
+#include "../os/linux/include/athdrv_linux.h"
+
+#endif /* _ADRV_H_ */
diff --git a/drivers/staging/ath6kl/include/a_drv_api.h b/drivers/staging/ath6kl/include/a_drv_api.h
new file mode 100644
index 00000000000..a40d97a84ff
--- /dev/null
+++ b/drivers/staging/ath6kl/include/a_drv_api.h
@@ -0,0 +1,204 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_drv_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_DRV_API_H_
+#define _A_DRV_API_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/****************************************************************************/
+/****************************************************************************/
+/**                                                                        **/
+/** WMI related hooks                                                      **/
+/**                                                                        **/
+/****************************************************************************/
+/****************************************************************************/
+
+#include <ar6000_api.h>
+
+#define A_WMI_CHANNELLIST_RX(devt, numChan, chanList)   \
+    ar6000_channelList_rx((devt), (numChan), (chanList))
+
+#define A_WMI_SET_NUMDATAENDPTS(devt, num)  \
+    ar6000_set_numdataendpts((devt), (num))
+
+#define A_WMI_CONTROL_TX(devt, osbuf, streamID) \
+    ar6000_control_tx((devt), (osbuf), (streamID))
+
+#define A_WMI_TARGETSTATS_EVENT(devt, pStats, len)  \
+    ar6000_targetStats_event((devt), (pStats), (len))
+
+#define A_WMI_SCANCOMPLETE_EVENT(devt, status)  \
+    ar6000_scanComplete_event((devt), (status))
+
+#ifdef CONFIG_HOST_DSET_SUPPORT
+
+#define A_WMI_DSET_DATA_REQ(devt, access_cookie, offset, length, targ_buf, targ_reply_fn, targ_reply_arg)   \
+    ar6000_dset_data_req((devt), (access_cookie), (offset), (length), (targ_buf), (targ_reply_fn), (targ_reply_arg))
+
+#define A_WMI_DSET_CLOSE(devt, access_cookie)   \
+    ar6000_dset_close((devt), (access_cookie))
+
+#endif
+
+#define A_WMI_DSET_OPEN_REQ(devt, id, targ_handle, targ_reply_fn, targ_reply_arg) \
+    ar6000_dset_open_req((devt), (id), (targ_handle), (targ_reply_fn), (targ_reply_arg))
+
+#define A_WMI_CONNECT_EVENT(devt, channel, bssid, listenInterval, beaconInterval, networkType, beaconIeLen, assocReqLen, assocRespLen, assocInfo) \
+    ar6000_connect_event((devt), (channel), (bssid), (listenInterval), (beaconInterval), (networkType), (beaconIeLen), (assocReqLen), (assocRespLen), (assocInfo))
+
+#define A_WMI_PSPOLL_EVENT(devt, aid)\
+    ar6000_pspoll_event((devt),(aid))
+
+#define A_WMI_DTIMEXPIRY_EVENT(devt)\
+    ar6000_dtimexpiry_event((devt))
+
+#ifdef WAPI_ENABLE
+#define A_WMI_WAPI_REKEY_EVENT(devt, type, mac)\
+    ap_wapi_rekey_event((devt),(type),(mac))
+#endif
+
+#define A_WMI_REGDOMAIN_EVENT(devt, regCode)    \
+    ar6000_regDomain_event((devt), (regCode))
+
+#define A_WMI_NEIGHBORREPORT_EVENT(devt, numAps, info)  \
+    ar6000_neighborReport_event((devt), (numAps), (info))
+
+#define A_WMI_DISCONNECT_EVENT(devt, reason, bssid, assocRespLen, assocInfo, protocolReasonStatus)  \
+    ar6000_disconnect_event((devt), (reason), (bssid), (assocRespLen), (assocInfo), (protocolReasonStatus))
+
+#define A_WMI_TKIP_MICERR_EVENT(devt, keyid, ismcast)   \
+    ar6000_tkip_micerr_event((devt), (keyid), (ismcast))
+
+#define A_WMI_BITRATE_RX(devt, rateKbps)    \
+    ar6000_bitrate_rx((devt), (rateKbps))
+
+#define A_WMI_TXPWR_RX(devt, txPwr) \
+    ar6000_txPwr_rx((devt), (txPwr))
+
+#define A_WMI_READY_EVENT(devt, datap, phyCap, sw_ver, abi_ver) \
+    ar6000_ready_event((devt), (datap), (phyCap), (sw_ver), (abi_ver))
+
+#define A_WMI_DBGLOG_INIT_DONE(ar) \
+    ar6000_dbglog_init_done(ar);
+
+#define A_WMI_RSSI_THRESHOLD_EVENT(devt, newThreshold, rssi)    \
+    ar6000_rssiThreshold_event((devt), (newThreshold), (rssi))
+
+#define A_WMI_REPORT_ERROR_EVENT(devt, errorVal)    \
+    ar6000_reportError_event((devt), (errorVal))
+
+#define A_WMI_ROAM_TABLE_EVENT(devt, pTbl) \
+    ar6000_roam_tbl_event((devt), (pTbl))
+
+#define A_WMI_ROAM_DATA_EVENT(devt, p) \
+    ar6000_roam_data_event((devt), (p))
+
+#define A_WMI_WOW_LIST_EVENT(devt, num_filters, wow_filters)    \
+    ar6000_wow_list_event((devt), (num_filters), (wow_filters))
+
+#define A_WMI_CAC_EVENT(devt, ac, cac_indication, statusCode, tspecSuggestion)  \
+    ar6000_cac_event((devt), (ac), (cac_indication), (statusCode), (tspecSuggestion))
+
+#define A_WMI_CHANNEL_CHANGE_EVENT(devt, oldChannel, newChannel)  \
+    ar6000_channel_change_event((devt), (oldChannel), (newChannel))
+
+#define A_WMI_PMKID_LIST_EVENT(devt, num_pmkid, pmkid_list, bssid_list) \
+    ar6000_pmkid_list_event((devt), (num_pmkid), (pmkid_list), (bssid_list))
+
+#define A_WMI_PEER_EVENT(devt, eventCode, bssid)    \
+    ar6000_peer_event ((devt), (eventCode), (bssid))
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+#define A_WMI_TCMD_RX_REPORT_EVENT(devt, results, len) \
+    ar6000_tcmd_rx_report_event((devt), (results), (len))
+#endif
+
+#define A_WMI_HBCHALLENGERESP_EVENT(devt, cookie, source)    \
+    ar6000_hbChallengeResp_event((devt), (cookie), (source))
+
+#define A_WMI_TX_RETRY_ERR_EVENT(devt) \
+    ar6000_tx_retry_err_event((devt))
+
+#define A_WMI_SNR_THRESHOLD_EVENT_RX(devt, newThreshold, snr) \
+    ar6000_snrThresholdEvent_rx((devt), (newThreshold), (snr))
+
+#define A_WMI_LQ_THRESHOLD_EVENT_RX(devt, range, lqVal) \
+    ar6000_lqThresholdEvent_rx((devt), (range), (lqVal))
+
+#define A_WMI_RATEMASK_RX(devt, ratemask) \
+    ar6000_ratemask_rx((devt), (ratemask))
+
+#define A_WMI_KEEPALIVE_RX(devt, configured)    \
+    ar6000_keepalive_rx((devt), (configured))
+
+#define A_WMI_BSSINFO_EVENT_RX(ar, datp, len)   \
+    ar6000_bssInfo_event_rx((ar), (datap), (len))
+
+#define A_WMI_DBGLOG_EVENT(ar, dropped, buffer, length) \
+    ar6000_dbglog_event((ar), (dropped), (buffer), (length));
+
+#define A_WMI_STREAM_TX_ACTIVE(devt,trafficClass) \
+    ar6000_indicate_tx_activity((devt),(trafficClass), true)
+
+#define A_WMI_STREAM_TX_INACTIVE(devt,trafficClass) \
+    ar6000_indicate_tx_activity((devt),(trafficClass), false)
+#define A_WMI_Ac2EndpointID(devht, ac)\
+    ar6000_ac2_endpoint_id((devht), (ac))
+
+#define A_WMI_AGGR_RECV_ADDBA_REQ_EVT(devt, cmd)\
+    ar6000_aggr_rcv_addba_req_evt((devt), (cmd))
+#define A_WMI_AGGR_RECV_ADDBA_RESP_EVT(devt, cmd)\
+    ar6000_aggr_rcv_addba_resp_evt((devt), (cmd))
+#define A_WMI_AGGR_RECV_DELBA_REQ_EVT(devt, cmd)\
+    ar6000_aggr_rcv_delba_req_evt((devt), (cmd))
+#define A_WMI_HCI_EVENT_EVT(devt, cmd)\
+    ar6000_hci_event_rcv_evt((devt), (cmd))
+
+#define A_WMI_Endpoint2Ac(devt, ep) \
+    ar6000_endpoint_id2_ac((devt), (ep))
+
+#define A_WMI_BTCOEX_CONFIG_EVENT(devt, evt, len)\
+        ar6000_btcoex_config_event((devt), (evt), (len))
+
+#define A_WMI_BTCOEX_STATS_EVENT(devt, datap, len)\
+        ar6000_btcoex_stats_event((devt), (datap), (len))
+
+/****************************************************************************/
+/****************************************************************************/
+/**                                                                        **/
+/** HTC related hooks                                                      **/
+/**                                                                        **/
+/****************************************************************************/
+/****************************************************************************/
+
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+#define A_WMI_PROF_COUNT_RX(addr, count) prof_count_rx((addr), (count))
+#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/drivers/staging/ath6kl/include/a_osapi.h b/drivers/staging/ath6kl/include/a_osapi.h
new file mode 100644
index 00000000000..fd7ae0d612c
--- /dev/null
+++ b/drivers/staging/ath6kl/include/a_osapi.h
@@ -0,0 +1,32 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_osapi.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_OSAPI_H_
+#define _A_OSAPI_H_
+
+#include "../os/linux/include/osapi_linux.h"
+
+#endif /* _OSAPI_H_ */
diff --git a/drivers/staging/ath6kl/include/aggr_recv_api.h b/drivers/staging/ath6kl/include/aggr_recv_api.h
new file mode 100644
index 00000000000..5ead58d5feb
--- /dev/null
+++ b/drivers/staging/ath6kl/include/aggr_recv_api.h
@@ -0,0 +1,140 @@
+/*
+ *
+ * Copyright (c) 2004-2010 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ * 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+ *
+ */
+
+#ifndef __AGGR_RECV_API_H__
+#define __AGGR_RECV_API_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (* RX_CALLBACK)(void * dev, void *osbuf);
+
+typedef void (* ALLOC_NETBUFS)(A_NETBUF_QUEUE_T *q, u16 num);
+
+/*
+ * aggr_init:
+ * Initialises the data structures, allocates data queues and 
+ * os buffers. Netbuf allocator is the input param, used by the
+ * aggr module for allocation of NETBUFs from driver context.
+ * These NETBUFs are used for AMSDU processing.
+ * Returns the context for the aggr module.
+ */
+void *
+aggr_init(ALLOC_NETBUFS netbuf_allocator);
+
+
+/*
+ * aggr_register_rx_dispatcher:
+ * Registers OS call back function to deliver the
+ * frames to OS. This is generally the topmost layer of
+ * the driver context, after which the frames go to
+ * IP stack via the call back function.
+ * This dispatcher is active only when aggregation is ON.
+ */
+void
+aggr_register_rx_dispatcher(void *cntxt, void * dev,  RX_CALLBACK fn);
+
+
+/*
+ * aggr_process_bar:
+ * When target receives BAR, it communicates to host driver
+ * for modifying window parameters. Target indicates this via the 
+ * event: WMI_ADDBA_REQ_EVENTID. Host will dequeue all frames
+ * up to the indicated sequence number.
+ */
+void
+aggr_process_bar(void *cntxt, u8 tid, u16 seq_no);
+
+
+/*
+ * aggr_recv_addba_req_evt:
+ * This event is to initiate/modify the receive side window.
+ * Target will send WMI_ADDBA_REQ_EVENTID event to host - to setup 
+ * recv re-ordering queues. Target will negotiate ADDBA with peer, 
+ * and indicate via this event after successfully completing the 
+ * negotiation. This happens in two situations:
+ *  1. Initial setup of aggregation
+ *  2. Renegotiation of current recv window.
+ * Window size for re-ordering is limited by target buffer
+ * space, which is reflected in win_sz.
+ * (Re)Start the periodic timer to deliver long standing frames,
+ * in hold_q to OS.
+ */
+void
+aggr_recv_addba_req_evt(void * cntxt, u8 tid, u16 seq_no, u8 win_sz);
+
+
+/*
+ * aggr_recv_delba_req_evt:
+ * Target indicates deletion of a BA window for a tid via the
+ * WMI_DELBA_EVENTID. Host would deliver all the frames in the 
+ * hold_q, reset tid config and disable the periodic timer, if 
+ * aggr is not enabled on any tid.
+ */
+void
+aggr_recv_delba_req_evt(void * cntxt, u8 tid);
+
+
+
+/*
+ * aggr_process_recv_frm:
+ * Called only for data frames. When aggr is ON for a tid, the buffer 
+ * is always consumed, and osbuf would be NULL. For a non-aggr case,
+ * osbuf is not modified.
+ * AMSDU frames are consumed and are later freed. They are sliced and 
+ * diced to individual frames and dispatched to stack.
+ * After consuming a osbuf(when aggr is ON), a previously registered
+ * callback may be called to deliver frames in order.
+ */
+void
+aggr_process_recv_frm(void *cntxt, u8 tid, u16 seq_no, bool is_amsdu, void **osbuf);
+
+
+/*
+ * aggr_module_destroy:
+ * Frees up all the queues and frames in them. Releases the cntxt to OS.
+ */
+void
+aggr_module_destroy(void *cntxt);
+
+/*
+ * Dumps the aggregation stats 
+ */
+void
+aggr_dump_stats(void *cntxt, PACKET_LOG **log_buf);
+
+/* 
+ * aggr_reset_state -- Called when it is deemed necessary to clear the aggregate
+ *  hold Q state.  Examples include when a Connect event or disconnect event is 
+ *  received. 
+ */
+void
+aggr_reset_state(void *cntxt);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*__AGGR_RECV_API_H__ */
diff --git a/drivers/staging/ath6kl/include/ar3kconfig.h b/drivers/staging/ath6kl/include/ar3kconfig.h
new file mode 100644
index 00000000000..91bc4ee3512
--- /dev/null
+++ b/drivers/staging/ath6kl/include/ar3kconfig.h
@@ -0,0 +1,65 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+/* AR3K module configuration APIs for HCI-bridge operation */
+
+#ifndef AR3KCONFIG_H_
+#define AR3KCONFIG_H_
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define AR3K_CONFIG_FLAG_FORCE_MINBOOT_EXIT         (1 << 0)
+#define AR3K_CONFIG_FLAG_SET_AR3K_BAUD              (1 << 1)
+#define AR3K_CONFIG_FLAG_AR3K_BAUD_CHANGE_DELAY     (1 << 2)
+#define AR3K_CONFIG_FLAG_SET_AR6K_SCALE_STEP        (1 << 3)
+
+
+struct ar3k_config_info {
+    u32 Flags;           /* config flags */
+    void                     *pHCIDev;        /* HCI bridge device     */
+    struct hci_transport_properties *pHCIProps;      /* HCI bridge props      */
+    struct hif_device               *pHIFDevice;     /* HIF layer device      */
+    
+    u32 AR3KBaudRate;    /* AR3K operational baud rate */
+    u16 AR6KScale;       /* AR6K UART scale value */
+    u16 AR6KStep;        /* AR6K UART step value  */
+    struct hci_dev           *pBtStackHCIDev; /* BT Stack HCI dev */
+    u32 PwrMgmtEnabled;  /* TLPM enabled? */
+    u16 IdleTimeout;     /* TLPM idle timeout */
+    u16 WakeupTimeout;   /* TLPM wakeup timeout */
+    u8 bdaddr[6];       /* Bluetooth device address */
+};
+                                                                                        
+int AR3KConfigure(struct ar3k_config_info *pConfigInfo);
+
+int AR3KConfigureExit(void *config);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*AR3KCONFIG_H_*/
diff --git a/drivers/staging/ath6kl/include/ar6000_api.h b/drivers/staging/ath6kl/include/ar6000_api.h
new file mode 100644
index 00000000000..e9460800272
--- /dev/null
+++ b/drivers/staging/ath6kl/include/ar6000_api.h
@@ -0,0 +1,32 @@
+//------------------------------------------------------------------------------
+// <copyright file="ar6000_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the API to access the OS dependent atheros host driver
+// by the WMI or WLAN generic modules.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _AR6000_API_H_
+#define _AR6000_API_H_
+
+#include "../os/linux/include/ar6xapi_linux.h"
+
+#endif /* _AR6000_API_H */
+
diff --git a/drivers/staging/ath6kl/include/ar6000_diag.h b/drivers/staging/ath6kl/include/ar6000_diag.h
new file mode 100644
index 00000000000..739c01c53f0
--- /dev/null
+++ b/drivers/staging/ath6kl/include/ar6000_diag.h
@@ -0,0 +1,48 @@
+//------------------------------------------------------------------------------
+// <copyright file="ar6000_diag.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef AR6000_DIAG_H_
+#define AR6000_DIAG_H_
+
+
+int
+ar6000_ReadRegDiag(struct hif_device *hifDevice, u32 *address, u32 *data);
+
+int
+ar6000_WriteRegDiag(struct hif_device *hifDevice, u32 *address, u32 *data);
+
+int
+ar6000_ReadDataDiag(struct hif_device *hifDevice, u32 address,
+                    u8 *data, u32 length);
+
+int
+ar6000_WriteDataDiag(struct hif_device *hifDevice, u32 address,
+                     u8 *data, u32 length);
+
+int
+ar6k_ReadTargetRegister(struct hif_device *hifDevice, int regsel, u32 *regval);
+
+void
+ar6k_FetchTargetRegs(struct hif_device *hifDevice, u32 *targregs);
+
+#endif /*AR6000_DIAG_H_*/
diff --git a/drivers/staging/ath6kl/include/ar6kap_common.h b/drivers/staging/ath6kl/include/ar6kap_common.h
new file mode 100644
index 00000000000..532d8eba932
--- /dev/null
+++ b/drivers/staging/ath6kl/include/ar6kap_common.h
@@ -0,0 +1,44 @@
+//------------------------------------------------------------------------------
+
+// <copyright file="ar6kap_common.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+
+//==============================================================================
+
+// This file contains the definitions of common AP mode data structures.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _AR6KAP_COMMON_H_
+#define _AR6KAP_COMMON_H_
+/*
+ * Used with AR6000_XIOCTL_AP_GET_STA_LIST
+ */
+typedef struct {
+    u8 mac[ATH_MAC_LEN];
+    u8 aid;
+    u8 keymgmt;
+    u8 ucipher;
+    u8 auth;
+} station_t;
+typedef struct {
+    station_t sta[AP_MAX_NUM_STA];
+} ap_get_sta_t;
+#endif /* _AR6KAP_COMMON_H_ */
diff --git a/drivers/staging/ath6kl/include/athbtfilter.h b/drivers/staging/ath6kl/include/athbtfilter.h
new file mode 100644
index 00000000000..81456eea3b0
--- /dev/null
+++ b/drivers/staging/ath6kl/include/athbtfilter.h
@@ -0,0 +1,135 @@
+//------------------------------------------------------------------------------
+// <copyright file="athbtfilter.h" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Public Bluetooth filter APIs
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef ATHBTFILTER_H_
+#define ATHBTFILTER_H_
+
+#define ATH_DEBUG_INFO  (1 << 2)
+#define ATH_DEBUG_INF    ATH_DEBUG_INFO
+
+typedef enum _ATHBT_HCI_CTRL_TYPE {
+    ATHBT_HCI_COMMAND     = 0,
+    ATHBT_HCI_EVENT       = 1,
+} ATHBT_HCI_CTRL_TYPE;
+
+typedef enum _ATHBT_STATE_INDICATION {
+    ATH_BT_NOOP        = 0,
+    ATH_BT_INQUIRY     = 1,
+    ATH_BT_CONNECT     = 2,
+    ATH_BT_SCO         = 3,
+    ATH_BT_ACL         = 4,
+    ATH_BT_A2DP        = 5,
+    ATH_BT_ESCO        = 6,
+    /* new states go here.. */
+
+    ATH_BT_MAX_STATE_INDICATION
+} ATHBT_STATE_INDICATION;
+
+    /* filter function for OUTGOING commands and INCOMMING events */
+typedef void   (*ATHBT_FILTER_CMD_EVENTS_FN)(void *pContext, ATHBT_HCI_CTRL_TYPE Type, unsigned char *pBuffer, int Length);
+
+    /* filter function for OUTGOING data HCI packets */
+typedef void   (*ATHBT_FILTER_DATA_FN)(void *pContext, unsigned char *pBuffer, int Length);
+
+typedef enum _ATHBT_STATE {
+    STATE_OFF  = 0,
+    STATE_ON   = 1,
+    STATE_MAX
+} ATHBT_STATE;
+
+    /* BT state indication (when filter functions are not used) */
+
+typedef void   (*ATHBT_INDICATE_STATE_FN)(void *pContext, ATHBT_STATE_INDICATION Indication, ATHBT_STATE State, unsigned char LMPVersion);
+
+struct athbt_filter_instance {
+#ifdef UNDER_CE
+    WCHAR                       *pWlanAdapterName;  /* filled in by user */
+#else
+    char *pWlanAdapterName;  /* filled in by user */
+#endif /* UNDER_CE */
+    int                         FilterEnabled;      /* filtering is enabled */
+    int                         Attached;           /* filter library is attached */
+    void                        *pContext;          /* private context for filter library */
+    ATHBT_FILTER_CMD_EVENTS_FN  pFilterCmdEvents;   /* function ptr to filter a command or event */
+    ATHBT_FILTER_DATA_FN        pFilterAclDataOut;  /* function ptr to filter ACL data out (to radio) */
+    ATHBT_FILTER_DATA_FN        pFilterAclDataIn;   /* function ptr to filter ACL data in (from radio) */
+    ATHBT_INDICATE_STATE_FN     pIndicateState;     /* function ptr to indicate a state */
+}; /* XXX: unused ? */
+
+
+/* API MACROS */
+
+#define AthBtFilterHciCommand(instance,packet,length)          \
+    if ((instance)->FilterEnabled) {                           \
+        (instance)->pFilterCmdEvents((instance)->pContext,     \
+                                   ATHBT_HCI_COMMAND,          \
+                                   (unsigned char *)(packet),  \
+                                   (length));                  \
+    }
+
+#define AthBtFilterHciEvent(instance,packet,length)            \
+    if ((instance)->FilterEnabled) {                           \
+        (instance)->pFilterCmdEvents((instance)->pContext,     \
+                                   ATHBT_HCI_EVENT,            \
+                                   (unsigned char *)(packet),  \
+                                   (length));                  \
+    }
+
+#define AthBtFilterHciAclDataOut(instance,packet,length)     \
+    if ((instance)->FilterEnabled) {                         \
+        (instance)->pFilterAclDataOut((instance)->pContext,  \
+                                 (unsigned char *)(packet),  \
+                                 (length));                  \
+    }
+
+#define AthBtFilterHciAclDataIn(instance,packet,length)      \
+    if ((instance)->FilterEnabled) {                         \
+        (instance)->pFilterAclDataIn((instance)->pContext,   \
+                                 (unsigned char *)(packet),  \
+                                 (length));                  \
+    }
+        
+/* if filtering is not desired, the application can indicate the state directly using this
+ * macro:
+ */
+#define AthBtIndicateState(instance,indication,state)           \
+    if ((instance)->FilterEnabled) {                            \
+        (instance)->pIndicateState((instance)->pContext,        \
+                                   (indication),                \
+                                   (state),                     \
+                                   0);                          \
+    }
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* API prototypes */
+int     AthBtFilter_Attach(ATH_BT_FILTER_INSTANCE *pInstance, unsigned int flags);
+void    AthBtFilter_Detach(ATH_BT_FILTER_INSTANCE *pInstance);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*ATHBTFILTER_H_*/
diff --git a/drivers/staging/ath6kl/include/bmi.h b/drivers/staging/ath6kl/include/bmi.h
new file mode 100644
index 00000000000..d3227f77fa5
--- /dev/null
+++ b/drivers/staging/ath6kl/include/bmi.h
@@ -0,0 +1,134 @@
+//------------------------------------------------------------------------------
+// <copyright file="bmi.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// BMI declarations and prototypes
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _BMI_H_
+#define _BMI_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/* Header files */
+#include "a_config.h"
+#include "athdefs.h"
+#include "hif.h"
+#include "a_osapi.h"
+#include "bmi_msg.h"
+
+void
+BMIInit(void);
+
+void
+BMICleanup(void);
+
+int
+BMIDone(struct hif_device *device);
+
+int
+BMIGetTargetInfo(struct hif_device *device, struct bmi_target_info *targ_info);
+
+int
+BMIReadMemory(struct hif_device *device,
+              u32 address,
+              u8 *buffer,
+              u32 length);
+
+int
+BMIWriteMemory(struct hif_device *device,
+               u32 address,
+               u8 *buffer,
+               u32 length);
+
+int
+BMIExecute(struct hif_device *device,
+           u32 address,
+           u32 *param);
+
+int
+BMISetAppStart(struct hif_device *device,
+               u32 address);
+
+int
+BMIReadSOCRegister(struct hif_device *device,
+                   u32 address,
+                   u32 *param);
+
+int
+BMIWriteSOCRegister(struct hif_device *device,
+                    u32 address,
+                    u32 param);
+
+int
+BMIrompatchInstall(struct hif_device *device,
+                   u32 ROM_addr,
+                   u32 RAM_addr,
+                   u32 nbytes,
+                   u32 do_activate,
+                   u32 *patch_id);
+
+int
+BMIrompatchUninstall(struct hif_device *device,
+                     u32 rompatch_id);
+
+int
+BMIrompatchActivate(struct hif_device *device,
+                    u32 rompatch_count,
+                    u32 *rompatch_list);
+
+int
+BMIrompatchDeactivate(struct hif_device *device,
+                      u32 rompatch_count,
+                      u32 *rompatch_list);
+
+int
+BMILZStreamStart(struct hif_device *device,
+                 u32 address);
+
+int
+BMILZData(struct hif_device *device,
+          u8 *buffer,
+          u32 length);
+
+int
+BMIFastDownload(struct hif_device *device,
+                u32 address,
+                u8 *buffer,
+                u32 length);
+
+int
+BMIRawWrite(struct hif_device *device,
+            u8 *buffer,
+            u32 length);
+
+int
+BMIRawRead(struct hif_device *device, 
+           u8 *buffer, 
+           u32 length,
+           bool want_timeout);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _BMI_H_ */
diff --git a/drivers/staging/ath6kl/include/common/AR6002/AR6K_version.h b/drivers/staging/ath6kl/include/common/AR6002/AR6K_version.h
new file mode 100644
index 00000000000..5407e05d9b0
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/AR6K_version.h
@@ -0,0 +1,52 @@
+//------------------------------------------------------------------------------
+// <copyright file="AR6K_version.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#define __VER_MAJOR_ 3
+#define __VER_MINOR_ 0 
+#define __VER_PATCH_ 0
+
+/* The makear6ksdk script (used for release builds) modifies the following line. */
+#define __BUILD_NUMBER_ 233
+
+
+/* Format of the version number. */
+#define VER_MAJOR_BIT_OFFSET        28
+#define VER_MINOR_BIT_OFFSET        24
+#define VER_PATCH_BIT_OFFSET        16
+#define VER_BUILD_NUM_BIT_OFFSET    0
+
+
+/*
+ * The version has the following format:
+ * Bits 28-31: Major version
+ * Bits 24-27: Minor version
+ * Bits 16-23: Patch version
+ * Bits 0-15:  Build number (automatically generated during build process )
+ * E.g. Build 1.1.3.7 would be represented as 0x11030007.
+ *
+ * DO NOT split the following macro into multiple lines as this may confuse the build scripts.
+ */
+#define AR6K_SW_VERSION     ( ( __VER_MAJOR_ << VER_MAJOR_BIT_OFFSET ) + ( __VER_MINOR_ << VER_MINOR_BIT_OFFSET ) + ( __VER_PATCH_ << VER_PATCH_BIT_OFFSET ) + ( __BUILD_NUMBER_ << VER_BUILD_NUM_BIT_OFFSET ) )
+
+/* ABI Version. Reflects the version of binary interface exposed by AR6K target firmware. Needs to be incremented by 1 for any change in the firmware that requires upgrade of the driver on the host side for the change to work correctly */
+#define AR6K_ABI_VERSION        1
diff --git a/drivers/staging/ath6kl/include/common/AR6002/addrs.h b/drivers/staging/ath6kl/include/common/AR6002/addrs.h
new file mode 100644
index 00000000000..bbf8d42828c
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/addrs.h
@@ -0,0 +1,90 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+//
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef __ADDRS_H__
+#define __ADDRS_H__
+
+/*
+ * Special AR6002 Addresses that may be needed by special
+ * applications (e.g. ART) on the Host as well as Target.
+ */
+
+#if defined(AR6002_REV2)
+#define AR6K_RAM_START 0x00500000
+#define TARG_RAM_OFFSET(vaddr) ((u32)(vaddr) & 0xfffff)
+#define TARG_RAM_SZ (184*1024)
+#define TARG_ROM_SZ (80*1024)
+#endif
+#if defined(AR6002_REV4) || defined(AR6003)
+#define AR6K_RAM_START 0x00540000
+#define TARG_RAM_OFFSET(vaddr) (((u32)(vaddr) & 0xfffff) - 0x40000)
+#define TARG_RAM_SZ (256*1024)
+#define TARG_ROM_SZ (256*1024)
+#endif
+
+#define AR6002_BOARD_DATA_SZ 768
+#define AR6002_BOARD_EXT_DATA_SZ 0
+#define AR6003_BOARD_DATA_SZ 1024
+#define AR6003_BOARD_EXT_DATA_SZ 768
+
+#define AR6K_RAM_ADDR(byte_offset) (AR6K_RAM_START+(byte_offset))
+#define TARG_RAM_ADDRS(byte_offset) AR6K_RAM_ADDR(byte_offset)
+
+#define AR6K_ROM_START 0x004e0000
+#define TARG_ROM_OFFSET(vaddr) (((u32)(vaddr) & 0x1fffff) - 0xe0000)
+#define AR6K_ROM_ADDR(byte_offset) (AR6K_ROM_START+(byte_offset))
+#define TARG_ROM_ADDRS(byte_offset) AR6K_ROM_ADDR(byte_offset)
+
+/*
+ * At this ROM address is a pointer to the start of the ROM DataSet Index.
+ * If there are no ROM DataSets, there's a 0 at this address.
+ */
+#define ROM_DATASET_INDEX_ADDR          (TARG_ROM_ADDRS(TARG_ROM_SZ)-8)
+#define ROM_MBIST_CKSUM_ADDR            (TARG_ROM_ADDRS(TARG_ROM_SZ)-4)
+
+/*
+ * The API A_BOARD_DATA_ADDR() is the proper way to get a read pointer to
+ * board data.
+ */
+
+/* Size of Board Data, in bytes */
+#if defined(AR6002_REV4) || defined(AR6003)
+#define BOARD_DATA_SZ AR6003_BOARD_DATA_SZ
+#else
+#define BOARD_DATA_SZ AR6002_BOARD_DATA_SZ
+#endif
+
+
+/*
+ * Constants used by ASM code to access fields of host_interest_s,
+ * which is at a fixed location in RAM.
+ */
+#if defined(AR6002_REV4) || defined(AR6003)
+#define HOST_INTEREST_FLASH_IS_PRESENT_ADDR  (AR6K_RAM_START + 0x60c)
+#else
+#define HOST_INTEREST_FLASH_IS_PRESENT_ADDR  (AR6K_RAM_START + 0x40c)
+#endif
+#define FLASH_IS_PRESENT_TARGADDR       HOST_INTEREST_FLASH_IS_PRESENT_ADDR
+
+#endif /* __ADDRS_H__ */
+
+
+
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_athr_wlan_map.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_athr_wlan_map.h
new file mode 100644
index 00000000000..609eb9841f5
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_athr_wlan_map.h
@@ -0,0 +1,40 @@
+// ------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// ------------------------------------------------------------------
+//===================================================================
+// Author(s): ="Atheros"
+//===================================================================
+
+
+#ifndef _APB_ATHR_WLAN_MAP_H_
+#define _APB_ATHR_WLAN_MAP_H_
+
+#define WLAN_RTC_BASE_ADDRESS                    0x00004000
+#define WLAN_VMC_BASE_ADDRESS                    0x00008000
+#define WLAN_UART_BASE_ADDRESS                   0x0000c000
+#define WLAN_DBG_UART_BASE_ADDRESS               0x0000d000
+#define WLAN_UMBOX_BASE_ADDRESS                  0x0000e000
+#define WLAN_SI_BASE_ADDRESS                     0x00010000
+#define WLAN_GPIO_BASE_ADDRESS                   0x00014000
+#define WLAN_MBOX_BASE_ADDRESS                   0x00018000
+#define WLAN_ANALOG_INTF_BASE_ADDRESS            0x0001c000
+#define WLAN_MAC_BASE_ADDRESS                    0x00020000
+#define WLAN_RDMA_BASE_ADDRESS                   0x00030100
+#define EFUSE_BASE_ADDRESS                       0x00031000
+
+#endif /* _APB_ATHR_WLAN_MAP_REG_H_ */
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_map.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_map.h
new file mode 100644
index 00000000000..0068ca31b05
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/apb_map.h
@@ -0,0 +1,40 @@
+// ------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// ------------------------------------------------------------------
+//===================================================================
+// Author(s): ="Atheros"
+//===================================================================
+
+
+#include "apb_athr_wlan_map.h"
+
+#ifndef BT_HEADERS
+
+#define RTC_BASE_ADDRESS WLAN_RTC_BASE_ADDRESS
+#define VMC_BASE_ADDRESS WLAN_VMC_BASE_ADDRESS
+#define UART_BASE_ADDRESS WLAN_UART_BASE_ADDRESS
+#define DBG_UART_BASE_ADDRESS WLAN_DBG_UART_BASE_ADDRESS
+#define UMBOX_BASE_ADDRESS WLAN_UMBOX_BASE_ADDRESS
+#define SI_BASE_ADDRESS WLAN_SI_BASE_ADDRESS
+#define GPIO_BASE_ADDRESS WLAN_GPIO_BASE_ADDRESS
+#define MBOX_BASE_ADDRESS WLAN_MBOX_BASE_ADDRESS
+#define ANALOG_INTF_BASE_ADDRESS WLAN_ANALOG_INTF_BASE_ADDRESS
+#define MAC_BASE_ADDRESS WLAN_MAC_BASE_ADDRESS
+#define RDMA_BASE_ADDRESS WLAN_RDMA_BASE_ADDRESS
+
+#endif
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_host_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_host_reg.h
new file mode 100644
index 00000000000..109f24e10a6
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_host_reg.h
@@ -0,0 +1,24 @@
+// ------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// ------------------------------------------------------------------
+//===================================================================
+// Author(s): ="Atheros"
+//===================================================================
+
+
+#include "mbox_wlan_host_reg.h"
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_reg.h
new file mode 100644
index 00000000000..72fa483450d
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_reg.h
@@ -0,0 +1,552 @@
+// ------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// ------------------------------------------------------------------
+//===================================================================
+// Author(s): ="Atheros"
+//===================================================================
+
+
+#include "mbox_wlan_reg.h"
+
+#ifndef BT_HEADERS
+
+#define MBOX_FIFO_ADDRESS WLAN_MBOX_FIFO_ADDRESS
+#define MBOX_FIFO_OFFSET WLAN_MBOX_FIFO_OFFSET
+#define MBOX_FIFO_DATA_MSB WLAN_MBOX_FIFO_DATA_MSB
+#define MBOX_FIFO_DATA_LSB WLAN_MBOX_FIFO_DATA_LSB
+#define MBOX_FIFO_DATA_MASK WLAN_MBOX_FIFO_DATA_MASK
+#define MBOX_FIFO_DATA_GET(x) WLAN_MBOX_FIFO_DATA_GET(x)
+#define MBOX_FIFO_DATA_SET(x) WLAN_MBOX_FIFO_DATA_SET(x)
+#define MBOX_FIFO_STATUS_ADDRESS WLAN_MBOX_FIFO_STATUS_ADDRESS
+#define MBOX_FIFO_STATUS_OFFSET WLAN_MBOX_FIFO_STATUS_OFFSET
+#define MBOX_FIFO_STATUS_EMPTY_MSB WLAN_MBOX_FIFO_STATUS_EMPTY_MSB
+#define MBOX_FIFO_STATUS_EMPTY_LSB WLAN_MBOX_FIFO_STATUS_EMPTY_LSB
+#define MBOX_FIFO_STATUS_EMPTY_MASK WLAN_MBOX_FIFO_STATUS_EMPTY_MASK
+#define MBOX_FIFO_STATUS_EMPTY_GET(x) WLAN_MBOX_FIFO_STATUS_EMPTY_GET(x)
+#define MBOX_FIFO_STATUS_EMPTY_SET(x) WLAN_MBOX_FIFO_STATUS_EMPTY_SET(x)
+#define MBOX_FIFO_STATUS_FULL_MSB WLAN_MBOX_FIFO_STATUS_FULL_MSB
+#define MBOX_FIFO_STATUS_FULL_LSB WLAN_MBOX_FIFO_STATUS_FULL_LSB
+#define MBOX_FIFO_STATUS_FULL_MASK WLAN_MBOX_FIFO_STATUS_FULL_MASK
+#define MBOX_FIFO_STATUS_FULL_GET(x) WLAN_MBOX_FIFO_STATUS_FULL_GET(x)
+#define MBOX_FIFO_STATUS_FULL_SET(x) WLAN_MBOX_FIFO_STATUS_FULL_SET(x)
+#define MBOX_DMA_POLICY_ADDRESS WLAN_MBOX_DMA_POLICY_ADDRESS
+#define MBOX_DMA_POLICY_OFFSET WLAN_MBOX_DMA_POLICY_OFFSET
+#define MBOX_DMA_POLICY_TX_QUANTUM_MSB WLAN_MBOX_DMA_POLICY_TX_QUANTUM_MSB
+#define MBOX_DMA_POLICY_TX_QUANTUM_LSB WLAN_MBOX_DMA_POLICY_TX_QUANTUM_LSB
+#define MBOX_DMA_POLICY_TX_QUANTUM_MASK WLAN_MBOX_DMA_POLICY_TX_QUANTUM_MASK
+#define MBOX_DMA_POLICY_TX_QUANTUM_GET(x) WLAN_MBOX_DMA_POLICY_TX_QUANTUM_GET(x)
+#define MBOX_DMA_POLICY_TX_QUANTUM_SET(x) WLAN_MBOX_DMA_POLICY_TX_QUANTUM_SET(x)
+#define MBOX_DMA_POLICY_TX_ORDER_MSB WLAN_MBOX_DMA_POLICY_TX_ORDER_MSB
+#define MBOX_DMA_POLICY_TX_ORDER_LSB WLAN_MBOX_DMA_POLICY_TX_ORDER_LSB
+#define MBOX_DMA_POLICY_TX_ORDER_MASK WLAN_MBOX_DMA_POLICY_TX_ORDER_MASK
+#define MBOX_DMA_POLICY_TX_ORDER_GET(x) WLAN_MBOX_DMA_POLICY_TX_ORDER_GET(x)
+#define MBOX_DMA_POLICY_TX_ORDER_SET(x) WLAN_MBOX_DMA_POLICY_TX_ORDER_SET(x)
+#define MBOX_DMA_POLICY_RX_QUANTUM_MSB WLAN_MBOX_DMA_POLICY_RX_QUANTUM_MSB
+#define MBOX_DMA_POLICY_RX_QUANTUM_LSB WLAN_MBOX_DMA_POLICY_RX_QUANTUM_LSB
+#define MBOX_DMA_POLICY_RX_QUANTUM_MASK WLAN_MBOX_DMA_POLICY_RX_QUANTUM_MASK
+#define MBOX_DMA_POLICY_RX_QUANTUM_GET(x) WLAN_MBOX_DMA_POLICY_RX_QUANTUM_GET(x)
+#define MBOX_DMA_POLICY_RX_QUANTUM_SET(x) WLAN_MBOX_DMA_POLICY_RX_QUANTUM_SET(x)
+#define MBOX_DMA_POLICY_RX_ORDER_MSB WLAN_MBOX_DMA_POLICY_RX_ORDER_MSB
+#define MBOX_DMA_POLICY_RX_ORDER_LSB WLAN_MBOX_DMA_POLICY_RX_ORDER_LSB
+#define MBOX_DMA_POLICY_RX_ORDER_MASK WLAN_MBOX_DMA_POLICY_RX_ORDER_MASK
+#define MBOX_DMA_POLICY_RX_ORDER_GET(x) WLAN_MBOX_DMA_POLICY_RX_ORDER_GET(x)
+#define MBOX_DMA_POLICY_RX_ORDER_SET(x) WLAN_MBOX_DMA_POLICY_RX_ORDER_SET(x)
+#define MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS
+#define MBOX0_DMA_RX_DESCRIPTOR_BASE_OFFSET WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_OFFSET
+#define MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define MBOX0_DMA_RX_CONTROL_ADDRESS WLAN_MBOX0_DMA_RX_CONTROL_ADDRESS
+#define MBOX0_DMA_RX_CONTROL_OFFSET WLAN_MBOX0_DMA_RX_CONTROL_OFFSET
+#define MBOX0_DMA_RX_CONTROL_RESUME_MSB WLAN_MBOX0_DMA_RX_CONTROL_RESUME_MSB
+#define MBOX0_DMA_RX_CONTROL_RESUME_LSB WLAN_MBOX0_DMA_RX_CONTROL_RESUME_LSB
+#define MBOX0_DMA_RX_CONTROL_RESUME_MASK WLAN_MBOX0_DMA_RX_CONTROL_RESUME_MASK
+#define MBOX0_DMA_RX_CONTROL_RESUME_GET(x) WLAN_MBOX0_DMA_RX_CONTROL_RESUME_GET(x)
+#define MBOX0_DMA_RX_CONTROL_RESUME_SET(x) WLAN_MBOX0_DMA_RX_CONTROL_RESUME_SET(x)
+#define MBOX0_DMA_RX_CONTROL_START_MSB WLAN_MBOX0_DMA_RX_CONTROL_START_MSB
+#define MBOX0_DMA_RX_CONTROL_START_LSB WLAN_MBOX0_DMA_RX_CONTROL_START_LSB
+#define MBOX0_DMA_RX_CONTROL_START_MASK WLAN_MBOX0_DMA_RX_CONTROL_START_MASK
+#define MBOX0_DMA_RX_CONTROL_START_GET(x) WLAN_MBOX0_DMA_RX_CONTROL_START_GET(x)
+#define MBOX0_DMA_RX_CONTROL_START_SET(x) WLAN_MBOX0_DMA_RX_CONTROL_START_SET(x)
+#define MBOX0_DMA_RX_CONTROL_STOP_MSB WLAN_MBOX0_DMA_RX_CONTROL_STOP_MSB
+#define MBOX0_DMA_RX_CONTROL_STOP_LSB WLAN_MBOX0_DMA_RX_CONTROL_STOP_LSB
+#define MBOX0_DMA_RX_CONTROL_STOP_MASK WLAN_MBOX0_DMA_RX_CONTROL_STOP_MASK
+#define MBOX0_DMA_RX_CONTROL_STOP_GET(x) WLAN_MBOX0_DMA_RX_CONTROL_STOP_GET(x)
+#define MBOX0_DMA_RX_CONTROL_STOP_SET(x) WLAN_MBOX0_DMA_RX_CONTROL_STOP_SET(x)
+#define MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS
+#define MBOX0_DMA_TX_DESCRIPTOR_BASE_OFFSET WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_OFFSET
+#define MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define MBOX0_DMA_TX_CONTROL_ADDRESS WLAN_MBOX0_DMA_TX_CONTROL_ADDRESS
+#define MBOX0_DMA_TX_CONTROL_OFFSET WLAN_MBOX0_DMA_TX_CONTROL_OFFSET
+#define MBOX0_DMA_TX_CONTROL_RESUME_MSB WLAN_MBOX0_DMA_TX_CONTROL_RESUME_MSB
+#define MBOX0_DMA_TX_CONTROL_RESUME_LSB WLAN_MBOX0_DMA_TX_CONTROL_RESUME_LSB
+#define MBOX0_DMA_TX_CONTROL_RESUME_MASK WLAN_MBOX0_DMA_TX_CONTROL_RESUME_MASK
+#define MBOX0_DMA_TX_CONTROL_RESUME_GET(x) WLAN_MBOX0_DMA_TX_CONTROL_RESUME_GET(x)
+#define MBOX0_DMA_TX_CONTROL_RESUME_SET(x) WLAN_MBOX0_DMA_TX_CONTROL_RESUME_SET(x)
+#define MBOX0_DMA_TX_CONTROL_START_MSB WLAN_MBOX0_DMA_TX_CONTROL_START_MSB
+#define MBOX0_DMA_TX_CONTROL_START_LSB WLAN_MBOX0_DMA_TX_CONTROL_START_LSB
+#define MBOX0_DMA_TX_CONTROL_START_MASK WLAN_MBOX0_DMA_TX_CONTROL_START_MASK
+#define MBOX0_DMA_TX_CONTROL_START_GET(x) WLAN_MBOX0_DMA_TX_CONTROL_START_GET(x)
+#define MBOX0_DMA_TX_CONTROL_START_SET(x) WLAN_MBOX0_DMA_TX_CONTROL_START_SET(x)
+#define MBOX0_DMA_TX_CONTROL_STOP_MSB WLAN_MBOX0_DMA_TX_CONTROL_STOP_MSB
+#define MBOX0_DMA_TX_CONTROL_STOP_LSB WLAN_MBOX0_DMA_TX_CONTROL_STOP_LSB
+#define MBOX0_DMA_TX_CONTROL_STOP_MASK WLAN_MBOX0_DMA_TX_CONTROL_STOP_MASK
+#define MBOX0_DMA_TX_CONTROL_STOP_GET(x) WLAN_MBOX0_DMA_TX_CONTROL_STOP_GET(x)
+#define MBOX0_DMA_TX_CONTROL_STOP_SET(x) WLAN_MBOX0_DMA_TX_CONTROL_STOP_SET(x)
+#define MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS
+#define MBOX1_DMA_RX_DESCRIPTOR_BASE_OFFSET WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_OFFSET
+#define MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define MBOX1_DMA_RX_CONTROL_ADDRESS WLAN_MBOX1_DMA_RX_CONTROL_ADDRESS
+#define MBOX1_DMA_RX_CONTROL_OFFSET WLAN_MBOX1_DMA_RX_CONTROL_OFFSET
+#define MBOX1_DMA_RX_CONTROL_RESUME_MSB WLAN_MBOX1_DMA_RX_CONTROL_RESUME_MSB
+#define MBOX1_DMA_RX_CONTROL_RESUME_LSB WLAN_MBOX1_DMA_RX_CONTROL_RESUME_LSB
+#define MBOX1_DMA_RX_CONTROL_RESUME_MASK WLAN_MBOX1_DMA_RX_CONTROL_RESUME_MASK
+#define MBOX1_DMA_RX_CONTROL_RESUME_GET(x) WLAN_MBOX1_DMA_RX_CONTROL_RESUME_GET(x)
+#define MBOX1_DMA_RX_CONTROL_RESUME_SET(x) WLAN_MBOX1_DMA_RX_CONTROL_RESUME_SET(x)
+#define MBOX1_DMA_RX_CONTROL_START_MSB WLAN_MBOX1_DMA_RX_CONTROL_START_MSB
+#define MBOX1_DMA_RX_CONTROL_START_LSB WLAN_MBOX1_DMA_RX_CONTROL_START_LSB
+#define MBOX1_DMA_RX_CONTROL_START_MASK WLAN_MBOX1_DMA_RX_CONTROL_START_MASK
+#define MBOX1_DMA_RX_CONTROL_START_GET(x) WLAN_MBOX1_DMA_RX_CONTROL_START_GET(x)
+#define MBOX1_DMA_RX_CONTROL_START_SET(x) WLAN_MBOX1_DMA_RX_CONTROL_START_SET(x)
+#define MBOX1_DMA_RX_CONTROL_STOP_MSB WLAN_MBOX1_DMA_RX_CONTROL_STOP_MSB
+#define MBOX1_DMA_RX_CONTROL_STOP_LSB WLAN_MBOX1_DMA_RX_CONTROL_STOP_LSB
+#define MBOX1_DMA_RX_CONTROL_STOP_MASK WLAN_MBOX1_DMA_RX_CONTROL_STOP_MASK
+#define MBOX1_DMA_RX_CONTROL_STOP_GET(x) WLAN_MBOX1_DMA_RX_CONTROL_STOP_GET(x)
+#define MBOX1_DMA_RX_CONTROL_STOP_SET(x) WLAN_MBOX1_DMA_RX_CONTROL_STOP_SET(x)
+#define MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS
+#define MBOX1_DMA_TX_DESCRIPTOR_BASE_OFFSET WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_OFFSET
+#define MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define MBOX1_DMA_TX_CONTROL_ADDRESS WLAN_MBOX1_DMA_TX_CONTROL_ADDRESS
+#define MBOX1_DMA_TX_CONTROL_OFFSET WLAN_MBOX1_DMA_TX_CONTROL_OFFSET
+#define MBOX1_DMA_TX_CONTROL_RESUME_MSB WLAN_MBOX1_DMA_TX_CONTROL_RESUME_MSB
+#define MBOX1_DMA_TX_CONTROL_RESUME_LSB WLAN_MBOX1_DMA_TX_CONTROL_RESUME_LSB
+#define MBOX1_DMA_TX_CONTROL_RESUME_MASK WLAN_MBOX1_DMA_TX_CONTROL_RESUME_MASK
+#define MBOX1_DMA_TX_CONTROL_RESUME_GET(x) WLAN_MBOX1_DMA_TX_CONTROL_RESUME_GET(x)
+#define MBOX1_DMA_TX_CONTROL_RESUME_SET(x) WLAN_MBOX1_DMA_TX_CONTROL_RESUME_SET(x)
+#define MBOX1_DMA_TX_CONTROL_START_MSB WLAN_MBOX1_DMA_TX_CONTROL_START_MSB
+#define MBOX1_DMA_TX_CONTROL_START_LSB WLAN_MBOX1_DMA_TX_CONTROL_START_LSB
+#define MBOX1_DMA_TX_CONTROL_START_MASK WLAN_MBOX1_DMA_TX_CONTROL_START_MASK
+#define MBOX1_DMA_TX_CONTROL_START_GET(x) WLAN_MBOX1_DMA_TX_CONTROL_START_GET(x)
+#define MBOX1_DMA_TX_CONTROL_START_SET(x) WLAN_MBOX1_DMA_TX_CONTROL_START_SET(x)
+#define MBOX1_DMA_TX_CONTROL_STOP_MSB WLAN_MBOX1_DMA_TX_CONTROL_STOP_MSB
+#define MBOX1_DMA_TX_CONTROL_STOP_LSB WLAN_MBOX1_DMA_TX_CONTROL_STOP_LSB
+#define MBOX1_DMA_TX_CONTROL_STOP_MASK WLAN_MBOX1_DMA_TX_CONTROL_STOP_MASK
+#define MBOX1_DMA_TX_CONTROL_STOP_GET(x) WLAN_MBOX1_DMA_TX_CONTROL_STOP_GET(x)
+#define MBOX1_DMA_TX_CONTROL_STOP_SET(x) WLAN_MBOX1_DMA_TX_CONTROL_STOP_SET(x)
+#define MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS
+#define MBOX2_DMA_RX_DESCRIPTOR_BASE_OFFSET WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_OFFSET
+#define MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define MBOX2_DMA_RX_CONTROL_ADDRESS WLAN_MBOX2_DMA_RX_CONTROL_ADDRESS
+#define MBOX2_DMA_RX_CONTROL_OFFSET WLAN_MBOX2_DMA_RX_CONTROL_OFFSET
+#define MBOX2_DMA_RX_CONTROL_RESUME_MSB WLAN_MBOX2_DMA_RX_CONTROL_RESUME_MSB
+#define MBOX2_DMA_RX_CONTROL_RESUME_LSB WLAN_MBOX2_DMA_RX_CONTROL_RESUME_LSB
+#define MBOX2_DMA_RX_CONTROL_RESUME_MASK WLAN_MBOX2_DMA_RX_CONTROL_RESUME_MASK
+#define MBOX2_DMA_RX_CONTROL_RESUME_GET(x) WLAN_MBOX2_DMA_RX_CONTROL_RESUME_GET(x)
+#define MBOX2_DMA_RX_CONTROL_RESUME_SET(x) WLAN_MBOX2_DMA_RX_CONTROL_RESUME_SET(x)
+#define MBOX2_DMA_RX_CONTROL_START_MSB WLAN_MBOX2_DMA_RX_CONTROL_START_MSB
+#define MBOX2_DMA_RX_CONTROL_START_LSB WLAN_MBOX2_DMA_RX_CONTROL_START_LSB
+#define MBOX2_DMA_RX_CONTROL_START_MASK WLAN_MBOX2_DMA_RX_CONTROL_START_MASK
+#define MBOX2_DMA_RX_CONTROL_START_GET(x) WLAN_MBOX2_DMA_RX_CONTROL_START_GET(x)
+#define MBOX2_DMA_RX_CONTROL_START_SET(x) WLAN_MBOX2_DMA_RX_CONTROL_START_SET(x)
+#define MBOX2_DMA_RX_CONTROL_STOP_MSB WLAN_MBOX2_DMA_RX_CONTROL_STOP_MSB
+#define MBOX2_DMA_RX_CONTROL_STOP_LSB WLAN_MBOX2_DMA_RX_CONTROL_STOP_LSB
+#define MBOX2_DMA_RX_CONTROL_STOP_MASK WLAN_MBOX2_DMA_RX_CONTROL_STOP_MASK
+#define MBOX2_DMA_RX_CONTROL_STOP_GET(x) WLAN_MBOX2_DMA_RX_CONTROL_STOP_GET(x)
+#define MBOX2_DMA_RX_CONTROL_STOP_SET(x) WLAN_MBOX2_DMA_RX_CONTROL_STOP_SET(x)
+#define MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS
+#define MBOX2_DMA_TX_DESCRIPTOR_BASE_OFFSET WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_OFFSET
+#define MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define MBOX2_DMA_TX_CONTROL_ADDRESS WLAN_MBOX2_DMA_TX_CONTROL_ADDRESS
+#define MBOX2_DMA_TX_CONTROL_OFFSET WLAN_MBOX2_DMA_TX_CONTROL_OFFSET
+#define MBOX2_DMA_TX_CONTROL_RESUME_MSB WLAN_MBOX2_DMA_TX_CONTROL_RESUME_MSB
+#define MBOX2_DMA_TX_CONTROL_RESUME_LSB WLAN_MBOX2_DMA_TX_CONTROL_RESUME_LSB
+#define MBOX2_DMA_TX_CONTROL_RESUME_MASK WLAN_MBOX2_DMA_TX_CONTROL_RESUME_MASK
+#define MBOX2_DMA_TX_CONTROL_RESUME_GET(x) WLAN_MBOX2_DMA_TX_CONTROL_RESUME_GET(x)
+#define MBOX2_DMA_TX_CONTROL_RESUME_SET(x) WLAN_MBOX2_DMA_TX_CONTROL_RESUME_SET(x)
+#define MBOX2_DMA_TX_CONTROL_START_MSB WLAN_MBOX2_DMA_TX_CONTROL_START_MSB
+#define MBOX2_DMA_TX_CONTROL_START_LSB WLAN_MBOX2_DMA_TX_CONTROL_START_LSB
+#define MBOX2_DMA_TX_CONTROL_START_MASK WLAN_MBOX2_DMA_TX_CONTROL_START_MASK
+#define MBOX2_DMA_TX_CONTROL_START_GET(x) WLAN_MBOX2_DMA_TX_CONTROL_START_GET(x)
+#define MBOX2_DMA_TX_CONTROL_START_SET(x) WLAN_MBOX2_DMA_TX_CONTROL_START_SET(x)
+#define MBOX2_DMA_TX_CONTROL_STOP_MSB WLAN_MBOX2_DMA_TX_CONTROL_STOP_MSB
+#define MBOX2_DMA_TX_CONTROL_STOP_LSB WLAN_MBOX2_DMA_TX_CONTROL_STOP_LSB
+#define MBOX2_DMA_TX_CONTROL_STOP_MASK WLAN_MBOX2_DMA_TX_CONTROL_STOP_MASK
+#define MBOX2_DMA_TX_CONTROL_STOP_GET(x) WLAN_MBOX2_DMA_TX_CONTROL_STOP_GET(x)
+#define MBOX2_DMA_TX_CONTROL_STOP_SET(x) WLAN_MBOX2_DMA_TX_CONTROL_STOP_SET(x)
+#define MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS
+#define MBOX3_DMA_RX_DESCRIPTOR_BASE_OFFSET WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_OFFSET
+#define MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define MBOX3_DMA_RX_CONTROL_ADDRESS WLAN_MBOX3_DMA_RX_CONTROL_ADDRESS
+#define MBOX3_DMA_RX_CONTROL_OFFSET WLAN_MBOX3_DMA_RX_CONTROL_OFFSET
+#define MBOX3_DMA_RX_CONTROL_RESUME_MSB WLAN_MBOX3_DMA_RX_CONTROL_RESUME_MSB
+#define MBOX3_DMA_RX_CONTROL_RESUME_LSB WLAN_MBOX3_DMA_RX_CONTROL_RESUME_LSB
+#define MBOX3_DMA_RX_CONTROL_RESUME_MASK WLAN_MBOX3_DMA_RX_CONTROL_RESUME_MASK
+#define MBOX3_DMA_RX_CONTROL_RESUME_GET(x) WLAN_MBOX3_DMA_RX_CONTROL_RESUME_GET(x)
+#define MBOX3_DMA_RX_CONTROL_RESUME_SET(x) WLAN_MBOX3_DMA_RX_CONTROL_RESUME_SET(x)
+#define MBOX3_DMA_RX_CONTROL_START_MSB WLAN_MBOX3_DMA_RX_CONTROL_START_MSB
+#define MBOX3_DMA_RX_CONTROL_START_LSB WLAN_MBOX3_DMA_RX_CONTROL_START_LSB
+#define MBOX3_DMA_RX_CONTROL_START_MASK WLAN_MBOX3_DMA_RX_CONTROL_START_MASK
+#define MBOX3_DMA_RX_CONTROL_START_GET(x) WLAN_MBOX3_DMA_RX_CONTROL_START_GET(x)
+#define MBOX3_DMA_RX_CONTROL_START_SET(x) WLAN_MBOX3_DMA_RX_CONTROL_START_SET(x)
+#define MBOX3_DMA_RX_CONTROL_STOP_MSB WLAN_MBOX3_DMA_RX_CONTROL_STOP_MSB
+#define MBOX3_DMA_RX_CONTROL_STOP_LSB WLAN_MBOX3_DMA_RX_CONTROL_STOP_LSB
+#define MBOX3_DMA_RX_CONTROL_STOP_MASK WLAN_MBOX3_DMA_RX_CONTROL_STOP_MASK
+#define MBOX3_DMA_RX_CONTROL_STOP_GET(x) WLAN_MBOX3_DMA_RX_CONTROL_STOP_GET(x)
+#define MBOX3_DMA_RX_CONTROL_STOP_SET(x) WLAN_MBOX3_DMA_RX_CONTROL_STOP_SET(x)
+#define MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS
+#define MBOX3_DMA_TX_DESCRIPTOR_BASE_OFFSET WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_OFFSET
+#define MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define MBOX3_DMA_TX_CONTROL_ADDRESS WLAN_MBOX3_DMA_TX_CONTROL_ADDRESS
+#define MBOX3_DMA_TX_CONTROL_OFFSET WLAN_MBOX3_DMA_TX_CONTROL_OFFSET
+#define MBOX3_DMA_TX_CONTROL_RESUME_MSB WLAN_MBOX3_DMA_TX_CONTROL_RESUME_MSB
+#define MBOX3_DMA_TX_CONTROL_RESUME_LSB WLAN_MBOX3_DMA_TX_CONTROL_RESUME_LSB
+#define MBOX3_DMA_TX_CONTROL_RESUME_MASK WLAN_MBOX3_DMA_TX_CONTROL_RESUME_MASK
+#define MBOX3_DMA_TX_CONTROL_RESUME_GET(x) WLAN_MBOX3_DMA_TX_CONTROL_RESUME_GET(x)
+#define MBOX3_DMA_TX_CONTROL_RESUME_SET(x) WLAN_MBOX3_DMA_TX_CONTROL_RESUME_SET(x)
+#define MBOX3_DMA_TX_CONTROL_START_MSB WLAN_MBOX3_DMA_TX_CONTROL_START_MSB
+#define MBOX3_DMA_TX_CONTROL_START_LSB WLAN_MBOX3_DMA_TX_CONTROL_START_LSB
+#define MBOX3_DMA_TX_CONTROL_START_MASK WLAN_MBOX3_DMA_TX_CONTROL_START_MASK
+#define MBOX3_DMA_TX_CONTROL_START_GET(x) WLAN_MBOX3_DMA_TX_CONTROL_START_GET(x)
+#define MBOX3_DMA_TX_CONTROL_START_SET(x) WLAN_MBOX3_DMA_TX_CONTROL_START_SET(x)
+#define MBOX3_DMA_TX_CONTROL_STOP_MSB WLAN_MBOX3_DMA_TX_CONTROL_STOP_MSB
+#define MBOX3_DMA_TX_CONTROL_STOP_LSB WLAN_MBOX3_DMA_TX_CONTROL_STOP_LSB
+#define MBOX3_DMA_TX_CONTROL_STOP_MASK WLAN_MBOX3_DMA_TX_CONTROL_STOP_MASK
+#define MBOX3_DMA_TX_CONTROL_STOP_GET(x) WLAN_MBOX3_DMA_TX_CONTROL_STOP_GET(x)
+#define MBOX3_DMA_TX_CONTROL_STOP_SET(x) WLAN_MBOX3_DMA_TX_CONTROL_STOP_SET(x)
+#define MBOX_INT_STATUS_ADDRESS WLAN_MBOX_INT_STATUS_ADDRESS
+#define MBOX_INT_STATUS_OFFSET WLAN_MBOX_INT_STATUS_OFFSET
+#define MBOX_INT_STATUS_RX_DMA_COMPLETE_MSB WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_MSB
+#define MBOX_INT_STATUS_RX_DMA_COMPLETE_LSB WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_LSB
+#define MBOX_INT_STATUS_RX_DMA_COMPLETE_MASK WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_MASK
+#define MBOX_INT_STATUS_RX_DMA_COMPLETE_GET(x) WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_GET(x)
+#define MBOX_INT_STATUS_RX_DMA_COMPLETE_SET(x) WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_SET(x)
+#define MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MSB WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MSB
+#define MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB
+#define MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK
+#define MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_GET(x) WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_GET(x)
+#define MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_SET(x) WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_SET(x)
+#define MBOX_INT_STATUS_TX_DMA_COMPLETE_MSB WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_MSB
+#define MBOX_INT_STATUS_TX_DMA_COMPLETE_LSB WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_LSB
+#define MBOX_INT_STATUS_TX_DMA_COMPLETE_MASK WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_MASK
+#define MBOX_INT_STATUS_TX_DMA_COMPLETE_GET(x) WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_GET(x)
+#define MBOX_INT_STATUS_TX_DMA_COMPLETE_SET(x) WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_SET(x)
+#define MBOX_INT_STATUS_TX_OVERFLOW_MSB WLAN_MBOX_INT_STATUS_TX_OVERFLOW_MSB
+#define MBOX_INT_STATUS_TX_OVERFLOW_LSB WLAN_MBOX_INT_STATUS_TX_OVERFLOW_LSB
+#define MBOX_INT_STATUS_TX_OVERFLOW_MASK WLAN_MBOX_INT_STATUS_TX_OVERFLOW_MASK
+#define MBOX_INT_STATUS_TX_OVERFLOW_GET(x) WLAN_MBOX_INT_STATUS_TX_OVERFLOW_GET(x)
+#define MBOX_INT_STATUS_TX_OVERFLOW_SET(x) WLAN_MBOX_INT_STATUS_TX_OVERFLOW_SET(x)
+#define MBOX_INT_STATUS_RX_UNDERFLOW_MSB WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_MSB
+#define MBOX_INT_STATUS_RX_UNDERFLOW_LSB WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_LSB
+#define MBOX_INT_STATUS_RX_UNDERFLOW_MASK WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_MASK
+#define MBOX_INT_STATUS_RX_UNDERFLOW_GET(x) WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_GET(x)
+#define MBOX_INT_STATUS_RX_UNDERFLOW_SET(x) WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_SET(x)
+#define MBOX_INT_STATUS_TX_NOT_EMPTY_MSB WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_MSB
+#define MBOX_INT_STATUS_TX_NOT_EMPTY_LSB WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_LSB
+#define MBOX_INT_STATUS_TX_NOT_EMPTY_MASK WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_MASK
+#define MBOX_INT_STATUS_TX_NOT_EMPTY_GET(x) WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_GET(x)
+#define MBOX_INT_STATUS_TX_NOT_EMPTY_SET(x) WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_SET(x)
+#define MBOX_INT_STATUS_RX_NOT_FULL_MSB WLAN_MBOX_INT_STATUS_RX_NOT_FULL_MSB
+#define MBOX_INT_STATUS_RX_NOT_FULL_LSB WLAN_MBOX_INT_STATUS_RX_NOT_FULL_LSB
+#define MBOX_INT_STATUS_RX_NOT_FULL_MASK WLAN_MBOX_INT_STATUS_RX_NOT_FULL_MASK
+#define MBOX_INT_STATUS_RX_NOT_FULL_GET(x) WLAN_MBOX_INT_STATUS_RX_NOT_FULL_GET(x)
+#define MBOX_INT_STATUS_RX_NOT_FULL_SET(x) WLAN_MBOX_INT_STATUS_RX_NOT_FULL_SET(x)
+#define MBOX_INT_STATUS_HOST_MSB WLAN_MBOX_INT_STATUS_HOST_MSB
+#define MBOX_INT_STATUS_HOST_LSB WLAN_MBOX_INT_STATUS_HOST_LSB
+#define MBOX_INT_STATUS_HOST_MASK WLAN_MBOX_INT_STATUS_HOST_MASK
+#define MBOX_INT_STATUS_HOST_GET(x) WLAN_MBOX_INT_STATUS_HOST_GET(x)
+#define MBOX_INT_STATUS_HOST_SET(x) WLAN_MBOX_INT_STATUS_HOST_SET(x)
+#define MBOX_INT_ENABLE_ADDRESS WLAN_MBOX_INT_ENABLE_ADDRESS
+#define MBOX_INT_ENABLE_OFFSET WLAN_MBOX_INT_ENABLE_OFFSET
+#define MBOX_INT_ENABLE_RX_DMA_COMPLETE_MSB WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_MSB
+#define MBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB
+#define MBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK
+#define MBOX_INT_ENABLE_RX_DMA_COMPLETE_GET(x) WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_GET(x)
+#define MBOX_INT_ENABLE_RX_DMA_COMPLETE_SET(x) WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_SET(x)
+#define MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MSB WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MSB
+#define MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB
+#define MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK
+#define MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_GET(x) WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_GET(x)
+#define MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_SET(x) WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_SET(x)
+#define MBOX_INT_ENABLE_TX_DMA_COMPLETE_MSB WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_MSB
+#define MBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB
+#define MBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK
+#define MBOX_INT_ENABLE_TX_DMA_COMPLETE_GET(x) WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_GET(x)
+#define MBOX_INT_ENABLE_TX_DMA_COMPLETE_SET(x) WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_SET(x)
+#define MBOX_INT_ENABLE_TX_OVERFLOW_MSB WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_MSB
+#define MBOX_INT_ENABLE_TX_OVERFLOW_LSB WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_LSB
+#define MBOX_INT_ENABLE_TX_OVERFLOW_MASK WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_MASK
+#define MBOX_INT_ENABLE_TX_OVERFLOW_GET(x) WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_GET(x)
+#define MBOX_INT_ENABLE_TX_OVERFLOW_SET(x) WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_SET(x)
+#define MBOX_INT_ENABLE_RX_UNDERFLOW_MSB WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_MSB
+#define MBOX_INT_ENABLE_RX_UNDERFLOW_LSB WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_LSB
+#define MBOX_INT_ENABLE_RX_UNDERFLOW_MASK WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_MASK
+#define MBOX_INT_ENABLE_RX_UNDERFLOW_GET(x) WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_GET(x)
+#define MBOX_INT_ENABLE_RX_UNDERFLOW_SET(x) WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_SET(x)
+#define MBOX_INT_ENABLE_TX_NOT_EMPTY_MSB WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_MSB
+#define MBOX_INT_ENABLE_TX_NOT_EMPTY_LSB WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_LSB
+#define MBOX_INT_ENABLE_TX_NOT_EMPTY_MASK WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_MASK
+#define MBOX_INT_ENABLE_TX_NOT_EMPTY_GET(x) WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_GET(x)
+#define MBOX_INT_ENABLE_TX_NOT_EMPTY_SET(x) WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_SET(x)
+#define MBOX_INT_ENABLE_RX_NOT_FULL_MSB WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_MSB
+#define MBOX_INT_ENABLE_RX_NOT_FULL_LSB WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_LSB
+#define MBOX_INT_ENABLE_RX_NOT_FULL_MASK WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_MASK
+#define MBOX_INT_ENABLE_RX_NOT_FULL_GET(x) WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_GET(x)
+#define MBOX_INT_ENABLE_RX_NOT_FULL_SET(x) WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_SET(x)
+#define MBOX_INT_ENABLE_HOST_MSB WLAN_MBOX_INT_ENABLE_HOST_MSB
+#define MBOX_INT_ENABLE_HOST_LSB WLAN_MBOX_INT_ENABLE_HOST_LSB
+#define MBOX_INT_ENABLE_HOST_MASK WLAN_MBOX_INT_ENABLE_HOST_MASK
+#define MBOX_INT_ENABLE_HOST_GET(x) WLAN_MBOX_INT_ENABLE_HOST_GET(x)
+#define MBOX_INT_ENABLE_HOST_SET(x) WLAN_MBOX_INT_ENABLE_HOST_SET(x)
+#define INT_HOST_ADDRESS WLAN_INT_HOST_ADDRESS
+#define INT_HOST_OFFSET WLAN_INT_HOST_OFFSET
+#define INT_HOST_VECTOR_MSB WLAN_INT_HOST_VECTOR_MSB
+#define INT_HOST_VECTOR_LSB WLAN_INT_HOST_VECTOR_LSB
+#define INT_HOST_VECTOR_MASK WLAN_INT_HOST_VECTOR_MASK
+#define INT_HOST_VECTOR_GET(x) WLAN_INT_HOST_VECTOR_GET(x)
+#define INT_HOST_VECTOR_SET(x) WLAN_INT_HOST_VECTOR_SET(x)
+#define LOCAL_COUNT_ADDRESS WLAN_LOCAL_COUNT_ADDRESS
+#define LOCAL_COUNT_OFFSET WLAN_LOCAL_COUNT_OFFSET
+#define LOCAL_COUNT_VALUE_MSB WLAN_LOCAL_COUNT_VALUE_MSB
+#define LOCAL_COUNT_VALUE_LSB WLAN_LOCAL_COUNT_VALUE_LSB
+#define LOCAL_COUNT_VALUE_MASK WLAN_LOCAL_COUNT_VALUE_MASK
+#define LOCAL_COUNT_VALUE_GET(x) WLAN_LOCAL_COUNT_VALUE_GET(x)
+#define LOCAL_COUNT_VALUE_SET(x) WLAN_LOCAL_COUNT_VALUE_SET(x)
+#define COUNT_INC_ADDRESS WLAN_COUNT_INC_ADDRESS
+#define COUNT_INC_OFFSET WLAN_COUNT_INC_OFFSET
+#define COUNT_INC_VALUE_MSB WLAN_COUNT_INC_VALUE_MSB
+#define COUNT_INC_VALUE_LSB WLAN_COUNT_INC_VALUE_LSB
+#define COUNT_INC_VALUE_MASK WLAN_COUNT_INC_VALUE_MASK
+#define COUNT_INC_VALUE_GET(x) WLAN_COUNT_INC_VALUE_GET(x)
+#define COUNT_INC_VALUE_SET(x) WLAN_COUNT_INC_VALUE_SET(x)
+#define LOCAL_SCRATCH_ADDRESS WLAN_LOCAL_SCRATCH_ADDRESS
+#define LOCAL_SCRATCH_OFFSET WLAN_LOCAL_SCRATCH_OFFSET
+#define LOCAL_SCRATCH_VALUE_MSB WLAN_LOCAL_SCRATCH_VALUE_MSB
+#define LOCAL_SCRATCH_VALUE_LSB WLAN_LOCAL_SCRATCH_VALUE_LSB
+#define LOCAL_SCRATCH_VALUE_MASK WLAN_LOCAL_SCRATCH_VALUE_MASK
+#define LOCAL_SCRATCH_VALUE_GET(x) WLAN_LOCAL_SCRATCH_VALUE_GET(x)
+#define LOCAL_SCRATCH_VALUE_SET(x) WLAN_LOCAL_SCRATCH_VALUE_SET(x)
+#define USE_LOCAL_BUS_ADDRESS WLAN_USE_LOCAL_BUS_ADDRESS
+#define USE_LOCAL_BUS_OFFSET WLAN_USE_LOCAL_BUS_OFFSET
+#define USE_LOCAL_BUS_PIN_INIT_MSB WLAN_USE_LOCAL_BUS_PIN_INIT_MSB
+#define USE_LOCAL_BUS_PIN_INIT_LSB WLAN_USE_LOCAL_BUS_PIN_INIT_LSB
+#define USE_LOCAL_BUS_PIN_INIT_MASK WLAN_USE_LOCAL_BUS_PIN_INIT_MASK
+#define USE_LOCAL_BUS_PIN_INIT_GET(x) WLAN_USE_LOCAL_BUS_PIN_INIT_GET(x)
+#define USE_LOCAL_BUS_PIN_INIT_SET(x) WLAN_USE_LOCAL_BUS_PIN_INIT_SET(x)
+#define SDIO_CONFIG_ADDRESS WLAN_SDIO_CONFIG_ADDRESS
+#define SDIO_CONFIG_OFFSET WLAN_SDIO_CONFIG_OFFSET
+#define SDIO_CONFIG_CCCR_IOR1_MSB WLAN_SDIO_CONFIG_CCCR_IOR1_MSB
+#define SDIO_CONFIG_CCCR_IOR1_LSB WLAN_SDIO_CONFIG_CCCR_IOR1_LSB
+#define SDIO_CONFIG_CCCR_IOR1_MASK WLAN_SDIO_CONFIG_CCCR_IOR1_MASK
+#define SDIO_CONFIG_CCCR_IOR1_GET(x) WLAN_SDIO_CONFIG_CCCR_IOR1_GET(x)
+#define SDIO_CONFIG_CCCR_IOR1_SET(x) WLAN_SDIO_CONFIG_CCCR_IOR1_SET(x)
+#define MBOX_DEBUG_ADDRESS WLAN_MBOX_DEBUG_ADDRESS
+#define MBOX_DEBUG_OFFSET WLAN_MBOX_DEBUG_OFFSET
+#define MBOX_DEBUG_SEL_MSB WLAN_MBOX_DEBUG_SEL_MSB
+#define MBOX_DEBUG_SEL_LSB WLAN_MBOX_DEBUG_SEL_LSB
+#define MBOX_DEBUG_SEL_MASK WLAN_MBOX_DEBUG_SEL_MASK
+#define MBOX_DEBUG_SEL_GET(x) WLAN_MBOX_DEBUG_SEL_GET(x)
+#define MBOX_DEBUG_SEL_SET(x) WLAN_MBOX_DEBUG_SEL_SET(x)
+#define MBOX_FIFO_RESET_ADDRESS WLAN_MBOX_FIFO_RESET_ADDRESS
+#define MBOX_FIFO_RESET_OFFSET WLAN_MBOX_FIFO_RESET_OFFSET
+#define MBOX_FIFO_RESET_INIT_MSB WLAN_MBOX_FIFO_RESET_INIT_MSB
+#define MBOX_FIFO_RESET_INIT_LSB WLAN_MBOX_FIFO_RESET_INIT_LSB
+#define MBOX_FIFO_RESET_INIT_MASK WLAN_MBOX_FIFO_RESET_INIT_MASK
+#define MBOX_FIFO_RESET_INIT_GET(x) WLAN_MBOX_FIFO_RESET_INIT_GET(x)
+#define MBOX_FIFO_RESET_INIT_SET(x) WLAN_MBOX_FIFO_RESET_INIT_SET(x)
+#define MBOX_TXFIFO_POP_ADDRESS WLAN_MBOX_TXFIFO_POP_ADDRESS
+#define MBOX_TXFIFO_POP_OFFSET WLAN_MBOX_TXFIFO_POP_OFFSET
+#define MBOX_TXFIFO_POP_DATA_MSB WLAN_MBOX_TXFIFO_POP_DATA_MSB
+#define MBOX_TXFIFO_POP_DATA_LSB WLAN_MBOX_TXFIFO_POP_DATA_LSB
+#define MBOX_TXFIFO_POP_DATA_MASK WLAN_MBOX_TXFIFO_POP_DATA_MASK
+#define MBOX_TXFIFO_POP_DATA_GET(x) WLAN_MBOX_TXFIFO_POP_DATA_GET(x)
+#define MBOX_TXFIFO_POP_DATA_SET(x) WLAN_MBOX_TXFIFO_POP_DATA_SET(x)
+#define MBOX_RXFIFO_POP_ADDRESS WLAN_MBOX_RXFIFO_POP_ADDRESS
+#define MBOX_RXFIFO_POP_OFFSET WLAN_MBOX_RXFIFO_POP_OFFSET
+#define MBOX_RXFIFO_POP_DATA_MSB WLAN_MBOX_RXFIFO_POP_DATA_MSB
+#define MBOX_RXFIFO_POP_DATA_LSB WLAN_MBOX_RXFIFO_POP_DATA_LSB
+#define MBOX_RXFIFO_POP_DATA_MASK WLAN_MBOX_RXFIFO_POP_DATA_MASK
+#define MBOX_RXFIFO_POP_DATA_GET(x) WLAN_MBOX_RXFIFO_POP_DATA_GET(x)
+#define MBOX_RXFIFO_POP_DATA_SET(x) WLAN_MBOX_RXFIFO_POP_DATA_SET(x)
+#define SDIO_DEBUG_ADDRESS WLAN_SDIO_DEBUG_ADDRESS
+#define SDIO_DEBUG_OFFSET WLAN_SDIO_DEBUG_OFFSET
+#define SDIO_DEBUG_SEL_MSB WLAN_SDIO_DEBUG_SEL_MSB
+#define SDIO_DEBUG_SEL_LSB WLAN_SDIO_DEBUG_SEL_LSB
+#define SDIO_DEBUG_SEL_MASK WLAN_SDIO_DEBUG_SEL_MASK
+#define SDIO_DEBUG_SEL_GET(x) WLAN_SDIO_DEBUG_SEL_GET(x)
+#define SDIO_DEBUG_SEL_SET(x) WLAN_SDIO_DEBUG_SEL_SET(x)
+#define GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS
+#define GMBOX0_DMA_RX_DESCRIPTOR_BASE_OFFSET WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_OFFSET
+#define GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define GMBOX0_DMA_RX_CONTROL_ADDRESS WLAN_GMBOX0_DMA_RX_CONTROL_ADDRESS
+#define GMBOX0_DMA_RX_CONTROL_OFFSET WLAN_GMBOX0_DMA_RX_CONTROL_OFFSET
+#define GMBOX0_DMA_RX_CONTROL_RESUME_MSB WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_MSB
+#define GMBOX0_DMA_RX_CONTROL_RESUME_LSB WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_LSB
+#define GMBOX0_DMA_RX_CONTROL_RESUME_MASK WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_MASK
+#define GMBOX0_DMA_RX_CONTROL_RESUME_GET(x) WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_GET(x)
+#define GMBOX0_DMA_RX_CONTROL_RESUME_SET(x) WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_SET(x)
+#define GMBOX0_DMA_RX_CONTROL_START_MSB WLAN_GMBOX0_DMA_RX_CONTROL_START_MSB
+#define GMBOX0_DMA_RX_CONTROL_START_LSB WLAN_GMBOX0_DMA_RX_CONTROL_START_LSB
+#define GMBOX0_DMA_RX_CONTROL_START_MASK WLAN_GMBOX0_DMA_RX_CONTROL_START_MASK
+#define GMBOX0_DMA_RX_CONTROL_START_GET(x) WLAN_GMBOX0_DMA_RX_CONTROL_START_GET(x)
+#define GMBOX0_DMA_RX_CONTROL_START_SET(x) WLAN_GMBOX0_DMA_RX_CONTROL_START_SET(x)
+#define GMBOX0_DMA_RX_CONTROL_STOP_MSB WLAN_GMBOX0_DMA_RX_CONTROL_STOP_MSB
+#define GMBOX0_DMA_RX_CONTROL_STOP_LSB WLAN_GMBOX0_DMA_RX_CONTROL_STOP_LSB
+#define GMBOX0_DMA_RX_CONTROL_STOP_MASK WLAN_GMBOX0_DMA_RX_CONTROL_STOP_MASK
+#define GMBOX0_DMA_RX_CONTROL_STOP_GET(x) WLAN_GMBOX0_DMA_RX_CONTROL_STOP_GET(x)
+#define GMBOX0_DMA_RX_CONTROL_STOP_SET(x) WLAN_GMBOX0_DMA_RX_CONTROL_STOP_SET(x)
+#define GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS
+#define GMBOX0_DMA_TX_DESCRIPTOR_BASE_OFFSET WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_OFFSET
+#define GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB
+#define GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB
+#define GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK
+#define GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x)
+#define GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x)
+#define GMBOX0_DMA_TX_CONTROL_ADDRESS WLAN_GMBOX0_DMA_TX_CONTROL_ADDRESS
+#define GMBOX0_DMA_TX_CONTROL_OFFSET WLAN_GMBOX0_DMA_TX_CONTROL_OFFSET
+#define GMBOX0_DMA_TX_CONTROL_RESUME_MSB WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_MSB
+#define GMBOX0_DMA_TX_CONTROL_RESUME_LSB WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_LSB
+#define GMBOX0_DMA_TX_CONTROL_RESUME_MASK WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_MASK
+#define GMBOX0_DMA_TX_CONTROL_RESUME_GET(x) WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_GET(x)
+#define GMBOX0_DMA_TX_CONTROL_RESUME_SET(x) WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_SET(x)
+#define GMBOX0_DMA_TX_CONTROL_START_MSB WLAN_GMBOX0_DMA_TX_CONTROL_START_MSB
+#define GMBOX0_DMA_TX_CONTROL_START_LSB WLAN_GMBOX0_DMA_TX_CONTROL_START_LSB
+#define GMBOX0_DMA_TX_CONTROL_START_MASK WLAN_GMBOX0_DMA_TX_CONTROL_START_MASK
+#define GMBOX0_DMA_TX_CONTROL_START_GET(x) WLAN_GMBOX0_DMA_TX_CONTROL_START_GET(x)
+#define GMBOX0_DMA_TX_CONTROL_START_SET(x) WLAN_GMBOX0_DMA_TX_CONTROL_START_SET(x)
+#define GMBOX0_DMA_TX_CONTROL_STOP_MSB WLAN_GMBOX0_DMA_TX_CONTROL_STOP_MSB
+#define GMBOX0_DMA_TX_CONTROL_STOP_LSB WLAN_GMBOX0_DMA_TX_CONTROL_STOP_LSB
+#define GMBOX0_DMA_TX_CONTROL_STOP_MASK WLAN_GMBOX0_DMA_TX_CONTROL_STOP_MASK
+#define GMBOX0_DMA_TX_CONTROL_STOP_GET(x) WLAN_GMBOX0_DMA_TX_CONTROL_STOP_GET(x)
+#define GMBOX0_DMA_TX_CONTROL_STOP_SET(x) WLAN_GMBOX0_DMA_TX_CONTROL_STOP_SET(x)
+#define GMBOX_INT_STATUS_ADDRESS WLAN_GMBOX_INT_STATUS_ADDRESS
+#define GMBOX_INT_STATUS_OFFSET WLAN_GMBOX_INT_STATUS_OFFSET
+#define GMBOX_INT_STATUS_TX_OVERFLOW_MSB WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_MSB
+#define GMBOX_INT_STATUS_TX_OVERFLOW_LSB WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_LSB
+#define GMBOX_INT_STATUS_TX_OVERFLOW_MASK WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_MASK
+#define GMBOX_INT_STATUS_TX_OVERFLOW_GET(x) WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_GET(x)
+#define GMBOX_INT_STATUS_TX_OVERFLOW_SET(x) WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_SET(x)
+#define GMBOX_INT_STATUS_RX_UNDERFLOW_MSB WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_MSB
+#define GMBOX_INT_STATUS_RX_UNDERFLOW_LSB WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_LSB
+#define GMBOX_INT_STATUS_RX_UNDERFLOW_MASK WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_MASK
+#define GMBOX_INT_STATUS_RX_UNDERFLOW_GET(x) WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_GET(x)
+#define GMBOX_INT_STATUS_RX_UNDERFLOW_SET(x) WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_SET(x)
+#define GMBOX_INT_STATUS_RX_DMA_COMPLETE_MSB WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_MSB
+#define GMBOX_INT_STATUS_RX_DMA_COMPLETE_LSB WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_LSB
+#define GMBOX_INT_STATUS_RX_DMA_COMPLETE_MASK WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_MASK
+#define GMBOX_INT_STATUS_RX_DMA_COMPLETE_GET(x) WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_GET(x)
+#define GMBOX_INT_STATUS_RX_DMA_COMPLETE_SET(x) WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_SET(x)
+#define GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MSB WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MSB
+#define GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB
+#define GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK
+#define GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_GET(x) WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_GET(x)
+#define GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_SET(x) WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_SET(x)
+#define GMBOX_INT_STATUS_TX_DMA_COMPLETE_MSB WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_MSB
+#define GMBOX_INT_STATUS_TX_DMA_COMPLETE_LSB WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_LSB
+#define GMBOX_INT_STATUS_TX_DMA_COMPLETE_MASK WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_MASK
+#define GMBOX_INT_STATUS_TX_DMA_COMPLETE_GET(x) WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_GET(x)
+#define GMBOX_INT_STATUS_TX_DMA_COMPLETE_SET(x) WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_SET(x)
+#define GMBOX_INT_STATUS_TX_NOT_EMPTY_MSB WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_MSB
+#define GMBOX_INT_STATUS_TX_NOT_EMPTY_LSB WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_LSB
+#define GMBOX_INT_STATUS_TX_NOT_EMPTY_MASK WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_MASK
+#define GMBOX_INT_STATUS_TX_NOT_EMPTY_GET(x) WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_GET(x)
+#define GMBOX_INT_STATUS_TX_NOT_EMPTY_SET(x) WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_SET(x)
+#define GMBOX_INT_STATUS_RX_NOT_FULL_MSB WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_MSB
+#define GMBOX_INT_STATUS_RX_NOT_FULL_LSB WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_LSB
+#define GMBOX_INT_STATUS_RX_NOT_FULL_MASK WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_MASK
+#define GMBOX_INT_STATUS_RX_NOT_FULL_GET(x) WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_GET(x)
+#define GMBOX_INT_STATUS_RX_NOT_FULL_SET(x) WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_SET(x)
+#define GMBOX_INT_ENABLE_ADDRESS WLAN_GMBOX_INT_ENABLE_ADDRESS
+#define GMBOX_INT_ENABLE_OFFSET WLAN_GMBOX_INT_ENABLE_OFFSET
+#define GMBOX_INT_ENABLE_TX_OVERFLOW_MSB WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_MSB
+#define GMBOX_INT_ENABLE_TX_OVERFLOW_LSB WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_LSB
+#define GMBOX_INT_ENABLE_TX_OVERFLOW_MASK WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_MASK
+#define GMBOX_INT_ENABLE_TX_OVERFLOW_GET(x) WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_GET(x)
+#define GMBOX_INT_ENABLE_TX_OVERFLOW_SET(x) WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_SET(x)
+#define GMBOX_INT_ENABLE_RX_UNDERFLOW_MSB WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_MSB
+#define GMBOX_INT_ENABLE_RX_UNDERFLOW_LSB WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_LSB
+#define GMBOX_INT_ENABLE_RX_UNDERFLOW_MASK WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_MASK
+#define GMBOX_INT_ENABLE_RX_UNDERFLOW_GET(x) WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_GET(x)
+#define GMBOX_INT_ENABLE_RX_UNDERFLOW_SET(x) WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_SET(x)
+#define GMBOX_INT_ENABLE_RX_DMA_COMPLETE_MSB WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_MSB
+#define GMBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB
+#define GMBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK
+#define GMBOX_INT_ENABLE_RX_DMA_COMPLETE_GET(x) WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_GET(x)
+#define GMBOX_INT_ENABLE_RX_DMA_COMPLETE_SET(x) WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_SET(x)
+#define GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MSB WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MSB
+#define GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB
+#define GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK
+#define GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_GET(x) WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_GET(x)
+#define GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_SET(x) WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_SET(x)
+#define GMBOX_INT_ENABLE_TX_DMA_COMPLETE_MSB WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_MSB
+#define GMBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB
+#define GMBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK
+#define GMBOX_INT_ENABLE_TX_DMA_COMPLETE_GET(x) WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_GET(x)
+#define GMBOX_INT_ENABLE_TX_DMA_COMPLETE_SET(x) WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_SET(x)
+#define GMBOX_INT_ENABLE_TX_NOT_EMPTY_MSB WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_MSB
+#define GMBOX_INT_ENABLE_TX_NOT_EMPTY_LSB WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_LSB
+#define GMBOX_INT_ENABLE_TX_NOT_EMPTY_MASK WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_MASK
+#define GMBOX_INT_ENABLE_TX_NOT_EMPTY_GET(x) WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_GET(x)
+#define GMBOX_INT_ENABLE_TX_NOT_EMPTY_SET(x) WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_SET(x)
+#define GMBOX_INT_ENABLE_RX_NOT_FULL_MSB WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_MSB
+#define GMBOX_INT_ENABLE_RX_NOT_FULL_LSB WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_LSB
+#define GMBOX_INT_ENABLE_RX_NOT_FULL_MASK WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_MASK
+#define GMBOX_INT_ENABLE_RX_NOT_FULL_GET(x) WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_GET(x)
+#define GMBOX_INT_ENABLE_RX_NOT_FULL_SET(x) WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_SET(x)
+#define HOST_IF_WINDOW_ADDRESS WLAN_HOST_IF_WINDOW_ADDRESS
+#define HOST_IF_WINDOW_OFFSET WLAN_HOST_IF_WINDOW_OFFSET
+#define HOST_IF_WINDOW_DATA_MSB WLAN_HOST_IF_WINDOW_DATA_MSB
+#define HOST_IF_WINDOW_DATA_LSB WLAN_HOST_IF_WINDOW_DATA_LSB
+#define HOST_IF_WINDOW_DATA_MASK WLAN_HOST_IF_WINDOW_DATA_MASK
+#define HOST_IF_WINDOW_DATA_GET(x) WLAN_HOST_IF_WINDOW_DATA_GET(x)
+#define HOST_IF_WINDOW_DATA_SET(x) WLAN_HOST_IF_WINDOW_DATA_SET(x)
+
+#endif
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_wlan_host_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_wlan_host_reg.h
new file mode 100644
index 00000000000..038d0d01927
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_wlan_host_reg.h
@@ -0,0 +1,471 @@
+// ------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// ------------------------------------------------------------------
+//===================================================================
+// Author(s): ="Atheros"
+//===================================================================
+
+
+#ifndef _MBOX_WLAN_HOST_REG_REG_H_
+#define _MBOX_WLAN_HOST_REG_REG_H_
+
+#define HOST_INT_STATUS_ADDRESS                  0x00000400
+#define HOST_INT_STATUS_OFFSET                   0x00000400
+#define HOST_INT_STATUS_ERROR_MSB                7
+#define HOST_INT_STATUS_ERROR_LSB                7
+#define HOST_INT_STATUS_ERROR_MASK               0x00000080
+#define HOST_INT_STATUS_ERROR_GET(x)             (((x) & HOST_INT_STATUS_ERROR_MASK) >> HOST_INT_STATUS_ERROR_LSB)
+#define HOST_INT_STATUS_ERROR_SET(x)             (((x) << HOST_INT_STATUS_ERROR_LSB) & HOST_INT_STATUS_ERROR_MASK)
+#define HOST_INT_STATUS_CPU_MSB                  6
+#define HOST_INT_STATUS_CPU_LSB                  6
+#define HOST_INT_STATUS_CPU_MASK                 0x00000040
+#define HOST_INT_STATUS_CPU_GET(x)               (((x) & HOST_INT_STATUS_CPU_MASK) >> HOST_INT_STATUS_CPU_LSB)
+#define HOST_INT_STATUS_CPU_SET(x)               (((x) << HOST_INT_STATUS_CPU_LSB) & HOST_INT_STATUS_CPU_MASK)
+#define HOST_INT_STATUS_INT_MSB                  5
+#define HOST_INT_STATUS_INT_LSB                  5
+#define HOST_INT_STATUS_INT_MASK                 0x00000020
+#define HOST_INT_STATUS_INT_GET(x)               (((x) & HOST_INT_STATUS_INT_MASK) >> HOST_INT_STATUS_INT_LSB)
+#define HOST_INT_STATUS_INT_SET(x)               (((x) << HOST_INT_STATUS_INT_LSB) & HOST_INT_STATUS_INT_MASK)
+#define HOST_INT_STATUS_COUNTER_MSB              4
+#define HOST_INT_STATUS_COUNTER_LSB              4
+#define HOST_INT_STATUS_COUNTER_MASK             0x00000010
+#define HOST_INT_STATUS_COUNTER_GET(x)           (((x) & HOST_INT_STATUS_COUNTER_MASK) >> HOST_INT_STATUS_COUNTER_LSB)
+#define HOST_INT_STATUS_COUNTER_SET(x)           (((x) << HOST_INT_STATUS_COUNTER_LSB) & HOST_INT_STATUS_COUNTER_MASK)
+#define HOST_INT_STATUS_MBOX_DATA_MSB            3
+#define HOST_INT_STATUS_MBOX_DATA_LSB            0
+#define HOST_INT_STATUS_MBOX_DATA_MASK           0x0000000f
+#define HOST_INT_STATUS_MBOX_DATA_GET(x)         (((x) & HOST_INT_STATUS_MBOX_DATA_MASK) >> HOST_INT_STATUS_MBOX_DATA_LSB)
+#define HOST_INT_STATUS_MBOX_DATA_SET(x)         (((x) << HOST_INT_STATUS_MBOX_DATA_LSB) & HOST_INT_STATUS_MBOX_DATA_MASK)
+
+#define CPU_INT_STATUS_ADDRESS                   0x00000401
+#define CPU_INT_STATUS_OFFSET                    0x00000401
+#define CPU_INT_STATUS_BIT_MSB                   7
+#define CPU_INT_STATUS_BIT_LSB                   0
+#define CPU_INT_STATUS_BIT_MASK                  0x000000ff
+#define CPU_INT_STATUS_BIT_GET(x)                (((x) & CPU_INT_STATUS_BIT_MASK) >> CPU_INT_STATUS_BIT_LSB)
+#define CPU_INT_STATUS_BIT_SET(x)                (((x) << CPU_INT_STATUS_BIT_LSB) & CPU_INT_STATUS_BIT_MASK)
+
+#define ERROR_INT_STATUS_ADDRESS                 0x00000402
+#define ERROR_INT_STATUS_OFFSET                  0x00000402
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_SYNC_ERROR_MSB 6
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_SYNC_ERROR_LSB 6
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_SYNC_ERROR_MASK 0x00000040
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_SYNC_ERROR_GET(x) (((x) & ERROR_INT_STATUS_UART_HCI_FRAMER_SYNC_ERROR_MASK) >> ERROR_INT_STATUS_UART_HCI_FRAMER_SYNC_ERROR_LSB)
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_SYNC_ERROR_SET(x) (((x) << ERROR_INT_STATUS_UART_HCI_FRAMER_SYNC_ERROR_LSB) & ERROR_INT_STATUS_UART_HCI_FRAMER_SYNC_ERROR_MASK)
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_OVERFLOW_MSB 5
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_OVERFLOW_LSB 5
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_OVERFLOW_MASK 0x00000020
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_OVERFLOW_GET(x) (((x) & ERROR_INT_STATUS_UART_HCI_FRAMER_OVERFLOW_MASK) >> ERROR_INT_STATUS_UART_HCI_FRAMER_OVERFLOW_LSB)
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_OVERFLOW_SET(x) (((x) << ERROR_INT_STATUS_UART_HCI_FRAMER_OVERFLOW_LSB) & ERROR_INT_STATUS_UART_HCI_FRAMER_OVERFLOW_MASK)
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_UNDERFLOW_MSB 4
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_UNDERFLOW_LSB 4
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_UNDERFLOW_MASK 0x00000010
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_UNDERFLOW_GET(x) (((x) & ERROR_INT_STATUS_UART_HCI_FRAMER_UNDERFLOW_MASK) >> ERROR_INT_STATUS_UART_HCI_FRAMER_UNDERFLOW_LSB)
+#define ERROR_INT_STATUS_UART_HCI_FRAMER_UNDERFLOW_SET(x) (((x) << ERROR_INT_STATUS_UART_HCI_FRAMER_UNDERFLOW_LSB) & ERROR_INT_STATUS_UART_HCI_FRAMER_UNDERFLOW_MASK)
+#define ERROR_INT_STATUS_SPI_MSB                 3
+#define ERROR_INT_STATUS_SPI_LSB                 3
+#define ERROR_INT_STATUS_SPI_MASK                0x00000008
+#define ERROR_INT_STATUS_SPI_GET(x)              (((x) & ERROR_INT_STATUS_SPI_MASK) >> ERROR_INT_STATUS_SPI_LSB)
+#define ERROR_INT_STATUS_SPI_SET(x)              (((x) << ERROR_INT_STATUS_SPI_LSB) & ERROR_INT_STATUS_SPI_MASK)
+#define ERROR_INT_STATUS_WAKEUP_MSB              2
+#define ERROR_INT_STATUS_WAKEUP_LSB              2
+#define ERROR_INT_STATUS_WAKEUP_MASK             0x00000004
+#define ERROR_INT_STATUS_WAKEUP_GET(x)           (((x) & ERROR_INT_STATUS_WAKEUP_MASK) >> ERROR_INT_STATUS_WAKEUP_LSB)
+#define ERROR_INT_STATUS_WAKEUP_SET(x)           (((x) << ERROR_INT_STATUS_WAKEUP_LSB) & ERROR_INT_STATUS_WAKEUP_MASK)
+#define ERROR_INT_STATUS_RX_UNDERFLOW_MSB        1
+#define ERROR_INT_STATUS_RX_UNDERFLOW_LSB        1
+#define ERROR_INT_STATUS_RX_UNDERFLOW_MASK       0x00000002
+#define ERROR_INT_STATUS_RX_UNDERFLOW_GET(x)     (((x) & ERROR_INT_STATUS_RX_UNDERFLOW_MASK) >> ERROR_INT_STATUS_RX_UNDERFLOW_LSB)
+#define ERROR_INT_STATUS_RX_UNDERFLOW_SET(x)     (((x) << ERROR_INT_STATUS_RX_UNDERFLOW_LSB) & ERROR_INT_STATUS_RX_UNDERFLOW_MASK)
+#define ERROR_INT_STATUS_TX_OVERFLOW_MSB         0
+#define ERROR_INT_STATUS_TX_OVERFLOW_LSB         0
+#define ERROR_INT_STATUS_TX_OVERFLOW_MASK        0x00000001
+#define ERROR_INT_STATUS_TX_OVERFLOW_GET(x)      (((x) & ERROR_INT_STATUS_TX_OVERFLOW_MASK) >> ERROR_INT_STATUS_TX_OVERFLOW_LSB)
+#define ERROR_INT_STATUS_TX_OVERFLOW_SET(x)      (((x) << ERROR_INT_STATUS_TX_OVERFLOW_LSB) & ERROR_INT_STATUS_TX_OVERFLOW_MASK)
+
+#define COUNTER_INT_STATUS_ADDRESS               0x00000403
+#define COUNTER_INT_STATUS_OFFSET                0x00000403
+#define COUNTER_INT_STATUS_COUNTER_MSB           7
+#define COUNTER_INT_STATUS_COUNTER_LSB           0
+#define COUNTER_INT_STATUS_COUNTER_MASK          0x000000ff
+#define COUNTER_INT_STATUS_COUNTER_GET(x)        (((x) & COUNTER_INT_STATUS_COUNTER_MASK) >> COUNTER_INT_STATUS_COUNTER_LSB)
+#define COUNTER_INT_STATUS_COUNTER_SET(x)        (((x) << COUNTER_INT_STATUS_COUNTER_LSB) & COUNTER_INT_STATUS_COUNTER_MASK)
+
+#define MBOX_FRAME_ADDRESS                       0x00000404
+#define MBOX_FRAME_OFFSET                        0x00000404
+#define MBOX_FRAME_RX_EOM_MSB                    7
+#define MBOX_FRAME_RX_EOM_LSB                    4
+#define MBOX_FRAME_RX_EOM_MASK                   0x000000f0
+#define MBOX_FRAME_RX_EOM_GET(x)                 (((x) & MBOX_FRAME_RX_EOM_MASK) >> MBOX_FRAME_RX_EOM_LSB)
+#define MBOX_FRAME_RX_EOM_SET(x)                 (((x) << MBOX_FRAME_RX_EOM_LSB) & MBOX_FRAME_RX_EOM_MASK)
+#define MBOX_FRAME_RX_SOM_MSB                    3
+#define MBOX_FRAME_RX_SOM_LSB                    0
+#define MBOX_FRAME_RX_SOM_MASK                   0x0000000f
+#define MBOX_FRAME_RX_SOM_GET(x)                 (((x) & MBOX_FRAME_RX_SOM_MASK) >> MBOX_FRAME_RX_SOM_LSB)
+#define MBOX_FRAME_RX_SOM_SET(x)                 (((x) << MBOX_FRAME_RX_SOM_LSB) & MBOX_FRAME_RX_SOM_MASK)
+
+#define RX_LOOKAHEAD_VALID_ADDRESS               0x00000405
+#define RX_LOOKAHEAD_VALID_OFFSET                0x00000405
+#define RX_LOOKAHEAD_VALID_MBOX_MSB              3
+#define RX_LOOKAHEAD_VALID_MBOX_LSB              0
+#define RX_LOOKAHEAD_VALID_MBOX_MASK             0x0000000f
+#define RX_LOOKAHEAD_VALID_MBOX_GET(x)           (((x) & RX_LOOKAHEAD_VALID_MBOX_MASK) >> RX_LOOKAHEAD_VALID_MBOX_LSB)
+#define RX_LOOKAHEAD_VALID_MBOX_SET(x)           (((x) << RX_LOOKAHEAD_VALID_MBOX_LSB) & RX_LOOKAHEAD_VALID_MBOX_MASK)
+
+#define HOST_INT_STATUS2_ADDRESS                 0x00000406
+#define HOST_INT_STATUS2_OFFSET                  0x00000406
+#define HOST_INT_STATUS2_GMBOX_RX_UNDERFLOW_MSB  2
+#define HOST_INT_STATUS2_GMBOX_RX_UNDERFLOW_LSB  2
+#define HOST_INT_STATUS2_GMBOX_RX_UNDERFLOW_MASK 0x00000004
+#define HOST_INT_STATUS2_GMBOX_RX_UNDERFLOW_GET(x) (((x) & HOST_INT_STATUS2_GMBOX_RX_UNDERFLOW_MASK) >> HOST_INT_STATUS2_GMBOX_RX_UNDERFLOW_LSB)
+#define HOST_INT_STATUS2_GMBOX_RX_UNDERFLOW_SET(x) (((x) << HOST_INT_STATUS2_GMBOX_RX_UNDERFLOW_LSB) & HOST_INT_STATUS2_GMBOX_RX_UNDERFLOW_MASK)
+#define HOST_INT_STATUS2_GMBOX_TX_OVERFLOW_MSB   1
+#define HOST_INT_STATUS2_GMBOX_TX_OVERFLOW_LSB   1
+#define HOST_INT_STATUS2_GMBOX_TX_OVERFLOW_MASK  0x00000002
+#define HOST_INT_STATUS2_GMBOX_TX_OVERFLOW_GET(x) (((x) & HOST_INT_STATUS2_GMBOX_TX_OVERFLOW_MASK) >> HOST_INT_STATUS2_GMBOX_TX_OVERFLOW_LSB)
+#define HOST_INT_STATUS2_GMBOX_TX_OVERFLOW_SET(x) (((x) << HOST_INT_STATUS2_GMBOX_TX_OVERFLOW_LSB) & HOST_INT_STATUS2_GMBOX_TX_OVERFLOW_MASK)
+#define HOST_INT_STATUS2_GMBOX_DATA_MSB          0
+#define HOST_INT_STATUS2_GMBOX_DATA_LSB          0
+#define HOST_INT_STATUS2_GMBOX_DATA_MASK         0x00000001
+#define HOST_INT_STATUS2_GMBOX_DATA_GET(x)       (((x) & HOST_INT_STATUS2_GMBOX_DATA_MASK) >> HOST_INT_STATUS2_GMBOX_DATA_LSB)
+#define HOST_INT_STATUS2_GMBOX_DATA_SET(x)       (((x) << HOST_INT_STATUS2_GMBOX_DATA_LSB) & HOST_INT_STATUS2_GMBOX_DATA_MASK)
+
+#define GMBOX_RX_AVAIL_ADDRESS                   0x00000407
+#define GMBOX_RX_AVAIL_OFFSET                    0x00000407
+#define GMBOX_RX_AVAIL_BYTE_MSB                  6
+#define GMBOX_RX_AVAIL_BYTE_LSB                  0
+#define GMBOX_RX_AVAIL_BYTE_MASK                 0x0000007f
+#define GMBOX_RX_AVAIL_BYTE_GET(x)               (((x) & GMBOX_RX_AVAIL_BYTE_MASK) >> GMBOX_RX_AVAIL_BYTE_LSB)
+#define GMBOX_RX_AVAIL_BYTE_SET(x)               (((x) << GMBOX_RX_AVAIL_BYTE_LSB) & GMBOX_RX_AVAIL_BYTE_MASK)
+
+#define RX_LOOKAHEAD0_ADDRESS                    0x00000408
+#define RX_LOOKAHEAD0_OFFSET                     0x00000408
+#define RX_LOOKAHEAD0_DATA_MSB                   7
+#define RX_LOOKAHEAD0_DATA_LSB                   0
+#define RX_LOOKAHEAD0_DATA_MASK                  0x000000ff
+#define RX_LOOKAHEAD0_DATA_GET(x)                (((x) & RX_LOOKAHEAD0_DATA_MASK) >> RX_LOOKAHEAD0_DATA_LSB)
+#define RX_LOOKAHEAD0_DATA_SET(x)                (((x) << RX_LOOKAHEAD0_DATA_LSB) & RX_LOOKAHEAD0_DATA_MASK)
+
+#define RX_LOOKAHEAD1_ADDRESS                    0x0000040c
+#define RX_LOOKAHEAD1_OFFSET                     0x0000040c
+#define RX_LOOKAHEAD1_DATA_MSB                   7
+#define RX_LOOKAHEAD1_DATA_LSB                   0
+#define RX_LOOKAHEAD1_DATA_MASK                  0x000000ff
+#define RX_LOOKAHEAD1_DATA_GET(x)                (((x) & RX_LOOKAHEAD1_DATA_MASK) >> RX_LOOKAHEAD1_DATA_LSB)
+#define RX_LOOKAHEAD1_DATA_SET(x)                (((x) << RX_LOOKAHEAD1_DATA_LSB) & RX_LOOKAHEAD1_DATA_MASK)
+
+#define RX_LOOKAHEAD2_ADDRESS                    0x00000410
+#define RX_LOOKAHEAD2_OFFSET                     0x00000410
+#define RX_LOOKAHEAD2_DATA_MSB                   7
+#define RX_LOOKAHEAD2_DATA_LSB                   0
+#define RX_LOOKAHEAD2_DATA_MASK                  0x000000ff
+#define RX_LOOKAHEAD2_DATA_GET(x)                (((x) & RX_LOOKAHEAD2_DATA_MASK) >> RX_LOOKAHEAD2_DATA_LSB)
+#define RX_LOOKAHEAD2_DATA_SET(x)                (((x) << RX_LOOKAHEAD2_DATA_LSB) & RX_LOOKAHEAD2_DATA_MASK)
+
+#define RX_LOOKAHEAD3_ADDRESS                    0x00000414
+#define RX_LOOKAHEAD3_OFFSET                     0x00000414
+#define RX_LOOKAHEAD3_DATA_MSB                   7
+#define RX_LOOKAHEAD3_DATA_LSB                   0
+#define RX_LOOKAHEAD3_DATA_MASK                  0x000000ff
+#define RX_LOOKAHEAD3_DATA_GET(x)                (((x) & RX_LOOKAHEAD3_DATA_MASK) >> RX_LOOKAHEAD3_DATA_LSB)
+#define RX_LOOKAHEAD3_DATA_SET(x)                (((x) << RX_LOOKAHEAD3_DATA_LSB) & RX_LOOKAHEAD3_DATA_MASK)
+
+#define INT_STATUS_ENABLE_ADDRESS                0x00000418
+#define INT_STATUS_ENABLE_OFFSET                 0x00000418
+#define INT_STATUS_ENABLE_ERROR_MSB              7
+#define INT_STATUS_ENABLE_ERROR_LSB              7
+#define INT_STATUS_ENABLE_ERROR_MASK             0x00000080
+#define INT_STATUS_ENABLE_ERROR_GET(x)           (((x) & INT_STATUS_ENABLE_ERROR_MASK) >> INT_STATUS_ENABLE_ERROR_LSB)
+#define INT_STATUS_ENABLE_ERROR_SET(x)           (((x) << INT_STATUS_ENABLE_ERROR_LSB) & INT_STATUS_ENABLE_ERROR_MASK)
+#define INT_STATUS_ENABLE_CPU_MSB                6
+#define INT_STATUS_ENABLE_CPU_LSB                6
+#define INT_STATUS_ENABLE_CPU_MASK               0x00000040
+#define INT_STATUS_ENABLE_CPU_GET(x)             (((x) & INT_STATUS_ENABLE_CPU_MASK) >> INT_STATUS_ENABLE_CPU_LSB)
+#define INT_STATUS_ENABLE_CPU_SET(x)             (((x) << INT_STATUS_ENABLE_CPU_LSB) & INT_STATUS_ENABLE_CPU_MASK)
+#define INT_STATUS_ENABLE_INT_MSB                5
+#define INT_STATUS_ENABLE_INT_LSB                5
+#define INT_STATUS_ENABLE_INT_MASK               0x00000020
+#define INT_STATUS_ENABLE_INT_GET(x)             (((x) & INT_STATUS_ENABLE_INT_MASK) >> INT_STATUS_ENABLE_INT_LSB)
+#define INT_STATUS_ENABLE_INT_SET(x)             (((x) << INT_STATUS_ENABLE_INT_LSB) & INT_STATUS_ENABLE_INT_MASK)
+#define INT_STATUS_ENABLE_COUNTER_MSB            4
+#define INT_STATUS_ENABLE_COUNTER_LSB            4
+#define INT_STATUS_ENABLE_COUNTER_MASK           0x00000010
+#define INT_STATUS_ENABLE_COUNTER_GET(x)         (((x) & INT_STATUS_ENABLE_COUNTER_MASK) >> INT_STATUS_ENABLE_COUNTER_LSB)
+#define INT_STATUS_ENABLE_COUNTER_SET(x)         (((x) << INT_STATUS_ENABLE_COUNTER_LSB) & INT_STATUS_ENABLE_COUNTER_MASK)
+#define INT_STATUS_ENABLE_MBOX_DATA_MSB          3
+#define INT_STATUS_ENABLE_MBOX_DATA_LSB          0
+#define INT_STATUS_ENABLE_MBOX_DATA_MASK         0x0000000f
+#define INT_STATUS_ENABLE_MBOX_DATA_GET(x)       (((x) & INT_STATUS_ENABLE_MBOX_DATA_MASK) >> INT_STATUS_ENABLE_MBOX_DATA_LSB)
+#define INT_STATUS_ENABLE_MBOX_DATA_SET(x)       (((x) << INT_STATUS_ENABLE_MBOX_DATA_LSB) & INT_STATUS_ENABLE_MBOX_DATA_MASK)
+
+#define CPU_INT_STATUS_ENABLE_ADDRESS            0x00000419
+#define CPU_INT_STATUS_ENABLE_OFFSET             0x00000419
+#define CPU_INT_STATUS_ENABLE_BIT_MSB            7
+#define CPU_INT_STATUS_ENABLE_BIT_LSB            0
+#define CPU_INT_STATUS_ENABLE_BIT_MASK           0x000000ff
+#define CPU_INT_STATUS_ENABLE_BIT_GET(x)         (((x) & CPU_INT_STATUS_ENABLE_BIT_MASK) >> CPU_INT_STATUS_ENABLE_BIT_LSB)
+#define CPU_INT_STATUS_ENABLE_BIT_SET(x)         (((x) << CPU_INT_STATUS_ENABLE_BIT_LSB) & CPU_INT_STATUS_ENABLE_BIT_MASK)
+
+#define ERROR_STATUS_ENABLE_ADDRESS              0x0000041a
+#define ERROR_STATUS_ENABLE_OFFSET               0x0000041a
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_SYNC_ERROR_MSB 6
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_SYNC_ERROR_LSB 6
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_SYNC_ERROR_MASK 0x00000040
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_SYNC_ERROR_GET(x) (((x) & ERROR_STATUS_ENABLE_UART_HCI_FRAMER_SYNC_ERROR_MASK) >> ERROR_STATUS_ENABLE_UART_HCI_FRAMER_SYNC_ERROR_LSB)
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_SYNC_ERROR_SET(x) (((x) << ERROR_STATUS_ENABLE_UART_HCI_FRAMER_SYNC_ERROR_LSB) & ERROR_STATUS_ENABLE_UART_HCI_FRAMER_SYNC_ERROR_MASK)
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_OVERFLOW_MSB 5
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_OVERFLOW_LSB 5
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_OVERFLOW_MASK 0x00000020
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_OVERFLOW_GET(x) (((x) & ERROR_STATUS_ENABLE_UART_HCI_FRAMER_OVERFLOW_MASK) >> ERROR_STATUS_ENABLE_UART_HCI_FRAMER_OVERFLOW_LSB)
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_OVERFLOW_SET(x) (((x) << ERROR_STATUS_ENABLE_UART_HCI_FRAMER_OVERFLOW_LSB) & ERROR_STATUS_ENABLE_UART_HCI_FRAMER_OVERFLOW_MASK)
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_UNDERFLOW_MSB 4
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_UNDERFLOW_LSB 4
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_UNDERFLOW_MASK 0x00000010
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_UNDERFLOW_GET(x) (((x) & ERROR_STATUS_ENABLE_UART_HCI_FRAMER_UNDERFLOW_MASK) >> ERROR_STATUS_ENABLE_UART_HCI_FRAMER_UNDERFLOW_LSB)
+#define ERROR_STATUS_ENABLE_UART_HCI_FRAMER_UNDERFLOW_SET(x) (((x) << ERROR_STATUS_ENABLE_UART_HCI_FRAMER_UNDERFLOW_LSB) & ERROR_STATUS_ENABLE_UART_HCI_FRAMER_UNDERFLOW_MASK)
+#define ERROR_STATUS_ENABLE_WAKEUP_MSB           2
+#define ERROR_STATUS_ENABLE_WAKEUP_LSB           2
+#define ERROR_STATUS_ENABLE_WAKEUP_MASK          0x00000004
+#define ERROR_STATUS_ENABLE_WAKEUP_GET(x)        (((x) & ERROR_STATUS_ENABLE_WAKEUP_MASK) >> ERROR_STATUS_ENABLE_WAKEUP_LSB)
+#define ERROR_STATUS_ENABLE_WAKEUP_SET(x)        (((x) << ERROR_STATUS_ENABLE_WAKEUP_LSB) & ERROR_STATUS_ENABLE_WAKEUP_MASK)
+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_MSB     1
+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB     1
+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK    0x00000002
+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_GET(x)  (((x) & ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK) >> ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB)
+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_SET(x)  (((x) << ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB) & ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK)
+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_MSB      0
+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB      0
+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK     0x00000001
+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_GET(x)   (((x) & ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK) >> ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB)
+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_SET(x)   (((x) << ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB) & ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK)
+
+#define COUNTER_INT_STATUS_ENABLE_ADDRESS        0x0000041b
+#define COUNTER_INT_STATUS_ENABLE_OFFSET         0x0000041b
+#define COUNTER_INT_STATUS_ENABLE_BIT_MSB        7
+#define COUNTER_INT_STATUS_ENABLE_BIT_LSB        0
+#define COUNTER_INT_STATUS_ENABLE_BIT_MASK       0x000000ff
+#define COUNTER_INT_STATUS_ENABLE_BIT_GET(x)     (((x) & COUNTER_INT_STATUS_ENABLE_BIT_MASK) >> COUNTER_INT_STATUS_ENABLE_BIT_LSB)
+#define COUNTER_INT_STATUS_ENABLE_BIT_SET(x)     (((x) << COUNTER_INT_STATUS_ENABLE_BIT_LSB) & COUNTER_INT_STATUS_ENABLE_BIT_MASK)
+
+#define COUNT_ADDRESS                            0x00000420
+#define COUNT_OFFSET                             0x00000420
+#define COUNT_VALUE_MSB                          7
+#define COUNT_VALUE_LSB                          0
+#define COUNT_VALUE_MASK                         0x000000ff
+#define COUNT_VALUE_GET(x)                       (((x) & COUNT_VALUE_MASK) >> COUNT_VALUE_LSB)
+#define COUNT_VALUE_SET(x)                       (((x) << COUNT_VALUE_LSB) & COUNT_VALUE_MASK)
+
+#define COUNT_DEC_ADDRESS                        0x00000440
+#define COUNT_DEC_OFFSET                         0x00000440
+#define COUNT_DEC_VALUE_MSB                      7
+#define COUNT_DEC_VALUE_LSB                      0
+#define COUNT_DEC_VALUE_MASK                     0x000000ff
+#define COUNT_DEC_VALUE_GET(x)                   (((x) & COUNT_DEC_VALUE_MASK) >> COUNT_DEC_VALUE_LSB)
+#define COUNT_DEC_VALUE_SET(x)                   (((x) << COUNT_DEC_VALUE_LSB) & COUNT_DEC_VALUE_MASK)
+
+#define SCRATCH_ADDRESS                          0x00000460
+#define SCRATCH_OFFSET                           0x00000460
+#define SCRATCH_VALUE_MSB                        7
+#define SCRATCH_VALUE_LSB                        0
+#define SCRATCH_VALUE_MASK                       0x000000ff
+#define SCRATCH_VALUE_GET(x)                     (((x) & SCRATCH_VALUE_MASK) >> SCRATCH_VALUE_LSB)
+#define SCRATCH_VALUE_SET(x)                     (((x) << SCRATCH_VALUE_LSB) & SCRATCH_VALUE_MASK)
+
+#define FIFO_TIMEOUT_ADDRESS                     0x00000468
+#define FIFO_TIMEOUT_OFFSET                      0x00000468
+#define FIFO_TIMEOUT_VALUE_MSB                   7
+#define FIFO_TIMEOUT_VALUE_LSB                   0
+#define FIFO_TIMEOUT_VALUE_MASK                  0x000000ff
+#define FIFO_TIMEOUT_VALUE_GET(x)                (((x) & FIFO_TIMEOUT_VALUE_MASK) >> FIFO_TIMEOUT_VALUE_LSB)
+#define FIFO_TIMEOUT_VALUE_SET(x)                (((x) << FIFO_TIMEOUT_VALUE_LSB) & FIFO_TIMEOUT_VALUE_MASK)
+
+#define FIFO_TIMEOUT_ENABLE_ADDRESS              0x00000469
+#define FIFO_TIMEOUT_ENABLE_OFFSET               0x00000469
+#define FIFO_TIMEOUT_ENABLE_SET_MSB              0
+#define FIFO_TIMEOUT_ENABLE_SET_LSB              0
+#define FIFO_TIMEOUT_ENABLE_SET_MASK             0x00000001
+#define FIFO_TIMEOUT_ENABLE_SET_GET(x)           (((x) & FIFO_TIMEOUT_ENABLE_SET_MASK) >> FIFO_TIMEOUT_ENABLE_SET_LSB)
+#define FIFO_TIMEOUT_ENABLE_SET_SET(x)           (((x) << FIFO_TIMEOUT_ENABLE_SET_LSB) & FIFO_TIMEOUT_ENABLE_SET_MASK)
+
+#define DISABLE_SLEEP_ADDRESS                    0x0000046a
+#define DISABLE_SLEEP_OFFSET                     0x0000046a
+#define DISABLE_SLEEP_FOR_INT_MSB                1
+#define DISABLE_SLEEP_FOR_INT_LSB                1
+#define DISABLE_SLEEP_FOR_INT_MASK               0x00000002
+#define DISABLE_SLEEP_FOR_INT_GET(x)             (((x) & DISABLE_SLEEP_FOR_INT_MASK) >> DISABLE_SLEEP_FOR_INT_LSB)
+#define DISABLE_SLEEP_FOR_INT_SET(x)             (((x) << DISABLE_SLEEP_FOR_INT_LSB) & DISABLE_SLEEP_FOR_INT_MASK)
+#define DISABLE_SLEEP_ON_MSB                     0
+#define DISABLE_SLEEP_ON_LSB                     0
+#define DISABLE_SLEEP_ON_MASK                    0x00000001
+#define DISABLE_SLEEP_ON_GET(x)                  (((x) & DISABLE_SLEEP_ON_MASK) >> DISABLE_SLEEP_ON_LSB)
+#define DISABLE_SLEEP_ON_SET(x)                  (((x) << DISABLE_SLEEP_ON_LSB) & DISABLE_SLEEP_ON_MASK)
+
+#define LOCAL_BUS_ADDRESS                        0x00000470
+#define LOCAL_BUS_OFFSET                         0x00000470
+#define LOCAL_BUS_STATE_MSB                      1
+#define LOCAL_BUS_STATE_LSB                      0
+#define LOCAL_BUS_STATE_MASK                     0x00000003
+#define LOCAL_BUS_STATE_GET(x)                   (((x) & LOCAL_BUS_STATE_MASK) >> LOCAL_BUS_STATE_LSB)
+#define LOCAL_BUS_STATE_SET(x)                   (((x) << LOCAL_BUS_STATE_LSB) & LOCAL_BUS_STATE_MASK)
+
+#define INT_WLAN_ADDRESS                         0x00000472
+#define INT_WLAN_OFFSET                          0x00000472
+#define INT_WLAN_VECTOR_MSB                      7
+#define INT_WLAN_VECTOR_LSB                      0
+#define INT_WLAN_VECTOR_MASK                     0x000000ff
+#define INT_WLAN_VECTOR_GET(x)                   (((x) & INT_WLAN_VECTOR_MASK) >> INT_WLAN_VECTOR_LSB)
+#define INT_WLAN_VECTOR_SET(x)                   (((x) << INT_WLAN_VECTOR_LSB) & INT_WLAN_VECTOR_MASK)
+
+#define WINDOW_DATA_ADDRESS                      0x00000474
+#define WINDOW_DATA_OFFSET                       0x00000474
+#define WINDOW_DATA_DATA_MSB                     7
+#define WINDOW_DATA_DATA_LSB                     0
+#define WINDOW_DATA_DATA_MASK                    0x000000ff
+#define WINDOW_DATA_DATA_GET(x)                  (((x) & WINDOW_DATA_DATA_MASK) >> WINDOW_DATA_DATA_LSB)
+#define WINDOW_DATA_DATA_SET(x)                  (((x) << WINDOW_DATA_DATA_LSB) & WINDOW_DATA_DATA_MASK)
+
+#define WINDOW_WRITE_ADDR_ADDRESS                0x00000478
+#define WINDOW_WRITE_ADDR_OFFSET                 0x00000478
+#define WINDOW_WRITE_ADDR_ADDR_MSB               7
+#define WINDOW_WRITE_ADDR_ADDR_LSB               0
+#define WINDOW_WRITE_ADDR_ADDR_MASK              0x000000ff
+#define WINDOW_WRITE_ADDR_ADDR_GET(x)            (((x) & WINDOW_WRITE_ADDR_ADDR_MASK) >> WINDOW_WRITE_ADDR_ADDR_LSB)
+#define WINDOW_WRITE_ADDR_ADDR_SET(x)            (((x) << WINDOW_WRITE_ADDR_ADDR_LSB) & WINDOW_WRITE_ADDR_ADDR_MASK)
+
+#define WINDOW_READ_ADDR_ADDRESS                 0x0000047c
+#define WINDOW_READ_ADDR_OFFSET                  0x0000047c
+#define WINDOW_READ_ADDR_ADDR_MSB                7
+#define WINDOW_READ_ADDR_ADDR_LSB                0
+#define WINDOW_READ_ADDR_ADDR_MASK               0x000000ff
+#define WINDOW_READ_ADDR_ADDR_GET(x)             (((x) & WINDOW_READ_ADDR_ADDR_MASK) >> WINDOW_READ_ADDR_ADDR_LSB)
+#define WINDOW_READ_ADDR_ADDR_SET(x)             (((x) << WINDOW_READ_ADDR_ADDR_LSB) & WINDOW_READ_ADDR_ADDR_MASK)
+
+#define HOST_CTRL_SPI_CONFIG_ADDRESS             0x00000480
+#define HOST_CTRL_SPI_CONFIG_OFFSET              0x00000480
+#define HOST_CTRL_SPI_CONFIG_SPI_RESET_MSB       4
+#define HOST_CTRL_SPI_CONFIG_SPI_RESET_LSB       4
+#define HOST_CTRL_SPI_CONFIG_SPI_RESET_MASK      0x00000010
+#define HOST_CTRL_SPI_CONFIG_SPI_RESET_GET(x)    (((x) & HOST_CTRL_SPI_CONFIG_SPI_RESET_MASK) >> HOST_CTRL_SPI_CONFIG_SPI_RESET_LSB)
+#define HOST_CTRL_SPI_CONFIG_SPI_RESET_SET(x)    (((x) << HOST_CTRL_SPI_CONFIG_SPI_RESET_LSB) & HOST_CTRL_SPI_CONFIG_SPI_RESET_MASK)
+#define HOST_CTRL_SPI_CONFIG_INTERRUPT_ENABLE_MSB 3
+#define HOST_CTRL_SPI_CONFIG_INTERRUPT_ENABLE_LSB 3
+#define HOST_CTRL_SPI_CONFIG_INTERRUPT_ENABLE_MASK 0x00000008
+#define HOST_CTRL_SPI_CONFIG_INTERRUPT_ENABLE_GET(x) (((x) & HOST_CTRL_SPI_CONFIG_INTERRUPT_ENABLE_MASK) >> HOST_CTRL_SPI_CONFIG_INTERRUPT_ENABLE_LSB)
+#define HOST_CTRL_SPI_CONFIG_INTERRUPT_ENABLE_SET(x) (((x) << HOST_CTRL_SPI_CONFIG_INTERRUPT_ENABLE_LSB) & HOST_CTRL_SPI_CONFIG_INTERRUPT_ENABLE_MASK)
+#define HOST_CTRL_SPI_CONFIG_TEST_MODE_MSB       2
+#define HOST_CTRL_SPI_CONFIG_TEST_MODE_LSB       2
+#define HOST_CTRL_SPI_CONFIG_TEST_MODE_MASK      0x00000004
+#define HOST_CTRL_SPI_CONFIG_TEST_MODE_GET(x)    (((x) & HOST_CTRL_SPI_CONFIG_TEST_MODE_MASK) >> HOST_CTRL_SPI_CONFIG_TEST_MODE_LSB)
+#define HOST_CTRL_SPI_CONFIG_TEST_MODE_SET(x)    (((x) << HOST_CTRL_SPI_CONFIG_TEST_MODE_LSB) & HOST_CTRL_SPI_CONFIG_TEST_MODE_MASK)
+#define HOST_CTRL_SPI_CONFIG_DATA_SIZE_MSB       1
+#define HOST_CTRL_SPI_CONFIG_DATA_SIZE_LSB       0
+#define HOST_CTRL_SPI_CONFIG_DATA_SIZE_MASK      0x00000003
+#define HOST_CTRL_SPI_CONFIG_DATA_SIZE_GET(x)    (((x) & HOST_CTRL_SPI_CONFIG_DATA_SIZE_MASK) >> HOST_CTRL_SPI_CONFIG_DATA_SIZE_LSB)
+#define HOST_CTRL_SPI_CONFIG_DATA_SIZE_SET(x)    (((x) << HOST_CTRL_SPI_CONFIG_DATA_SIZE_LSB) & HOST_CTRL_SPI_CONFIG_DATA_SIZE_MASK)
+
+#define HOST_CTRL_SPI_STATUS_ADDRESS             0x00000481
+#define HOST_CTRL_SPI_STATUS_OFFSET              0x00000481
+#define HOST_CTRL_SPI_STATUS_ADDR_ERR_MSB        3
+#define HOST_CTRL_SPI_STATUS_ADDR_ERR_LSB        3
+#define HOST_CTRL_SPI_STATUS_ADDR_ERR_MASK       0x00000008
+#define HOST_CTRL_SPI_STATUS_ADDR_ERR_GET(x)     (((x) & HOST_CTRL_SPI_STATUS_ADDR_ERR_MASK) >> HOST_CTRL_SPI_STATUS_ADDR_ERR_LSB)
+#define HOST_CTRL_SPI_STATUS_ADDR_ERR_SET(x)     (((x) << HOST_CTRL_SPI_STATUS_ADDR_ERR_LSB) & HOST_CTRL_SPI_STATUS_ADDR_ERR_MASK)
+#define HOST_CTRL_SPI_STATUS_RD_ERR_MSB          2
+#define HOST_CTRL_SPI_STATUS_RD_ERR_LSB          2
+#define HOST_CTRL_SPI_STATUS_RD_ERR_MASK         0x00000004
+#define HOST_CTRL_SPI_STATUS_RD_ERR_GET(x)       (((x) & HOST_CTRL_SPI_STATUS_RD_ERR_MASK) >> HOST_CTRL_SPI_STATUS_RD_ERR_LSB)
+#define HOST_CTRL_SPI_STATUS_RD_ERR_SET(x)       (((x) << HOST_CTRL_SPI_STATUS_RD_ERR_LSB) & HOST_CTRL_SPI_STATUS_RD_ERR_MASK)
+#define HOST_CTRL_SPI_STATUS_WR_ERR_MSB          1
+#define HOST_CTRL_SPI_STATUS_WR_ERR_LSB          1
+#define HOST_CTRL_SPI_STATUS_WR_ERR_MASK         0x00000002
+#define HOST_CTRL_SPI_STATUS_WR_ERR_GET(x)       (((x) & HOST_CTRL_SPI_STATUS_WR_ERR_MASK) >> HOST_CTRL_SPI_STATUS_WR_ERR_LSB)
+#define HOST_CTRL_SPI_STATUS_WR_ERR_SET(x)       (((x) << HOST_CTRL_SPI_STATUS_WR_ERR_LSB) & HOST_CTRL_SPI_STATUS_WR_ERR_MASK)
+#define HOST_CTRL_SPI_STATUS_READY_MSB           0
+#define HOST_CTRL_SPI_STATUS_READY_LSB           0
+#define HOST_CTRL_SPI_STATUS_READY_MASK          0x00000001
+#define HOST_CTRL_SPI_STATUS_READY_GET(x)        (((x) & HOST_CTRL_SPI_STATUS_READY_MASK) >> HOST_CTRL_SPI_STATUS_READY_LSB)
+#define HOST_CTRL_SPI_STATUS_READY_SET(x)        (((x) << HOST_CTRL_SPI_STATUS_READY_LSB) & HOST_CTRL_SPI_STATUS_READY_MASK)
+
+#define NON_ASSOC_SLEEP_EN_ADDRESS               0x00000482
+#define NON_ASSOC_SLEEP_EN_OFFSET                0x00000482
+#define NON_ASSOC_SLEEP_EN_BIT_MSB               0
+#define NON_ASSOC_SLEEP_EN_BIT_LSB               0
+#define NON_ASSOC_SLEEP_EN_BIT_MASK              0x00000001
+#define NON_ASSOC_SLEEP_EN_BIT_GET(x)            (((x) & NON_ASSOC_SLEEP_EN_BIT_MASK) >> NON_ASSOC_SLEEP_EN_BIT_LSB)
+#define NON_ASSOC_SLEEP_EN_BIT_SET(x)            (((x) << NON_ASSOC_SLEEP_EN_BIT_LSB) & NON_ASSOC_SLEEP_EN_BIT_MASK)
+
+#define CPU_DBG_SEL_ADDRESS                      0x00000483
+#define CPU_DBG_SEL_OFFSET                       0x00000483
+#define CPU_DBG_SEL_BIT_MSB                      5
+#define CPU_DBG_SEL_BIT_LSB                      0
+#define CPU_DBG_SEL_BIT_MASK                     0x0000003f
+#define CPU_DBG_SEL_BIT_GET(x)                   (((x) & CPU_DBG_SEL_BIT_MASK) >> CPU_DBG_SEL_BIT_LSB)
+#define CPU_DBG_SEL_BIT_SET(x)                   (((x) << CPU_DBG_SEL_BIT_LSB) & CPU_DBG_SEL_BIT_MASK)
+
+#define CPU_DBG_ADDRESS                          0x00000484
+#define CPU_DBG_OFFSET                           0x00000484
+#define CPU_DBG_DATA_MSB                         7
+#define CPU_DBG_DATA_LSB                         0
+#define CPU_DBG_DATA_MASK                        0x000000ff
+#define CPU_DBG_DATA_GET(x)                      (((x) & CPU_DBG_DATA_MASK) >> CPU_DBG_DATA_LSB)
+#define CPU_DBG_DATA_SET(x)                      (((x) << CPU_DBG_DATA_LSB) & CPU_DBG_DATA_MASK)
+
+#define INT_STATUS2_ENABLE_ADDRESS               0x00000488
+#define INT_STATUS2_ENABLE_OFFSET                0x00000488
+#define INT_STATUS2_ENABLE_GMBOX_RX_UNDERFLOW_MSB 2
+#define INT_STATUS2_ENABLE_GMBOX_RX_UNDERFLOW_LSB 2
+#define INT_STATUS2_ENABLE_GMBOX_RX_UNDERFLOW_MASK 0x00000004
+#define INT_STATUS2_ENABLE_GMBOX_RX_UNDERFLOW_GET(x) (((x) & INT_STATUS2_ENABLE_GMBOX_RX_UNDERFLOW_MASK) >> INT_STATUS2_ENABLE_GMBOX_RX_UNDERFLOW_LSB)
+#define INT_STATUS2_ENABLE_GMBOX_RX_UNDERFLOW_SET(x) (((x) << INT_STATUS2_ENABLE_GMBOX_RX_UNDERFLOW_LSB) & INT_STATUS2_ENABLE_GMBOX_RX_UNDERFLOW_MASK)
+#define INT_STATUS2_ENABLE_GMBOX_TX_OVERFLOW_MSB 1
+#define INT_STATUS2_ENABLE_GMBOX_TX_OVERFLOW_LSB 1
+#define INT_STATUS2_ENABLE_GMBOX_TX_OVERFLOW_MASK 0x00000002
+#define INT_STATUS2_ENABLE_GMBOX_TX_OVERFLOW_GET(x) (((x) & INT_STATUS2_ENABLE_GMBOX_TX_OVERFLOW_MASK) >> INT_STATUS2_ENABLE_GMBOX_TX_OVERFLOW_LSB)
+#define INT_STATUS2_ENABLE_GMBOX_TX_OVERFLOW_SET(x) (((x) << INT_STATUS2_ENABLE_GMBOX_TX_OVERFLOW_LSB) & INT_STATUS2_ENABLE_GMBOX_TX_OVERFLOW_MASK)
+#define INT_STATUS2_ENABLE_GMBOX_DATA_MSB        0
+#define INT_STATUS2_ENABLE_GMBOX_DATA_LSB        0
+#define INT_STATUS2_ENABLE_GMBOX_DATA_MASK       0x00000001
+#define INT_STATUS2_ENABLE_GMBOX_DATA_GET(x)     (((x) & INT_STATUS2_ENABLE_GMBOX_DATA_MASK) >> INT_STATUS2_ENABLE_GMBOX_DATA_LSB)
+#define INT_STATUS2_ENABLE_GMBOX_DATA_SET(x)     (((x) << INT_STATUS2_ENABLE_GMBOX_DATA_LSB) & INT_STATUS2_ENABLE_GMBOX_DATA_MASK)
+
+#define GMBOX_RX_LOOKAHEAD_ADDRESS               0x00000490
+#define GMBOX_RX_LOOKAHEAD_OFFSET                0x00000490
+#define GMBOX_RX_LOOKAHEAD_DATA_MSB              7
+#define GMBOX_RX_LOOKAHEAD_DATA_LSB              0
+#define GMBOX_RX_LOOKAHEAD_DATA_MASK             0x000000ff
+#define GMBOX_RX_LOOKAHEAD_DATA_GET(x)           (((x) & GMBOX_RX_LOOKAHEAD_DATA_MASK) >> GMBOX_RX_LOOKAHEAD_DATA_LSB)
+#define GMBOX_RX_LOOKAHEAD_DATA_SET(x)           (((x) << GMBOX_RX_LOOKAHEAD_DATA_LSB) & GMBOX_RX_LOOKAHEAD_DATA_MASK)
+
+#define GMBOX_RX_LOOKAHEAD_MUX_ADDRESS           0x00000498
+#define GMBOX_RX_LOOKAHEAD_MUX_OFFSET            0x00000498
+#define GMBOX_RX_LOOKAHEAD_MUX_SEL_MSB           0
+#define GMBOX_RX_LOOKAHEAD_MUX_SEL_LSB           0
+#define GMBOX_RX_LOOKAHEAD_MUX_SEL_MASK          0x00000001
+#define GMBOX_RX_LOOKAHEAD_MUX_SEL_GET(x)        (((x) & GMBOX_RX_LOOKAHEAD_MUX_SEL_MASK) >> GMBOX_RX_LOOKAHEAD_MUX_SEL_LSB)
+#define GMBOX_RX_LOOKAHEAD_MUX_SEL_SET(x)        (((x) << GMBOX_RX_LOOKAHEAD_MUX_SEL_LSB) & GMBOX_RX_LOOKAHEAD_MUX_SEL_MASK)
+
+#define CIS_WINDOW_ADDRESS                       0x00000600
+#define CIS_WINDOW_OFFSET                        0x00000600
+#define CIS_WINDOW_DATA_MSB                      7
+#define CIS_WINDOW_DATA_LSB                      0
+#define CIS_WINDOW_DATA_MASK                     0x000000ff
+#define CIS_WINDOW_DATA_GET(x)                   (((x) & CIS_WINDOW_DATA_MASK) >> CIS_WINDOW_DATA_LSB)
+#define CIS_WINDOW_DATA_SET(x)                   (((x) << CIS_WINDOW_DATA_LSB) & CIS_WINDOW_DATA_MASK)
+
+
+#endif /* _MBOX_WLAN_HOST_REG_H_ */
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_wlan_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_wlan_reg.h
new file mode 100644
index 00000000000..f5167b9ae8d
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/mbox_wlan_reg.h
@@ -0,0 +1,589 @@
+// ------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// ------------------------------------------------------------------
+//===================================================================
+// Author(s): ="Atheros"
+//===================================================================
+
+
+#ifndef _MBOX_WLAN_REG_REG_H_
+#define _MBOX_WLAN_REG_REG_H_
+
+#define WLAN_MBOX_FIFO_ADDRESS                   0x00000000
+#define WLAN_MBOX_FIFO_OFFSET                    0x00000000
+#define WLAN_MBOX_FIFO_DATA_MSB                  19
+#define WLAN_MBOX_FIFO_DATA_LSB                  0
+#define WLAN_MBOX_FIFO_DATA_MASK                 0x000fffff
+#define WLAN_MBOX_FIFO_DATA_GET(x)               (((x) & WLAN_MBOX_FIFO_DATA_MASK) >> WLAN_MBOX_FIFO_DATA_LSB)
+#define WLAN_MBOX_FIFO_DATA_SET(x)               (((x) << WLAN_MBOX_FIFO_DATA_LSB) & WLAN_MBOX_FIFO_DATA_MASK)
+
+#define WLAN_MBOX_FIFO_STATUS_ADDRESS            0x00000010
+#define WLAN_MBOX_FIFO_STATUS_OFFSET             0x00000010
+#define WLAN_MBOX_FIFO_STATUS_EMPTY_MSB          19
+#define WLAN_MBOX_FIFO_STATUS_EMPTY_LSB          16
+#define WLAN_MBOX_FIFO_STATUS_EMPTY_MASK         0x000f0000
+#define WLAN_MBOX_FIFO_STATUS_EMPTY_GET(x)       (((x) & WLAN_MBOX_FIFO_STATUS_EMPTY_MASK) >> WLAN_MBOX_FIFO_STATUS_EMPTY_LSB)
+#define WLAN_MBOX_FIFO_STATUS_EMPTY_SET(x)       (((x) << WLAN_MBOX_FIFO_STATUS_EMPTY_LSB) & WLAN_MBOX_FIFO_STATUS_EMPTY_MASK)
+#define WLAN_MBOX_FIFO_STATUS_FULL_MSB           15
+#define WLAN_MBOX_FIFO_STATUS_FULL_LSB           12
+#define WLAN_MBOX_FIFO_STATUS_FULL_MASK          0x0000f000
+#define WLAN_MBOX_FIFO_STATUS_FULL_GET(x)        (((x) & WLAN_MBOX_FIFO_STATUS_FULL_MASK) >> WLAN_MBOX_FIFO_STATUS_FULL_LSB)
+#define WLAN_MBOX_FIFO_STATUS_FULL_SET(x)        (((x) << WLAN_MBOX_FIFO_STATUS_FULL_LSB) & WLAN_MBOX_FIFO_STATUS_FULL_MASK)
+
+#define WLAN_MBOX_DMA_POLICY_ADDRESS             0x00000014
+#define WLAN_MBOX_DMA_POLICY_OFFSET              0x00000014
+#define WLAN_MBOX_DMA_POLICY_TX_QUANTUM_MSB      3
+#define WLAN_MBOX_DMA_POLICY_TX_QUANTUM_LSB      3
+#define WLAN_MBOX_DMA_POLICY_TX_QUANTUM_MASK     0x00000008
+#define WLAN_MBOX_DMA_POLICY_TX_QUANTUM_GET(x)   (((x) & WLAN_MBOX_DMA_POLICY_TX_QUANTUM_MASK) >> WLAN_MBOX_DMA_POLICY_TX_QUANTUM_LSB)
+#define WLAN_MBOX_DMA_POLICY_TX_QUANTUM_SET(x)   (((x) << WLAN_MBOX_DMA_POLICY_TX_QUANTUM_LSB) & WLAN_MBOX_DMA_POLICY_TX_QUANTUM_MASK)
+#define WLAN_MBOX_DMA_POLICY_TX_ORDER_MSB        2
+#define WLAN_MBOX_DMA_POLICY_TX_ORDER_LSB        2
+#define WLAN_MBOX_DMA_POLICY_TX_ORDER_MASK       0x00000004
+#define WLAN_MBOX_DMA_POLICY_TX_ORDER_GET(x)     (((x) & WLAN_MBOX_DMA_POLICY_TX_ORDER_MASK) >> WLAN_MBOX_DMA_POLICY_TX_ORDER_LSB)
+#define WLAN_MBOX_DMA_POLICY_TX_ORDER_SET(x)     (((x) << WLAN_MBOX_DMA_POLICY_TX_ORDER_LSB) & WLAN_MBOX_DMA_POLICY_TX_ORDER_MASK)
+#define WLAN_MBOX_DMA_POLICY_RX_QUANTUM_MSB      1
+#define WLAN_MBOX_DMA_POLICY_RX_QUANTUM_LSB      1
+#define WLAN_MBOX_DMA_POLICY_RX_QUANTUM_MASK     0x00000002
+#define WLAN_MBOX_DMA_POLICY_RX_QUANTUM_GET(x)   (((x) & WLAN_MBOX_DMA_POLICY_RX_QUANTUM_MASK) >> WLAN_MBOX_DMA_POLICY_RX_QUANTUM_LSB)
+#define WLAN_MBOX_DMA_POLICY_RX_QUANTUM_SET(x)   (((x) << WLAN_MBOX_DMA_POLICY_RX_QUANTUM_LSB) & WLAN_MBOX_DMA_POLICY_RX_QUANTUM_MASK)
+#define WLAN_MBOX_DMA_POLICY_RX_ORDER_MSB        0
+#define WLAN_MBOX_DMA_POLICY_RX_ORDER_LSB        0
+#define WLAN_MBOX_DMA_POLICY_RX_ORDER_MASK       0x00000001
+#define WLAN_MBOX_DMA_POLICY_RX_ORDER_GET(x)     (((x) & WLAN_MBOX_DMA_POLICY_RX_ORDER_MASK) >> WLAN_MBOX_DMA_POLICY_RX_ORDER_LSB)
+#define WLAN_MBOX_DMA_POLICY_RX_ORDER_SET(x)     (((x) << WLAN_MBOX_DMA_POLICY_RX_ORDER_LSB) & WLAN_MBOX_DMA_POLICY_RX_ORDER_MASK)
+
+#define WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS 0x00000018
+#define WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_OFFSET 0x00000018
+#define WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_MBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_MBOX0_DMA_RX_CONTROL_ADDRESS        0x0000001c
+#define WLAN_MBOX0_DMA_RX_CONTROL_OFFSET         0x0000001c
+#define WLAN_MBOX0_DMA_RX_CONTROL_RESUME_MSB     2
+#define WLAN_MBOX0_DMA_RX_CONTROL_RESUME_LSB     2
+#define WLAN_MBOX0_DMA_RX_CONTROL_RESUME_MASK    0x00000004
+#define WLAN_MBOX0_DMA_RX_CONTROL_RESUME_GET(x)  (((x) & WLAN_MBOX0_DMA_RX_CONTROL_RESUME_MASK) >> WLAN_MBOX0_DMA_RX_CONTROL_RESUME_LSB)
+#define WLAN_MBOX0_DMA_RX_CONTROL_RESUME_SET(x)  (((x) << WLAN_MBOX0_DMA_RX_CONTROL_RESUME_LSB) & WLAN_MBOX0_DMA_RX_CONTROL_RESUME_MASK)
+#define WLAN_MBOX0_DMA_RX_CONTROL_START_MSB      1
+#define WLAN_MBOX0_DMA_RX_CONTROL_START_LSB      1
+#define WLAN_MBOX0_DMA_RX_CONTROL_START_MASK     0x00000002
+#define WLAN_MBOX0_DMA_RX_CONTROL_START_GET(x)   (((x) & WLAN_MBOX0_DMA_RX_CONTROL_START_MASK) >> WLAN_MBOX0_DMA_RX_CONTROL_START_LSB)
+#define WLAN_MBOX0_DMA_RX_CONTROL_START_SET(x)   (((x) << WLAN_MBOX0_DMA_RX_CONTROL_START_LSB) & WLAN_MBOX0_DMA_RX_CONTROL_START_MASK)
+#define WLAN_MBOX0_DMA_RX_CONTROL_STOP_MSB       0
+#define WLAN_MBOX0_DMA_RX_CONTROL_STOP_LSB       0
+#define WLAN_MBOX0_DMA_RX_CONTROL_STOP_MASK      0x00000001
+#define WLAN_MBOX0_DMA_RX_CONTROL_STOP_GET(x)    (((x) & WLAN_MBOX0_DMA_RX_CONTROL_STOP_MASK) >> WLAN_MBOX0_DMA_RX_CONTROL_STOP_LSB)
+#define WLAN_MBOX0_DMA_RX_CONTROL_STOP_SET(x)    (((x) << WLAN_MBOX0_DMA_RX_CONTROL_STOP_LSB) & WLAN_MBOX0_DMA_RX_CONTROL_STOP_MASK)
+
+#define WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS 0x00000020
+#define WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_OFFSET 0x00000020
+#define WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_MBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_MBOX0_DMA_TX_CONTROL_ADDRESS        0x00000024
+#define WLAN_MBOX0_DMA_TX_CONTROL_OFFSET         0x00000024
+#define WLAN_MBOX0_DMA_TX_CONTROL_RESUME_MSB     2
+#define WLAN_MBOX0_DMA_TX_CONTROL_RESUME_LSB     2
+#define WLAN_MBOX0_DMA_TX_CONTROL_RESUME_MASK    0x00000004
+#define WLAN_MBOX0_DMA_TX_CONTROL_RESUME_GET(x)  (((x) & WLAN_MBOX0_DMA_TX_CONTROL_RESUME_MASK) >> WLAN_MBOX0_DMA_TX_CONTROL_RESUME_LSB)
+#define WLAN_MBOX0_DMA_TX_CONTROL_RESUME_SET(x)  (((x) << WLAN_MBOX0_DMA_TX_CONTROL_RESUME_LSB) & WLAN_MBOX0_DMA_TX_CONTROL_RESUME_MASK)
+#define WLAN_MBOX0_DMA_TX_CONTROL_START_MSB      1
+#define WLAN_MBOX0_DMA_TX_CONTROL_START_LSB      1
+#define WLAN_MBOX0_DMA_TX_CONTROL_START_MASK     0x00000002
+#define WLAN_MBOX0_DMA_TX_CONTROL_START_GET(x)   (((x) & WLAN_MBOX0_DMA_TX_CONTROL_START_MASK) >> WLAN_MBOX0_DMA_TX_CONTROL_START_LSB)
+#define WLAN_MBOX0_DMA_TX_CONTROL_START_SET(x)   (((x) << WLAN_MBOX0_DMA_TX_CONTROL_START_LSB) & WLAN_MBOX0_DMA_TX_CONTROL_START_MASK)
+#define WLAN_MBOX0_DMA_TX_CONTROL_STOP_MSB       0
+#define WLAN_MBOX0_DMA_TX_CONTROL_STOP_LSB       0
+#define WLAN_MBOX0_DMA_TX_CONTROL_STOP_MASK      0x00000001
+#define WLAN_MBOX0_DMA_TX_CONTROL_STOP_GET(x)    (((x) & WLAN_MBOX0_DMA_TX_CONTROL_STOP_MASK) >> WLAN_MBOX0_DMA_TX_CONTROL_STOP_LSB)
+#define WLAN_MBOX0_DMA_TX_CONTROL_STOP_SET(x)    (((x) << WLAN_MBOX0_DMA_TX_CONTROL_STOP_LSB) & WLAN_MBOX0_DMA_TX_CONTROL_STOP_MASK)
+
+#define WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS 0x00000028
+#define WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_OFFSET 0x00000028
+#define WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_MBOX1_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_MBOX1_DMA_RX_CONTROL_ADDRESS        0x0000002c
+#define WLAN_MBOX1_DMA_RX_CONTROL_OFFSET         0x0000002c
+#define WLAN_MBOX1_DMA_RX_CONTROL_RESUME_MSB     2
+#define WLAN_MBOX1_DMA_RX_CONTROL_RESUME_LSB     2
+#define WLAN_MBOX1_DMA_RX_CONTROL_RESUME_MASK    0x00000004
+#define WLAN_MBOX1_DMA_RX_CONTROL_RESUME_GET(x)  (((x) & WLAN_MBOX1_DMA_RX_CONTROL_RESUME_MASK) >> WLAN_MBOX1_DMA_RX_CONTROL_RESUME_LSB)
+#define WLAN_MBOX1_DMA_RX_CONTROL_RESUME_SET(x)  (((x) << WLAN_MBOX1_DMA_RX_CONTROL_RESUME_LSB) & WLAN_MBOX1_DMA_RX_CONTROL_RESUME_MASK)
+#define WLAN_MBOX1_DMA_RX_CONTROL_START_MSB      1
+#define WLAN_MBOX1_DMA_RX_CONTROL_START_LSB      1
+#define WLAN_MBOX1_DMA_RX_CONTROL_START_MASK     0x00000002
+#define WLAN_MBOX1_DMA_RX_CONTROL_START_GET(x)   (((x) & WLAN_MBOX1_DMA_RX_CONTROL_START_MASK) >> WLAN_MBOX1_DMA_RX_CONTROL_START_LSB)
+#define WLAN_MBOX1_DMA_RX_CONTROL_START_SET(x)   (((x) << WLAN_MBOX1_DMA_RX_CONTROL_START_LSB) & WLAN_MBOX1_DMA_RX_CONTROL_START_MASK)
+#define WLAN_MBOX1_DMA_RX_CONTROL_STOP_MSB       0
+#define WLAN_MBOX1_DMA_RX_CONTROL_STOP_LSB       0
+#define WLAN_MBOX1_DMA_RX_CONTROL_STOP_MASK      0x00000001
+#define WLAN_MBOX1_DMA_RX_CONTROL_STOP_GET(x)    (((x) & WLAN_MBOX1_DMA_RX_CONTROL_STOP_MASK) >> WLAN_MBOX1_DMA_RX_CONTROL_STOP_LSB)
+#define WLAN_MBOX1_DMA_RX_CONTROL_STOP_SET(x)    (((x) << WLAN_MBOX1_DMA_RX_CONTROL_STOP_LSB) & WLAN_MBOX1_DMA_RX_CONTROL_STOP_MASK)
+
+#define WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS 0x00000030
+#define WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_OFFSET 0x00000030
+#define WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_MBOX1_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_MBOX1_DMA_TX_CONTROL_ADDRESS        0x00000034
+#define WLAN_MBOX1_DMA_TX_CONTROL_OFFSET         0x00000034
+#define WLAN_MBOX1_DMA_TX_CONTROL_RESUME_MSB     2
+#define WLAN_MBOX1_DMA_TX_CONTROL_RESUME_LSB     2
+#define WLAN_MBOX1_DMA_TX_CONTROL_RESUME_MASK    0x00000004
+#define WLAN_MBOX1_DMA_TX_CONTROL_RESUME_GET(x)  (((x) & WLAN_MBOX1_DMA_TX_CONTROL_RESUME_MASK) >> WLAN_MBOX1_DMA_TX_CONTROL_RESUME_LSB)
+#define WLAN_MBOX1_DMA_TX_CONTROL_RESUME_SET(x)  (((x) << WLAN_MBOX1_DMA_TX_CONTROL_RESUME_LSB) & WLAN_MBOX1_DMA_TX_CONTROL_RESUME_MASK)
+#define WLAN_MBOX1_DMA_TX_CONTROL_START_MSB      1
+#define WLAN_MBOX1_DMA_TX_CONTROL_START_LSB      1
+#define WLAN_MBOX1_DMA_TX_CONTROL_START_MASK     0x00000002
+#define WLAN_MBOX1_DMA_TX_CONTROL_START_GET(x)   (((x) & WLAN_MBOX1_DMA_TX_CONTROL_START_MASK) >> WLAN_MBOX1_DMA_TX_CONTROL_START_LSB)
+#define WLAN_MBOX1_DMA_TX_CONTROL_START_SET(x)   (((x) << WLAN_MBOX1_DMA_TX_CONTROL_START_LSB) & WLAN_MBOX1_DMA_TX_CONTROL_START_MASK)
+#define WLAN_MBOX1_DMA_TX_CONTROL_STOP_MSB       0
+#define WLAN_MBOX1_DMA_TX_CONTROL_STOP_LSB       0
+#define WLAN_MBOX1_DMA_TX_CONTROL_STOP_MASK      0x00000001
+#define WLAN_MBOX1_DMA_TX_CONTROL_STOP_GET(x)    (((x) & WLAN_MBOX1_DMA_TX_CONTROL_STOP_MASK) >> WLAN_MBOX1_DMA_TX_CONTROL_STOP_LSB)
+#define WLAN_MBOX1_DMA_TX_CONTROL_STOP_SET(x)    (((x) << WLAN_MBOX1_DMA_TX_CONTROL_STOP_LSB) & WLAN_MBOX1_DMA_TX_CONTROL_STOP_MASK)
+
+#define WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS 0x00000038
+#define WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_OFFSET 0x00000038
+#define WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_MBOX2_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_MBOX2_DMA_RX_CONTROL_ADDRESS        0x0000003c
+#define WLAN_MBOX2_DMA_RX_CONTROL_OFFSET         0x0000003c
+#define WLAN_MBOX2_DMA_RX_CONTROL_RESUME_MSB     2
+#define WLAN_MBOX2_DMA_RX_CONTROL_RESUME_LSB     2
+#define WLAN_MBOX2_DMA_RX_CONTROL_RESUME_MASK    0x00000004
+#define WLAN_MBOX2_DMA_RX_CONTROL_RESUME_GET(x)  (((x) & WLAN_MBOX2_DMA_RX_CONTROL_RESUME_MASK) >> WLAN_MBOX2_DMA_RX_CONTROL_RESUME_LSB)
+#define WLAN_MBOX2_DMA_RX_CONTROL_RESUME_SET(x)  (((x) << WLAN_MBOX2_DMA_RX_CONTROL_RESUME_LSB) & WLAN_MBOX2_DMA_RX_CONTROL_RESUME_MASK)
+#define WLAN_MBOX2_DMA_RX_CONTROL_START_MSB      1
+#define WLAN_MBOX2_DMA_RX_CONTROL_START_LSB      1
+#define WLAN_MBOX2_DMA_RX_CONTROL_START_MASK     0x00000002
+#define WLAN_MBOX2_DMA_RX_CONTROL_START_GET(x)   (((x) & WLAN_MBOX2_DMA_RX_CONTROL_START_MASK) >> WLAN_MBOX2_DMA_RX_CONTROL_START_LSB)
+#define WLAN_MBOX2_DMA_RX_CONTROL_START_SET(x)   (((x) << WLAN_MBOX2_DMA_RX_CONTROL_START_LSB) & WLAN_MBOX2_DMA_RX_CONTROL_START_MASK)
+#define WLAN_MBOX2_DMA_RX_CONTROL_STOP_MSB       0
+#define WLAN_MBOX2_DMA_RX_CONTROL_STOP_LSB       0
+#define WLAN_MBOX2_DMA_RX_CONTROL_STOP_MASK      0x00000001
+#define WLAN_MBOX2_DMA_RX_CONTROL_STOP_GET(x)    (((x) & WLAN_MBOX2_DMA_RX_CONTROL_STOP_MASK) >> WLAN_MBOX2_DMA_RX_CONTROL_STOP_LSB)
+#define WLAN_MBOX2_DMA_RX_CONTROL_STOP_SET(x)    (((x) << WLAN_MBOX2_DMA_RX_CONTROL_STOP_LSB) & WLAN_MBOX2_DMA_RX_CONTROL_STOP_MASK)
+
+#define WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS 0x00000040
+#define WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_OFFSET 0x00000040
+#define WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_MBOX2_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_MBOX2_DMA_TX_CONTROL_ADDRESS        0x00000044
+#define WLAN_MBOX2_DMA_TX_CONTROL_OFFSET         0x00000044
+#define WLAN_MBOX2_DMA_TX_CONTROL_RESUME_MSB     2
+#define WLAN_MBOX2_DMA_TX_CONTROL_RESUME_LSB     2
+#define WLAN_MBOX2_DMA_TX_CONTROL_RESUME_MASK    0x00000004
+#define WLAN_MBOX2_DMA_TX_CONTROL_RESUME_GET(x)  (((x) & WLAN_MBOX2_DMA_TX_CONTROL_RESUME_MASK) >> WLAN_MBOX2_DMA_TX_CONTROL_RESUME_LSB)
+#define WLAN_MBOX2_DMA_TX_CONTROL_RESUME_SET(x)  (((x) << WLAN_MBOX2_DMA_TX_CONTROL_RESUME_LSB) & WLAN_MBOX2_DMA_TX_CONTROL_RESUME_MASK)
+#define WLAN_MBOX2_DMA_TX_CONTROL_START_MSB      1
+#define WLAN_MBOX2_DMA_TX_CONTROL_START_LSB      1
+#define WLAN_MBOX2_DMA_TX_CONTROL_START_MASK     0x00000002
+#define WLAN_MBOX2_DMA_TX_CONTROL_START_GET(x)   (((x) & WLAN_MBOX2_DMA_TX_CONTROL_START_MASK) >> WLAN_MBOX2_DMA_TX_CONTROL_START_LSB)
+#define WLAN_MBOX2_DMA_TX_CONTROL_START_SET(x)   (((x) << WLAN_MBOX2_DMA_TX_CONTROL_START_LSB) & WLAN_MBOX2_DMA_TX_CONTROL_START_MASK)
+#define WLAN_MBOX2_DMA_TX_CONTROL_STOP_MSB       0
+#define WLAN_MBOX2_DMA_TX_CONTROL_STOP_LSB       0
+#define WLAN_MBOX2_DMA_TX_CONTROL_STOP_MASK      0x00000001
+#define WLAN_MBOX2_DMA_TX_CONTROL_STOP_GET(x)    (((x) & WLAN_MBOX2_DMA_TX_CONTROL_STOP_MASK) >> WLAN_MBOX2_DMA_TX_CONTROL_STOP_LSB)
+#define WLAN_MBOX2_DMA_TX_CONTROL_STOP_SET(x)    (((x) << WLAN_MBOX2_DMA_TX_CONTROL_STOP_LSB) & WLAN_MBOX2_DMA_TX_CONTROL_STOP_MASK)
+
+#define WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS 0x00000048
+#define WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_OFFSET 0x00000048
+#define WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_MBOX3_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_MBOX3_DMA_RX_CONTROL_ADDRESS        0x0000004c
+#define WLAN_MBOX3_DMA_RX_CONTROL_OFFSET         0x0000004c
+#define WLAN_MBOX3_DMA_RX_CONTROL_RESUME_MSB     2
+#define WLAN_MBOX3_DMA_RX_CONTROL_RESUME_LSB     2
+#define WLAN_MBOX3_DMA_RX_CONTROL_RESUME_MASK    0x00000004
+#define WLAN_MBOX3_DMA_RX_CONTROL_RESUME_GET(x)  (((x) & WLAN_MBOX3_DMA_RX_CONTROL_RESUME_MASK) >> WLAN_MBOX3_DMA_RX_CONTROL_RESUME_LSB)
+#define WLAN_MBOX3_DMA_RX_CONTROL_RESUME_SET(x)  (((x) << WLAN_MBOX3_DMA_RX_CONTROL_RESUME_LSB) & WLAN_MBOX3_DMA_RX_CONTROL_RESUME_MASK)
+#define WLAN_MBOX3_DMA_RX_CONTROL_START_MSB      1
+#define WLAN_MBOX3_DMA_RX_CONTROL_START_LSB      1
+#define WLAN_MBOX3_DMA_RX_CONTROL_START_MASK     0x00000002
+#define WLAN_MBOX3_DMA_RX_CONTROL_START_GET(x)   (((x) & WLAN_MBOX3_DMA_RX_CONTROL_START_MASK) >> WLAN_MBOX3_DMA_RX_CONTROL_START_LSB)
+#define WLAN_MBOX3_DMA_RX_CONTROL_START_SET(x)   (((x) << WLAN_MBOX3_DMA_RX_CONTROL_START_LSB) & WLAN_MBOX3_DMA_RX_CONTROL_START_MASK)
+#define WLAN_MBOX3_DMA_RX_CONTROL_STOP_MSB       0
+#define WLAN_MBOX3_DMA_RX_CONTROL_STOP_LSB       0
+#define WLAN_MBOX3_DMA_RX_CONTROL_STOP_MASK      0x00000001
+#define WLAN_MBOX3_DMA_RX_CONTROL_STOP_GET(x)    (((x) & WLAN_MBOX3_DMA_RX_CONTROL_STOP_MASK) >> WLAN_MBOX3_DMA_RX_CONTROL_STOP_LSB)
+#define WLAN_MBOX3_DMA_RX_CONTROL_STOP_SET(x)    (((x) << WLAN_MBOX3_DMA_RX_CONTROL_STOP_LSB) & WLAN_MBOX3_DMA_RX_CONTROL_STOP_MASK)
+
+#define WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS 0x00000050
+#define WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_OFFSET 0x00000050
+#define WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_MBOX3_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_MBOX3_DMA_TX_CONTROL_ADDRESS        0x00000054
+#define WLAN_MBOX3_DMA_TX_CONTROL_OFFSET         0x00000054
+#define WLAN_MBOX3_DMA_TX_CONTROL_RESUME_MSB     2
+#define WLAN_MBOX3_DMA_TX_CONTROL_RESUME_LSB     2
+#define WLAN_MBOX3_DMA_TX_CONTROL_RESUME_MASK    0x00000004
+#define WLAN_MBOX3_DMA_TX_CONTROL_RESUME_GET(x)  (((x) & WLAN_MBOX3_DMA_TX_CONTROL_RESUME_MASK) >> WLAN_MBOX3_DMA_TX_CONTROL_RESUME_LSB)
+#define WLAN_MBOX3_DMA_TX_CONTROL_RESUME_SET(x)  (((x) << WLAN_MBOX3_DMA_TX_CONTROL_RESUME_LSB) & WLAN_MBOX3_DMA_TX_CONTROL_RESUME_MASK)
+#define WLAN_MBOX3_DMA_TX_CONTROL_START_MSB      1
+#define WLAN_MBOX3_DMA_TX_CONTROL_START_LSB      1
+#define WLAN_MBOX3_DMA_TX_CONTROL_START_MASK     0x00000002
+#define WLAN_MBOX3_DMA_TX_CONTROL_START_GET(x)   (((x) & WLAN_MBOX3_DMA_TX_CONTROL_START_MASK) >> WLAN_MBOX3_DMA_TX_CONTROL_START_LSB)
+#define WLAN_MBOX3_DMA_TX_CONTROL_START_SET(x)   (((x) << WLAN_MBOX3_DMA_TX_CONTROL_START_LSB) & WLAN_MBOX3_DMA_TX_CONTROL_START_MASK)
+#define WLAN_MBOX3_DMA_TX_CONTROL_STOP_MSB       0
+#define WLAN_MBOX3_DMA_TX_CONTROL_STOP_LSB       0
+#define WLAN_MBOX3_DMA_TX_CONTROL_STOP_MASK      0x00000001
+#define WLAN_MBOX3_DMA_TX_CONTROL_STOP_GET(x)    (((x) & WLAN_MBOX3_DMA_TX_CONTROL_STOP_MASK) >> WLAN_MBOX3_DMA_TX_CONTROL_STOP_LSB)
+#define WLAN_MBOX3_DMA_TX_CONTROL_STOP_SET(x)    (((x) << WLAN_MBOX3_DMA_TX_CONTROL_STOP_LSB) & WLAN_MBOX3_DMA_TX_CONTROL_STOP_MASK)
+
+#define WLAN_MBOX_INT_STATUS_ADDRESS             0x00000058
+#define WLAN_MBOX_INT_STATUS_OFFSET              0x00000058
+#define WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_MSB 31
+#define WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_LSB 28
+#define WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_MASK 0xf0000000
+#define WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_GET(x) (((x) & WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_MASK) >> WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_LSB)
+#define WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_SET(x) (((x) << WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_LSB) & WLAN_MBOX_INT_STATUS_RX_DMA_COMPLETE_MASK)
+#define WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MSB 27
+#define WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB 24
+#define WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK 0x0f000000
+#define WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_GET(x) (((x) & WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK) >> WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB)
+#define WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_SET(x) (((x) << WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB) & WLAN_MBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK)
+#define WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_MSB 23
+#define WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_LSB 20
+#define WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_MASK 0x00f00000
+#define WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_GET(x) (((x) & WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_MASK) >> WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_LSB)
+#define WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_SET(x) (((x) << WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_LSB) & WLAN_MBOX_INT_STATUS_TX_DMA_COMPLETE_MASK)
+#define WLAN_MBOX_INT_STATUS_TX_OVERFLOW_MSB     17
+#define WLAN_MBOX_INT_STATUS_TX_OVERFLOW_LSB     17
+#define WLAN_MBOX_INT_STATUS_TX_OVERFLOW_MASK    0x00020000
+#define WLAN_MBOX_INT_STATUS_TX_OVERFLOW_GET(x)  (((x) & WLAN_MBOX_INT_STATUS_TX_OVERFLOW_MASK) >> WLAN_MBOX_INT_STATUS_TX_OVERFLOW_LSB)
+#define WLAN_MBOX_INT_STATUS_TX_OVERFLOW_SET(x)  (((x) << WLAN_MBOX_INT_STATUS_TX_OVERFLOW_LSB) & WLAN_MBOX_INT_STATUS_TX_OVERFLOW_MASK)
+#define WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_MSB    16
+#define WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_LSB    16
+#define WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_MASK   0x00010000
+#define WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_GET(x) (((x) & WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_MASK) >> WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_LSB)
+#define WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_SET(x) (((x) << WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_LSB) & WLAN_MBOX_INT_STATUS_RX_UNDERFLOW_MASK)
+#define WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_MSB    15
+#define WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_LSB    12
+#define WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_MASK   0x0000f000
+#define WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_GET(x) (((x) & WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_MASK) >> WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_LSB)
+#define WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_SET(x) (((x) << WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_LSB) & WLAN_MBOX_INT_STATUS_TX_NOT_EMPTY_MASK)
+#define WLAN_MBOX_INT_STATUS_RX_NOT_FULL_MSB     11
+#define WLAN_MBOX_INT_STATUS_RX_NOT_FULL_LSB     8
+#define WLAN_MBOX_INT_STATUS_RX_NOT_FULL_MASK    0x00000f00
+#define WLAN_MBOX_INT_STATUS_RX_NOT_FULL_GET(x)  (((x) & WLAN_MBOX_INT_STATUS_RX_NOT_FULL_MASK) >> WLAN_MBOX_INT_STATUS_RX_NOT_FULL_LSB)
+#define WLAN_MBOX_INT_STATUS_RX_NOT_FULL_SET(x)  (((x) << WLAN_MBOX_INT_STATUS_RX_NOT_FULL_LSB) & WLAN_MBOX_INT_STATUS_RX_NOT_FULL_MASK)
+#define WLAN_MBOX_INT_STATUS_HOST_MSB            7
+#define WLAN_MBOX_INT_STATUS_HOST_LSB            0
+#define WLAN_MBOX_INT_STATUS_HOST_MASK           0x000000ff
+#define WLAN_MBOX_INT_STATUS_HOST_GET(x)         (((x) & WLAN_MBOX_INT_STATUS_HOST_MASK) >> WLAN_MBOX_INT_STATUS_HOST_LSB)
+#define WLAN_MBOX_INT_STATUS_HOST_SET(x)         (((x) << WLAN_MBOX_INT_STATUS_HOST_LSB) & WLAN_MBOX_INT_STATUS_HOST_MASK)
+
+#define WLAN_MBOX_INT_ENABLE_ADDRESS             0x0000005c
+#define WLAN_MBOX_INT_ENABLE_OFFSET              0x0000005c
+#define WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_MSB 31
+#define WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB 28
+#define WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK 0xf0000000
+#define WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_GET(x) (((x) & WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK) >> WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB)
+#define WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_SET(x) (((x) << WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB) & WLAN_MBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK)
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MSB 27
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB 24
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK 0x0f000000
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_GET(x) (((x) & WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK) >> WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB)
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_SET(x) (((x) << WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB) & WLAN_MBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK)
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_MSB 23
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB 20
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK 0x00f00000
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_GET(x) (((x) & WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK) >> WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB)
+#define WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_SET(x) (((x) << WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB) & WLAN_MBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK)
+#define WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_MSB     17
+#define WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_LSB     17
+#define WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_MASK    0x00020000
+#define WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_GET(x)  (((x) & WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_MASK) >> WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_LSB)
+#define WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_SET(x)  (((x) << WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_LSB) & WLAN_MBOX_INT_ENABLE_TX_OVERFLOW_MASK)
+#define WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_MSB    16
+#define WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_LSB    16
+#define WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_MASK   0x00010000
+#define WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_GET(x) (((x) & WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_MASK) >> WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_LSB)
+#define WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_SET(x) (((x) << WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_LSB) & WLAN_MBOX_INT_ENABLE_RX_UNDERFLOW_MASK)
+#define WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_MSB    15
+#define WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_LSB    12
+#define WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_MASK   0x0000f000
+#define WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_GET(x) (((x) & WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_MASK) >> WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_LSB)
+#define WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_SET(x) (((x) << WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_LSB) & WLAN_MBOX_INT_ENABLE_TX_NOT_EMPTY_MASK)
+#define WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_MSB     11
+#define WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_LSB     8
+#define WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_MASK    0x00000f00
+#define WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_GET(x)  (((x) & WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_MASK) >> WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_LSB)
+#define WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_SET(x)  (((x) << WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_LSB) & WLAN_MBOX_INT_ENABLE_RX_NOT_FULL_MASK)
+#define WLAN_MBOX_INT_ENABLE_HOST_MSB            7
+#define WLAN_MBOX_INT_ENABLE_HOST_LSB            0
+#define WLAN_MBOX_INT_ENABLE_HOST_MASK           0x000000ff
+#define WLAN_MBOX_INT_ENABLE_HOST_GET(x)         (((x) & WLAN_MBOX_INT_ENABLE_HOST_MASK) >> WLAN_MBOX_INT_ENABLE_HOST_LSB)
+#define WLAN_MBOX_INT_ENABLE_HOST_SET(x)         (((x) << WLAN_MBOX_INT_ENABLE_HOST_LSB) & WLAN_MBOX_INT_ENABLE_HOST_MASK)
+
+#define WLAN_INT_HOST_ADDRESS                    0x00000060
+#define WLAN_INT_HOST_OFFSET                     0x00000060
+#define WLAN_INT_HOST_VECTOR_MSB                 7
+#define WLAN_INT_HOST_VECTOR_LSB                 0
+#define WLAN_INT_HOST_VECTOR_MASK                0x000000ff
+#define WLAN_INT_HOST_VECTOR_GET(x)              (((x) & WLAN_INT_HOST_VECTOR_MASK) >> WLAN_INT_HOST_VECTOR_LSB)
+#define WLAN_INT_HOST_VECTOR_SET(x)              (((x) << WLAN_INT_HOST_VECTOR_LSB) & WLAN_INT_HOST_VECTOR_MASK)
+
+#define WLAN_LOCAL_COUNT_ADDRESS                 0x00000080
+#define WLAN_LOCAL_COUNT_OFFSET                  0x00000080
+#define WLAN_LOCAL_COUNT_VALUE_MSB               7
+#define WLAN_LOCAL_COUNT_VALUE_LSB               0
+#define WLAN_LOCAL_COUNT_VALUE_MASK              0x000000ff
+#define WLAN_LOCAL_COUNT_VALUE_GET(x)            (((x) & WLAN_LOCAL_COUNT_VALUE_MASK) >> WLAN_LOCAL_COUNT_VALUE_LSB)
+#define WLAN_LOCAL_COUNT_VALUE_SET(x)            (((x) << WLAN_LOCAL_COUNT_VALUE_LSB) & WLAN_LOCAL_COUNT_VALUE_MASK)
+
+#define WLAN_COUNT_INC_ADDRESS                   0x000000a0
+#define WLAN_COUNT_INC_OFFSET                    0x000000a0
+#define WLAN_COUNT_INC_VALUE_MSB                 7
+#define WLAN_COUNT_INC_VALUE_LSB                 0
+#define WLAN_COUNT_INC_VALUE_MASK                0x000000ff
+#define WLAN_COUNT_INC_VALUE_GET(x)              (((x) & WLAN_COUNT_INC_VALUE_MASK) >> WLAN_COUNT_INC_VALUE_LSB)
+#define WLAN_COUNT_INC_VALUE_SET(x)              (((x) << WLAN_COUNT_INC_VALUE_LSB) & WLAN_COUNT_INC_VALUE_MASK)
+
+#define WLAN_LOCAL_SCRATCH_ADDRESS               0x000000c0
+#define WLAN_LOCAL_SCRATCH_OFFSET                0x000000c0
+#define WLAN_LOCAL_SCRATCH_VALUE_MSB             7
+#define WLAN_LOCAL_SCRATCH_VALUE_LSB             0
+#define WLAN_LOCAL_SCRATCH_VALUE_MASK            0x000000ff
+#define WLAN_LOCAL_SCRATCH_VALUE_GET(x)          (((x) & WLAN_LOCAL_SCRATCH_VALUE_MASK) >> WLAN_LOCAL_SCRATCH_VALUE_LSB)
+#define WLAN_LOCAL_SCRATCH_VALUE_SET(x)          (((x) << WLAN_LOCAL_SCRATCH_VALUE_LSB) & WLAN_LOCAL_SCRATCH_VALUE_MASK)
+
+#define WLAN_USE_LOCAL_BUS_ADDRESS               0x000000e0
+#define WLAN_USE_LOCAL_BUS_OFFSET                0x000000e0
+#define WLAN_USE_LOCAL_BUS_PIN_INIT_MSB          0
+#define WLAN_USE_LOCAL_BUS_PIN_INIT_LSB          0
+#define WLAN_USE_LOCAL_BUS_PIN_INIT_MASK         0x00000001
+#define WLAN_USE_LOCAL_BUS_PIN_INIT_GET(x)       (((x) & WLAN_USE_LOCAL_BUS_PIN_INIT_MASK) >> WLAN_USE_LOCAL_BUS_PIN_INIT_LSB)
+#define WLAN_USE_LOCAL_BUS_PIN_INIT_SET(x)       (((x) << WLAN_USE_LOCAL_BUS_PIN_INIT_LSB) & WLAN_USE_LOCAL_BUS_PIN_INIT_MASK)
+
+#define WLAN_SDIO_CONFIG_ADDRESS                 0x000000e4
+#define WLAN_SDIO_CONFIG_OFFSET                  0x000000e4
+#define WLAN_SDIO_CONFIG_CCCR_IOR1_MSB           0
+#define WLAN_SDIO_CONFIG_CCCR_IOR1_LSB           0
+#define WLAN_SDIO_CONFIG_CCCR_IOR1_MASK          0x00000001
+#define WLAN_SDIO_CONFIG_CCCR_IOR1_GET(x)        (((x) & WLAN_SDIO_CONFIG_CCCR_IOR1_MASK) >> WLAN_SDIO_CONFIG_CCCR_IOR1_LSB)
+#define WLAN_SDIO_CONFIG_CCCR_IOR1_SET(x)        (((x) << WLAN_SDIO_CONFIG_CCCR_IOR1_LSB) & WLAN_SDIO_CONFIG_CCCR_IOR1_MASK)
+
+#define WLAN_MBOX_DEBUG_ADDRESS                  0x000000e8
+#define WLAN_MBOX_DEBUG_OFFSET                   0x000000e8
+#define WLAN_MBOX_DEBUG_SEL_MSB                  2
+#define WLAN_MBOX_DEBUG_SEL_LSB                  0
+#define WLAN_MBOX_DEBUG_SEL_MASK                 0x00000007
+#define WLAN_MBOX_DEBUG_SEL_GET(x)               (((x) & WLAN_MBOX_DEBUG_SEL_MASK) >> WLAN_MBOX_DEBUG_SEL_LSB)
+#define WLAN_MBOX_DEBUG_SEL_SET(x)               (((x) << WLAN_MBOX_DEBUG_SEL_LSB) & WLAN_MBOX_DEBUG_SEL_MASK)
+
+#define WLAN_MBOX_FIFO_RESET_ADDRESS             0x000000ec
+#define WLAN_MBOX_FIFO_RESET_OFFSET              0x000000ec
+#define WLAN_MBOX_FIFO_RESET_INIT_MSB            0
+#define WLAN_MBOX_FIFO_RESET_INIT_LSB            0
+#define WLAN_MBOX_FIFO_RESET_INIT_MASK           0x00000001
+#define WLAN_MBOX_FIFO_RESET_INIT_GET(x)         (((x) & WLAN_MBOX_FIFO_RESET_INIT_MASK) >> WLAN_MBOX_FIFO_RESET_INIT_LSB)
+#define WLAN_MBOX_FIFO_RESET_INIT_SET(x)         (((x) << WLAN_MBOX_FIFO_RESET_INIT_LSB) & WLAN_MBOX_FIFO_RESET_INIT_MASK)
+
+#define WLAN_MBOX_TXFIFO_POP_ADDRESS             0x000000f0
+#define WLAN_MBOX_TXFIFO_POP_OFFSET              0x000000f0
+#define WLAN_MBOX_TXFIFO_POP_DATA_MSB            0
+#define WLAN_MBOX_TXFIFO_POP_DATA_LSB            0
+#define WLAN_MBOX_TXFIFO_POP_DATA_MASK           0x00000001
+#define WLAN_MBOX_TXFIFO_POP_DATA_GET(x)         (((x) & WLAN_MBOX_TXFIFO_POP_DATA_MASK) >> WLAN_MBOX_TXFIFO_POP_DATA_LSB)
+#define WLAN_MBOX_TXFIFO_POP_DATA_SET(x)         (((x) << WLAN_MBOX_TXFIFO_POP_DATA_LSB) & WLAN_MBOX_TXFIFO_POP_DATA_MASK)
+
+#define WLAN_MBOX_RXFIFO_POP_ADDRESS             0x00000100
+#define WLAN_MBOX_RXFIFO_POP_OFFSET              0x00000100
+#define WLAN_MBOX_RXFIFO_POP_DATA_MSB            0
+#define WLAN_MBOX_RXFIFO_POP_DATA_LSB            0
+#define WLAN_MBOX_RXFIFO_POP_DATA_MASK           0x00000001
+#define WLAN_MBOX_RXFIFO_POP_DATA_GET(x)         (((x) & WLAN_MBOX_RXFIFO_POP_DATA_MASK) >> WLAN_MBOX_RXFIFO_POP_DATA_LSB)
+#define WLAN_MBOX_RXFIFO_POP_DATA_SET(x)         (((x) << WLAN_MBOX_RXFIFO_POP_DATA_LSB) & WLAN_MBOX_RXFIFO_POP_DATA_MASK)
+
+#define WLAN_SDIO_DEBUG_ADDRESS                  0x00000110
+#define WLAN_SDIO_DEBUG_OFFSET                   0x00000110
+#define WLAN_SDIO_DEBUG_SEL_MSB                  3
+#define WLAN_SDIO_DEBUG_SEL_LSB                  0
+#define WLAN_SDIO_DEBUG_SEL_MASK                 0x0000000f
+#define WLAN_SDIO_DEBUG_SEL_GET(x)               (((x) & WLAN_SDIO_DEBUG_SEL_MASK) >> WLAN_SDIO_DEBUG_SEL_LSB)
+#define WLAN_SDIO_DEBUG_SEL_SET(x)               (((x) << WLAN_SDIO_DEBUG_SEL_LSB) & WLAN_SDIO_DEBUG_SEL_MASK)
+
+#define WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS 0x00000114
+#define WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_OFFSET 0x00000114
+#define WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_GMBOX0_DMA_RX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_GMBOX0_DMA_RX_CONTROL_ADDRESS       0x00000118
+#define WLAN_GMBOX0_DMA_RX_CONTROL_OFFSET        0x00000118
+#define WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_MSB    2
+#define WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_LSB    2
+#define WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_MASK   0x00000004
+#define WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_GET(x) (((x) & WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_MASK) >> WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_LSB)
+#define WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_SET(x) (((x) << WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_LSB) & WLAN_GMBOX0_DMA_RX_CONTROL_RESUME_MASK)
+#define WLAN_GMBOX0_DMA_RX_CONTROL_START_MSB     1
+#define WLAN_GMBOX0_DMA_RX_CONTROL_START_LSB     1
+#define WLAN_GMBOX0_DMA_RX_CONTROL_START_MASK    0x00000002
+#define WLAN_GMBOX0_DMA_RX_CONTROL_START_GET(x)  (((x) & WLAN_GMBOX0_DMA_RX_CONTROL_START_MASK) >> WLAN_GMBOX0_DMA_RX_CONTROL_START_LSB)
+#define WLAN_GMBOX0_DMA_RX_CONTROL_START_SET(x)  (((x) << WLAN_GMBOX0_DMA_RX_CONTROL_START_LSB) & WLAN_GMBOX0_DMA_RX_CONTROL_START_MASK)
+#define WLAN_GMBOX0_DMA_RX_CONTROL_STOP_MSB      0
+#define WLAN_GMBOX0_DMA_RX_CONTROL_STOP_LSB      0
+#define WLAN_GMBOX0_DMA_RX_CONTROL_STOP_MASK     0x00000001
+#define WLAN_GMBOX0_DMA_RX_CONTROL_STOP_GET(x)   (((x) & WLAN_GMBOX0_DMA_RX_CONTROL_STOP_MASK) >> WLAN_GMBOX0_DMA_RX_CONTROL_STOP_LSB)
+#define WLAN_GMBOX0_DMA_RX_CONTROL_STOP_SET(x)   (((x) << WLAN_GMBOX0_DMA_RX_CONTROL_STOP_LSB) & WLAN_GMBOX0_DMA_RX_CONTROL_STOP_MASK)
+
+#define WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS 0x0000011c
+#define WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_OFFSET 0x0000011c
+#define WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MSB 27
+#define WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB 2
+#define WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK 0x0ffffffc
+#define WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_GET(x) (((x) & WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK) >> WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB)
+#define WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_SET(x) (((x) << WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_LSB) & WLAN_GMBOX0_DMA_TX_DESCRIPTOR_BASE_ADDRESS_MASK)
+
+#define WLAN_GMBOX0_DMA_TX_CONTROL_ADDRESS       0x00000120
+#define WLAN_GMBOX0_DMA_TX_CONTROL_OFFSET        0x00000120
+#define WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_MSB    2
+#define WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_LSB    2
+#define WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_MASK   0x00000004
+#define WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_GET(x) (((x) & WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_MASK) >> WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_LSB)
+#define WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_SET(x) (((x) << WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_LSB) & WLAN_GMBOX0_DMA_TX_CONTROL_RESUME_MASK)
+#define WLAN_GMBOX0_DMA_TX_CONTROL_START_MSB     1
+#define WLAN_GMBOX0_DMA_TX_CONTROL_START_LSB     1
+#define WLAN_GMBOX0_DMA_TX_CONTROL_START_MASK    0x00000002
+#define WLAN_GMBOX0_DMA_TX_CONTROL_START_GET(x)  (((x) & WLAN_GMBOX0_DMA_TX_CONTROL_START_MASK) >> WLAN_GMBOX0_DMA_TX_CONTROL_START_LSB)
+#define WLAN_GMBOX0_DMA_TX_CONTROL_START_SET(x)  (((x) << WLAN_GMBOX0_DMA_TX_CONTROL_START_LSB) & WLAN_GMBOX0_DMA_TX_CONTROL_START_MASK)
+#define WLAN_GMBOX0_DMA_TX_CONTROL_STOP_MSB      0
+#define WLAN_GMBOX0_DMA_TX_CONTROL_STOP_LSB      0
+#define WLAN_GMBOX0_DMA_TX_CONTROL_STOP_MASK     0x00000001
+#define WLAN_GMBOX0_DMA_TX_CONTROL_STOP_GET(x)   (((x) & WLAN_GMBOX0_DMA_TX_CONTROL_STOP_MASK) >> WLAN_GMBOX0_DMA_TX_CONTROL_STOP_LSB)
+#define WLAN_GMBOX0_DMA_TX_CONTROL_STOP_SET(x)   (((x) << WLAN_GMBOX0_DMA_TX_CONTROL_STOP_LSB) & WLAN_GMBOX0_DMA_TX_CONTROL_STOP_MASK)
+
+#define WLAN_GMBOX_INT_STATUS_ADDRESS            0x00000124
+#define WLAN_GMBOX_INT_STATUS_OFFSET             0x00000124
+#define WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_MSB    6
+#define WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_LSB    6
+#define WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_MASK   0x00000040
+#define WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_GET(x) (((x) & WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_MASK) >> WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_LSB)
+#define WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_SET(x) (((x) << WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_LSB) & WLAN_GMBOX_INT_STATUS_TX_OVERFLOW_MASK)
+#define WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_MSB   5
+#define WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_LSB   5
+#define WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_MASK  0x00000020
+#define WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_GET(x) (((x) & WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_MASK) >> WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_LSB)
+#define WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_SET(x) (((x) << WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_LSB) & WLAN_GMBOX_INT_STATUS_RX_UNDERFLOW_MASK)
+#define WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_MSB 4
+#define WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_LSB 4
+#define WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_MASK 0x00000010
+#define WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_GET(x) (((x) & WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_MASK) >> WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_LSB)
+#define WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_SET(x) (((x) << WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_LSB) & WLAN_GMBOX_INT_STATUS_RX_DMA_COMPLETE_MASK)
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MSB 3
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB 3
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK 0x00000008
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_GET(x) (((x) & WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK) >> WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB)
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_SET(x) (((x) << WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_LSB) & WLAN_GMBOX_INT_STATUS_TX_DMA_EOM_COMPLETE_MASK)
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_MSB 2
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_LSB 2
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_MASK 0x00000004
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_GET(x) (((x) & WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_MASK) >> WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_LSB)
+#define WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_SET(x) (((x) << WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_LSB) & WLAN_GMBOX_INT_STATUS_TX_DMA_COMPLETE_MASK)
+#define WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_MSB   1
+#define WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_LSB   1
+#define WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_MASK  0x00000002
+#define WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_GET(x) (((x) & WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_MASK) >> WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_LSB)
+#define WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_SET(x) (((x) << WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_LSB) & WLAN_GMBOX_INT_STATUS_TX_NOT_EMPTY_MASK)
+#define WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_MSB    0
+#define WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_LSB    0
+#define WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_MASK   0x00000001
+#define WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_GET(x) (((x) & WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_MASK) >> WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_LSB)
+#define WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_SET(x) (((x) << WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_LSB) & WLAN_GMBOX_INT_STATUS_RX_NOT_FULL_MASK)
+
+#define WLAN_GMBOX_INT_ENABLE_ADDRESS            0x00000128
+#define WLAN_GMBOX_INT_ENABLE_OFFSET             0x00000128
+#define WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_MSB    6
+#define WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_LSB    6
+#define WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_MASK   0x00000040
+#define WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_GET(x) (((x) & WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_MASK) >> WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_LSB)
+#define WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_SET(x) (((x) << WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_LSB) & WLAN_GMBOX_INT_ENABLE_TX_OVERFLOW_MASK)
+#define WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_MSB   5
+#define WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_LSB   5
+#define WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_MASK  0x00000020
+#define WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_GET(x) (((x) & WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_MASK) >> WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_LSB)
+#define WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_SET(x) (((x) << WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_LSB) & WLAN_GMBOX_INT_ENABLE_RX_UNDERFLOW_MASK)
+#define WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_MSB 4
+#define WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB 4
+#define WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK 0x00000010
+#define WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_GET(x) (((x) & WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK) >> WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB)
+#define WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_SET(x) (((x) << WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_LSB) & WLAN_GMBOX_INT_ENABLE_RX_DMA_COMPLETE_MASK)
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MSB 3
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB 3
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK 0x00000008
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_GET(x) (((x) & WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK) >> WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB)
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_SET(x) (((x) << WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_LSB) & WLAN_GMBOX_INT_ENABLE_TX_DMA_EOM_COMPLETE_MASK)
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_MSB 2
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB 2
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK 0x00000004
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_GET(x) (((x) & WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK) >> WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB)
+#define WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_SET(x) (((x) << WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_LSB) & WLAN_GMBOX_INT_ENABLE_TX_DMA_COMPLETE_MASK)
+#define WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_MSB   1
+#define WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_LSB   1
+#define WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_MASK  0x00000002
+#define WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_GET(x) (((x) & WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_MASK) >> WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_LSB)
+#define WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_SET(x) (((x) << WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_LSB) & WLAN_GMBOX_INT_ENABLE_TX_NOT_EMPTY_MASK)
+#define WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_MSB    0
+#define WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_LSB    0
+#define WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_MASK   0x00000001
+#define WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_GET(x) (((x) & WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_MASK) >> WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_LSB)
+#define WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_SET(x) (((x) << WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_LSB) & WLAN_GMBOX_INT_ENABLE_RX_NOT_FULL_MASK)
+
+#define WLAN_HOST_IF_WINDOW_ADDRESS              0x00002000
+#define WLAN_HOST_IF_WINDOW_OFFSET               0x00002000
+#define WLAN_HOST_IF_WINDOW_DATA_MSB             7
+#define WLAN_HOST_IF_WINDOW_DATA_LSB             0
+#define WLAN_HOST_IF_WINDOW_DATA_MASK            0x000000ff
+#define WLAN_HOST_IF_WINDOW_DATA_GET(x)          (((x) & WLAN_HOST_IF_WINDOW_DATA_MASK) >> WLAN_HOST_IF_WINDOW_DATA_LSB)
+#define WLAN_HOST_IF_WINDOW_DATA_SET(x)          (((x) << WLAN_HOST_IF_WINDOW_DATA_LSB) & WLAN_HOST_IF_WINDOW_DATA_MASK)
+
+#endif /* _MBOX_WLAN_REG_H_ */
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_reg.h
new file mode 100644
index 00000000000..fcafec88a6b
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_reg.h
@@ -0,0 +1,187 @@
+// ------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// ------------------------------------------------------------------
+//===================================================================
+// Author(s): ="Atheros"
+//===================================================================
+
+
+#include "rtc_wlan_reg.h"
+
+#ifndef BT_HEADERS
+
+#define RESET_CONTROL_ADDRESS WLAN_RESET_CONTROL_ADDRESS
+#define RESET_CONTROL_OFFSET WLAN_RESET_CONTROL_OFFSET
+#define RESET_CONTROL_DEBUG_UART_RST_MSB WLAN_RESET_CONTROL_DEBUG_UART_RST_MSB
+#define RESET_CONTROL_DEBUG_UART_RST_LSB WLAN_RESET_CONTROL_DEBUG_UART_RST_LSB
+#define RESET_CONTROL_DEBUG_UART_RST_MASK WLAN_RESET_CONTROL_DEBUG_UART_RST_MASK
+#define RESET_CONTROL_DEBUG_UART_RST_GET(x) WLAN_RESET_CONTROL_DEBUG_UART_RST_GET(x)
+#define RESET_CONTROL_DEBUG_UART_RST_SET(x) WLAN_RESET_CONTROL_DEBUG_UART_RST_SET(x)
+#define RESET_CONTROL_BB_COLD_RST_MSB WLAN_RESET_CONTROL_BB_COLD_RST_MSB
+#define RESET_CONTROL_BB_COLD_RST_LSB WLAN_RESET_CONTROL_BB_COLD_RST_LSB
+#define RESET_CONTROL_BB_COLD_RST_MASK WLAN_RESET_CONTROL_BB_COLD_RST_MASK
+#define RESET_CONTROL_BB_COLD_RST_GET(x) WLAN_RESET_CONTROL_BB_COLD_RST_GET(x)
+#define RESET_CONTROL_BB_COLD_RST_SET(x) WLAN_RESET_CONTROL_BB_COLD_RST_SET(x)
+#define RESET_CONTROL_BB_WARM_RST_MSB WLAN_RESET_CONTROL_BB_WARM_RST_MSB
+#define RESET_CONTROL_BB_WARM_RST_LSB WLAN_RESET_CONTROL_BB_WARM_RST_LSB
+#define RESET_CONTROL_BB_WARM_RST_MASK WLAN_RESET_CONTROL_BB_WARM_RST_MASK
+#define RESET_CONTROL_BB_WARM_RST_GET(x) WLAN_RESET_CONTROL_BB_WARM_RST_GET(x)
+#define RESET_CONTROL_BB_WARM_RST_SET(x) WLAN_RESET_CONTROL_BB_WARM_RST_SET(x)
+#define RESET_CONTROL_CPU_INIT_RESET_MSB WLAN_RESET_CONTROL_CPU_INIT_RESET_MSB
+#define RESET_CONTROL_CPU_INIT_RESET_LSB WLAN_RESET_CONTROL_CPU_INIT_RESET_LSB
+#define RESET_CONTROL_CPU_INIT_RESET_MASK WLAN_RESET_CONTROL_CPU_INIT_RESET_MASK
+#define RESET_CONTROL_CPU_INIT_RESET_GET(x) WLAN_RESET_CONTROL_CPU_INIT_RESET_GET(x)
+#define RESET_CONTROL_CPU_INIT_RESET_SET(x) WLAN_RESET_CONTROL_CPU_INIT_RESET_SET(x)
+#define RESET_CONTROL_VMC_REMAP_RESET_MSB WLAN_RESET_CONTROL_VMC_REMAP_RESET_MSB
+#define RESET_CONTROL_VMC_REMAP_RESET_LSB WLAN_RESET_CONTROL_VMC_REMAP_RESET_LSB
+#define RESET_CONTROL_VMC_REMAP_RESET_MASK WLAN_RESET_CONTROL_VMC_REMAP_RESET_MASK
+#define RESET_CONTROL_VMC_REMAP_RESET_GET(x) WLAN_RESET_CONTROL_VMC_REMAP_RESET_GET(x)
+#define RESET_CONTROL_VMC_REMAP_RESET_SET(x) WLAN_RESET_CONTROL_VMC_REMAP_RESET_SET(x)
+#define RESET_CONTROL_RST_OUT_MSB WLAN_RESET_CONTROL_RST_OUT_MSB
+#define RESET_CONTROL_RST_OUT_LSB WLAN_RESET_CONTROL_RST_OUT_LSB
+#define RESET_CONTROL_RST_OUT_MASK WLAN_RESET_CONTROL_RST_OUT_MASK
+#define RESET_CONTROL_RST_OUT_GET(x) WLAN_RESET_CONTROL_RST_OUT_GET(x)
+#define RESET_CONTROL_RST_OUT_SET(x) WLAN_RESET_CONTROL_RST_OUT_SET(x)
+#define RESET_CONTROL_COLD_RST_MSB WLAN_RESET_CONTROL_COLD_RST_MSB
+#define RESET_CONTROL_COLD_RST_LSB WLAN_RESET_CONTROL_COLD_RST_LSB
+#define RESET_CONTROL_COLD_RST_MASK WLAN_RESET_CONTROL_COLD_RST_MASK
+#define RESET_CONTROL_COLD_RST_GET(x) WLAN_RESET_CONTROL_COLD_RST_GET(x)
+#define RESET_CONTROL_COLD_RST_SET(x) WLAN_RESET_CONTROL_COLD_RST_SET(x)
+#define RESET_CONTROL_WARM_RST_MSB WLAN_RESET_CONTROL_WARM_RST_MSB
+#define RESET_CONTROL_WARM_RST_LSB WLAN_RESET_CONTROL_WARM_RST_LSB
+#define RESET_CONTROL_WARM_RST_MASK WLAN_RESET_CONTROL_WARM_RST_MASK
+#define RESET_CONTROL_WARM_RST_GET(x) WLAN_RESET_CONTROL_WARM_RST_GET(x)
+#define RESET_CONTROL_WARM_RST_SET(x) WLAN_RESET_CONTROL_WARM_RST_SET(x)
+#define RESET_CONTROL_CPU_WARM_RST_MSB WLAN_RESET_CONTROL_CPU_WARM_RST_MSB
+#define RESET_CONTROL_CPU_WARM_RST_LSB WLAN_RESET_CONTROL_CPU_WARM_RST_LSB
+#define RESET_CONTROL_CPU_WARM_RST_MASK WLAN_RESET_CONTROL_CPU_WARM_RST_MASK
+#define RESET_CONTROL_CPU_WARM_RST_GET(x) WLAN_RESET_CONTROL_CPU_WARM_RST_GET(x)
+#define RESET_CONTROL_CPU_WARM_RST_SET(x) WLAN_RESET_CONTROL_CPU_WARM_RST_SET(x)
+#define RESET_CONTROL_MAC_COLD_RST_MSB WLAN_RESET_CONTROL_MAC_COLD_RST_MSB
+#define RESET_CONTROL_MAC_COLD_RST_LSB WLAN_RESET_CONTROL_MAC_COLD_RST_LSB
+#define RESET_CONTROL_MAC_COLD_RST_MASK WLAN_RESET_CONTROL_MAC_COLD_RST_MASK
+#define RESET_CONTROL_MAC_COLD_RST_GET(x) WLAN_RESET_CONTROL_MAC_COLD_RST_GET(x)
+#define RESET_CONTROL_MAC_COLD_RST_SET(x) WLAN_RESET_CONTROL_MAC_COLD_RST_SET(x)
+#define RESET_CONTROL_MAC_WARM_RST_MSB WLAN_RESET_CONTROL_MAC_WARM_RST_MSB
+#define RESET_CONTROL_MAC_WARM_RST_LSB WLAN_RESET_CONTROL_MAC_WARM_RST_LSB
+#define RESET_CONTROL_MAC_WARM_RST_MASK WLAN_RESET_CONTROL_MAC_WARM_RST_MASK
+#define RESET_CONTROL_MAC_WARM_RST_GET(x) WLAN_RESET_CONTROL_MAC_WARM_RST_GET(x)
+#define RESET_CONTROL_MAC_WARM_RST_SET(x) WLAN_RESET_CONTROL_MAC_WARM_RST_SET(x)
+#define RESET_CONTROL_MBOX_RST_MSB WLAN_RESET_CONTROL_MBOX_RST_MSB
+#define RESET_CONTROL_MBOX_RST_LSB WLAN_RESET_CONTROL_MBOX_RST_LSB
+#define RESET_CONTROL_MBOX_RST_MASK WLAN_RESET_CONTROL_MBOX_RST_MASK
+#define RESET_CONTROL_MBOX_RST_GET(x) WLAN_RESET_CONTROL_MBOX_RST_GET(x)
+#define RESET_CONTROL_MBOX_RST_SET(x) WLAN_RESET_CONTROL_MBOX_RST_SET(x)
+#define RESET_CONTROL_UART_RST_MSB WLAN_RESET_CONTROL_UART_RST_MSB
+#define RESET_CONTROL_UART_RST_LSB WLAN_RESET_CONTROL_UART_RST_LSB
+#define RESET_CONTROL_UART_RST_MASK WLAN_RESET_CONTROL_UART_RST_MASK
+#define RESET_CONTROL_UART_RST_GET(x) WLAN_RESET_CONTROL_UART_RST_GET(x)
+#define RESET_CONTROL_UART_RST_SET(x) WLAN_RESET_CONTROL_UART_RST_SET(x)
+#define RESET_CONTROL_SI0_RST_MSB WLAN_RESET_CONTROL_SI0_RST_MSB
+#define RESET_CONTROL_SI0_RST_LSB WLAN_RESET_CONTROL_SI0_RST_LSB
+#define RESET_CONTROL_SI0_RST_MASK WLAN_RESET_CONTROL_SI0_RST_MASK
+#define RESET_CONTROL_SI0_RST_GET(x) WLAN_RESET_CONTROL_SI0_RST_GET(x)
+#define RESET_CONTROL_SI0_RST_SET(x) WLAN_RESET_CONTROL_SI0_RST_SET(x)
+#define CPU_CLOCK_ADDRESS WLAN_CPU_CLOCK_ADDRESS
+#define CPU_CLOCK_OFFSET WLAN_CPU_CLOCK_OFFSET
+#define CPU_CLOCK_STANDARD_MSB WLAN_CPU_CLOCK_STANDARD_MSB
+#define CPU_CLOCK_STANDARD_LSB WLAN_CPU_CLOCK_STANDARD_LSB
+#define CPU_CLOCK_STANDARD_MASK WLAN_CPU_CLOCK_STANDARD_MASK
+#define CPU_CLOCK_STANDARD_GET(x) WLAN_CPU_CLOCK_STANDARD_GET(x)
+#define CPU_CLOCK_STANDARD_SET(x) WLAN_CPU_CLOCK_STANDARD_SET(x)
+#define CLOCK_OUT_ADDRESS WLAN_CLOCK_OUT_ADDRESS
+#define CLOCK_OUT_OFFSET WLAN_CLOCK_OUT_OFFSET
+#define CLOCK_OUT_SELECT_MSB WLAN_CLOCK_OUT_SELECT_MSB
+#define CLOCK_OUT_SELECT_LSB WLAN_CLOCK_OUT_SELECT_LSB
+#define CLOCK_OUT_SELECT_MASK WLAN_CLOCK_OUT_SELECT_MASK
+#define CLOCK_OUT_SELECT_GET(x) WLAN_CLOCK_OUT_SELECT_GET(x)
+#define CLOCK_OUT_SELECT_SET(x) WLAN_CLOCK_OUT_SELECT_SET(x)
+#define CLOCK_CONTROL_ADDRESS WLAN_CLOCK_CONTROL_ADDRESS
+#define CLOCK_CONTROL_OFFSET WLAN_CLOCK_CONTROL_OFFSET
+#define CLOCK_CONTROL_LF_CLK32_MSB WLAN_CLOCK_CONTROL_LF_CLK32_MSB
+#define CLOCK_CONTROL_LF_CLK32_LSB WLAN_CLOCK_CONTROL_LF_CLK32_LSB
+#define CLOCK_CONTROL_LF_CLK32_MASK WLAN_CLOCK_CONTROL_LF_CLK32_MASK
+#define CLOCK_CONTROL_LF_CLK32_GET(x) WLAN_CLOCK_CONTROL_LF_CLK32_GET(x)
+#define CLOCK_CONTROL_LF_CLK32_SET(x) WLAN_CLOCK_CONTROL_LF_CLK32_SET(x)
+#define CLOCK_CONTROL_SI0_CLK_MSB WLAN_CLOCK_CONTROL_SI0_CLK_MSB
+#define CLOCK_CONTROL_SI0_CLK_LSB WLAN_CLOCK_CONTROL_SI0_CLK_LSB
+#define CLOCK_CONTROL_SI0_CLK_MASK WLAN_CLOCK_CONTROL_SI0_CLK_MASK
+#define CLOCK_CONTROL_SI0_CLK_GET(x) WLAN_CLOCK_CONTROL_SI0_CLK_GET(x)
+#define CLOCK_CONTROL_SI0_CLK_SET(x) WLAN_CLOCK_CONTROL_SI0_CLK_SET(x)
+#define RESET_CAUSE_ADDRESS WLAN_RESET_CAUSE_ADDRESS
+#define RESET_CAUSE_OFFSET WLAN_RESET_CAUSE_OFFSET
+#define RESET_CAUSE_LAST_MSB WLAN_RESET_CAUSE_LAST_MSB
+#define RESET_CAUSE_LAST_LSB WLAN_RESET_CAUSE_LAST_LSB
+#define RESET_CAUSE_LAST_MASK WLAN_RESET_CAUSE_LAST_MASK
+#define RESET_CAUSE_LAST_GET(x) WLAN_RESET_CAUSE_LAST_GET(x)
+#define RESET_CAUSE_LAST_SET(x) WLAN_RESET_CAUSE_LAST_SET(x)
+#define SYSTEM_SLEEP_ADDRESS WLAN_SYSTEM_SLEEP_ADDRESS
+#define SYSTEM_SLEEP_OFFSET WLAN_SYSTEM_SLEEP_OFFSET
+#define SYSTEM_SLEEP_HOST_IF_MSB WLAN_SYSTEM_SLEEP_HOST_IF_MSB
+#define SYSTEM_SLEEP_HOST_IF_LSB WLAN_SYSTEM_SLEEP_HOST_IF_LSB
+#define SYSTEM_SLEEP_HOST_IF_MASK WLAN_SYSTEM_SLEEP_HOST_IF_MASK
+#define SYSTEM_SLEEP_HOST_IF_GET(x) WLAN_SYSTEM_SLEEP_HOST_IF_GET(x)
+#define SYSTEM_SLEEP_HOST_IF_SET(x) WLAN_SYSTEM_SLEEP_HOST_IF_SET(x)
+#define SYSTEM_SLEEP_MBOX_MSB WLAN_SYSTEM_SLEEP_MBOX_MSB
+#define SYSTEM_SLEEP_MBOX_LSB WLAN_SYSTEM_SLEEP_MBOX_LSB
+#define SYSTEM_SLEEP_MBOX_MASK WLAN_SYSTEM_SLEEP_MBOX_MASK
+#define SYSTEM_SLEEP_MBOX_GET(x) WLAN_SYSTEM_SLEEP_MBOX_GET(x)
+#define SYSTEM_SLEEP_MBOX_SET(x) WLAN_SYSTEM_SLEEP_MBOX_SET(x)
+#define SYSTEM_SLEEP_MAC_IF_MSB WLAN_SYSTEM_SLEEP_MAC_IF_MSB
+#define SYSTEM_SLEEP_MAC_IF_LSB WLAN_SYSTEM_SLEEP_MAC_IF_LSB
+#define SYSTEM_SLEEP_MAC_IF_MASK WLAN_SYSTEM_SLEEP_MAC_IF_MASK
+#define SYSTEM_SLEEP_MAC_IF_GET(x) WLAN_SYSTEM_SLEEP_MAC_IF_GET(x)
+#define SYSTEM_SLEEP_MAC_IF_SET(x) WLAN_SYSTEM_SLEEP_MAC_IF_SET(x)
+#define SYSTEM_SLEEP_LIGHT_MSB WLAN_SYSTEM_SLEEP_LIGHT_MSB
+#define SYSTEM_SLEEP_LIGHT_LSB WLAN_SYSTEM_SLEEP_LIGHT_LSB
+#define SYSTEM_SLEEP_LIGHT_MASK WLAN_SYSTEM_SLEEP_LIGHT_MASK
+#define SYSTEM_SLEEP_LIGHT_GET(x) WLAN_SYSTEM_SLEEP_LIGHT_GET(x)
+#define SYSTEM_SLEEP_LIGHT_SET(x) WLAN_SYSTEM_SLEEP_LIGHT_SET(x)
+#define SYSTEM_SLEEP_DISABLE_MSB WLAN_SYSTEM_SLEEP_DISABLE_MSB
+#define SYSTEM_SLEEP_DISABLE_LSB WLAN_SYSTEM_SLEEP_DISABLE_LSB
+#define SYSTEM_SLEEP_DISABLE_MASK WLAN_SYSTEM_SLEEP_DISABLE_MASK
+#define SYSTEM_SLEEP_DISABLE_GET(x) WLAN_SYSTEM_SLEEP_DISABLE_GET(x)
+#define SYSTEM_SLEEP_DISABLE_SET(x) WLAN_SYSTEM_SLEEP_DISABLE_SET(x)
+#define LPO_INIT_DIVIDEND_INT_ADDRESS WLAN_LPO_INIT_DIVIDEND_INT_ADDRESS
+#define LPO_INIT_DIVIDEND_INT_OFFSET WLAN_LPO_INIT_DIVIDEND_INT_OFFSET
+#define LPO_INIT_DIVIDEND_INT_VALUE_MSB WLAN_LPO_INIT_DIVIDEND_INT_VALUE_MSB
+#define LPO_INIT_DIVIDEND_INT_VALUE_LSB WLAN_LPO_INIT_DIVIDEND_INT_VALUE_LSB
+#define LPO_INIT_DIVIDEND_INT_VALUE_MASK WLAN_LPO_INIT_DIVIDEND_INT_VALUE_MASK
+#define LPO_INIT_DIVIDEND_INT_VALUE_GET(x) WLAN_LPO_INIT_DIVIDEND_INT_VALUE_GET(x)
+#define LPO_INIT_DIVIDEND_INT_VALUE_SET(x) WLAN_LPO_INIT_DIVIDEND_INT_VALUE_SET(x)
+#define LPO_INIT_DIVIDEND_FRACTION_ADDRESS WLAN_LPO_INIT_DIVIDEND_FRACTION_ADDRESS
+#define LPO_INIT_DIVIDEND_FRACTION_OFFSET WLAN_LPO_INIT_DIVIDEND_FRACTION_OFFSET
+#define LPO_INIT_DIVIDEND_FRACTION_VALUE_MSB WLAN_LPO_INIT_DIVIDEND_FRACTION_VALUE_MSB
+#define LPO_INIT_DIVIDEND_FRACTION_VALUE_LSB WLAN_LPO_INIT_DIVIDEND_FRACTION_VALUE_LSB
+#define LPO_INIT_DIVIDEND_FRACTION_VALUE_MASK WLAN_LPO_INIT_DIVIDEND_FRACTION_VALUE_MASK
+#define LPO_INIT_DIVIDEND_FRACTION_VALUE_GET(x) WLAN_LPO_INIT_DIVIDEND_FRACTION_VALUE_GET(x)
+#define LPO_INIT_DIVIDEND_FRACTION_VALUE_SET(x) WLAN_LPO_INIT_DIVIDEND_FRACTION_VALUE_SET(x)
+#define LPO_CAL_ADDRESS WLAN_LPO_CAL_ADDRESS
+#define LPO_CAL_OFFSET WLAN_LPO_CAL_OFFSET
+#define LPO_CAL_ENABLE_MSB WLAN_LPO_CAL_ENABLE_MSB
+#define LPO_CAL_ENABLE_LSB WLAN_LPO_CAL_ENABLE_LSB
+#define LPO_CAL_ENABLE_MASK WLAN_LPO_CAL_ENABLE_MASK
+#define LPO_CAL_ENABLE_GET(x) WLAN_LPO_CAL_ENABLE_GET(x)
+#define LPO_CAL_ENABLE_SET(x) WLAN_LPO_CAL_ENABLE_SET(x)
+#define LPO_CAL_COUNT_MSB WLAN_LPO_CAL_COUNT_MSB
+#define LPO_CAL_COUNT_LSB WLAN_LPO_CAL_COUNT_LSB
+#define LPO_CAL_COUNT_MASK WLAN_LPO_CAL_COUNT_MASK
+#define LPO_CAL_COUNT_GET(x) WLAN_LPO_CAL_COUNT_GET(x)
+#define LPO_CAL_COUNT_SET(x) WLAN_LPO_CAL_COUNT_SET(x)
+
+#endif
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_wlan_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_wlan_reg.h
new file mode 100644
index 00000000000..5c048ff51b0
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/rtc_wlan_reg.h
@@ -0,0 +1,162 @@
+// ------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// ------------------------------------------------------------------
+//===================================================================
+// Author(s): ="Atheros"
+//===================================================================
+
+
+#ifndef _RTC_WLAN_REG_REG_H_
+#define _RTC_WLAN_REG_REG_H_
+
+#define WLAN_RESET_CONTROL_ADDRESS               0x00000000
+#define WLAN_RESET_CONTROL_OFFSET                0x00000000
+#define WLAN_RESET_CONTROL_DEBUG_UART_RST_MSB    14
+#define WLAN_RESET_CONTROL_DEBUG_UART_RST_LSB    14
+#define WLAN_RESET_CONTROL_DEBUG_UART_RST_MASK   0x00004000
+#define WLAN_RESET_CONTROL_DEBUG_UART_RST_GET(x) (((x) & WLAN_RESET_CONTROL_DEBUG_UART_RST_MASK) >> WLAN_RESET_CONTROL_DEBUG_UART_RST_LSB)
+#define WLAN_RESET_CONTROL_DEBUG_UART_RST_SET(x) (((x) << WLAN_RESET_CONTROL_DEBUG_UART_RST_LSB) & WLAN_RESET_CONTROL_DEBUG_UART_RST_MASK)
+#define WLAN_RESET_CONTROL_BB_COLD_RST_MSB       13
+#define WLAN_RESET_CONTROL_BB_COLD_RST_LSB       13
+#define WLAN_RESET_CONTROL_BB_COLD_RST_MASK      0x00002000
+#define WLAN_RESET_CONTROL_BB_COLD_RST_GET(x)    (((x) & WLAN_RESET_CONTROL_BB_COLD_RST_MASK) >> WLAN_RESET_CONTROL_BB_COLD_RST_LSB)
+#define WLAN_RESET_CONTROL_BB_COLD_RST_SET(x)    (((x) << WLAN_RESET_CONTROL_BB_COLD_RST_LSB) & WLAN_RESET_CONTROL_BB_COLD_RST_MASK)
+#define WLAN_RESET_CONTROL_BB_WARM_RST_MSB       12
+#define WLAN_RESET_CONTROL_BB_WARM_RST_LSB       12
+#define WLAN_RESET_CONTROL_BB_WARM_RST_MASK      0x00001000
+#define WLAN_RESET_CONTROL_BB_WARM_RST_GET(x)    (((x) & WLAN_RESET_CONTROL_BB_WARM_RST_MASK) >> WLAN_RESET_CONTROL_BB_WARM_RST_LSB)
+#define WLAN_RESET_CONTROL_BB_WARM_RST_SET(x)    (((x) << WLAN_RESET_CONTROL_BB_WARM_RST_LSB) & WLAN_RESET_CONTROL_BB_WARM_RST_MASK)
+#define WLAN_RESET_CONTROL_CPU_INIT_RESET_MSB    11
+#define WLAN_RESET_CONTROL_CPU_INIT_RESET_LSB    11
+#define WLAN_RESET_CONTROL_CPU_INIT_RESET_MASK   0x00000800
+#define WLAN_RESET_CONTROL_CPU_INIT_RESET_GET(x) (((x) & WLAN_RESET_CONTROL_CPU_INIT_RESET_MASK) >> WLAN_RESET_CONTROL_CPU_INIT_RESET_LSB)
+#define WLAN_RESET_CONTROL_CPU_INIT_RESET_SET(x) (((x) << WLAN_RESET_CONTROL_CPU_INIT_RESET_LSB) & WLAN_RESET_CONTROL_CPU_INIT_RESET_MASK)
+#define WLAN_RESET_CONTROL_VMC_REMAP_RESET_MSB   10
+#define WLAN_RESET_CONTROL_VMC_REMAP_RESET_LSB   10
+#define WLAN_RESET_CONTROL_VMC_REMAP_RESET_MASK  0x00000400
+#define WLAN_RESET_CONTROL_VMC_REMAP_RESET_GET(x) (((x) & WLAN_RESET_CONTROL_VMC_REMAP_RESET_MASK) >> WLAN_RESET_CONTROL_VMC_REMAP_RESET_LSB)
+#define WLAN_RESET_CONTROL_VMC_REMAP_RESET_SET(x) (((x) << WLAN_RESET_CONTROL_VMC_REMAP_RESET_LSB) & WLAN_RESET_CONTROL_VMC_REMAP_RESET_MASK)
+#define WLAN_RESET_CONTROL_RST_OUT_MSB           9
+#define WLAN_RESET_CONTROL_RST_OUT_LSB           9
+#define WLAN_RESET_CONTROL_RST_OUT_MASK          0x00000200
+#define WLAN_RESET_CONTROL_RST_OUT_GET(x)        (((x) & WLAN_RESET_CONTROL_RST_OUT_MASK) >> WLAN_RESET_CONTROL_RST_OUT_LSB)
+#define WLAN_RESET_CONTROL_RST_OUT_SET(x)        (((x) << WLAN_RESET_CONTROL_RST_OUT_LSB) & WLAN_RESET_CONTROL_RST_OUT_MASK)
+#define WLAN_RESET_CONTROL_COLD_RST_MSB          8
+#define WLAN_RESET_CONTROL_COLD_RST_LSB          8
+#define WLAN_RESET_CONTROL_COLD_RST_MASK         0x00000100
+#define WLAN_RESET_CONTROL_COLD_RST_GET(x)       (((x) & WLAN_RESET_CONTROL_COLD_RST_MASK) >> WLAN_RESET_CONTROL_COLD_RST_LSB)
+#define WLAN_RESET_CONTROL_COLD_RST_SET(x)       (((x) << WLAN_RESET_CONTROL_COLD_RST_LSB) & WLAN_RESET_CONTROL_COLD_RST_MASK)
+#define WLAN_RESET_CONTROL_WARM_RST_MSB          7
+#define WLAN_RESET_CONTROL_WARM_RST_LSB          7
+#define WLAN_RESET_CONTROL_WARM_RST_MASK         0x00000080
+#define WLAN_RESET_CONTROL_WARM_RST_GET(x)       (((x) & WLAN_RESET_CONTROL_WARM_RST_MASK) >> WLAN_RESET_CONTROL_WARM_RST_LSB)
+#define WLAN_RESET_CONTROL_WARM_RST_SET(x)       (((x) << WLAN_RESET_CONTROL_WARM_RST_LSB) & WLAN_RESET_CONTROL_WARM_RST_MASK)
+#define WLAN_RESET_CONTROL_CPU_WARM_RST_MSB      6
+#define WLAN_RESET_CONTROL_CPU_WARM_RST_LSB      6
+#define WLAN_RESET_CONTROL_CPU_WARM_RST_MASK     0x00000040
+#define WLAN_RESET_CONTROL_CPU_WARM_RST_GET(x)   (((x) & WLAN_RESET_CONTROL_CPU_WARM_RST_MASK) >> WLAN_RESET_CONTROL_CPU_WARM_RST_LSB)
+#define WLAN_RESET_CONTROL_CPU_WARM_RST_SET(x)   (((x) << WLAN_RESET_CONTROL_CPU_WARM_RST_LSB) & WLAN_RESET_CONTROL_CPU_WARM_RST_MASK)
+#define WLAN_RESET_CONTROL_MAC_COLD_RST_MSB      5
+#define WLAN_RESET_CONTROL_MAC_COLD_RST_LSB      5
+#define WLAN_RESET_CONTROL_MAC_COLD_RST_MASK     0x00000020
+#define WLAN_RESET_CONTROL_MAC_COLD_RST_GET(x)   (((x) & WLAN_RESET_CONTROL_MAC_COLD_RST_MASK) >> WLAN_RESET_CONTROL_MAC_COLD_RST_LSB)
+#define WLAN_RESET_CONTROL_MAC_COLD_RST_SET(x)   (((x) << WLAN_RESET_CONTROL_MAC_COLD_RST_LSB) & WLAN_RESET_CONTROL_MAC_COLD_RST_MASK)
+#define WLAN_RESET_CONTROL_MAC_WARM_RST_MSB      4
+#define WLAN_RESET_CONTROL_MAC_WARM_RST_LSB      4
+#define WLAN_RESET_CONTROL_MAC_WARM_RST_MASK     0x00000010
+#define WLAN_RESET_CONTROL_MAC_WARM_RST_GET(x)   (((x) & WLAN_RESET_CONTROL_MAC_WARM_RST_MASK) >> WLAN_RESET_CONTROL_MAC_WARM_RST_LSB)
+#define WLAN_RESET_CONTROL_MAC_WARM_RST_SET(x)   (((x) << WLAN_RESET_CONTROL_MAC_WARM_RST_LSB) & WLAN_RESET_CONTROL_MAC_WARM_RST_MASK)
+#define WLAN_RESET_CONTROL_MBOX_RST_MSB          2
+#define WLAN_RESET_CONTROL_MBOX_RST_LSB          2
+#define WLAN_RESET_CONTROL_MBOX_RST_MASK         0x00000004
+#define WLAN_RESET_CONTROL_MBOX_RST_GET(x)       (((x) & WLAN_RESET_CONTROL_MBOX_RST_MASK) >> WLAN_RESET_CONTROL_MBOX_RST_LSB)
+#define WLAN_RESET_CONTROL_MBOX_RST_SET(x)       (((x) << WLAN_RESET_CONTROL_MBOX_RST_LSB) & WLAN_RESET_CONTROL_MBOX_RST_MASK)
+#define WLAN_RESET_CONTROL_UART_RST_MSB          1
+#define WLAN_RESET_CONTROL_UART_RST_LSB          1
+#define WLAN_RESET_CONTROL_UART_RST_MASK         0x00000002
+#define WLAN_RESET_CONTROL_UART_RST_GET(x)       (((x) & WLAN_RESET_CONTROL_UART_RST_MASK) >> WLAN_RESET_CONTROL_UART_RST_LSB)
+#define WLAN_RESET_CONTROL_UART_RST_SET(x)       (((x) << WLAN_RESET_CONTROL_UART_RST_LSB) & WLAN_RESET_CONTROL_UART_RST_MASK)
+#define WLAN_RESET_CONTROL_SI0_RST_MSB           0
+#define WLAN_RESET_CONTROL_SI0_RST_LSB           0
+#define WLAN_RESET_CONTROL_SI0_RST_MASK          0x00000001
+#define WLAN_RESET_CONTROL_SI0_RST_GET(x)        (((x) & WLAN_RESET_CONTROL_SI0_RST_MASK) >> WLAN_RESET_CONTROL_SI0_RST_LSB)
+#define WLAN_RESET_CONTROL_SI0_RST_SET(x)        (((x) << WLAN_RESET_CONTROL_SI0_RST_LSB) & WLAN_RESET_CONTROL_SI0_RST_MASK)
+
+#define WLAN_CPU_CLOCK_ADDRESS                   0x00000020
+#define WLAN_CPU_CLOCK_OFFSET                    0x00000020
+#define WLAN_CPU_CLOCK_STANDARD_MSB              1
+#define WLAN_CPU_CLOCK_STANDARD_LSB              0
+#define WLAN_CPU_CLOCK_STANDARD_MASK             0x00000003
+#define WLAN_CPU_CLOCK_STANDARD_GET(x)           (((x) & WLAN_CPU_CLOCK_STANDARD_MASK) >> WLAN_CPU_CLOCK_STANDARD_LSB)
+#define WLAN_CPU_CLOCK_STANDARD_SET(x)           (((x) << WLAN_CPU_CLOCK_STANDARD_LSB) & WLAN_CPU_CLOCK_STANDARD_MASK)
+
+#define WLAN_CLOCK_CONTROL_ADDRESS               0x00000028
+#define WLAN_CLOCK_CONTROL_OFFSET                0x00000028
+#define WLAN_CLOCK_CONTROL_LF_CLK32_MSB          2
+#define WLAN_CLOCK_CONTROL_LF_CLK32_LSB          2
+#define WLAN_CLOCK_CONTROL_LF_CLK32_MASK         0x00000004
+#define WLAN_CLOCK_CONTROL_LF_CLK32_GET(x)       (((x) & WLAN_CLOCK_CONTROL_LF_CLK32_MASK) >> WLAN_CLOCK_CONTROL_LF_CLK32_LSB)
+#define WLAN_CLOCK_CONTROL_LF_CLK32_SET(x)       (((x) << WLAN_CLOCK_CONTROL_LF_CLK32_LSB) & WLAN_CLOCK_CONTROL_LF_CLK32_MASK)
+#define WLAN_CLOCK_CONTROL_SI0_CLK_MSB           0
+#define WLAN_CLOCK_CONTROL_SI0_CLK_LSB           0
+#define WLAN_CLOCK_CONTROL_SI0_CLK_MASK          0x00000001
+#define WLAN_CLOCK_CONTROL_SI0_CLK_GET(x)        (((x) & WLAN_CLOCK_CONTROL_SI0_CLK_MASK) >> WLAN_CLOCK_CONTROL_SI0_CLK_LSB)
+#define WLAN_CLOCK_CONTROL_SI0_CLK_SET(x)        (((x) << WLAN_CLOCK_CONTROL_SI0_CLK_LSB) & WLAN_CLOCK_CONTROL_SI0_CLK_MASK)
+
+#define WLAN_SYSTEM_SLEEP_ADDRESS                0x000000c4
+#define WLAN_SYSTEM_SLEEP_OFFSET                 0x000000c4
+#define WLAN_SYSTEM_SLEEP_HOST_IF_MSB            4
+#define WLAN_SYSTEM_SLEEP_HOST_IF_LSB            4
+#define WLAN_SYSTEM_SLEEP_HOST_IF_MASK           0x00000010
+#define WLAN_SYSTEM_SLEEP_HOST_IF_GET(x)         (((x) & WLAN_SYSTEM_SLEEP_HOST_IF_MASK) >> WLAN_SYSTEM_SLEEP_HOST_IF_LSB)
+#define WLAN_SYSTEM_SLEEP_HOST_IF_SET(x)         (((x) << WLAN_SYSTEM_SLEEP_HOST_IF_LSB) & WLAN_SYSTEM_SLEEP_HOST_IF_MASK)
+#define WLAN_SYSTEM_SLEEP_MBOX_MSB               3
+#define WLAN_SYSTEM_SLEEP_MBOX_LSB               3
+#define WLAN_SYSTEM_SLEEP_MBOX_MASK              0x00000008
+#define WLAN_SYSTEM_SLEEP_MBOX_GET(x)            (((x) & WLAN_SYSTEM_SLEEP_MBOX_MASK) >> WLAN_SYSTEM_SLEEP_MBOX_LSB)
+#define WLAN_SYSTEM_SLEEP_MBOX_SET(x)            (((x) << WLAN_SYSTEM_SLEEP_MBOX_LSB) & WLAN_SYSTEM_SLEEP_MBOX_MASK)
+#define WLAN_SYSTEM_SLEEP_MAC_IF_MSB             2
+#define WLAN_SYSTEM_SLEEP_MAC_IF_LSB             2
+#define WLAN_SYSTEM_SLEEP_MAC_IF_MASK            0x00000004
+#define WLAN_SYSTEM_SLEEP_MAC_IF_GET(x)          (((x) & WLAN_SYSTEM_SLEEP_MAC_IF_MASK) >> WLAN_SYSTEM_SLEEP_MAC_IF_LSB)
+#define WLAN_SYSTEM_SLEEP_MAC_IF_SET(x)          (((x) << WLAN_SYSTEM_SLEEP_MAC_IF_LSB) & WLAN_SYSTEM_SLEEP_MAC_IF_MASK)
+#define WLAN_SYSTEM_SLEEP_LIGHT_MSB              1
+#define WLAN_SYSTEM_SLEEP_LIGHT_LSB              1
+#define WLAN_SYSTEM_SLEEP_LIGHT_MASK             0x00000002
+#define WLAN_SYSTEM_SLEEP_LIGHT_GET(x)           (((x) & WLAN_SYSTEM_SLEEP_LIGHT_MASK) >> WLAN_SYSTEM_SLEEP_LIGHT_LSB)
+#define WLAN_SYSTEM_SLEEP_LIGHT_SET(x)           (((x) << WLAN_SYSTEM_SLEEP_LIGHT_LSB) & WLAN_SYSTEM_SLEEP_LIGHT_MASK)
+#define WLAN_SYSTEM_SLEEP_DISABLE_MSB            0
+#define WLAN_SYSTEM_SLEEP_DISABLE_LSB            0
+#define WLAN_SYSTEM_SLEEP_DISABLE_MASK           0x00000001
+#define WLAN_SYSTEM_SLEEP_DISABLE_GET(x)         (((x) & WLAN_SYSTEM_SLEEP_DISABLE_MASK) >> WLAN_SYSTEM_SLEEP_DISABLE_LSB)
+#define WLAN_SYSTEM_SLEEP_DISABLE_SET(x)         (((x) << WLAN_SYSTEM_SLEEP_DISABLE_LSB) & WLAN_SYSTEM_SLEEP_DISABLE_MASK)
+
+#define WLAN_LPO_CAL_ADDRESS                     0x000000e0
+#define WLAN_LPO_CAL_OFFSET                      0x000000e0
+#define WLAN_LPO_CAL_ENABLE_MSB                  20
+#define WLAN_LPO_CAL_ENABLE_LSB                  20
+#define WLAN_LPO_CAL_ENABLE_MASK                 0x00100000
+#define WLAN_LPO_CAL_ENABLE_GET(x)               (((x) & WLAN_LPO_CAL_ENABLE_MASK) >> WLAN_LPO_CAL_ENABLE_LSB)
+#define WLAN_LPO_CAL_ENABLE_SET(x)               (((x) << WLAN_LPO_CAL_ENABLE_LSB) & WLAN_LPO_CAL_ENABLE_MASK)
+#define WLAN_LPO_CAL_COUNT_MSB                   19
+#define WLAN_LPO_CAL_COUNT_LSB                   0
+#define WLAN_LPO_CAL_COUNT_MASK                  0x000fffff
+#define WLAN_LPO_CAL_COUNT_GET(x)                (((x) & WLAN_LPO_CAL_COUNT_MASK) >> WLAN_LPO_CAL_COUNT_LSB)
+#define WLAN_LPO_CAL_COUNT_SET(x)                (((x) << WLAN_LPO_CAL_COUNT_LSB) & WLAN_LPO_CAL_COUNT_MASK)
+
+#endif /* _RTC_WLAN_REG_H_ */
diff --git a/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/uart_reg.h b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/uart_reg.h
new file mode 100644
index 00000000000..302b20bc1ba
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/AR6002/hw4.0/hw/uart_reg.h
@@ -0,0 +1,40 @@
+// ------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// ------------------------------------------------------------------
+//===================================================================
+// Author(s): ="Atheros"
+//===================================================================
+
+
+#ifndef _UART_REG_REG_H_
+#define _UART_REG_REG_H_
+
+#define UART_CLKDIV_ADDRESS                      0x00000008
+#define UART_CLKDIV_OFFSET                       0x00000008
+#define UART_CLKDIV_CLK_SCALE_MSB                23
+#define UART_CLKDIV_CLK_SCALE_LSB                16
+#define UART_CLKDIV_CLK_SCALE_MASK               0x00ff0000
+#define UART_CLKDIV_CLK_SCALE_GET(x)             (((x) & UART_CLKDIV_CLK_SCALE_MASK) >> UART_CLKDIV_CLK_SCALE_LSB)
+#define UART_CLKDIV_CLK_SCALE_SET(x)             (((x) << UART_CLKDIV_CLK_SCALE_LSB) & UART_CLKDIV_CLK_SCALE_MASK)
+#define UART_CLKDIV_CLK_STEP_MSB                 15
+#define UART_CLKDIV_CLK_STEP_LSB                 0
+#define UART_CLKDIV_CLK_STEP_MASK                0x0000ffff
+#define UART_CLKDIV_CLK_STEP_GET(x)              (((x) & UART_CLKDIV_CLK_STEP_MASK) >> UART_CLKDIV_CLK_STEP_LSB)
+#define UART_CLKDIV_CLK_STEP_SET(x)              (((x) << UART_CLKDIV_CLK_STEP_LSB) & UART_CLKDIV_CLK_STEP_MASK)
+
+#endif /* _UART_REG_H_ */
diff --git a/drivers/staging/ath6kl/include/common/athdefs.h b/drivers/staging/ath6kl/include/common/athdefs.h
new file mode 100644
index 00000000000..74922481e06
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/athdefs.h
@@ -0,0 +1,75 @@
+//------------------------------------------------------------------------------
+// <copyright file="athdefs.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef __ATHDEFS_H__
+#define __ATHDEFS_H__
+
+/*
+ * This file contains definitions that may be used across both
+ * Host and Target software.  Nothing here is module-dependent
+ * or platform-dependent.
+ */
+
+/*
+ * Generic error codes that can be used by hw, sta, ap, sim, dk
+ * and any other environments.
+ * Feel free to add any more non-zero codes that you need.
+ */
+
+#define A_ERROR                 (-1)    /* Generic error return */
+#define A_DEVICE_NOT_FOUND      1       /* not able to find PCI device */
+#define A_NO_MEMORY             2       /* not able to allocate memory,
+                                         * not avail#defineable */
+#define A_MEMORY_NOT_AVAIL      3       /* memory region is not free for
+                                         * mapping */
+#define A_NO_FREE_DESC          4       /* no free descriptors available */
+#define A_BAD_ADDRESS           5       /* address does not match descriptor */
+#define A_WIN_DRIVER_ERROR      6       /* used in NT_HW version,
+                                         * if problem at init */
+#define A_REGS_NOT_MAPPED       7       /* registers not correctly mapped */
+#define A_EPERM                 8       /* Not superuser */
+#define A_EACCES                0       /* Access denied */
+#define A_ENOENT                10      /* No such entry, search failed, etc. */
+#define A_EEXIST                11      /* The object already exists
+                                         * (can't create) */
+#define A_EFAULT                12      /* Bad address fault */
+#define A_EBUSY                 13      /* Object is busy */
+#define A_EINVAL                14      /* Invalid parameter */
+#define A_EMSGSIZE              15      /* Bad message buffer length */
+#define A_ECANCELED             16      /* Operation canceled */
+#define A_ENOTSUP               17      /* Operation not supported */
+#define A_ECOMM                 18      /* Communication error on send */
+#define A_EPROTO                19      /* Protocol error */
+#define A_ENODEV                20      /* No such device */
+#define A_EDEVNOTUP             21      /* device is not UP */
+#define A_NO_RESOURCE           22      /* No resources for
+                                         * requested operation */
+#define A_HARDWARE              23      /* Hardware failure */
+#define A_PENDING               24      /* Asynchronous routine; will send up
+                                         * results later
+                                         * (typically in callback) */
+#define A_EBADCHANNEL           25      /* The channel cannot be used */
+#define A_DECRYPT_ERROR         26      /* Decryption error */
+#define A_PHY_ERROR             27      /* RX PHY error */
+#define A_CONSUMED              28      /* Object was consumed */
+
+#endif /* __ATHDEFS_H__ */
diff --git a/drivers/staging/ath6kl/include/common/bmi_msg.h b/drivers/staging/ath6kl/include/common/bmi_msg.h
new file mode 100644
index 00000000000..84e8db569a9
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/bmi_msg.h
@@ -0,0 +1,233 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+//
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef __BMI_MSG_H__
+#define __BMI_MSG_H__
+
+/*
+ * Bootloader Messaging Interface (BMI)
+ *
+ * BMI is a very simple messaging interface used during initialization
+ * to read memory, write memory, execute code, and to define an
+ * application entry PC.
+ *
+ * It is used to download an application to AR6K, to provide
+ * patches to code that is already resident on AR6K, and generally
+ * to examine and modify state.  The Host has an opportunity to use
+ * BMI only once during bootup.  Once the Host issues a BMI_DONE
+ * command, this opportunity ends.
+ *
+ * The Host writes BMI requests to mailbox0, and reads BMI responses
+ * from mailbox0.   BMI requests all begin with a command
+ * (see below for specific commands), and are followed by
+ * command-specific data.
+ *
+ * Flow control:
+ * The Host can only issue a command once the Target gives it a
+ * "BMI Command Credit", using AR6K Counter #4.  As soon as the
+ * Target has completed a command, it issues another BMI Command
+ * Credit (so the Host can issue the next command).
+ *
+ * BMI handles all required Target-side cache flushing.
+ */
+
+
+/* Maximum data size used for BMI transfers */
+#define BMI_DATASZ_MAX                      256
+
+/* BMI Commands */
+
+#define BMI_NO_COMMAND                      0
+
+#define BMI_DONE                            1
+        /*
+         * Semantics: Host is done using BMI
+         * Request format:
+         *    u32 command (BMI_DONE)
+         * Response format: none
+         */
+
+#define BMI_READ_MEMORY                     2
+        /*
+         * Semantics: Host reads AR6K memory
+         * Request format:
+         *    u32 command (BMI_READ_MEMORY)
+         *    u32 address
+         *    u32 length, at most BMI_DATASZ_MAX
+         * Response format:
+         *    u8 data[length]
+         */
+
+#define BMI_WRITE_MEMORY                    3
+        /*
+         * Semantics: Host writes AR6K memory
+         * Request format:
+         *    u32 command (BMI_WRITE_MEMORY)
+         *    u32 address
+         *    u32 length, at most BMI_DATASZ_MAX
+         *    u8 data[length]
+         * Response format: none
+         */
+
+#define BMI_EXECUTE                         4
+        /*
+         * Semantics: Causes AR6K to execute code
+         * Request format:
+         *    u32 command (BMI_EXECUTE)
+         *    u32 address
+         *    u32 parameter
+         * Response format:
+         *    u32 return value
+         */
+
+#define BMI_SET_APP_START                   5
+        /*
+         * Semantics: Set Target application starting address
+         * Request format:
+         *    u32 command (BMI_SET_APP_START)
+         *    u32 address
+         * Response format: none
+         */
+
+#define BMI_READ_SOC_REGISTER               6
+        /*
+         * Semantics: Read a 32-bit Target SOC register.
+         * Request format:
+         *    u32 command (BMI_READ_REGISTER)
+         *    u32 address
+         * Response format: 
+         *    u32 value
+         */
+
+#define BMI_WRITE_SOC_REGISTER              7
+        /*
+         * Semantics: Write a 32-bit Target SOC register.
+         * Request format:
+         *    u32 command (BMI_WRITE_REGISTER)
+         *    u32 address
+         *    u32 value
+         *
+         * Response format: none
+         */
+
+#define BMI_GET_TARGET_ID                  8
+#define BMI_GET_TARGET_INFO                8
+        /*
+         * Semantics: Fetch the 4-byte Target information
+         * Request format:
+         *    u32 command (BMI_GET_TARGET_ID/INFO)
+         * Response format1 (old firmware):
+         *    u32 TargetVersionID
+         * Response format2 (newer firmware):
+         *    u32 TARGET_VERSION_SENTINAL
+         *    struct bmi_target_info;
+         */
+
+PREPACK struct bmi_target_info {
+    u32 target_info_byte_count; /* size of this structure */
+    u32 target_ver;             /* Target Version ID */
+    u32 target_type;            /* Target type */
+} POSTPACK;
+#define TARGET_VERSION_SENTINAL 0xffffffff
+#define TARGET_TYPE_AR6001 1
+#define TARGET_TYPE_AR6002 2
+#define TARGET_TYPE_AR6003 3
+
+
+#define BMI_ROMPATCH_INSTALL               9
+        /*
+         * Semantics: Install a ROM Patch.
+         * Request format:
+         *    u32 command (BMI_ROMPATCH_INSTALL)
+         *    u32 Target ROM Address
+         *    u32 Target RAM Address or Value (depending on Target Type)
+         *    u32 Size, in bytes
+         *    u32 Activate? 1-->activate;
+         *                            0-->install but do not activate
+         * Response format:
+         *    u32 PatchID
+         */
+
+#define BMI_ROMPATCH_UNINSTALL             10
+        /*
+         * Semantics: Uninstall a previously-installed ROM Patch,
+         * automatically deactivating, if necessary.
+         * Request format:
+         *    u32 command (BMI_ROMPATCH_UNINSTALL)
+         *    u32 PatchID
+         *
+         * Response format: none
+         */
+
+#define BMI_ROMPATCH_ACTIVATE              11
+        /*
+         * Semantics: Activate a list of previously-installed ROM Patches.
+         * Request format:
+         *    u32 command (BMI_ROMPATCH_ACTIVATE)
+         *    u32 rompatch_count
+         *    u32 PatchID[rompatch_count]
+         *
+         * Response format: none
+         */
+
+#define BMI_ROMPATCH_DEACTIVATE            12
+        /*
+         * Semantics: Deactivate a list of active ROM Patches.
+         * Request format:
+         *    u32 command (BMI_ROMPATCH_DEACTIVATE)
+         *    u32 rompatch_count
+         *    u32 PatchID[rompatch_count]
+         *
+         * Response format: none
+         */
+
+
+#define BMI_LZ_STREAM_START                13
+        /*
+         * Semantics: Begin an LZ-compressed stream of input
+         * which is to be uncompressed by the Target to an
+         * output buffer at address.  The output buffer must
+         * be sufficiently large to hold the uncompressed
+         * output from the compressed input stream.  This BMI
+         * command should be followed by a series of 1 or more
+         * BMI_LZ_DATA commands.
+         *    u32 command (BMI_LZ_STREAM_START)
+         *    u32 address
+         * Note: Not supported on all versions of ROM firmware.
+         */
+
+#define BMI_LZ_DATA                        14
+        /*
+         * Semantics: Host writes AR6K memory with LZ-compressed
+         * data which is uncompressed by the Target.  This command
+         * must be preceded by a BMI_LZ_STREAM_START command. A series
+         * of BMI_LZ_DATA commands are considered part of a single
+         * input stream until another BMI_LZ_STREAM_START is issued.
+         * Request format:
+         *    u32 command (BMI_LZ_DATA)
+         *    u32 length (of compressed data),
+         *                  at most BMI_DATASZ_MAX
+         *    u8 CompressedData[length]
+         * Response format: none
+         * Note: Not supported on all versions of ROM firmware.
+         */
+
+#endif /* __BMI_MSG_H__ */
diff --git a/drivers/staging/ath6kl/include/common/cnxmgmt.h b/drivers/staging/ath6kl/include/common/cnxmgmt.h
new file mode 100644
index 00000000000..7a902cb5483
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/cnxmgmt.h
@@ -0,0 +1,36 @@
+//------------------------------------------------------------------------------
+// <copyright file="cnxmgmt.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _CNXMGMT_H_
+#define _CNXMGMT_H_
+
+typedef enum {
+    CM_CONNECT_WITHOUT_SCAN             = 0x0001,
+    CM_CONNECT_ASSOC_POLICY_USER        = 0x0002,
+    CM_CONNECT_SEND_REASSOC             = 0x0004,
+    CM_CONNECT_WITHOUT_ROAMTABLE_UPDATE = 0x0008,
+    CM_CONNECT_DO_WPA_OFFLOAD           = 0x0010,
+    CM_CONNECT_DO_NOT_DEAUTH            = 0x0020,
+} CM_CONNECT_TYPE;
+
+#endif  /* _CNXMGMT_H_ */
diff --git a/drivers/staging/ath6kl/include/common/dbglog.h b/drivers/staging/ath6kl/include/common/dbglog.h
new file mode 100644
index 00000000000..5566e568b83
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/dbglog.h
@@ -0,0 +1,126 @@
+//------------------------------------------------------------------------------
+// <copyright file="dbglog.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _DBGLOG_H_
+#define _DBGLOG_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define DBGLOG_TIMESTAMP_OFFSET          0
+#define DBGLOG_TIMESTAMP_MASK            0x0000FFFF /* Bit 0-15. Contains bit
+                                                       8-23 of the LF0 timer */
+#define DBGLOG_DBGID_OFFSET              16
+#define DBGLOG_DBGID_MASK                0x03FF0000 /* Bit 16-25 */
+#define DBGLOG_DBGID_NUM_MAX             256 /* Upper limit is width of mask */
+
+#define DBGLOG_MODULEID_OFFSET           26
+#define DBGLOG_MODULEID_MASK             0x3C000000 /* Bit 26-29 */
+#define DBGLOG_MODULEID_NUM_MAX          16 /* Upper limit is width of mask */
+
+/*
+ * Please ensure that the definition of any new module introduced is captured
+ * between the DBGLOG_MODULEID_START and DBGLOG_MODULEID_END defines. The 
+ * structure is required for the parser to correctly pick up the values for
+ * different modules.
+ */
+#define DBGLOG_MODULEID_START
+#define DBGLOG_MODULEID_INF                   0
+#define DBGLOG_MODULEID_WMI                   1
+#define DBGLOG_MODULEID_MISC                  2
+#define DBGLOG_MODULEID_PM                    3
+#define DBGLOG_MODULEID_TXRX_MGMTBUF          4
+#define DBGLOG_MODULEID_TXRX_TXBUF            5
+#define DBGLOG_MODULEID_TXRX_RXBUF            6
+#define DBGLOG_MODULEID_WOW                   7
+#define DBGLOG_MODULEID_WHAL                  8
+#define DBGLOG_MODULEID_DC                    9
+#define DBGLOG_MODULEID_CO                    10
+#define DBGLOG_MODULEID_RO                    11
+#define DBGLOG_MODULEID_CM                    12
+#define DBGLOG_MODULEID_MGMT                  13
+#define DBGLOG_MODULEID_TMR                   14
+#define DBGLOG_MODULEID_BTCOEX                15
+#define DBGLOG_MODULEID_END
+
+#define DBGLOG_NUM_ARGS_OFFSET             30
+#define DBGLOG_NUM_ARGS_MASK               0xC0000000 /* Bit 30-31 */
+#define DBGLOG_NUM_ARGS_MAX                2 /* Upper limit is width of mask */
+
+#define DBGLOG_MODULE_LOG_ENABLE_OFFSET    0
+#define DBGLOG_MODULE_LOG_ENABLE_MASK      0x0000FFFF
+
+#define DBGLOG_REPORTING_ENABLED_OFFSET    16
+#define DBGLOG_REPORTING_ENABLED_MASK      0x00010000
+
+#define DBGLOG_TIMESTAMP_RESOLUTION_OFFSET 17
+#define DBGLOG_TIMESTAMP_RESOLUTION_MASK   0x000E0000
+
+#define DBGLOG_REPORT_SIZE_OFFSET          20
+#define DBGLOG_REPORT_SIZE_MASK            0x3FF00000
+
+#define DBGLOG_LOG_BUFFER_SIZE             1500
+#define DBGLOG_DBGID_DEFINITION_LEN_MAX    90
+
+PREPACK struct dbglog_buf_s {
+    struct dbglog_buf_s *next;
+    u8 *buffer;
+    u32 bufsize;
+    u32 length;
+    u32 count;
+    u32 free;
+} POSTPACK;
+
+PREPACK struct dbglog_hdr_s {
+    struct dbglog_buf_s *dbuf;
+    u32 dropped;
+} POSTPACK;
+
+PREPACK struct dbglog_config_s {
+    u32 cfgvalid; /* Mask with valid config bits */
+    union {
+        /* TODO: Take care of endianness */
+        struct {
+            u32 mmask:16; /* Mask of modules with logging on */
+            u32 rep:1; /* Reporting enabled or not */
+            u32 tsr:3; /* Time stamp resolution. Def: 1 ms */
+            u32 size:10; /* Report size in number of messages */
+            u32 reserved:2;
+        } dbglog_config;
+
+        u32 value;
+    } u;
+} POSTPACK;
+
+#define cfgmmask                   u.dbglog_config.mmask
+#define cfgrep                     u.dbglog_config.rep
+#define cfgtsr                     u.dbglog_config.tsr
+#define cfgsize                    u.dbglog_config.size
+#define cfgvalue                   u.value
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DBGLOG_H_ */
diff --git a/drivers/staging/ath6kl/include/common/dbglog_id.h b/drivers/staging/ath6kl/include/common/dbglog_id.h
new file mode 100644
index 00000000000..15ef829cab2
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/dbglog_id.h
@@ -0,0 +1,558 @@
+//------------------------------------------------------------------------------
+// <copyright file="dbglog_id.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _DBGLOG_ID_H_
+#define _DBGLOG_ID_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* 
+ * The nomenclature for the debug identifiers is MODULE_DESCRIPTION.
+ * Please ensure that the definition of any new debugid introduced is captured
+ * between the <MODULE>_DBGID_DEFINITION_START and 
+ * <MODULE>_DBGID_DEFINITION_END defines. The structure is required for the 
+ * parser to correctly pick up the values for different debug identifiers.
+ */
+
+/* INF debug identifier definitions */
+#define INF_DBGID_DEFINITION_START
+#define INF_ASSERTION_FAILED                          1
+#define INF_TARGET_ID                                 2
+#define INF_DBGID_DEFINITION_END
+
+/* WMI debug identifier definitions */
+#define WMI_DBGID_DEFINITION_START
+#define WMI_CMD_RX_XTND_PKT_TOO_SHORT                 1
+#define WMI_EXTENDED_CMD_NOT_HANDLED                  2
+#define WMI_CMD_RX_PKT_TOO_SHORT                      3
+#define WMI_CALLING_WMI_EXTENSION_FN                  4
+#define WMI_CMD_NOT_HANDLED                           5
+#define WMI_IN_SYNC                                   6
+#define WMI_TARGET_WMI_SYNC_CMD                       7
+#define WMI_SET_SNR_THRESHOLD_PARAMS                  8
+#define WMI_SET_RSSI_THRESHOLD_PARAMS                 9
+#define WMI_SET_LQ_TRESHOLD_PARAMS                   10
+#define WMI_TARGET_CREATE_PSTREAM_CMD                11
+#define WMI_WI_DTM_INUSE                             12
+#define WMI_TARGET_DELETE_PSTREAM_CMD                13
+#define WMI_TARGET_IMPLICIT_DELETE_PSTREAM_CMD       14
+#define WMI_TARGET_GET_BIT_RATE_CMD                  15
+#define WMI_GET_RATE_MASK_CMD_FIX_RATE_MASK_IS       16
+#define WMI_TARGET_GET_AVAILABLE_CHANNELS_CMD        17
+#define WMI_TARGET_GET_TX_PWR_CMD                    18
+#define WMI_FREE_EVBUF_WMIBUF                        19
+#define WMI_FREE_EVBUF_DATABUF                       20
+#define WMI_FREE_EVBUF_BADFLAG                       21
+#define WMI_HTC_RX_ERROR_DATA_PACKET                 22
+#define WMI_HTC_RX_SYNC_PAUSING_FOR_MBOX             23
+#define WMI_INCORRECT_WMI_DATA_HDR_DROPPING_PKT      24
+#define WMI_SENDING_READY_EVENT                      25
+#define WMI_SETPOWER_MDOE_TO_MAXPERF                 26
+#define WMI_SETPOWER_MDOE_TO_REC                     27
+#define WMI_BSSINFO_EVENT_FROM                       28
+#define WMI_TARGET_GET_STATS_CMD                     29
+#define WMI_SENDING_SCAN_COMPLETE_EVENT              30
+#define WMI_SENDING_RSSI_INDB_THRESHOLD_EVENT        31
+#define WMI_SENDING_RSSI_INDBM_THRESHOLD_EVENT       32
+#define WMI_SENDING_LINK_QUALITY_THRESHOLD_EVENT     33
+#define WMI_SENDING_ERROR_REPORT_EVENT               34
+#define WMI_SENDING_CAC_EVENT                        35
+#define WMI_TARGET_GET_ROAM_TABLE_CMD                36
+#define WMI_TARGET_GET_ROAM_DATA_CMD                 37
+#define WMI_SENDING_GPIO_INTR_EVENT                  38
+#define WMI_SENDING_GPIO_ACK_EVENT                   39
+#define WMI_SENDING_GPIO_DATA_EVENT                  40
+#define WMI_CMD_RX                                   41
+#define WMI_CMD_RX_XTND                              42
+#define WMI_EVENT_SEND                               43
+#define WMI_EVENT_SEND_XTND                          44
+#define WMI_CMD_PARAMS_DUMP_START                    45
+#define WMI_CMD_PARAMS_DUMP_END                      46
+#define WMI_CMD_PARAMS                               47
+#define WMI_DBGID_DEFINITION_END
+
+/* MISC debug identifier definitions */
+#define MISC_DBGID_DEFINITION_START
+#define MISC_WLAN_SCHEDULER_EVENT_REGISTER_ERROR     1
+#define TLPM_INIT                                    2
+#define TLPM_FILTER_POWER_STATE                      3
+#define TLPM_NOTIFY_NOT_IDLE                         4
+#define TLPM_TIMEOUT_IDLE_HANDLER                    5
+#define TLPM_TIMEOUT_WAKEUP_HANDLER                  6
+#define TLPM_WAKEUP_SIGNAL_HANDLER                   7
+#define TLPM_UNEXPECTED_GPIO_INTR_ERROR              8
+#define TLPM_BREAK_ON_NOT_RECEIVED_ERROR             9
+#define TLPM_BREAK_OFF_NOT_RECIVED_ERROR             10
+#define TLPM_ACK_GPIO_INTR                           11
+#define TLPM_ON                                      12
+#define TLPM_OFF                                     13
+#define TLPM_WAKEUP_FROM_HOST                        14
+#define TLPM_WAKEUP_FROM_BT                          15 
+#define TLPM_TX_BREAK_RECIVED                        16
+#define TLPM_IDLE_TIMER_NOT_RUNNING                  17
+#define MISC_DBGID_DEFINITION_END
+    
+/* TXRX debug identifier definitions */
+#define TXRX_TXBUF_DBGID_DEFINITION_START
+#define TXRX_TXBUF_ALLOCATE_BUF                      1
+#define TXRX_TXBUF_QUEUE_BUF_TO_MBOX                 2
+#define TXRX_TXBUF_QUEUE_BUF_TO_TXQ                  3
+#define TXRX_TXBUF_TXQ_DEPTH                         4   
+#define TXRX_TXBUF_IBSS_QUEUE_TO_SFQ                 5
+#define TXRX_TXBUF_IBSS_QUEUE_TO_TXQ_FRM_SFQ         6
+#define TXRX_TXBUF_INITIALIZE_TIMER                  7
+#define TXRX_TXBUF_ARM_TIMER                         8
+#define TXRX_TXBUF_DISARM_TIMER                      9
+#define TXRX_TXBUF_UNINITIALIZE_TIMER                10
+#define TXRX_TXBUF_DBGID_DEFINITION_END
+ 
+#define TXRX_RXBUF_DBGID_DEFINITION_START    
+#define TXRX_RXBUF_ALLOCATE_BUF                      1
+#define TXRX_RXBUF_QUEUE_TO_HOST                     2
+#define TXRX_RXBUF_QUEUE_TO_WLAN                     3
+#define TXRX_RXBUF_ZERO_LEN_BUF                      4
+#define TXRX_RXBUF_QUEUE_TO_HOST_LASTBUF_IN_RXCHAIN  5
+#define TXRX_RXBUF_LASTBUF_IN_RXCHAIN_ZEROBUF        6
+#define TXRX_RXBUF_QUEUE_EMPTY_QUEUE_TO_WLAN         7
+#define TXRX_RXBUF_SEND_TO_RECV_MGMT                 8
+#define TXRX_RXBUF_SEND_TO_IEEE_LAYER                9
+#define TXRX_RXBUF_REQUEUE_ERROR                     10
+#define TXRX_RXBUF_DBGID_DEFINITION_END
+
+#define TXRX_MGMTBUF_DBGID_DEFINITION_START 
+#define TXRX_MGMTBUF_ALLOCATE_BUF                    1
+#define TXRX_MGMTBUF_ALLOCATE_SM_BUF                 2    
+#define TXRX_MGMTBUF_ALLOCATE_RMBUF                  3
+#define TXRX_MGMTBUF_GET_BUF                         4
+#define TXRX_MGMTBUF_GET_SM_BUF                      5
+#define TXRX_MGMTBUF_QUEUE_BUF_TO_TXQ                6
+#define TXRX_MGMTBUF_REAPED_BUF                      7
+#define TXRX_MGMTBUF_REAPED_SM_BUF                   8
+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_DRAIN              9
+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_SFQ_DRAIN          10
+#define TXRX_MGMTBUF_ENQUEUE_INTO_DATA_SFQ           11
+#define TXRX_MGMTBUF_DEQUEUE_FROM_DATA_SFQ           12
+#define TXRX_MGMTBUF_PAUSE_DATA_TXQ                  13
+#define TXRX_MGMTBUF_RESUME_DATA_TXQ                 14
+#define TXRX_MGMTBUF_WAIT_FORTXQ_DRAIN_TIMEOUT       15
+#define TXRX_MGMTBUF_DRAINQ                          16
+#define TXRX_MGMTBUF_INDICATE_Q_DRAINED              17
+#define TXRX_MGMTBUF_ENQUEUE_INTO_HW_SFQ             18
+#define TXRX_MGMTBUF_DEQUEUE_FROM_HW_SFQ             19
+#define TXRX_MGMTBUF_PAUSE_HW_TXQ                    20
+#define TXRX_MGMTBUF_RESUME_HW_TXQ                   21
+#define TXRX_MGMTBUF_TEAR_DOWN_BA                    22
+#define TXRX_MGMTBUF_PROCESS_ADDBA_REQ               23
+#define TXRX_MGMTBUF_PROCESS_DELBA                   24
+#define TXRX_MGMTBUF_PERFORM_BA                      25
+#define TXRX_MGMTBUF_WLAN_RESET_ON_ERROR             26 
+#define TXRX_MGMTBUF_DBGID_DEFINITION_END
+
+/* PM (Power Module) debug identifier definitions */
+#define PM_DBGID_DEFINITION_START
+#define PM_INIT                                      1
+#define PM_ENABLE                                    2
+#define PM_SET_STATE                                 3
+#define PM_SET_POWERMODE                             4
+#define PM_CONN_NOTIFY                               5
+#define PM_REF_COUNT_NEGATIVE                        6
+#define PM_INFRA_STA_APSD_ENABLE                     7
+#define PM_INFRA_STA_UPDATE_APSD_STATE               8
+#define PM_CHAN_OP_REQ                               9
+#define PM_SET_MY_BEACON_POLICY                      10
+#define PM_SET_ALL_BEACON_POLICY                     11
+#define PM_INFRA_STA_SET_PM_PARAMS1                  12
+#define PM_INFRA_STA_SET_PM_PARAMS2                  13
+#define PM_ADHOC_SET_PM_CAPS_FAIL                    14
+#define PM_ADHOC_UNKNOWN_IBSS_ATTRIB_ID              15
+#define PM_ADHOC_SET_PM_PARAMS                       16
+#define PM_ADHOC_STATE1                              18
+#define PM_ADHOC_STATE2                              19
+#define PM_ADHOC_CONN_MAP                            20 
+#define PM_FAKE_SLEEP                                21
+#define PM_AP_STATE1                                 22
+#define PM_AP_SET_PM_PARAMS                          23
+#define PM_DBGID_DEFINITION_END
+
+/* Wake on Wireless debug identifier definitions */
+#define WOW_DBGID_DEFINITION_START
+#define WOW_INIT                                        1
+#define WOW_GET_CONFIG_DSET                             2   
+#define WOW_NO_CONFIG_DSET                              3
+#define WOW_INVALID_CONFIG_DSET                         4
+#define WOW_USE_DEFAULT_CONFIG                          5
+#define WOW_SETUP_GPIO                                  6
+#define WOW_INIT_DONE                                   7
+#define WOW_SET_GPIO_PIN                                8
+#define WOW_CLEAR_GPIO_PIN                              9
+#define WOW_SET_WOW_MODE_CMD                            10
+#define WOW_SET_HOST_MODE_CMD                           11  
+#define WOW_ADD_WOW_PATTERN_CMD                         12    
+#define WOW_NEW_WOW_PATTERN_AT_INDEX                    13    
+#define WOW_DEL_WOW_PATTERN_CMD                         14    
+#define WOW_LIST_CONTAINS_PATTERNS                      15    
+#define WOW_GET_WOW_LIST_CMD                            16 
+#define WOW_INVALID_FILTER_ID                           17
+#define WOW_INVALID_FILTER_LISTID                       18
+#define WOW_NO_VALID_FILTER_AT_ID                       19
+#define WOW_NO_VALID_LIST_AT_ID                         20
+#define WOW_NUM_PATTERNS_EXCEEDED                       21
+#define WOW_NUM_LISTS_EXCEEDED                          22
+#define WOW_GET_WOW_STATS                               23
+#define WOW_CLEAR_WOW_STATS                             24
+#define WOW_WAKEUP_HOST                                 25
+#define WOW_EVENT_WAKEUP_HOST                           26
+#define WOW_EVENT_DISCARD                               27
+#define WOW_PATTERN_MATCH                               28
+#define WOW_PATTERN_NOT_MATCH                           29
+#define WOW_PATTERN_NOT_MATCH_OFFSET                    30
+#define WOW_DISABLED_HOST_ASLEEP                        31
+#define WOW_ENABLED_HOST_ASLEEP_NO_PATTERNS             32
+#define WOW_ENABLED_HOST_ASLEEP_NO_MATCH_FOUND          33
+#define WOW_DBGID_DEFINITION_END
+
+/* WHAL debug identifier definitions */
+#define WHAL_DBGID_DEFINITION_START
+#define WHAL_ERROR_ANI_CONTROL                      1
+#define WHAL_ERROR_CHIP_TEST1                       2
+#define WHAL_ERROR_CHIP_TEST2                       3
+#define WHAL_ERROR_EEPROM_CHECKSUM                  4
+#define WHAL_ERROR_EEPROM_MACADDR                   5
+#define WHAL_ERROR_INTERRUPT_HIU                    6
+#define WHAL_ERROR_KEYCACHE_RESET                   7
+#define WHAL_ERROR_KEYCACHE_SET                     8 
+#define WHAL_ERROR_KEYCACHE_TYPE                    9
+#define WHAL_ERROR_KEYCACHE_TKIPENTRY              10
+#define WHAL_ERROR_KEYCACHE_WEPLENGTH              11
+#define WHAL_ERROR_PHY_INVALID_CHANNEL             12
+#define WHAL_ERROR_POWER_AWAKE                     13
+#define WHAL_ERROR_POWER_SET                       14
+#define WHAL_ERROR_RECV_STOPDMA                    15
+#define WHAL_ERROR_RECV_STOPPCU                    16
+#define WHAL_ERROR_RESET_CHANNF1                   17
+#define WHAL_ERROR_RESET_CHANNF2                   18
+#define WHAL_ERROR_RESET_PM                        19
+#define WHAL_ERROR_RESET_OFFSETCAL                 20
+#define WHAL_ERROR_RESET_RFGRANT                   21
+#define WHAL_ERROR_RESET_RXFRAME                   22
+#define WHAL_ERROR_RESET_STOPDMA                   23
+#define WHAL_ERROR_RESET_RECOVER                   24
+#define WHAL_ERROR_XMIT_COMPUTE                    25
+#define WHAL_ERROR_XMIT_NOQUEUE                    26
+#define WHAL_ERROR_XMIT_ACTIVEQUEUE                27
+#define WHAL_ERROR_XMIT_BADTYPE                    28
+#define WHAL_ERROR_XMIT_STOPDMA                    29
+#define WHAL_ERROR_INTERRUPT_BB_PANIC              30 
+#define WHAL_ERROR_RESET_TXIQCAL                   31 
+#define WHAL_ERROR_PAPRD_MAXGAIN_ABOVE_WINDOW      32 
+#define WHAL_DBGID_DEFINITION_END
+
+/* DC debug identifier definitions */
+#define DC_DBGID_DEFINITION_START
+#define DC_SCAN_CHAN_START                          1
+#define DC_SCAN_CHAN_FINISH                         2
+#define DC_BEACON_RECEIVE7                          3
+#define DC_SSID_PROBE_CB                            4
+#define DC_SEND_NEXT_SSID_PROBE                     5
+#define DC_START_SEARCH                             6
+#define DC_CANCEL_SEARCH_CB                         7
+#define DC_STOP_SEARCH                              8
+#define DC_END_SEARCH                               9
+#define DC_MIN_CHDWELL_TIMEOUT                     10
+#define DC_START_SEARCH_CANCELED                   11
+#define DC_SET_POWER_MODE                          12
+#define DC_INIT                                    13
+#define DC_SEARCH_OPPORTUNITY                      14
+#define DC_RECEIVED_ANY_BEACON                     15
+#define DC_RECEIVED_MY_BEACON                      16
+#define DC_PROFILE_IS_ADHOC_BUT_BSS_IS_INFRA       17
+#define DC_PS_ENABLED_BUT_ATHEROS_IE_ABSENT        18
+#define DC_BSS_ADHOC_CHANNEL_NOT_ALLOWED           19
+#define DC_SET_BEACON_UPDATE                       20
+#define DC_BEACON_UPDATE_COMPLETE                  21
+#define DC_END_SEARCH_BEACON_UPDATE_COMP_CB        22
+#define DC_BSSINFO_EVENT_DROPPED                   23
+#define DC_IEEEPS_ENABLED_BUT_ATIM_ABSENT          24 
+#define DC_DBGID_DEFINITION_END
+
+/* CO debug identifier definitions */
+#define CO_DBGID_DEFINITION_START
+#define CO_INIT                                     1
+#define CO_ACQUIRE_LOCK                             2
+#define CO_START_OP1                                3
+#define CO_START_OP2                                4
+#define CO_DRAIN_TX_COMPLETE_CB                     5
+#define CO_CHANGE_CHANNEL_CB                        6
+#define CO_RETURN_TO_HOME_CHANNEL                   7
+#define CO_FINISH_OP_TIMEOUT                        8
+#define CO_OP_END                                   9
+#define CO_CANCEL_OP                               10
+#define CO_CHANGE_CHANNEL                          11
+#define CO_RELEASE_LOCK                            12
+#define CO_CHANGE_STATE                            13
+#define CO_DBGID_DEFINITION_END
+
+/* RO debug identifier definitions */
+#define RO_DBGID_DEFINITION_START
+#define RO_REFRESH_ROAM_TABLE                       1
+#define RO_UPDATE_ROAM_CANDIDATE                    2
+#define RO_UPDATE_ROAM_CANDIDATE_CB                 3
+#define RO_UPDATE_ROAM_CANDIDATE_FINISH             4
+#define RO_REFRESH_ROAM_TABLE_DONE                  5
+#define RO_PERIODIC_SEARCH_CB                       6
+#define RO_PERIODIC_SEARCH_TIMEOUT                  7
+#define RO_INIT                                     8
+#define RO_BMISS_STATE1                             9
+#define RO_BMISS_STATE2                            10
+#define RO_SET_PERIODIC_SEARCH_ENABLE              11
+#define RO_SET_PERIODIC_SEARCH_DISABLE             12
+#define RO_ENABLE_SQ_THRESHOLD                     13
+#define RO_DISABLE_SQ_THRESHOLD                    14
+#define RO_ADD_BSS_TO_ROAM_TABLE                   15
+#define RO_SET_PERIODIC_SEARCH_MODE                16
+#define RO_CONFIGURE_SQ_THRESHOLD1                 17
+#define RO_CONFIGURE_SQ_THRESHOLD2                 18
+#define RO_CONFIGURE_SQ_PARAMS                     19
+#define RO_LOW_SIGNAL_QUALITY_EVENT                20
+#define RO_HIGH_SIGNAL_QUALITY_EVENT               21
+#define RO_REMOVE_BSS_FROM_ROAM_TABLE              22
+#define RO_UPDATE_CONNECTION_STATE_METRIC          23
+#define RO_DBGID_DEFINITION_END
+
+/* CM debug identifier definitions */
+#define CM_DBGID_DEFINITION_START
+#define CM_INITIATE_HANDOFF                         1
+#define CM_INITIATE_HANDOFF_CB                      2
+#define CM_CONNECT_EVENT                            3
+#define CM_DISCONNECT_EVENT                         4
+#define CM_INIT                                     5
+#define CM_HANDOFF_SOURCE                           6
+#define CM_SET_HANDOFF_TRIGGERS                     7
+#define CM_CONNECT_REQUEST                          8
+#define CM_CONNECT_REQUEST_CB                       9
+#define CM_CONTINUE_SCAN_CB                         10 
+#define CM_DBGID_DEFINITION_END
+
+
+/* mgmt debug identifier definitions */
+#define MGMT_DBGID_DEFINITION_START
+#define KEYMGMT_CONNECTION_INIT                     1
+#define KEYMGMT_CONNECTION_COMPLETE                 2
+#define KEYMGMT_CONNECTION_CLOSE                    3
+#define KEYMGMT_ADD_KEY                             4
+#define MLME_NEW_STATE                              5
+#define MLME_CONN_INIT                              6
+#define MLME_CONN_COMPLETE                          7
+#define MLME_CONN_CLOSE                             8 
+#define MGMT_DBGID_DEFINITION_END
+
+/* TMR debug identifier definitions */
+#define TMR_DBGID_DEFINITION_START
+#define TMR_HANG_DETECTED                           1
+#define TMR_WDT_TRIGGERED                           2
+#define TMR_WDT_RESET                               3
+#define TMR_HANDLER_ENTRY                           4
+#define TMR_HANDLER_EXIT                            5
+#define TMR_SAVED_START                             6
+#define TMR_SAVED_END                               7
+#define TMR_DBGID_DEFINITION_END
+
+/* BTCOEX debug identifier definitions */
+#define BTCOEX_DBGID_DEFINITION_START
+#define BTCOEX_STATUS_CMD                           1
+#define BTCOEX_PARAMS_CMD                           2
+#define BTCOEX_ANT_CONFIG                           3
+#define BTCOEX_COLOCATED_BT_DEVICE                  4
+#define BTCOEX_CLOSE_RANGE_SCO_ON                   5
+#define BTCOEX_CLOSE_RANGE_SCO_OFF                  6
+#define BTCOEX_CLOSE_RANGE_A2DP_ON                  7
+#define BTCOEX_CLOSE_RANGE_A2DP_OFF                 8
+#define BTCOEX_A2DP_PROTECT_ON                      9
+#define BTCOEX_A2DP_PROTECT_OFF                     10
+#define BTCOEX_SCO_PROTECT_ON                       11
+#define BTCOEX_SCO_PROTECT_OFF                      12
+#define BTCOEX_CLOSE_RANGE_DETECTOR_START           13
+#define BTCOEX_CLOSE_RANGE_DETECTOR_STOP            14
+#define BTCOEX_CLOSE_RANGE_TOGGLE                   15
+#define BTCOEX_CLOSE_RANGE_TOGGLE_RSSI_LRCNT        16
+#define BTCOEX_CLOSE_RANGE_RSSI_THRESH              17
+#define BTCOEX_CLOSE_RANGE_LOW_RATE_THRESH          18
+#define BTCOEX_PTA_PRI_INTR_HANDLER                     19
+#define BTCOEX_PSPOLL_QUEUED                                            20
+#define BTCOEX_PSPOLL_COMPLETE                                          21
+#define BTCOEX_DBG_PM_AWAKE                                                     22
+#define BTCOEX_DBG_PM_SLEEP                                                     23
+#define BTCOEX_DBG_SCO_COEX_ON                                          24
+#define BTCOEX_SCO_DATARECEIVE                                          25
+#define BTCOEX_INTR_INIT                                                        26
+#define BTCOEX_PTA_PRI_DIFF                                                     27
+#define BTCOEX_TIM_NOTIFICATION                                         28
+#define BTCOEX_SCO_WAKEUP_ON_DATA                                       29
+#define BTCOEX_SCO_SLEEP                                                        30
+#define BTCOEX_SET_WEIGHTS                                                      31
+#define BTCOEX_SCO_DATARECEIVE_LATENCY_VAL                      32
+#define BTCOEX_SCO_MEASURE_TIME_DIFF                            33
+#define BTCOEX_SET_EOL_VAL                                                      34
+#define BTCOEX_OPT_DETECT_HANDLER                                       35
+#define BTCOEX_SCO_TOGGLE_STATE                                         36
+#define BTCOEX_SCO_STOMP                                                        37
+#define BTCOEX_NULL_COMP_CALLBACK                                       38
+#define BTCOEX_RX_INCOMING                                                      39
+#define BTCOEX_RX_INCOMING_CTL                                          40
+#define BTCOEX_RX_INCOMING_MGMT                                         41
+#define BTCOEX_RX_INCOMING_DATA                                         42
+#define BTCOEX_RTS_RECEPTION                                            43
+#define BTCOEX_FRAME_PRI_LOW_RATE_THRES                         44
+#define BTCOEX_PM_FAKE_SLEEP                                            45
+#define BTCOEX_ACL_COEX_STATUS                                          46
+#define BTCOEX_ACL_COEX_DETECTION                                       47
+#define BTCOEX_A2DP_COEX_STATUS                                         48
+#define BTCOEX_SCO_STATUS                                                       49
+#define BTCOEX_WAKEUP_ON_DATA                                           50
+#define BTCOEX_DATARECEIVE                                                      51
+#define BTCOEX_GET_MAX_AGGR_SIZE                                        53
+#define BTCOEX_MAX_AGGR_AVAIL_TIME                                      54
+#define BTCOEX_DBG_WBTIMER_INTR                                         55
+#define BTCOEX_DBG_SCO_SYNC                         57
+#define BTCOEX_UPLINK_QUEUED_RATE                                       59
+#define BTCOEX_DBG_UPLINK_ENABLE_EOL                            60
+#define BTCOEX_UPLINK_FRAME_DURATION                            61
+#define BTCOEX_UPLINK_SET_EOL                                           62
+#define BTCOEX_DBG_EOL_EXPIRED                                          63
+#define BTCOEX_DBG_DATA_COMPLETE                                        64
+#define BTCOEX_UPLINK_QUEUED_TIMESTAMP                          65
+#define BTCOEX_DBG_DATA_COMPLETE_TIME                           66
+#define BTCOEX_DBG_A2DP_ROLE_IS_SLAVE               67
+#define BTCOEX_DBG_A2DP_ROLE_IS_MASTER              68
+#define BTCOEX_DBG_UPLINK_SEQ_NUM                                       69
+#define BTCOEX_UPLINK_AGGR_SEQ                                          70
+#define BTCOEX_DBG_TX_COMP_SEQ_NO                                       71
+#define BTCOEX_DBG_MAX_AGGR_PAUSE_STATE                         72
+#define BTCOEX_DBG_ACL_TRAFFIC                      73
+#define BTCOEX_CURR_AGGR_PROP                                           74
+#define BTCOEX_DBG_SCO_GET_PER_TIME_DIFF                        75
+#define BTCOEX_PSPOLL_PROCESS                                           76
+#define BTCOEX_RETURN_FROM_MAC                                          77
+#define BTCOEX_FREED_REQUEUED_CNT                                       78
+#define BTCOEX_DBG_TOGGLE_LOW_RATES                                     79
+#define BTCOEX_MAC_GOES_TO_SLEEP                                80
+#define BTCOEX_DBG_A2DP_NO_SYNC                     81
+#define BTCOEX_RETURN_FROM_MAC_HOLD_Q_INFO                      82
+#define BTCOEX_RETURN_FROM_MAC_AC                                       83
+#define BTCOEX_DBG_DTIM_RECV                        84
+#define BTCOEX_IS_PRE_UPDATE                                            86
+#define BTCOEX_ENQUEUED_BIT_MAP                                         87
+#define BTCOEX_TX_COMPLETE_FIRST_DESC_STATS                     88
+#define BTCOEX_UPLINK_DESC                                                      89
+#define BTCOEX_SCO_GET_PER_FIRST_FRM_TIMESTAMP          90
+#define BTCOEX_DBG_RECV_ACK                                                     94
+#define BTCOEX_DBG_ADDBA_INDICATION                 95
+#define BTCOEX_TX_COMPLETE_EOL_FAILED                           96
+#define BTCOEX_DBG_A2DP_USAGE_COMPLETE                          97
+#define BTCOEX_DBG_A2DP_STOMP_FOR_BCN_HANDLER           98
+#define BTCOEX_DBG_A2DP_SYNC_INTR                   99
+#define BTCOEX_DBG_A2DP_STOMP_FOR_BCN_RECEPTION    100
+#define BTCOEX_FORM_AGGR_CURR_AGGR                                 101
+#define BTCOEX_DBG_TOGGLE_A2DP_BURST_CNT           102
+#define BTCOEX_DBG_BT_TRAFFIC                                      103
+#define BTCOEX_DBG_STOMP_BT_TRAFFIC                        104
+#define BTCOEX_RECV_NULL                           105
+#define BTCOEX_DBG_A2DP_MASTER_BT_END                      106
+#define BTCOEX_DBG_A2DP_BT_START                                   107
+#define BTCOEX_DBG_A2DP_SLAVE_BT_END                       108
+#define BTCOEX_DBG_A2DP_STOMP_BT                                   109
+#define BTCOEX_DBG_GO_TO_SLEEP                                     110
+#define BTCOEX_DBG_A2DP_PKT                                                111
+#define BTCOEX_DBG_A2DP_PSPOLL_DATA_RECV                   112
+#define BTCOEX_DBG_A2DP_NULL                                       113
+#define BTCOEX_DBG_UPLINK_DATA                                     114
+#define BTCOEX_DBG_A2DP_STOMP_LOW_PRIO_NULL                115
+#define BTCOEX_DBG_ADD_BA_RESP_TIMEOUT                     116
+#define BTCOEX_DBG_TXQ_STATE                                       117
+#define BTCOEX_DBG_ALLOW_SCAN                                      118
+#define BTCOEX_DBG_SCAN_REQUEST                                    119
+#define BTCOEX_A2DP_SLEEP                                                  127
+#define BTCOEX_DBG_DATA_ACTIV_TIMEOUT                      128
+#define BTCOEX_DBG_SWITCH_TO_PSPOLL_ON_MODE                129
+#define BTCOEX_DBG_SWITCH_TO_PSPOLL_OFF_MODE       130
+#define BTCOEX_DATARECEIVE_AGGR                                    131
+#define BTCOEX_DBG_DATA_RECV_SLEEPING_PENDING      132
+#define BTCOEX_DBG_DATARESP_TIMEOUT                                133
+#define BTCOEX_BDG_BMISS                                                   134
+#define BTCOEX_DBG_DATA_RECV_WAKEUP_TIM                    135
+#define BTCOEX_DBG_SECOND_BMISS                                    136
+#define BTCOEX_DBG_SET_WLAN_STATE                                  138
+#define BTCOEX_BDG_FIRST_BMISS                                     139
+#define BTCOEX_DBG_A2DP_CHAN_OP                                    140
+#define BTCOEX_DBG_A2DP_INTR                                       141
+#define BTCOEX_DBG_BT_INQUIRY                                      142
+#define BTCOEX_DBG_BT_INQUIRY_DATA_FETCH                   143
+#define BTCOEX_DBG_POST_INQUIRY_FINISH                     144
+#define BTCOEX_DBG_SCO_OPT_MODE_TIMER_HANDLER      145
+#define BTCOEX_DBG_NULL_FRAME_SLEEP                                146
+#define BTCOEX_DBG_NULL_FRAME_AWAKE                                147
+#define BTCOEX_DBG_SET_AGGR_SIZE                                   152
+#define BTCOEX_DBG_TEAR_BA_TIMEOUT                                 153
+#define BTCOEX_DBG_MGMT_FRAME_SEQ_NO                       154
+#define BTCOEX_DBG_SCO_STOMP_HIGH_PRI                      155
+#define BTCOEX_DBG_COLOCATED_BT_DEV                                156
+#define BTCOEX_DBG_FE_ANT_TYPE                                 157
+#define BTCOEX_DBG_BT_INQUIRY_CMD                                  158
+#define BTCOEX_DBG_SCO_CONFIG                                      159
+#define BTCOEX_DBG_SCO_PSPOLL_CONFIG                       160
+#define BTCOEX_DBG_SCO_OPTMODE_CONFIG                  161
+#define BTCOEX_DBG_A2DP_CONFIG                                 162
+#define BTCOEX_DBG_A2DP_PSPOLL_CONFIG                  163
+#define BTCOEX_DBG_A2DP_OPTMODE_CONFIG                 164
+#define BTCOEX_DBG_ACLCOEX_CONFIG                              165
+#define BTCOEX_DBG_ACLCOEX_PSPOLL_CONFIG                   166
+#define BTCOEX_DBG_ACLCOEX_OPTMODE_CONFIG              167
+#define BTCOEX_DBG_DEBUG_CMD                                       168
+#define BTCOEX_DBG_SET_BT_OPERATING_STATUS                 169
+#define BTCOEX_DBG_GET_CONFIG                                      170
+#define BTCOEX_DBG_GET_STATS                                       171
+#define BTCOEX_DBG_BT_OPERATING_STATUS                     172
+#define BTCOEX_DBG_PERFORM_RECONNECT               173
+#define BTCOEX_DBG_ACL_WLAN_MED                    175
+#define BTCOEX_DBG_ACL_BT_MED                      176
+#define BTCOEX_DBG_WLAN_CONNECT                    177
+#define BTCOEX_DBG_A2DP_DUAL_START                 178
+#define BTCOEX_DBG_PMAWAKE_NOTIFY                  179
+#define BTCOEX_DBG_BEACON_SCAN_ENABLE              180
+#define BTCOEX_DBG_BEACON_SCAN_DISABLE             181
+#define BTCOEX_DBG_RX_NOTIFY                       182
+#define BTCOEX_SCO_GET_PER_SECOND_FRM_TIMESTAMP    183
+#define BTCOEX_DBG_TXQ_DETAILS                     184
+#define BTCOEX_DBG_SCO_STOMP_LOW_PRI               185
+#define BTCOEX_DBG_A2DP_FORCE_SCAN                 186
+#define BTCOEX_DBG_DTIM_STOMP_COMP                 187
+#define BTCOEX_ACL_PRESENCE_TIMER                  188
+#define BTCOEX_DBGID_DEFINITION_END
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DBGLOG_ID_H_ */
diff --git a/drivers/staging/ath6kl/include/common/discovery.h b/drivers/staging/ath6kl/include/common/discovery.h
new file mode 100644
index 00000000000..da1b3324506
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/discovery.h
@@ -0,0 +1,75 @@
+//------------------------------------------------------------------------------
+// <copyright file="discovery.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _DISCOVERY_H_
+#define _DISCOVERY_H_
+
+/*
+ * DC_SCAN_PRIORITY is an 8-bit bitmap of the scan priority of a channel
+ */
+typedef enum {
+    DEFAULT_SCPRI = 0x01,
+    POPULAR_SCPRI = 0x02,
+    SSIDS_SCPRI   = 0x04,
+    PROF_SCPRI    = 0x08,
+} DC_SCAN_PRIORITY;
+
+/* The following search type construct can be used to manipulate the behavior of the search module based on different bits set */
+typedef enum {
+    SCAN_RESET                     = 0,
+    SCAN_ALL                       = (DEFAULT_SCPRI | POPULAR_SCPRI |  \
+                                      SSIDS_SCPRI | PROF_SCPRI),
+
+    SCAN_POPULAR                   = (POPULAR_SCPRI | SSIDS_SCPRI | PROF_SCPRI),
+    SCAN_SSIDS                     = (SSIDS_SCPRI | PROF_SCPRI),
+    SCAN_PROF_MASK                 = (PROF_SCPRI),
+    SCAN_MULTI_CHANNEL             = 0x000100,
+    SCAN_DETERMINISTIC             = 0x000200,
+    SCAN_PROFILE_MATCH_TERMINATED  = 0x000400,
+    SCAN_HOME_CHANNEL_SKIP         = 0x000800,
+    SCAN_CHANNEL_LIST_CONTINUE     = 0x001000,
+    SCAN_CURRENT_SSID_SKIP         = 0x002000,
+    SCAN_ACTIVE_PROBE_DISABLE      = 0x004000,
+    SCAN_CHANNEL_HINT_ONLY         = 0x008000,
+    SCAN_ACTIVE_CHANNELS_ONLY      = 0x010000,
+    SCAN_UNUSED1                   = 0x020000, /* unused */
+    SCAN_PERIODIC                  = 0x040000,
+    SCAN_FIXED_DURATION            = 0x080000,
+    SCAN_AP_ASSISTED               = 0x100000,
+} DC_SCAN_TYPE;
+
+typedef enum {
+    BSS_REPORTING_DEFAULT = 0x0,
+    EXCLUDE_NON_SCAN_RESULTS = 0x1, /* Exclude results outside of scan */
+} DC_BSS_REPORTING_POLICY;
+
+typedef enum {
+    DC_IGNORE_WPAx_GROUP_CIPHER = 0x01,
+    DC_PROFILE_MATCH_DONE = 0x02,
+    DC_IGNORE_AAC_BEACON = 0x04, 
+    DC_CSA_FOLLOW_BSS = 0x08,
+} DC_PROFILE_FILTER;
+
+#define DEFAULT_DC_PROFILE_FILTER   (DC_CSA_FOLLOW_BSS)
+
+#endif  /* _DISCOVERY_H_ */
diff --git a/drivers/staging/ath6kl/include/common/epping_test.h b/drivers/staging/ath6kl/include/common/epping_test.h
new file mode 100644
index 00000000000..9eb5fdfa746
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/epping_test.h
@@ -0,0 +1,111 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//
+
+/* This file contains shared definitions for the host/target endpoint ping test */
+
+#ifndef EPPING_TEST_H_
+#define EPPING_TEST_H_
+
+    /* alignment to 4-bytes */
+#define EPPING_ALIGNMENT_PAD  (((sizeof(struct htc_frame_hdr) + 3) & (~0x3)) - sizeof(struct htc_frame_hdr))
+
+#ifndef A_OFFSETOF
+#define A_OFFSETOF(type,field) (int)(&(((type *)NULL)->field))
+#endif
+
+#define EPPING_RSVD_FILL                  0xCC
+
+#define HCI_RSVD_EXPECTED_PKT_TYPE_RECV_OFFSET  7 
+  
+typedef PREPACK struct {    
+    u8 _HCIRsvd[8];           /* reserved for HCI packet header (GMBOX) testing */
+    u8 StreamEcho_h;          /* stream no. to echo this packet on (filled by host) */
+    u8 StreamEchoSent_t;      /* stream no. packet was echoed to (filled by target)
+                                          When echoed: StreamEchoSent_t == StreamEcho_h */
+    u8 StreamRecv_t;          /* stream no. that target received this packet on (filled by target) */
+    u8 StreamNo_h;            /* stream number to send on (filled by host) */
+    u8 Magic_h[4];            /* magic number to filter for this packet on the host*/
+    u8 _rsvd[6];              /* reserved fields that must be set to a "reserved" value
+                                          since this packet maps to a 14-byte ethernet frame we want 
+                                          to make sure ethertype field is set to something unknown */
+                                          
+    u8 _pad[2];               /* padding for alignment */
+    u8 TimeStamp[8];          /* timestamp of packet (host or target) */
+    u32 HostContext_h;         /* 4 byte host context, target echos this back */
+    u32 SeqNo;                 /* sequence number (set by host or target) */
+    u16 Cmd_h;                 /* ping command (filled by host) */
+    u16 CmdFlags_h;            /* optional flags */
+    u8 CmdBuffer_h[8];        /* buffer for command (host -> target) */
+    u8 CmdBuffer_t[8];        /* buffer for command (target -> host) */
+    u16 DataLength;            /* length of data */
+    u16 DataCRC;               /* 16 bit CRC of data */
+    u16 HeaderCRC;             /* header CRC (fields : StreamNo_h to end, minus HeaderCRC) */
+} POSTPACK EPPING_HEADER;
+
+#define EPPING_PING_MAGIC_0               0xAA
+#define EPPING_PING_MAGIC_1               0x55
+#define EPPING_PING_MAGIC_2               0xCE
+#define EPPING_PING_MAGIC_3               0xEC
+
+
+
+#define IS_EPPING_PACKET(pPkt)   (((pPkt)->Magic_h[0] == EPPING_PING_MAGIC_0) && \
+                                  ((pPkt)->Magic_h[1] == EPPING_PING_MAGIC_1) && \
+                                  ((pPkt)->Magic_h[2] == EPPING_PING_MAGIC_2) && \
+                                  ((pPkt)->Magic_h[3] == EPPING_PING_MAGIC_3))
+
+#define SET_EPPING_PACKET_MAGIC(pPkt) { (pPkt)->Magic_h[0] = EPPING_PING_MAGIC_0; \
+                                        (pPkt)->Magic_h[1] = EPPING_PING_MAGIC_1; \
+                                        (pPkt)->Magic_h[2] = EPPING_PING_MAGIC_2; \
+                                        (pPkt)->Magic_h[3] = EPPING_PING_MAGIC_3;}
+                                                                            
+#define CMD_FLAGS_DATA_CRC            (1 << 0)  /* DataCRC field is valid */
+#define CMD_FLAGS_DELAY_ECHO          (1 << 1)  /* delay the echo of the packet */
+#define CMD_FLAGS_NO_DROP             (1 << 2)  /* do not drop at HTC layer no matter what the stream is */
+
+#define IS_EPING_PACKET_NO_DROP(pPkt)  ((pPkt)->CmdFlags_h & CMD_FLAGS_NO_DROP)
+
+#define EPPING_CMD_ECHO_PACKET          1   /* echo packet test */
+#define EPPING_CMD_RESET_RECV_CNT       2   /* reset recv count */
+#define EPPING_CMD_CAPTURE_RECV_CNT     3   /* fetch recv count, 4-byte count returned in CmdBuffer_t */
+#define EPPING_CMD_NO_ECHO              4   /* non-echo packet test (tx-only) */
+#define EPPING_CMD_CONT_RX_START        5   /* continuous RX packets, parameters are in CmdBuffer_h */
+#define EPPING_CMD_CONT_RX_STOP         6   /* stop continuous RX packet transmission */
+
+    /* test command parameters may be no more than 8 bytes */
+typedef PREPACK struct {    
+    u16 BurstCnt;       /* number of packets to burst together (for HTC 2.1 testing) */
+    u16 PacketLength;   /* length of packet to generate including header */
+    u16 Flags;          /* flags */
+
+#define EPPING_CONT_RX_DATA_CRC     (1 << 0)  /* Add CRC to all data */
+#define EPPING_CONT_RX_RANDOM_DATA  (1 << 1)  /* randomize the data pattern */
+#define EPPING_CONT_RX_RANDOM_LEN   (1 << 2)  /* randomize the packet lengths */          
+} POSTPACK EPPING_CONT_RX_PARAMS;
+
+#define EPPING_HDR_CRC_OFFSET    A_OFFSETOF(EPPING_HEADER,StreamNo_h)
+#define EPPING_HDR_BYTES_CRC     (sizeof(EPPING_HEADER) - EPPING_HDR_CRC_OFFSET - (sizeof(u16)))
+
+#define HCI_TRANSPORT_STREAM_NUM  16  /* this number is higher than the define WMM AC classes so we
+                                         can use this to distinguish packets */
+
+#endif /*EPPING_TEST_H_*/
diff --git a/drivers/staging/ath6kl/include/common/gmboxif.h b/drivers/staging/ath6kl/include/common/gmboxif.h
new file mode 100644
index 00000000000..ea11c14def4
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/gmboxif.h
@@ -0,0 +1,70 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __GMBOXIF_H__
+#define __GMBOXIF_H__
+
+/* GMBOX interface definitions */
+    
+#define AR6K_GMBOX_CREDIT_COUNTER       1   /* we use credit counter 1 to track credits */
+#define AR6K_GMBOX_CREDIT_SIZE_COUNTER  2   /* credit counter 2 is used to pass the size of each credit */
+
+
+    /* HCI UART transport definitions when used over GMBOX interface */
+#define HCI_UART_COMMAND_PKT 0x01
+#define HCI_UART_ACL_PKT     0x02
+#define HCI_UART_SCO_PKT     0x03
+#define HCI_UART_EVENT_PKT   0x04
+
+    /* definitions for BT HCI packets */
+typedef PREPACK struct {
+    u16 Flags_ConnHandle;
+    u16 Length;
+} POSTPACK BT_HCI_ACL_HEADER;
+
+typedef PREPACK struct {
+    u16 Flags_ConnHandle;
+    u8 Length;
+} POSTPACK BT_HCI_SCO_HEADER;
+
+typedef PREPACK struct {
+    u16 OpCode;
+    u8 ParamLength;
+} POSTPACK BT_HCI_COMMAND_HEADER;
+
+typedef PREPACK struct {
+    u8 EventCode;
+    u8 ParamLength;
+} POSTPACK BT_HCI_EVENT_HEADER;
+
+/* MBOX host interrupt signal assignments */
+
+#define MBOX_SIG_HCI_BRIDGE_MAX      8
+#define MBOX_SIG_HCI_BRIDGE_BT_ON    0
+#define MBOX_SIG_HCI_BRIDGE_BT_OFF   1
+#define MBOX_SIG_HCI_BRIDGE_BAUD_SET 2
+#define MBOX_SIG_HCI_BRIDGE_PWR_SAV_ON    3
+#define MBOX_SIG_HCI_BRIDGE_PWR_SAV_OFF   4
+
+
+#endif /* __GMBOXIF_H__ */
+
diff --git a/drivers/staging/ath6kl/include/common/gpio_reg.h b/drivers/staging/ath6kl/include/common/gpio_reg.h
new file mode 100644
index 00000000000..f9d425d48dc
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/gpio_reg.h
@@ -0,0 +1,9 @@
+#ifndef _GPIO_REG_REG_H_
+#define _GPIO_REG_REG_H_
+
+#define GPIO_PIN10_ADDRESS                       0x00000050
+#define GPIO_PIN11_ADDRESS                       0x00000054
+#define GPIO_PIN12_ADDRESS                       0x00000058
+#define GPIO_PIN13_ADDRESS                       0x0000005c
+
+#endif /* _GPIO_REG_H_ */
diff --git a/drivers/staging/ath6kl/include/common/htc.h b/drivers/staging/ath6kl/include/common/htc.h
new file mode 100644
index 00000000000..85cbfa89d67
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/htc.h
@@ -0,0 +1,227 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __HTC_H__
+#define __HTC_H__
+
+#define A_OFFSETOF(type,field) (unsigned long)(&(((type *)NULL)->field))
+
+#define ASSEMBLE_UNALIGNED_UINT16(p,highbyte,lowbyte) \
+        (((u16)(((u8 *)(p))[(highbyte)])) << 8 | (u16)(((u8 *)(p))[(lowbyte)]))
+        
+/* alignment independent macros (little-endian) to fetch UINT16s or UINT8s from a 
+ * structure using only the type and field name.
+ * Use these macros if there is the potential for unaligned buffer accesses. */
+#define A_GET_UINT16_FIELD(p,type,field) \
+    ASSEMBLE_UNALIGNED_UINT16(p,\
+                              A_OFFSETOF(type,field) + 1, \
+                              A_OFFSETOF(type,field))
+
+#define A_SET_UINT16_FIELD(p,type,field,value) \
+{                                              \
+    ((u8 *)(p))[A_OFFSETOF(type,field)] = (u8)(value);        \
+    ((u8 *)(p))[A_OFFSETOF(type,field) + 1] = (u8)((value) >> 8); \
+}
+  
+#define A_GET_UINT8_FIELD(p,type,field) \
+            ((u8 *)(p))[A_OFFSETOF(type,field)]
+            
+#define A_SET_UINT8_FIELD(p,type,field,value) \
+    ((u8 *)(p))[A_OFFSETOF(type,field)] = (value)
+
+/****** DANGER DANGER ***************
+ * 
+ *   The frame header length and message formats defined herein were
+ *   selected to accommodate optimal alignment for target processing.  This reduces code
+ *   size and improves performance.
+ * 
+ *   Any changes to the header length may alter the alignment and cause exceptions
+ *   on the target. When adding to the message structures insure that fields are
+ *   properly aligned.
+ * 
+ */
+
+/* HTC frame header */
+PREPACK struct htc_frame_hdr {
+        /* do not remove or re-arrange these fields, these are minimally required
+         * to take advantage of 4-byte lookaheads in some hardware implementations */
+    u8 EndpointID;
+    u8 Flags;
+    u16 PayloadLen;       /* length of data (including trailer) that follows the header */
+    
+    /***** end of 4-byte lookahead ****/
+    
+    u8 ControlBytes[2];
+    
+    /* message payload starts after the header */
+    
+} POSTPACK;
+
+/* frame header flags */
+
+    /* send direction */
+#define HTC_FLAGS_NEED_CREDIT_UPDATE (1 << 0)
+#define HTC_FLAGS_SEND_BUNDLE        (1 << 1)  /* start or part of bundle */
+    /* receive direction */
+#define HTC_FLAGS_RECV_UNUSED_0      (1 << 0)  /* bit 0 unused */    
+#define HTC_FLAGS_RECV_TRAILER       (1 << 1)  /* bit 1 trailer data present */
+#define HTC_FLAGS_RECV_UNUSED_2      (1 << 0)  /* bit 2 unused */
+#define HTC_FLAGS_RECV_UNUSED_3      (1 << 0)  /* bit 3 unused */
+#define HTC_FLAGS_RECV_BUNDLE_CNT_MASK (0xF0)  /* bits 7..4  */
+#define HTC_FLAGS_RECV_BUNDLE_CNT_SHIFT 4
+
+#define HTC_HDR_LENGTH  (sizeof(struct htc_frame_hdr))
+#define HTC_MAX_TRAILER_LENGTH   255
+#define HTC_MAX_PAYLOAD_LENGTH   (4096 - sizeof(struct htc_frame_hdr))
+
+/* HTC control message IDs */
+
+#define HTC_MSG_READY_ID                    1
+#define HTC_MSG_CONNECT_SERVICE_ID          2
+#define HTC_MSG_CONNECT_SERVICE_RESPONSE_ID 3   
+#define HTC_MSG_SETUP_COMPLETE_ID           4
+#define HTC_MSG_SETUP_COMPLETE_EX_ID        5
+
+#define HTC_MAX_CONTROL_MESSAGE_LENGTH  256
+         
+/* base message ID header */
+typedef PREPACK struct {
+    u16 MessageID;
+} POSTPACK HTC_UNKNOWN_MSG;
+                                                     
+/* HTC ready message
+ * direction : target-to-host  */
+typedef PREPACK struct {
+    u16 MessageID;    /* ID */
+    u16 CreditCount;  /* number of credits the target can offer */
+    u16 CreditSize;   /* size of each credit */
+    u8 MaxEndpoints; /* maximum number of endpoints the target has resources for */
+    u8 _Pad1;
+} POSTPACK HTC_READY_MSG;
+
+    /* extended HTC ready message */
+typedef PREPACK struct {
+    HTC_READY_MSG   Version2_0_Info;   /* legacy version 2.0 information at the front... */
+    /* extended information */
+    u8 HTCVersion;
+    u8 MaxMsgsPerHTCBundle;
+} POSTPACK HTC_READY_EX_MSG;
+
+#define HTC_VERSION_2P0  0x00  
+#define HTC_VERSION_2P1  0x01  /* HTC 2.1 */
+
+#define HTC_SERVICE_META_DATA_MAX_LENGTH 128
+
+/* connect service
+ * direction : host-to-target */
+typedef PREPACK struct {
+    u16 MessageID;
+    u16 ServiceID;           /* service ID of the service to connect to */
+    u16 ConnectionFlags;     /* connection flags */
+
+#define HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE (1 << 2)  /* reduce credit dribbling when 
+                                                             the host needs credits */  
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK             (0x3)  
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_FOURTH        0x0
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF          0x1
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_THREE_FOURTHS     0x2
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_UNITY             0x3
+                                                             
+    u8 ServiceMetaLength;   /* length of meta data that follows */
+    u8 _Pad1;
+    
+    /* service-specific meta data starts after the header */
+    
+} POSTPACK HTC_CONNECT_SERVICE_MSG;
+
+/* connect response
+ * direction : target-to-host */
+typedef PREPACK struct {
+    u16 MessageID;
+    u16 ServiceID;            /* service ID that the connection request was made */
+    u8 Status;               /* service connection status */
+    u8 EndpointID;           /* assigned endpoint ID */
+    u16 MaxMsgSize;           /* maximum expected message size on this endpoint */
+    u8 ServiceMetaLength;    /* length of meta data that follows */
+    u8 _Pad1;
+    
+    /* service-specific meta data starts after the header */
+    
+} POSTPACK HTC_CONNECT_SERVICE_RESPONSE_MSG;
+
+typedef PREPACK struct {
+    u16 MessageID;
+    /* currently, no other fields */
+} POSTPACK HTC_SETUP_COMPLETE_MSG;
+
+    /* extended setup completion message */
+typedef PREPACK struct {
+    u16 MessageID;
+    u32 SetupFlags;
+    u8 MaxMsgsPerBundledRecv;
+    u8 Rsvd[3];
+} POSTPACK HTC_SETUP_COMPLETE_EX_MSG;
+
+#define HTC_SETUP_COMPLETE_FLAGS_ENABLE_BUNDLE_RECV     (1 << 0)
+
+/* connect response status codes */
+#define HTC_SERVICE_SUCCESS      0  /* success */
+#define HTC_SERVICE_NOT_FOUND    1  /* service could not be found */
+#define HTC_SERVICE_FAILED       2  /* specific service failed the connect */
+#define HTC_SERVICE_NO_RESOURCES 3  /* no resources (i.e. no more endpoints) */  
+#define HTC_SERVICE_NO_MORE_EP   4  /* specific service is not allowing any more 
+                                       endpoints */
+
+/* report record IDs */
+
+#define HTC_RECORD_NULL             0
+#define HTC_RECORD_CREDITS          1
+#define HTC_RECORD_LOOKAHEAD        2
+#define HTC_RECORD_LOOKAHEAD_BUNDLE 3
+
+typedef PREPACK struct {
+    u8 RecordID;     /* Record ID */
+    u8 Length;       /* Length of record */
+} POSTPACK HTC_RECORD_HDR;
+
+typedef PREPACK struct {
+    u8 EndpointID;     /* Endpoint that owns these credits */
+    u8 Credits;        /* credits to report since last report */
+} POSTPACK HTC_CREDIT_REPORT;
+
+typedef PREPACK struct {    
+    u8 PreValid;         /* pre valid guard */
+    u8 LookAhead[4];     /* 4 byte lookahead */
+    u8 PostValid;        /* post valid guard */
+    
+   /* NOTE: the LookAhead array is guarded by a PreValid and Post Valid guard bytes.
+    * The PreValid bytes must equal the inverse of the PostValid byte */
+    
+} POSTPACK HTC_LOOKAHEAD_REPORT;
+
+typedef PREPACK struct {    
+    u8 LookAhead[4];     /* 4 byte lookahead */
+} POSTPACK HTC_BUNDLED_LOOKAHEAD_REPORT;
+
+#endif /* __HTC_H__ */
+
diff --git a/drivers/staging/ath6kl/include/common/htc_services.h b/drivers/staging/ath6kl/include/common/htc_services.h
new file mode 100644
index 00000000000..fb22268a8d8
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/htc_services.h
@@ -0,0 +1,52 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_services.h" company="Atheros">
+//    Copyright (c) 2007 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __HTC_SERVICES_H__
+#define __HTC_SERVICES_H__
+
+/* Current service IDs */
+
+typedef enum {
+    RSVD_SERVICE_GROUP  = 0,
+    WMI_SERVICE_GROUP   = 1, 
+    
+    HTC_TEST_GROUP = 254,
+    HTC_SERVICE_GROUP_LAST = 255
+}HTC_SERVICE_GROUP_IDS;
+
+#define MAKE_SERVICE_ID(group,index) \
+            (int)(((int)group << 8) | (int)(index))
+
+/* NOTE: service ID of 0x0000 is reserved and should never be used */
+#define HTC_CTRL_RSVD_SVC MAKE_SERVICE_ID(RSVD_SERVICE_GROUP,1)
+#define WMI_CONTROL_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,0)
+#define WMI_DATA_BE_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,1)
+#define WMI_DATA_BK_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,2)
+#define WMI_DATA_VI_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,3)
+#define WMI_DATA_VO_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,4)
+#define WMI_MAX_SERVICES  5
+
+/* raw stream service (i.e. flash, tcmd, calibration apps) */
+#define HTC_RAW_STREAMS_SVC MAKE_SERVICE_ID(HTC_TEST_GROUP,0)
+
+#endif /*HTC_SERVICES_H_*/
diff --git a/drivers/staging/ath6kl/include/common/pkt_log.h b/drivers/staging/ath6kl/include/common/pkt_log.h
new file mode 100644
index 00000000000..a3719adf54c
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/pkt_log.h
@@ -0,0 +1,45 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2005-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __PKT_LOG_H__
+#define __PKT_LOG_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/* Pkt log info */
+typedef PREPACK struct pkt_log_t {
+    struct info_t {
+        u16 st;
+        u16 end;
+        u16 cur;
+    }info[4096];
+    u16 last_idx;
+}POSTPACK PACKET_LOG;
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif  /* __PKT_LOG_H__ */
diff --git a/drivers/staging/ath6kl/include/common/roaming.h b/drivers/staging/ath6kl/include/common/roaming.h
new file mode 100644
index 00000000000..8019850a057
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/roaming.h
@@ -0,0 +1,41 @@
+//------------------------------------------------------------------------------
+// <copyright file="roaming.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _ROAMING_H_
+#define _ROAMING_H_
+
+/* 
+ * The signal quality could be in terms of either snr or rssi. We should 
+ * have an enum for both of them. For the time being, we are going to move 
+ * it to wmi.h that is shared by both host and the target, since we are 
+ * repartitioning the code to the host 
+ */
+#define SIGNAL_QUALITY_NOISE_FLOOR        -96
+#define SIGNAL_QUALITY_METRICS_NUM_MAX    2
+typedef enum {
+    SIGNAL_QUALITY_METRICS_SNR = 0,
+    SIGNAL_QUALITY_METRICS_RSSI,
+    SIGNAL_QUALITY_METRICS_ALL,
+} SIGNAL_QUALITY_METRICS_TYPE;
+
+#endif  /* _ROAMING_H_ */
diff --git a/drivers/staging/ath6kl/include/common/targaddrs.h b/drivers/staging/ath6kl/include/common/targaddrs.h
new file mode 100644
index 00000000000..c866cefbd8f
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/targaddrs.h
@@ -0,0 +1,395 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2010 Atheros Corporation.  All rights reserved.
+//
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef __TARGADDRS_H__
+#define __TARGADDRS_H__
+
+#if defined(AR6002)
+#include "AR6002/addrs.h"
+#endif
+
+/*
+ * AR6K option bits, to enable/disable various features.
+ * By default, all option bits are 0.
+ * These bits can be set in LOCAL_SCRATCH register 0.
+ */
+#define AR6K_OPTION_BMI_DISABLE      0x01 /* Disable BMI comm with Host */
+#define AR6K_OPTION_SERIAL_ENABLE    0x02 /* Enable serial port msgs */
+#define AR6K_OPTION_WDT_DISABLE      0x04 /* WatchDog Timer override */
+#define AR6K_OPTION_SLEEP_DISABLE    0x08 /* Disable system sleep */
+#define AR6K_OPTION_STOP_BOOT        0x10 /* Stop boot processes (for ATE) */
+#define AR6K_OPTION_ENABLE_NOANI     0x20 /* Operate without ANI */
+#define AR6K_OPTION_DSET_DISABLE     0x40 /* Ignore DataSets */
+#define AR6K_OPTION_IGNORE_FLASH     0x80 /* Ignore flash during bootup */
+
+/*
+ * xxx_HOST_INTEREST_ADDRESS is the address in Target RAM of the
+ * host_interest structure.  It must match the address of the _host_interest
+ * symbol (see linker script).
+ *
+ * Host Interest is shared between Host and Target in order to coordinate
+ * between the two, and is intended to remain constant (with additions only
+ * at the end) across software releases.
+ *
+ * All addresses are available here so that it's possible to
+ * write a single binary that works with all Target Types.
+ * May be used in assembler code as well as C.
+ */
+#define AR6002_HOST_INTEREST_ADDRESS    0x00500400
+#define AR6003_HOST_INTEREST_ADDRESS    0x00540600
+
+
+#define HOST_INTEREST_MAX_SIZE          0x100
+
+#if !defined(__ASSEMBLER__)
+struct register_dump_s;
+struct dbglog_hdr_s;
+
+/*
+ * These are items that the Host may need to access
+ * via BMI or via the Diagnostic Window. The position
+ * of items in this structure must remain constant
+ * across firmware revisions!
+ *
+ * Types for each item must be fixed size across
+ * target and host platforms.
+ *
+ * More items may be added at the end.
+ */
+PREPACK struct host_interest_s {
+    /*
+     * Pointer to application-defined area, if any.
+     * Set by Target application during startup.
+     */
+    u32 hi_app_host_interest;                      /* 0x00 */
+
+    /* Pointer to register dump area, valid after Target crash. */
+    u32 hi_failure_state;                          /* 0x04 */
+
+    /* Pointer to debug logging header */
+    u32 hi_dbglog_hdr;                             /* 0x08 */
+
+    u32 hi_unused1;                       /* 0x0c */
+
+    /*
+     * General-purpose flag bits, similar to AR6000_OPTION_* flags.
+     * Can be used by application rather than by OS.
+     */
+    u32 hi_option_flag;                            /* 0x10 */
+
+    /*
+     * Boolean that determines whether or not to
+     * display messages on the serial port.
+     */
+    u32 hi_serial_enable;                          /* 0x14 */
+
+    /* Start address of DataSet index, if any */
+    u32 hi_dset_list_head;                         /* 0x18 */
+
+    /* Override Target application start address */
+    u32 hi_app_start;                              /* 0x1c */
+
+    /* Clock and voltage tuning */
+    u32 hi_skip_clock_init;                        /* 0x20 */
+    u32 hi_core_clock_setting;                     /* 0x24 */
+    u32 hi_cpu_clock_setting;                      /* 0x28 */
+    u32 hi_system_sleep_setting;                   /* 0x2c */
+    u32 hi_xtal_control_setting;                   /* 0x30 */
+    u32 hi_pll_ctrl_setting_24ghz;                 /* 0x34 */
+    u32 hi_pll_ctrl_setting_5ghz;                  /* 0x38 */
+    u32 hi_ref_voltage_trim_setting;               /* 0x3c */
+    u32 hi_clock_info;                             /* 0x40 */
+
+    /*
+     * Flash configuration overrides, used only
+     * when firmware is not executing from flash.
+     * (When using flash, modify the global variables
+     * with equivalent names.)
+     */
+    u32 hi_bank0_addr_value;                       /* 0x44 */
+    u32 hi_bank0_read_value;                       /* 0x48 */
+    u32 hi_bank0_write_value;                      /* 0x4c */
+    u32 hi_bank0_config_value;                     /* 0x50 */
+
+    /* Pointer to Board Data  */
+    u32 hi_board_data;                             /* 0x54 */
+    u32 hi_board_data_initialized;                 /* 0x58 */
+
+    u32 hi_dset_RAM_index_table;                   /* 0x5c */
+
+    u32 hi_desired_baud_rate;                      /* 0x60 */
+    u32 hi_dbglog_config;                          /* 0x64 */
+    u32 hi_end_RAM_reserve_sz;                     /* 0x68 */
+    u32 hi_mbox_io_block_sz;                       /* 0x6c */
+
+    u32 hi_num_bpatch_streams;                     /* 0x70 -- unused */
+    u32 hi_mbox_isr_yield_limit;                   /* 0x74 */
+
+    u32 hi_refclk_hz;                              /* 0x78 */
+    u32 hi_ext_clk_detected;                       /* 0x7c */
+    u32 hi_dbg_uart_txpin;                         /* 0x80 */
+    u32 hi_dbg_uart_rxpin;                         /* 0x84 */
+    u32 hi_hci_uart_baud;                          /* 0x88 */
+    u32 hi_hci_uart_pin_assignments;               /* 0x8C */
+        /* NOTE: byte [0] = tx pin, [1] = rx pin, [2] = rts pin, [3] = cts pin */
+    u32 hi_hci_uart_baud_scale_val;                /* 0x90 */
+    u32 hi_hci_uart_baud_step_val;                 /* 0x94 */
+
+    u32 hi_allocram_start;                         /* 0x98 */
+    u32 hi_allocram_sz;                            /* 0x9c */
+    u32 hi_hci_bridge_flags;                       /* 0xa0 */
+    u32 hi_hci_uart_support_pins;                  /* 0xa4 */
+        /* NOTE: byte [0] = RESET pin (bit 7 is polarity), bytes[1]..bytes[3] are for future use */
+    u32 hi_hci_uart_pwr_mgmt_params;               /* 0xa8 */
+        /*
+         * 0xa8   - [1]: 0 = UART FC active low, 1 = UART FC active high
+         *      [31:16]: wakeup timeout in ms
+         */
+
+        /* Pointer to extended board data */
+        u32 hi_board_ext_data;                /* 0xac */
+        u32 hi_board_ext_data_config;         /* 0xb0 */
+
+        /*
+         * Bit [0]  :   valid
+         * Bit[31:16:   size
+        */
+        /*
+         * hi_reset_flag is used to do some stuff when target reset.
+         * such as restore app_start after warm reset or
+         * preserve host Interest area, or preserve ROM data, literals etc.
+         */
+        u32 hi_reset_flag;                            /* 0xb4 */
+        /* indicate hi_reset_flag is valid */
+        u32 hi_reset_flag_valid;                      /* 0xb8 */
+        u32 hi_hci_uart_pwr_mgmt_params_ext;           /* 0xbc */
+        /*
+         * 0xbc - [31:0]: idle timeout in ms
+         */
+        /* ACS flags */
+        u32 hi_acs_flags;                              /* 0xc0 */
+        u32 hi_console_flags;                          /* 0xc4 */
+        u32 hi_nvram_state;                            /* 0xc8 */
+        u32 hi_option_flag2;                           /* 0xcc */
+
+        /* If non-zero, override values sent to Host in WMI_READY event. */
+        u32 hi_sw_version_override;                    /* 0xd0 */
+        u32 hi_abi_version_override;                   /* 0xd4 */
+
+        /*
+         * Percentage of high priority RX traffic to total expected RX traffic -
+         * applicable only to ar6004
+         */
+        u32 hi_hp_rx_traffic_ratio;                    /* 0xd8 */
+
+        /* test applications flags */
+        u32 hi_test_apps_related    ;                  /* 0xdc */
+        /* location of test script */
+        u32 hi_ota_testscript;                         /* 0xe0 */
+        /* location of CAL data */
+        u32 hi_cal_data;                               /* 0xe4 */
+        /* Number of packet log buffers */
+        u32 hi_pktlog_num_buffers;                     /* 0xe8 */
+
+} POSTPACK;
+
+/* Bits defined in hi_option_flag */
+#define HI_OPTION_TIMER_WAR       0x01 /* Enable timer workaround */
+#define HI_OPTION_BMI_CRED_LIMIT  0x02 /* Limit BMI command credits */
+#define HI_OPTION_RELAY_DOT11_HDR 0x04 /* Relay Dot11 hdr to/from host */
+/* MAC addr method 0-locally administred 1-globally unique addrs */
+#define HI_OPTION_MAC_ADDR_METHOD   0x08
+#define HI_OPTION_FW_BRIDGE         0x10 /* Firmware Bridging */
+#define HI_OPTION_ENABLE_PROFILE    0x20 /* Enable CPU profiling */
+#define HI_OPTION_DISABLE_DBGLOG    0x40 /* Disable debug logging */
+#define HI_OPTION_SKIP_ERA_TRACKING 0x80 /* Skip Era Tracking */
+#define HI_OPTION_PAPRD_DISABLE     0x100 /* Disable PAPRD (debug) */
+#define HI_OPTION_NUM_DEV_LSB       0x200
+#define HI_OPTION_NUM_DEV_MSB       0x800
+#define HI_OPTION_DEV_MODE_LSB      0x1000
+#define HI_OPTION_DEV_MODE_MSB      0x8000000
+/* Disable LowFreq Timer Stabilization */
+#define HI_OPTION_NO_LFT_STBL       0x10000000
+#define HI_OPTION_SKIP_REG_SCAN     0x20000000 /* Skip regulatory scan */
+/* Do regulatory scan during init beforesending WMI ready event to host */
+#define HI_OPTION_INIT_REG_SCAN     0x40000000
+#define HI_OPTION_SKIP_MEMMAP       0x80000000 /* REV6: Do not adjust memory
+                                                map */
+
+/* hi_option_flag2 options */
+#define HI_OPTION_OFFLOAD_AMSDU     0x01
+#define HI_OPTION_DFS_SUPPORT       0x02 /* Enable DFS support */
+
+#define HI_OPTION_MAC_ADDR_METHOD_SHIFT 3
+
+/* 2 bits of hi_option_flag are used to represent 3 modes */
+#define HI_OPTION_FW_MODE_IBSS    0x0 /* IBSS Mode */
+#define HI_OPTION_FW_MODE_BSS_STA 0x1 /* STA Mode */
+#define HI_OPTION_FW_MODE_AP      0x2 /* AP Mode */
+
+/* 2 bits of hi_option flag are usedto represent 4 submodes */
+#define HI_OPTION_FW_SUBMODE_NONE    0x0  /* Normal mode */
+#define HI_OPTION_FW_SUBMODE_P2PDEV  0x1  /* p2p device mode */
+#define HI_OPTION_FW_SUBMODE_P2PCLIENT 0x2 /* p2p client mode */
+#define HI_OPTION_FW_SUBMODE_P2PGO   0x3 /* p2p go mode */
+
+/* Num dev Mask */
+#define HI_OPTION_NUM_DEV_MASK    0x7
+#define HI_OPTION_NUM_DEV_SHIFT   0x9
+
+/* firmware bridging */
+#define HI_OPTION_FW_BRIDGE_SHIFT 0x04
+
+/* Fw Mode/SubMode Mask
+|------------------------------------------------------------------------------|
+|   SUB   |   SUB   |   SUB   |  SUB    |         |         |         |
+| MODE[3] | MODE[2] | MODE[1] | MODE[0] | MODE[3] | MODE[2] | MODE[1] | MODE[0|
+|   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |   (2)
+|------------------------------------------------------------------------------|
+*/
+#define HI_OPTION_FW_MODE_BITS         0x2
+#define HI_OPTION_FW_MODE_MASK         0x3
+#define HI_OPTION_FW_MODE_SHIFT        0xC
+#define HI_OPTION_ALL_FW_MODE_MASK     0xFF
+
+#define HI_OPTION_FW_SUBMODE_BITS      0x2
+#define HI_OPTION_FW_SUBMODE_MASK      0x3
+#define HI_OPTION_FW_SUBMODE_SHIFT     0x14
+#define HI_OPTION_ALL_FW_SUBMODE_MASK  0xFF00
+#define HI_OPTION_ALL_FW_SUBMODE_SHIFT 0x8
+
+/* hi_reset_flag */
+
+/* preserve App Start address */
+#define HI_RESET_FLAG_PRESERVE_APP_START         0x01
+/* preserve host interest */
+#define HI_RESET_FLAG_PRESERVE_HOST_INTEREST     0x02
+#define HI_RESET_FLAG_PRESERVE_ROMDATA           0x04  /* preserve ROM data */
+#define HI_RESET_FLAG_PRESERVE_NVRAM_STATE       0x08
+#define HI_RESET_FLAG_PRESERVE_BOOT_INFO         0x10
+
+#define HI_RESET_FLAG_IS_VALID  0x12345678 /* indicate the reset flag is
+valid */
+
+#define ON_RESET_FLAGS_VALID() \
+        (HOST_INTEREST->hi_reset_flag_valid == HI_RESET_FLAG_IS_VALID)
+
+#define RESET_FLAGS_VALIDATE()  \
+        (HOST_INTEREST->hi_reset_flag_valid = HI_RESET_FLAG_IS_VALID)
+
+#define RESET_FLAGS_INVALIDATE() \
+        (HOST_INTEREST->hi_reset_flag_valid = 0)
+
+#define ON_RESET_PRESERVE_APP_START() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_APP_START)
+
+#define ON_RESET_PRESERVE_NVRAM_STATE() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_NVRAM_STATE)
+
+#define ON_RESET_PRESERVE_HOST_INTEREST() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_HOST_INTEREST)
+
+#define ON_RESET_PRESERVE_ROMDATA() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_ROMDATA)
+
+#define ON_RESET_PRESERVE_BOOT_INFO() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_BOOT_INFO)
+
+#define HI_ACS_FLAGS_ENABLED        (1 << 0)    /* ACS is enabled */
+#define HI_ACS_FLAGS_USE_WWAN       (1 << 1)    /* Use physical WWAN device */
+#define HI_ACS_FLAGS_TEST_VAP       (1 << 2)    /* Use test VAP */
+
+/* CONSOLE FLAGS
+ *
+ * Bit Range  Meaning
+ * ---------  --------------------------------
+ *   2..0     UART ID (0 = Default)
+ *    3       Baud Select (0 = 9600, 1 = 115200)
+ *   30..4    Reserved
+ *    31      Enable Console
+ *
+ */
+
+#define HI_CONSOLE_FLAGS_ENABLE       (1 << 31)
+#define HI_CONSOLE_FLAGS_UART_MASK    (0x7)
+#define HI_CONSOLE_FLAGS_UART_SHIFT   0
+#define HI_CONSOLE_FLAGS_BAUD_SELECT  (1 << 3)
+
+/*
+ * Intended for use by Host software, this macro returns the Target RAM
+ * address of any item in the host_interest structure.
+ * Example: target_addr = AR6002_HOST_INTEREST_ITEM_ADDRESS(hi_board_data);
+ */
+#define AR6002_HOST_INTEREST_ITEM_ADDRESS(item) \
+    (u32)((unsigned long)&((((struct host_interest_s *)(AR6002_HOST_INTEREST_ADDRESS))->item)))
+
+#define AR6003_HOST_INTEREST_ITEM_ADDRESS(item) \
+    (u32)((unsigned long)&((((struct host_interest_s *)(AR6003_HOST_INTEREST_ADDRESS))->item)))
+
+#define AR6004_HOST_INTEREST_ITEM_ADDRESS(item) \
+        ((u32)&((((struct host_interest_s *)(AR6004_HOST_INTEREST_ADDRESS))->item)))
+
+
+#define HOST_INTEREST_DBGLOG_IS_ENABLED() \
+        (!(HOST_INTEREST->hi_option_flag & HI_OPTION_DISABLE_DBGLOG))
+
+#define HOST_INTEREST_PKTLOG_IS_ENABLED() \
+        ((HOST_INTEREST->hi_pktlog_num_buffers))
+
+
+#define HOST_INTEREST_PROFILE_IS_ENABLED() \
+        (HOST_INTEREST->hi_option_flag & HI_OPTION_ENABLE_PROFILE)
+
+#define LF_TIMER_STABILIZATION_IS_ENABLED() \
+        (!(HOST_INTEREST->hi_option_flag & HI_OPTION_NO_LFT_STBL))
+
+#define IS_AMSDU_OFFLAOD_ENABLED() \
+        ((HOST_INTEREST->hi_option_flag2 & HI_OPTION_OFFLOAD_AMSDU))
+
+#define HOST_INTEREST_DFS_IS_ENABLED() \
+        ((HOST_INTEREST->hi_option_flag2 & HI_OPTION_DFS_SUPPORT))
+
+/* Convert a Target virtual address into a Target physical address */
+#define AR6002_VTOP(vaddr) ((vaddr) & 0x001fffff)
+#define AR6003_VTOP(vaddr) ((vaddr) & 0x001fffff)
+#define TARG_VTOP(TargetType, vaddr) \
+        (((TargetType) == TARGET_TYPE_AR6002) ? AR6002_VTOP(vaddr) : AR6003_VTOP(vaddr))
+
+#define AR6003_REV2_APP_START_OVERRIDE          0x944C00
+#define AR6003_REV2_APP_LOAD_ADDRESS            0x543180
+#define AR6003_REV2_BOARD_EXT_DATA_ADDRESS      0x57E500
+#define AR6003_REV2_DATASET_PATCH_ADDRESS       0x57e884
+#define AR6003_REV2_RAM_RESERVE_SIZE            6912
+
+#define AR6003_REV3_APP_START_OVERRIDE          0x945d00
+#define AR6003_REV3_APP_LOAD_ADDRESS            0x545000
+#define AR6003_REV3_BOARD_EXT_DATA_ADDRESS      0x542330
+#define AR6003_REV3_DATASET_PATCH_ADDRESS       0x57FF74
+#define AR6003_REV3_RAM_RESERVE_SIZE            512
+
+#define AR6003_BOARD_EXT_DATA_ADDRESS           0x57E600
+
+/* # of u32 entries in targregs, used by DIAG_FETCH_TARG_REGS */
+#define AR6003_FETCH_TARG_REGS_COUNT 64
+
+#endif /* !__ASSEMBLER__ */
+
+#endif /* __TARGADDRS_H__ */
diff --git a/drivers/staging/ath6kl/include/common/testcmd.h b/drivers/staging/ath6kl/include/common/testcmd.h
new file mode 100644
index 00000000000..7d94aee508b
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/testcmd.h
@@ -0,0 +1,185 @@
+//------------------------------------------------------------------------------
+// <copyright file="testcmd.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef  TESTCMD_H_
+#define  TESTCMD_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef AR6002_REV2
+#define TCMD_MAX_RATES 12
+#else
+#define TCMD_MAX_RATES 28
+#endif
+
+typedef enum {
+    ZEROES_PATTERN = 0,
+    ONES_PATTERN,
+    REPEATING_10,
+    PN7_PATTERN,
+    PN9_PATTERN,
+    PN15_PATTERN
+}TX_DATA_PATTERN;
+
+/* Continuous tx
+   mode : TCMD_CONT_TX_OFF - Disabling continuous tx
+          TCMD_CONT_TX_SINE - Enable continuous unmodulated tx
+          TCMD_CONT_TX_FRAME- Enable continuous modulated tx
+   freq : Channel freq in Mhz. (e.g 2412 for channel 1 in 11 g)
+dataRate: 0 - 1 Mbps
+          1 - 2 Mbps
+          2 - 5.5 Mbps
+          3 - 11 Mbps
+          4 - 6 Mbps
+          5 - 9 Mbps
+          6 - 12 Mbps
+          7 - 18 Mbps
+          8 - 24 Mbps
+          9 - 36 Mbps
+         10 - 28 Mbps
+         11 - 54 Mbps
+  txPwr: Tx power in dBm[5 -11] for unmod Tx, [5-14] for mod Tx
+antenna:  1 - one antenna
+          2 - two antenna
+Note : Enable/disable continuous tx test cmd works only when target is awake.
+*/
+
+typedef enum {
+    TCMD_CONT_TX_OFF = 0,
+    TCMD_CONT_TX_SINE,
+    TCMD_CONT_TX_FRAME,
+    TCMD_CONT_TX_TX99,
+    TCMD_CONT_TX_TX100
+} TCMD_CONT_TX_MODE;
+
+typedef enum {
+    TCMD_WLAN_MODE_NOHT = 0,
+    TCMD_WLAN_MODE_HT20 = 1,
+    TCMD_WLAN_MODE_HT40PLUS = 2,
+    TCMD_WLAN_MODE_HT40MINUS = 3,
+} TCMD_WLAN_MODE;
+
+typedef PREPACK struct {
+    u32 testCmdId;
+    u32 mode;
+    u32 freq;
+    u32 dataRate;
+    s32 txPwr;
+    u32 antenna;
+    u32 enANI;
+    u32 scramblerOff;
+    u32 aifsn;
+    u16 pktSz;
+    u16 txPattern;
+    u32 shortGuard;
+    u32 numPackets;
+    u32 wlanMode;
+} POSTPACK TCMD_CONT_TX;
+
+#define TCMD_TXPATTERN_ZERONE                 0x1
+#define TCMD_TXPATTERN_ZERONE_DIS_SCRAMBLE    0x2
+
+/* Continuous Rx
+ act: TCMD_CONT_RX_PROMIS - promiscuous mode (accept all incoming frames)
+      TCMD_CONT_RX_FILTER - filter mode (accept only frames with dest
+                                             address equal specified
+                                             mac address (set via act =3)
+      TCMD_CONT_RX_REPORT  off mode  (disable cont rx mode and get the
+                                          report from the last cont
+                                          Rx test)
+
+     TCMD_CONT_RX_SETMAC - set MacAddr mode (sets the MAC address for the
+                                                 target. This Overrides
+                                                 the default MAC address.)
+
+*/
+typedef enum {
+    TCMD_CONT_RX_PROMIS =0,
+    TCMD_CONT_RX_FILTER,
+    TCMD_CONT_RX_REPORT,
+    TCMD_CONT_RX_SETMAC,
+    TCMD_CONT_RX_SET_ANT_SWITCH_TABLE
+} TCMD_CONT_RX_ACT;
+
+typedef PREPACK struct {
+    u32 testCmdId;
+    u32 act;
+    u32 enANI;
+    PREPACK union {
+        struct PREPACK TCMD_CONT_RX_PARA {
+            u32 freq;
+            u32 antenna;
+            u32 wlanMode;
+        } POSTPACK para;
+        struct PREPACK TCMD_CONT_RX_REPORT {
+            u32 totalPkt;
+            s32 rssiInDBm;
+            u32 crcErrPkt;
+            u32 secErrPkt;
+            u16 rateCnt[TCMD_MAX_RATES];
+            u16 rateCntShortGuard[TCMD_MAX_RATES];
+        } POSTPACK report;
+        struct PREPACK TCMD_CONT_RX_MAC {
+            u8    addr[ATH_MAC_LEN];
+        } POSTPACK mac;
+        struct PREPACK TCMD_CONT_RX_ANT_SWITCH_TABLE {
+            u32 antswitch1;
+            u32 antswitch2;
+        }POSTPACK antswitchtable;
+    } POSTPACK u;
+} POSTPACK TCMD_CONT_RX;
+
+/* Force sleep/wake  test cmd
+ mode: TCMD_PM_WAKEUP - Wakeup the target
+       TCMD_PM_SLEEP - Force the target to sleep.
+ */
+typedef enum {
+    TCMD_PM_WAKEUP = 1, /* be consistent with target */
+    TCMD_PM_SLEEP,
+    TCMD_PM_DEEPSLEEP
+} TCMD_PM_MODE;
+
+typedef PREPACK struct {
+    u32 testCmdId;
+    u32 mode;
+} POSTPACK TCMD_PM;
+
+typedef enum {
+    TCMD_CONT_TX_ID,
+    TCMD_CONT_RX_ID,
+    TCMD_PM_ID
+} TCMD_ID;
+
+typedef PREPACK union {
+          TCMD_CONT_TX contTx;
+          TCMD_CONT_RX contRx;
+          TCMD_PM pm;
+} POSTPACK TEST_CMD;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* TESTCMD_H_ */
diff --git a/drivers/staging/ath6kl/include/common/tlpm.h b/drivers/staging/ath6kl/include/common/tlpm.h
new file mode 100644
index 00000000000..659b1c07ba9
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/tlpm.h
@@ -0,0 +1,38 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __TLPM_H__
+#define __TLPM_H__
+
+/* idle timeout in 16-bit value as in HOST_INTEREST hi_hci_uart_pwr_mgmt_params */
+#define TLPM_DEFAULT_IDLE_TIMEOUT_MS         1000
+/* hex in LSB and MSB for HCI command */
+#define TLPM_DEFAULT_IDLE_TIMEOUT_LSB        0xE8
+#define TLPM_DEFAULT_IDLE_TIMEOUT_MSB        0x3
+
+/* wakeup timeout in 8-bit value as in HOST_INTEREST hi_hci_uart_pwr_mgmt_params */
+#define TLPM_DEFAULT_WAKEUP_TIMEOUT_MS       10
+
+/* default UART FC polarity is low */
+#define TLPM_DEFAULT_UART_FC_POLARITY        0
+
+#endif
diff --git a/drivers/staging/ath6kl/include/common/wlan_defs.h b/drivers/staging/ath6kl/include/common/wlan_defs.h
new file mode 100644
index 00000000000..03e4d23788c
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/wlan_defs.h
@@ -0,0 +1,79 @@
+//------------------------------------------------------------------------------
+// <copyright file="wlan_defs.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef __WLAN_DEFS_H__
+#define __WLAN_DEFS_H__
+
+/*
+ * This file contains WLAN definitions that may be used across both
+ * Host and Target software.  
+ */
+
+typedef enum {
+    MODE_11A        = 0,   /* 11a Mode */
+    MODE_11G        = 1,   /* 11b/g Mode */
+    MODE_11B        = 2,   /* 11b Mode */
+    MODE_11GONLY    = 3,   /* 11g only Mode */
+#ifdef SUPPORT_11N
+    MODE_11NA_HT20   = 4,  /* 11a HT20 mode */
+    MODE_11NG_HT20   = 5,  /* 11g HT20 mode */
+    MODE_11NA_HT40   = 6,  /* 11a HT40 mode */
+    MODE_11NG_HT40   = 7,  /* 11g HT40 mode */
+    MODE_UNKNOWN    = 8,
+    MODE_MAX        = 8
+#else
+    MODE_UNKNOWN    = 4,
+    MODE_MAX        = 4
+#endif
+} WLAN_PHY_MODE;
+
+typedef enum {
+    WLAN_11A_CAPABILITY   = 1,
+    WLAN_11G_CAPABILITY   = 2,
+    WLAN_11AG_CAPABILITY  = 3,
+}WLAN_CAPABILITY;
+
+#ifdef SUPPORT_11N
+typedef unsigned long A_RATEMASK;
+#else
+typedef unsigned short A_RATEMASK;
+#endif
+
+#ifdef SUPPORT_11N
+#define IS_MODE_11A(mode)       (((mode) == MODE_11A) || \
+                                 ((mode) == MODE_11NA_HT20) || \
+                                 ((mode) == MODE_11NA_HT40))
+#define IS_MODE_11B(mode)       ((mode) == MODE_11B)
+#define IS_MODE_11G(mode)       (((mode) == MODE_11G) || \
+                                 ((mode) == MODE_11GONLY) || \
+                                 ((mode) == MODE_11NG_HT20) || \
+                                 ((mode) == MODE_11NG_HT40))
+#define IS_MODE_11GONLY(mode)   ((mode) == MODE_11GONLY)
+#else
+#define IS_MODE_11A(mode)       ((mode) == MODE_11A)
+#define IS_MODE_11B(mode)       ((mode) == MODE_11B)
+#define IS_MODE_11G(mode)       (((mode) == MODE_11G) || \
+                                 ((mode) == MODE_11GONLY))
+#define IS_MODE_11GONLY(mode)   ((mode) == MODE_11GONLY)
+#endif /* SUPPORT_11N */
+
+#endif /* __WLANDEFS_H__ */
diff --git a/drivers/staging/ath6kl/include/common/wmi.h b/drivers/staging/ath6kl/include/common/wmi.h
new file mode 100644
index 00000000000..d9687443d32
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/wmi.h
@@ -0,0 +1,3220 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+//
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+/*
+ * This file contains the definitions of the WMI protocol specified in the
+ * Wireless Module Interface (WMI).  It includes definitions of all the
+ * commands and events. Commands are messages from the host to the WM.
+ * Events and Replies are messages from the WM to the host.
+ *
+ * Ownership of correctness in regards to commands
+ * belongs to the host driver and the WMI is not required to validate
+ * parameters for value, proper range, or any other checking.
+ *
+ */
+
+#ifndef _WMI_H_
+#define _WMI_H_
+
+#include "wmix.h"
+#include "wlan_defs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define HTC_PROTOCOL_VERSION    0x0002
+#define HTC_PROTOCOL_REVISION   0x0000
+
+#define WMI_PROTOCOL_VERSION    0x0002
+#define WMI_PROTOCOL_REVISION   0x0000
+
+#define ATH_MAC_LEN             6               /* length of mac in bytes */
+#define WMI_CMD_MAX_LEN         100
+#define WMI_CONTROL_MSG_MAX_LEN     256
+#define WMI_OPT_CONTROL_MSG_MAX_LEN 1536
+#define IS_ETHERTYPE(_typeOrLen)        ((_typeOrLen) >= 0x0600)
+#define RFC1042OUI      {0x00, 0x00, 0x00}
+
+#define IP_ETHERTYPE 0x0800
+
+#define WMI_IMPLICIT_PSTREAM 0xFF
+#define WMI_MAX_THINSTREAM 15
+
+#ifdef AR6002_REV2
+#define IBSS_MAX_NUM_STA          4
+#else
+#define IBSS_MAX_NUM_STA          8
+#endif
+
+PREPACK struct host_app_area_s {
+    u32 wmi_protocol_ver;
+} POSTPACK;
+
+/*
+ * Data Path
+ */
+typedef PREPACK struct {
+    u8 dstMac[ATH_MAC_LEN];
+    u8 srcMac[ATH_MAC_LEN];
+    u16 typeOrLen;
+} POSTPACK ATH_MAC_HDR;
+
+typedef PREPACK struct {
+    u8 dsap;
+    u8 ssap;
+    u8 cntl;
+    u8 orgCode[3];
+    u16 etherType;
+} POSTPACK ATH_LLC_SNAP_HDR;
+
+typedef enum {
+    DATA_MSGTYPE = 0x0,
+    CNTL_MSGTYPE,
+    SYNC_MSGTYPE,
+    OPT_MSGTYPE,
+} WMI_MSG_TYPE;
+
+
+/*
+ * Macros for operating on WMI_DATA_HDR (info) field
+ */
+
+#define WMI_DATA_HDR_MSG_TYPE_MASK  0x03
+#define WMI_DATA_HDR_MSG_TYPE_SHIFT 0
+#define WMI_DATA_HDR_UP_MASK        0x07
+#define WMI_DATA_HDR_UP_SHIFT       2
+/* In AP mode, the same bit (b5) is used to indicate Power save state in
+ * the Rx dir and More data bit state in the tx direction.
+ */
+#define WMI_DATA_HDR_PS_MASK        0x1
+#define WMI_DATA_HDR_PS_SHIFT       5
+
+#define WMI_DATA_HDR_MORE_MASK      0x1
+#define WMI_DATA_HDR_MORE_SHIFT     5
+
+typedef enum {
+    WMI_DATA_HDR_DATA_TYPE_802_3 = 0,
+    WMI_DATA_HDR_DATA_TYPE_802_11,
+    WMI_DATA_HDR_DATA_TYPE_ACL, /* used to be used for the PAL */
+} WMI_DATA_HDR_DATA_TYPE;
+
+#define WMI_DATA_HDR_DATA_TYPE_MASK     0x3
+#define WMI_DATA_HDR_DATA_TYPE_SHIFT    6
+
+#define WMI_DATA_HDR_SET_MORE_BIT(h) ((h)->info |= (WMI_DATA_HDR_MORE_MASK << WMI_DATA_HDR_MORE_SHIFT))
+
+#define WMI_DATA_HDR_IS_MSG_TYPE(h, t)  (((h)->info & (WMI_DATA_HDR_MSG_TYPE_MASK)) == (t))
+#define WMI_DATA_HDR_SET_MSG_TYPE(h, t) (h)->info = (((h)->info & ~(WMI_DATA_HDR_MSG_TYPE_MASK << WMI_DATA_HDR_MSG_TYPE_SHIFT)) | (t << WMI_DATA_HDR_MSG_TYPE_SHIFT))
+#define WMI_DATA_HDR_GET_UP(h)    (((h)->info >> WMI_DATA_HDR_UP_SHIFT) & WMI_DATA_HDR_UP_MASK)
+#define WMI_DATA_HDR_SET_UP(h, p) (h)->info = (((h)->info & ~(WMI_DATA_HDR_UP_MASK << WMI_DATA_HDR_UP_SHIFT)) | (p << WMI_DATA_HDR_UP_SHIFT))
+
+#define WMI_DATA_HDR_GET_DATA_TYPE(h)   (((h)->info >> WMI_DATA_HDR_DATA_TYPE_SHIFT) & WMI_DATA_HDR_DATA_TYPE_MASK)
+#define WMI_DATA_HDR_SET_DATA_TYPE(h, p) (h)->info = (((h)->info & ~(WMI_DATA_HDR_DATA_TYPE_MASK << WMI_DATA_HDR_DATA_TYPE_SHIFT)) | ((p) << WMI_DATA_HDR_DATA_TYPE_SHIFT))
+
+#define WMI_DATA_HDR_GET_DOT11(h)   (WMI_DATA_HDR_GET_DATA_TYPE((h)) == WMI_DATA_HDR_DATA_TYPE_802_11)
+#define WMI_DATA_HDR_SET_DOT11(h, p) WMI_DATA_HDR_SET_DATA_TYPE((h), (p))
+
+/* Macros for operating on WMI_DATA_HDR (info2) field */
+#define WMI_DATA_HDR_SEQNO_MASK     0xFFF
+#define WMI_DATA_HDR_SEQNO_SHIFT    0
+
+#define WMI_DATA_HDR_AMSDU_MASK     0x1
+#define WMI_DATA_HDR_AMSDU_SHIFT    12
+
+#define WMI_DATA_HDR_META_MASK      0x7
+#define WMI_DATA_HDR_META_SHIFT     13
+
+#define GET_SEQ_NO(_v)                  ((_v) & WMI_DATA_HDR_SEQNO_MASK)
+#define GET_ISMSDU(_v)                  ((_v) & WMI_DATA_HDR_AMSDU_MASK)
+
+#define WMI_DATA_HDR_GET_SEQNO(h)        GET_SEQ_NO((h)->info2 >> WMI_DATA_HDR_SEQNO_SHIFT)
+#define WMI_DATA_HDR_SET_SEQNO(h, _v)   ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_SEQNO_MASK << WMI_DATA_HDR_SEQNO_SHIFT)) | (GET_SEQ_NO(_v) << WMI_DATA_HDR_SEQNO_SHIFT))
+
+#define WMI_DATA_HDR_IS_AMSDU(h)        GET_ISMSDU((h)->info2 >> WMI_DATA_HDR_AMSDU_SHIFT)
+#define WMI_DATA_HDR_SET_AMSDU(h, _v)   ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_AMSDU_MASK << WMI_DATA_HDR_AMSDU_SHIFT)) | (GET_ISMSDU(_v) << WMI_DATA_HDR_AMSDU_SHIFT))
+
+#define WMI_DATA_HDR_GET_META(h)        (((h)->info2 >> WMI_DATA_HDR_META_SHIFT) & WMI_DATA_HDR_META_MASK)
+#define WMI_DATA_HDR_SET_META(h, _v)    ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_META_MASK << WMI_DATA_HDR_META_SHIFT)) | ((_v) << WMI_DATA_HDR_META_SHIFT))
+
+/* Macros for operating on WMI_DATA_HDR (info3) field */
+#define WMI_DATA_HDR_DEVID_MASK      0xF
+#define WMI_DATA_HDR_DEVID_SHIFT     0
+#define GET_DEVID(_v)                ((_v) & WMI_DATA_HDR_DEVID_MASK)
+
+#define WMI_DATA_HDR_GET_DEVID(h) \
+        (((h)->info3 >> WMI_DATA_HDR_DEVID_SHIFT) & WMI_DATA_HDR_DEVID_MASK)
+#define WMI_DATA_HDR_SET_DEVID(h, _v) \
+        ((h)->info3 = ((h)->info3 & ~(WMI_DATA_HDR_DEVID_MASK << WMI_DATA_HDR_DEVID_SHIFT)) | (GET_DEVID(_v) << WMI_DATA_HDR_DEVID_SHIFT))
+
+typedef PREPACK struct {
+    s8 rssi;
+    u8 info;               /* usage of 'info' field(8-bit):
+                                     *  b1:b0       - WMI_MSG_TYPE
+                                     *  b4:b3:b2    - UP(tid)
+                                     *  b5          - Used in AP mode. More-data in tx dir, PS in rx.
+                                     *  b7:b6       -  Dot3 header(0),
+                                     *                 Dot11 Header(1),
+                                     *                 ACL data(2)
+                                     */
+
+    u16 info2;              /* usage of 'info2' field(16-bit):
+                                     * b11:b0       - seq_no
+                                     * b12          - A-MSDU?
+                                     * b15:b13      - META_DATA_VERSION 0 - 7
+                                     */
+    u16 info3;
+} POSTPACK WMI_DATA_HDR;
+
+/*
+ *  TX META VERSION DEFINITIONS
+ */
+#define WMI_MAX_TX_META_SZ  (12)
+#define WMI_MAX_TX_META_VERSION (7)
+#define WMI_META_VERSION_1 (0x01)
+#define WMI_META_VERSION_2 (0X02)
+
+#define WMI_ACL_TO_DOT11_HEADROOM   36
+
+#if 0 /* removed to prevent compile errors for WM.. */
+typedef PREPACK struct {
+/* intentionally empty. Default version is no meta data. */
+} POSTPACK WMI_TX_META_V0;
+#endif
+
+typedef PREPACK struct {
+    u8 pktID;           /* The packet ID to identify the tx request */
+    u8 ratePolicyID;    /* The rate policy to be used for the tx of this frame */
+} POSTPACK WMI_TX_META_V1;
+
+
+#define WMI_CSUM_DIR_TX (0x1)
+#define TX_CSUM_CALC_FILL (0x1)
+typedef PREPACK struct {
+    u8 csumStart;       /*Offset from start of the WMI header for csum calculation to begin */
+    u8 csumDest;        /*Offset from start of WMI header where final csum goes*/
+    u8 csumFlags;    /*number of bytes over which csum is calculated*/
+} POSTPACK WMI_TX_META_V2;
+
+
+/*
+ *  RX META VERSION DEFINITIONS
+ */
+/* if RX meta data is present at all then the meta data field
+ *  will consume WMI_MAX_RX_META_SZ bytes of space between the
+ *  WMI_DATA_HDR and the payload. How much of the available
+ *  Meta data is actually used depends on which meta data
+ *  version is active. */
+#define WMI_MAX_RX_META_SZ  (12)
+#define WMI_MAX_RX_META_VERSION (7)
+
+#define WMI_RX_STATUS_OK            0 /* success */
+#define WMI_RX_STATUS_DECRYPT_ERR   1 /* decrypt error */
+#define WMI_RX_STATUS_MIC_ERR       2 /* tkip MIC error */
+#define WMI_RX_STATUS_ERR           3 /* undefined error */
+
+#define WMI_RX_FLAGS_AGGR           0x0001 /* part of AGGR */
+#define WMI_RX_FlAGS_STBC           0x0002 /* used STBC */
+#define WMI_RX_FLAGS_SGI            0x0004 /* used SGI */
+#define WMI_RX_FLAGS_HT             0x0008 /* is HT packet */
+/* the flags field is also used to store the CRYPTO_TYPE of the frame
+ * that value is shifted by WMI_RX_FLAGS_CRYPTO_SHIFT */
+#define WMI_RX_FLAGS_CRYPTO_SHIFT   4
+#define WMI_RX_FLAGS_CRYPTO_MASK    0x1f
+#define WMI_RX_META_GET_CRYPTO(flags) (((flags) >> WMI_RX_FLAGS_CRYPTO_SHIFT) & WMI_RX_FLAGS_CRYPTO_MASK)
+
+#if 0 /* removed to prevent compile errors for WM.. */
+typedef PREPACK struct {
+/* intentionally empty. Default version is no meta data. */
+} POSTPACK WMI_RX_META_VERSION_0;
+#endif
+
+typedef PREPACK struct {
+    u8 status; /* one of WMI_RX_STATUS_... */
+    u8 rix;    /* rate index mapped to rate at which this packet was received. */
+    u8 rssi;   /* rssi of packet */
+    u8 channel;/* rf channel during packet reception */
+    u16 flags;  /* a combination of WMI_RX_FLAGS_... */
+} POSTPACK WMI_RX_META_V1;
+
+#define RX_CSUM_VALID_FLAG (0x1)
+typedef PREPACK struct {
+    u16 csum;
+    u8 csumFlags;/* bit 0 set -partial csum valid
+                             bit 1 set -test mode */
+} POSTPACK WMI_RX_META_V2;
+
+
+
+#define WMI_GET_DEVICE_ID(info1) ((info1) & 0xF)
+/* Macros for operating on WMI_CMD_HDR (info1) field */
+#define WMI_CMD_HDR_DEVID_MASK      0xF
+#define WMI_CMD_HDR_DEVID_SHIFT     0
+#define GET_CMD_DEVID(_v)           ((_v) & WMI_CMD_HDR_DEVID_MASK)
+
+#define WMI_CMD_HDR_GET_DEVID(h) \
+        (((h)->info1 >> WMI_CMD_HDR_DEVID_SHIFT) & WMI_CMD_HDR_DEVID_MASK)
+#define WMI_CMD_HDR_SET_DEVID(h, _v) \
+        ((h)->info1 = ((h)->info1 & \
+                ~(WMI_CMD_HDR_DEVID_MASK << WMI_CMD_HDR_DEVID_SHIFT)) | \
+                 (GET_CMD_DEVID(_v) << WMI_CMD_HDR_DEVID_SHIFT))
+
+/*
+ * Control Path
+ */
+typedef PREPACK struct {
+    u16 commandId;
+/*
+ * info1 - 16 bits
+ * b03:b00 - id
+ * b15:b04 - unused
+ */
+    u16 info1;
+
+    u16 reserved;      /* For alignment */
+} POSTPACK WMI_CMD_HDR;        /* used for commands and events */
+
+/*
+ * List of Commnands
+ */
+typedef enum {
+    WMI_CONNECT_CMDID           = 0x0001,
+    WMI_RECONNECT_CMDID,
+    WMI_DISCONNECT_CMDID,
+    WMI_SYNCHRONIZE_CMDID,
+    WMI_CREATE_PSTREAM_CMDID,
+    WMI_DELETE_PSTREAM_CMDID,
+    WMI_START_SCAN_CMDID,
+    WMI_SET_SCAN_PARAMS_CMDID,
+    WMI_SET_BSS_FILTER_CMDID,
+    WMI_SET_PROBED_SSID_CMDID,               /* 10 */
+    WMI_SET_LISTEN_INT_CMDID,
+    WMI_SET_BMISS_TIME_CMDID,
+    WMI_SET_DISC_TIMEOUT_CMDID,
+    WMI_GET_CHANNEL_LIST_CMDID,
+    WMI_SET_BEACON_INT_CMDID,
+    WMI_GET_STATISTICS_CMDID,
+    WMI_SET_CHANNEL_PARAMS_CMDID,
+    WMI_SET_POWER_MODE_CMDID,
+    WMI_SET_IBSS_PM_CAPS_CMDID,
+    WMI_SET_POWER_PARAMS_CMDID,              /* 20 */
+    WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
+    WMI_ADD_CIPHER_KEY_CMDID,
+    WMI_DELETE_CIPHER_KEY_CMDID,
+    WMI_ADD_KRK_CMDID,
+    WMI_DELETE_KRK_CMDID,
+    WMI_SET_PMKID_CMDID,
+    WMI_SET_TX_PWR_CMDID,
+    WMI_GET_TX_PWR_CMDID,
+    WMI_SET_ASSOC_INFO_CMDID,
+    WMI_ADD_BAD_AP_CMDID,                    /* 30 */
+    WMI_DELETE_BAD_AP_CMDID,
+    WMI_SET_TKIP_COUNTERMEASURES_CMDID,
+    WMI_RSSI_THRESHOLD_PARAMS_CMDID,
+    WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
+    WMI_SET_ACCESS_PARAMS_CMDID,
+    WMI_SET_RETRY_LIMITS_CMDID,
+    WMI_SET_OPT_MODE_CMDID,
+    WMI_OPT_TX_FRAME_CMDID,
+    WMI_SET_VOICE_PKT_SIZE_CMDID,
+    WMI_SET_MAX_SP_LEN_CMDID,                /* 40 */
+    WMI_SET_ROAM_CTRL_CMDID,
+    WMI_GET_ROAM_TBL_CMDID,
+    WMI_GET_ROAM_DATA_CMDID,
+    WMI_ENABLE_RM_CMDID,
+    WMI_SET_MAX_OFFHOME_DURATION_CMDID,
+    WMI_EXTENSION_CMDID,                        /* Non-wireless extensions */
+    WMI_SNR_THRESHOLD_PARAMS_CMDID,
+    WMI_LQ_THRESHOLD_PARAMS_CMDID,
+    WMI_SET_LPREAMBLE_CMDID,
+    WMI_SET_RTS_CMDID,                       /* 50 */
+    WMI_CLR_RSSI_SNR_CMDID,
+    WMI_SET_FIXRATES_CMDID,
+    WMI_GET_FIXRATES_CMDID,
+    WMI_SET_AUTH_MODE_CMDID,
+    WMI_SET_REASSOC_MODE_CMDID,
+    WMI_SET_WMM_CMDID,
+    WMI_SET_WMM_TXOP_CMDID,
+    WMI_TEST_CMDID,
+    /* COEX AR6002 only*/
+    WMI_SET_BT_STATUS_CMDID,                
+    WMI_SET_BT_PARAMS_CMDID,                /* 60 */
+
+    WMI_SET_KEEPALIVE_CMDID,
+    WMI_GET_KEEPALIVE_CMDID,
+    WMI_SET_APPIE_CMDID,
+    WMI_GET_APPIE_CMDID,
+    WMI_SET_WSC_STATUS_CMDID,
+
+    /* Wake on Wireless */
+    WMI_SET_HOST_SLEEP_MODE_CMDID,
+    WMI_SET_WOW_MODE_CMDID,
+    WMI_GET_WOW_LIST_CMDID,
+    WMI_ADD_WOW_PATTERN_CMDID,
+    WMI_DEL_WOW_PATTERN_CMDID,               /* 70 */
+
+    WMI_SET_FRAMERATES_CMDID,
+    WMI_SET_AP_PS_CMDID,
+    WMI_SET_QOS_SUPP_CMDID,
+    /* WMI_THIN_RESERVED_... mark the start and end
+     * values for WMI_THIN_RESERVED command IDs. These
+     * command IDs can be found in wmi_thin.h */
+    WMI_THIN_RESERVED_START = 0x8000,
+    WMI_THIN_RESERVED_END = 0x8fff,
+    /*
+     * Developer commands starts at 0xF000
+     */
+    WMI_SET_BITRATE_CMDID = 0xF000,
+    WMI_GET_BITRATE_CMDID,
+    WMI_SET_WHALPARAM_CMDID,
+
+
+    /*Should add the new command to the tail for compatible with
+     * etna.
+     */
+    WMI_SET_MAC_ADDRESS_CMDID,
+    WMI_SET_AKMP_PARAMS_CMDID,
+    WMI_SET_PMKID_LIST_CMDID,
+    WMI_GET_PMKID_LIST_CMDID,
+    WMI_ABORT_SCAN_CMDID,
+    WMI_SET_TARGET_EVENT_REPORT_CMDID,
+
+    // Unused
+    WMI_UNUSED1,
+    WMI_UNUSED2,
+
+    /*
+     * AP mode commands
+     */
+    WMI_AP_HIDDEN_SSID_CMDID,
+    WMI_AP_SET_NUM_STA_CMDID,
+    WMI_AP_ACL_POLICY_CMDID,
+    WMI_AP_ACL_MAC_LIST_CMDID,
+    WMI_AP_CONFIG_COMMIT_CMDID,
+    WMI_AP_SET_MLME_CMDID,
+    WMI_AP_SET_PVB_CMDID,
+    WMI_AP_CONN_INACT_CMDID,
+    WMI_AP_PROT_SCAN_TIME_CMDID,
+    WMI_AP_SET_COUNTRY_CMDID,
+    WMI_AP_SET_DTIM_CMDID,
+    WMI_AP_MODE_STAT_CMDID,
+
+    WMI_SET_IP_CMDID,
+    WMI_SET_PARAMS_CMDID,
+    WMI_SET_MCAST_FILTER_CMDID,
+    WMI_DEL_MCAST_FILTER_CMDID,
+
+    WMI_ALLOW_AGGR_CMDID,
+    WMI_ADDBA_REQ_CMDID,
+    WMI_DELBA_REQ_CMDID,
+    WMI_SET_HT_CAP_CMDID,
+    WMI_SET_HT_OP_CMDID,
+    WMI_SET_TX_SELECT_RATES_CMDID,
+    WMI_SET_TX_SGI_PARAM_CMDID,
+    WMI_SET_RATE_POLICY_CMDID,
+
+    WMI_HCI_CMD_CMDID,
+    WMI_RX_FRAME_FORMAT_CMDID,
+    WMI_SET_THIN_MODE_CMDID,
+    WMI_SET_BT_WLAN_CONN_PRECEDENCE_CMDID,
+
+    WMI_AP_SET_11BG_RATESET_CMDID,
+    WMI_SET_PMK_CMDID,
+    WMI_MCAST_FILTER_CMDID,
+    /* COEX CMDID AR6003*/
+    WMI_SET_BTCOEX_FE_ANT_CMDID,
+    WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID,
+    WMI_SET_BTCOEX_SCO_CONFIG_CMDID,
+    WMI_SET_BTCOEX_A2DP_CONFIG_CMDID,
+    WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID,
+    WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID,
+    WMI_SET_BTCOEX_DEBUG_CMDID,
+    WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID,
+    WMI_GET_BTCOEX_STATS_CMDID,
+    WMI_GET_BTCOEX_CONFIG_CMDID,
+
+        WMI_SET_DFS_ENABLE_CMDID,   /* F034 */
+        WMI_SET_DFS_MINRSSITHRESH_CMDID,
+        WMI_SET_DFS_MAXPULSEDUR_CMDID,
+        WMI_DFS_RADAR_DETECTED_CMDID,
+
+        /* P2P CMDS */
+        WMI_P2P_SET_CONFIG_CMDID,    /* F038 */
+        WMI_WPS_SET_CONFIG_CMDID,
+        WMI_SET_REQ_DEV_ATTR_CMDID,
+        WMI_P2P_FIND_CMDID,
+        WMI_P2P_STOP_FIND_CMDID,
+        WMI_P2P_GO_NEG_START_CMDID,
+        WMI_P2P_LISTEN_CMDID,
+
+        WMI_CONFIG_TX_MAC_RULES_CMDID,    /* F040 */
+        WMI_SET_PROMISCUOUS_MODE_CMDID,
+        WMI_RX_FRAME_FILTER_CMDID,
+        WMI_SET_CHANNEL_CMDID,
+
+        /* WAC commands */
+        WMI_ENABLE_WAC_CMDID,
+        WMI_WAC_SCAN_REPLY_CMDID,
+        WMI_WAC_CTRL_REQ_CMDID,
+        WMI_SET_DIV_PARAMS_CMDID,
+
+        WMI_GET_PMK_CMDID,
+        WMI_SET_PASSPHRASE_CMDID,
+        WMI_SEND_ASSOC_RES_CMDID,
+        WMI_SET_ASSOC_REQ_RELAY_CMDID,
+        WMI_GET_RFKILL_MODE_CMDID,
+
+        /* ACS command, consists of sub-commands */
+        WMI_ACS_CTRL_CMDID,
+
+        /* Ultra low power store / recall commands */
+        WMI_STORERECALL_CONFIGURE_CMDID,
+        WMI_STORERECALL_RECALL_CMDID,
+        WMI_STORERECALL_HOST_READY_CMDID,
+        WMI_FORCE_TARGET_ASSERT_CMDID,
+        WMI_SET_EXCESS_TX_RETRY_THRES_CMDID,
+} WMI_COMMAND_ID;
+
+/*
+ * Frame Types
+ */
+typedef enum {
+    WMI_FRAME_BEACON        =   0,
+    WMI_FRAME_PROBE_REQ,
+    WMI_FRAME_PROBE_RESP,
+    WMI_FRAME_ASSOC_REQ,
+    WMI_FRAME_ASSOC_RESP,
+    WMI_NUM_MGMT_FRAME
+} WMI_MGMT_FRAME_TYPE;
+
+/*
+ * Connect Command
+ */
+typedef enum {
+    INFRA_NETWORK       = 0x01,
+    ADHOC_NETWORK       = 0x02,
+    ADHOC_CREATOR       = 0x04,
+    AP_NETWORK          = 0x10,
+} NETWORK_TYPE;
+
+typedef enum {
+    OPEN_AUTH           = 0x01,
+    SHARED_AUTH         = 0x02,
+    LEAP_AUTH           = 0x04,  /* different from IEEE_AUTH_MODE definitions */
+} DOT11_AUTH_MODE;
+
+enum {
+        AUTH_IDLE,
+        AUTH_OPEN_IN_PROGRESS,
+};
+
+typedef enum {
+    NONE_AUTH           = 0x01,
+    WPA_AUTH            = 0x02,
+    WPA2_AUTH           = 0x04,
+    WPA_PSK_AUTH        = 0x08,
+    WPA2_PSK_AUTH       = 0x10,
+    WPA_AUTH_CCKM       = 0x20,
+    WPA2_AUTH_CCKM      = 0x40,
+} AUTH_MODE;
+
+typedef enum {
+    NONE_CRYPT          = 0x01,
+    WEP_CRYPT           = 0x02,
+    TKIP_CRYPT          = 0x04,
+    AES_CRYPT           = 0x08,
+#ifdef WAPI_ENABLE
+    WAPI_CRYPT          = 0x10,
+#endif /*WAPI_ENABLE*/
+} CRYPTO_TYPE;
+
+#define WMI_MIN_CRYPTO_TYPE NONE_CRYPT
+#define WMI_MAX_CRYPTO_TYPE (AES_CRYPT + 1)
+
+#ifdef WAPI_ENABLE
+#undef WMI_MAX_CRYPTO_TYPE
+#define WMI_MAX_CRYPTO_TYPE (WAPI_CRYPT + 1)
+#endif /* WAPI_ENABLE */
+
+#ifdef WAPI_ENABLE
+#define IW_ENCODE_ALG_SM4       0x20
+#define IW_AUTH_WAPI_ENABLED    0x20
+#endif
+
+#define WMI_MIN_KEY_INDEX   0
+#define WMI_MAX_KEY_INDEX   3
+
+#ifdef WAPI_ENABLE
+#undef WMI_MAX_KEY_INDEX
+#define WMI_MAX_KEY_INDEX   7 /* wapi grpKey 0-3, prwKey 4-7 */
+#endif /* WAPI_ENABLE */
+
+#define WMI_MAX_KEY_LEN     32
+
+#define WMI_MAX_SSID_LEN    32
+
+typedef enum {
+    CONNECT_ASSOC_POLICY_USER           = 0x0001,
+    CONNECT_SEND_REASSOC                = 0x0002,
+    CONNECT_IGNORE_WPAx_GROUP_CIPHER    = 0x0004,
+    CONNECT_PROFILE_MATCH_DONE          = 0x0008,
+    CONNECT_IGNORE_AAC_BEACON           = 0x0010,
+    CONNECT_CSA_FOLLOW_BSS              = 0x0020,
+    CONNECT_DO_WPA_OFFLOAD              = 0x0040,
+    CONNECT_DO_NOT_DEAUTH               = 0x0080,
+} WMI_CONNECT_CTRL_FLAGS_BITS;
+
+#define DEFAULT_CONNECT_CTRL_FLAGS    (CONNECT_CSA_FOLLOW_BSS)
+
+typedef PREPACK struct {
+    u8 networkType;
+    u8 dot11AuthMode;
+    u8 authMode;
+    u8 pairwiseCryptoType;
+    u8 pairwiseCryptoLen;
+    u8 groupCryptoType;
+    u8 groupCryptoLen;
+    u8 ssidLength;
+    u8     ssid[WMI_MAX_SSID_LEN];
+    u16 channel;
+    u8 bssid[ATH_MAC_LEN];
+    u32 ctrl_flags;
+} POSTPACK WMI_CONNECT_CMD;
+
+/*
+ * WMI_RECONNECT_CMDID
+ */
+typedef PREPACK struct {
+    u16 channel;                    /* hint */
+    u8 bssid[ATH_MAC_LEN];         /* mandatory if set */
+} POSTPACK WMI_RECONNECT_CMD;
+
+#define WMI_PMK_LEN     32
+typedef PREPACK struct {
+    u8 pmk[WMI_PMK_LEN];
+} POSTPACK WMI_SET_PMK_CMD;
+
+/*
+ * WMI_SET_EXCESS_TX_RETRY_THRES_CMDID
+ */
+typedef PREPACK struct {
+    u32 threshold;
+} POSTPACK WMI_SET_EXCESS_TX_RETRY_THRES_CMD;
+
+/*
+ * WMI_ADD_CIPHER_KEY_CMDID
+ */
+typedef enum {
+    PAIRWISE_USAGE      = 0x00,
+    GROUP_USAGE         = 0x01,
+    TX_USAGE            = 0x02,     /* default Tx Key - Static WEP only */
+} KEY_USAGE;
+
+/*
+ * Bit Flag
+ * Bit 0 - Initialise TSC - default is Initialize
+ */
+#define KEY_OP_INIT_TSC       0x01
+#define KEY_OP_INIT_RSC       0x02
+#ifdef WAPI_ENABLE
+#define KEY_OP_INIT_WAPIPN    0x10
+#endif /* WAPI_ENABLE */
+
+#define KEY_OP_INIT_VAL     0x03     /* Default Initialise the TSC & RSC */
+#define KEY_OP_VALID_MASK   0x03
+
+typedef PREPACK struct {
+    u8 keyIndex;
+    u8 keyType;
+    u8 keyUsage;           /* KEY_USAGE */
+    u8 keyLength;
+    u8 keyRSC[8];          /* key replay sequence counter */
+    u8 key[WMI_MAX_KEY_LEN];
+    u8 key_op_ctrl;       /* Additional Key Control information */
+    u8 key_macaddr[ATH_MAC_LEN];
+} POSTPACK WMI_ADD_CIPHER_KEY_CMD;
+
+/*
+ * WMI_DELETE_CIPHER_KEY_CMDID
+ */
+typedef PREPACK struct {
+    u8 keyIndex;
+} POSTPACK WMI_DELETE_CIPHER_KEY_CMD;
+
+#define WMI_KRK_LEN     16
+/*
+ * WMI_ADD_KRK_CMDID
+ */
+typedef PREPACK struct {
+    u8 krk[WMI_KRK_LEN];
+} POSTPACK WMI_ADD_KRK_CMD;
+
+/*
+ * WMI_SET_TKIP_COUNTERMEASURES_CMDID
+ */
+typedef enum {
+    WMI_TKIP_CM_DISABLE = 0x0,
+    WMI_TKIP_CM_ENABLE  = 0x1,
+} WMI_TKIP_CM_CONTROL;
+
+typedef PREPACK struct {
+    u8 cm_en;                     /* WMI_TKIP_CM_CONTROL */
+} POSTPACK WMI_SET_TKIP_COUNTERMEASURES_CMD;
+
+/*
+ * WMI_SET_PMKID_CMDID
+ */
+
+#define WMI_PMKID_LEN 16
+
+typedef enum {
+   PMKID_DISABLE = 0,
+   PMKID_ENABLE  = 1,
+} PMKID_ENABLE_FLG;
+
+typedef PREPACK struct {
+    u8 bssid[ATH_MAC_LEN];
+    u8 enable;                 /* PMKID_ENABLE_FLG */
+    u8 pmkid[WMI_PMKID_LEN];
+} POSTPACK WMI_SET_PMKID_CMD;
+
+/*
+ * WMI_START_SCAN_CMD
+ */
+typedef enum {
+    WMI_LONG_SCAN  = 0,
+    WMI_SHORT_SCAN = 1,
+} WMI_SCAN_TYPE;
+
+typedef PREPACK struct {
+    u32   forceFgScan;
+    u32   isLegacy;        /* For Legacy Cisco AP compatibility */
+    u32 homeDwellTime;   /* Maximum duration in the home channel(milliseconds) */
+    u32 forceScanInterval;    /* Time interval between scans (milliseconds)*/
+    u8 scanType;           /* WMI_SCAN_TYPE */
+    u8 numChannels;            /* how many channels follow */
+    u16 channelList[1];         /* channels in Mhz */
+} POSTPACK WMI_START_SCAN_CMD;
+
+/*
+ * WMI_SET_SCAN_PARAMS_CMDID
+ */
+#define WMI_SHORTSCANRATIO_DEFAULT      3
+/* 
+ *  Warning: ScanCtrlFlag value of 0xFF is used to disable all flags in WMI_SCAN_PARAMS_CMD 
+ *  Do not add any more flags to WMI_SCAN_CTRL_FLAG_BITS
+ */
+typedef enum {
+    CONNECT_SCAN_CTRL_FLAGS = 0x01,    /* set if can scan in the Connect cmd */
+    SCAN_CONNECTED_CTRL_FLAGS = 0x02,  /* set if scan for the SSID it is */
+                                       /* already connected to */
+    ACTIVE_SCAN_CTRL_FLAGS = 0x04,     /* set if enable active scan */
+    ROAM_SCAN_CTRL_FLAGS = 0x08,       /* set if enable roam scan when bmiss and lowrssi */
+    REPORT_BSSINFO_CTRL_FLAGS = 0x10,   /* set if follows customer BSSINFO reporting rule */
+    ENABLE_AUTO_CTRL_FLAGS = 0x20,      /* if disabled, target doesn't
+                                          scan after a disconnect event  */
+    ENABLE_SCAN_ABORT_EVENT = 0x40      /* Scan complete event with canceled status will be generated when a scan is prempted before it gets completed */
+} WMI_SCAN_CTRL_FLAGS_BITS;
+
+#define CAN_SCAN_IN_CONNECT(flags)      (flags & CONNECT_SCAN_CTRL_FLAGS)
+#define CAN_SCAN_CONNECTED(flags)       (flags & SCAN_CONNECTED_CTRL_FLAGS)
+#define ENABLE_ACTIVE_SCAN(flags)       (flags & ACTIVE_SCAN_CTRL_FLAGS)
+#define ENABLE_ROAM_SCAN(flags)         (flags & ROAM_SCAN_CTRL_FLAGS)
+#define CONFIG_REPORT_BSSINFO(flags)     (flags & REPORT_BSSINFO_CTRL_FLAGS)
+#define IS_AUTO_SCAN_ENABLED(flags)      (flags & ENABLE_AUTO_CTRL_FLAGS)
+#define SCAN_ABORT_EVENT_ENABLED(flags) (flags & ENABLE_SCAN_ABORT_EVENT)
+
+#define DEFAULT_SCAN_CTRL_FLAGS         (CONNECT_SCAN_CTRL_FLAGS| SCAN_CONNECTED_CTRL_FLAGS| ACTIVE_SCAN_CTRL_FLAGS| ROAM_SCAN_CTRL_FLAGS | ENABLE_AUTO_CTRL_FLAGS)
+
+
+typedef PREPACK struct {
+    u16 fg_start_period;        /* seconds */
+    u16 fg_end_period;          /* seconds */
+    u16 bg_period;              /* seconds */
+    u16 maxact_chdwell_time;    /* msec */
+    u16 pas_chdwell_time;       /* msec */
+    u8 shortScanRatio;         /* how many shorts scan for one long */
+    u8 scanCtrlFlags;
+    u16 minact_chdwell_time;    /* msec */
+    u16 maxact_scan_per_ssid;   /* max active scans per ssid */
+    u32 max_dfsch_act_time;  /* msecs */
+} POSTPACK WMI_SCAN_PARAMS_CMD;
+
+/*
+ * WMI_SET_BSS_FILTER_CMDID
+ */
+typedef enum {
+    NONE_BSS_FILTER = 0x0,              /* no beacons forwarded */
+    ALL_BSS_FILTER,                     /* all beacons forwarded */
+    PROFILE_FILTER,                     /* only beacons matching profile */
+    ALL_BUT_PROFILE_FILTER,             /* all but beacons matching profile */
+    CURRENT_BSS_FILTER,                 /* only beacons matching current BSS */
+    ALL_BUT_BSS_FILTER,                 /* all but beacons matching BSS */
+    PROBED_SSID_FILTER,                 /* beacons matching probed ssid */
+    LAST_BSS_FILTER,                    /* marker only */
+} WMI_BSS_FILTER;
+
+typedef PREPACK struct {
+    u8 bssFilter;                      /* see WMI_BSS_FILTER */
+    u8 reserved1;                      /* For alignment */
+    u16 reserved2;                      /* For alignment */
+    u32 ieMask;
+} POSTPACK WMI_BSS_FILTER_CMD;
+
+/*
+ * WMI_SET_PROBED_SSID_CMDID
+ */
+#define MAX_PROBED_SSID_INDEX   9
+
+typedef enum {
+    DISABLE_SSID_FLAG  = 0,                  /* disables entry */
+    SPECIFIC_SSID_FLAG = 0x01,               /* probes specified ssid */
+    ANY_SSID_FLAG      = 0x02,               /* probes for any ssid */
+} WMI_SSID_FLAG;
+
+typedef PREPACK struct {
+    u8 entryIndex;                     /* 0 to MAX_PROBED_SSID_INDEX */
+    u8 flag;                           /* WMI_SSID_FLG */
+    u8 ssidLength;
+    u8 ssid[32];
+} POSTPACK WMI_PROBED_SSID_CMD;
+
+/*
+ * WMI_SET_LISTEN_INT_CMDID
+ * The Listen interval is between 15 and 3000 TUs
+ */
+#define MIN_LISTEN_INTERVAL 15
+#define MAX_LISTEN_INTERVAL 5000
+#define MIN_LISTEN_BEACONS 1
+#define MAX_LISTEN_BEACONS 50
+
+typedef PREPACK struct {
+    u16 listenInterval;
+    u16 numBeacons;
+} POSTPACK WMI_LISTEN_INT_CMD;
+
+/*
+ * WMI_SET_BEACON_INT_CMDID
+ */
+typedef PREPACK struct {
+    u16 beaconInterval;
+} POSTPACK WMI_BEACON_INT_CMD;
+
+/*
+ * WMI_SET_BMISS_TIME_CMDID
+ * valid values are between 1000 and 5000 TUs
+ */
+
+#define MIN_BMISS_TIME     1000
+#define MAX_BMISS_TIME     5000
+#define MIN_BMISS_BEACONS  1
+#define MAX_BMISS_BEACONS  50
+
+typedef PREPACK struct {
+    u16 bmissTime;
+    u16 numBeacons;
+} POSTPACK WMI_BMISS_TIME_CMD;
+
+/*
+ * WMI_SET_POWER_MODE_CMDID
+ */
+typedef enum {
+    REC_POWER = 0x01,
+    MAX_PERF_POWER,
+} WMI_POWER_MODE;
+
+typedef PREPACK struct {
+    u8 powerMode;      /* WMI_POWER_MODE */
+} POSTPACK WMI_POWER_MODE_CMD;
+
+typedef PREPACK struct {
+    s8 status;      /* WMI_SET_PARAMS_REPLY */
+} POSTPACK WMI_SET_PARAMS_REPLY;
+
+typedef PREPACK struct {
+    u32 opcode;
+    u32 length;
+    char buffer[1];      /* WMI_SET_PARAMS */
+} POSTPACK WMI_SET_PARAMS_CMD;
+
+typedef PREPACK struct {
+    u8 multicast_mac[ATH_MAC_LEN];      /* WMI_SET_MCAST_FILTER */
+} POSTPACK WMI_SET_MCAST_FILTER_CMD;
+
+typedef PREPACK struct {
+    u8 enable;      /* WMI_MCAST_FILTER */
+} POSTPACK WMI_MCAST_FILTER_CMD;
+
+/*
+ * WMI_SET_POWER_PARAMS_CMDID
+ */
+typedef enum {
+    IGNORE_DTIM = 0x01,
+    NORMAL_DTIM = 0x02,
+    STICK_DTIM  = 0x03,
+    AUTO_DTIM   = 0x04,
+} WMI_DTIM_POLICY;
+
+/* Policy to determnine whether TX should wakeup WLAN if sleeping */
+typedef enum {
+    TX_WAKEUP_UPON_SLEEP = 1,
+    TX_DONT_WAKEUP_UPON_SLEEP = 2
+} WMI_TX_WAKEUP_POLICY_UPON_SLEEP;
+
+/*
+ * Policy to determnine whether power save failure event should be sent to
+ * host during scanning
+ */
+typedef enum {
+    SEND_POWER_SAVE_FAIL_EVENT_ALWAYS = 1,
+    IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN = 2,
+} POWER_SAVE_FAIL_EVENT_POLICY;
+
+typedef PREPACK struct {
+    u16 idle_period;             /* msec */
+    u16 pspoll_number;
+    u16 dtim_policy;
+    u16 tx_wakeup_policy;
+    u16 num_tx_to_wakeup;
+    u16 ps_fail_event_policy;
+} POSTPACK WMI_POWER_PARAMS_CMD;
+
+/* Adhoc power save types */
+typedef enum {
+    ADHOC_PS_DISABLE=1,
+    ADHOC_PS_ATH=2,
+    ADHOC_PS_IEEE=3,
+    ADHOC_PS_OTHER=4,
+} WMI_ADHOC_PS_TYPE;
+
+typedef PREPACK struct {
+    u8 power_saving;
+    u8 ttl; /* number of beacon periods */
+    u16 atim_windows;          /* msec */
+    u16 timeout_value;         /* msec */
+} POSTPACK WMI_IBSS_PM_CAPS_CMD;
+
+/* AP power save types */
+typedef enum {
+    AP_PS_DISABLE=1,
+    AP_PS_ATH=2,
+} WMI_AP_PS_TYPE;
+
+typedef PREPACK struct {
+    u32 idle_time;   /* in msec */
+    u32 ps_period;   /* in usec */
+    u8 sleep_period; /* in ps periods */
+    u8 psType;
+} POSTPACK WMI_AP_PS_CMD;
+
+/*
+ * WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID
+ */
+typedef enum {
+    IGNORE_TIM_ALL_QUEUES_APSD = 0,
+    PROCESS_TIM_ALL_QUEUES_APSD = 1,
+    IGNORE_TIM_SIMULATED_APSD = 2,
+    PROCESS_TIM_SIMULATED_APSD = 3,
+} APSD_TIM_POLICY;
+
+typedef PREPACK struct {
+    u16 psPollTimeout;          /* msec */
+    u16 triggerTimeout;         /* msec */
+    u32 apsdTimPolicy;      /* TIM behavior with  ques APSD enabled. Default is IGNORE_TIM_ALL_QUEUES_APSD */
+    u32 simulatedAPSDTimPolicy;      /* TIM behavior with  simulated APSD enabled. Default is PROCESS_TIM_SIMULATED_APSD */
+} POSTPACK WMI_POWERSAVE_TIMERS_POLICY_CMD;
+
+/*
+ * WMI_SET_VOICE_PKT_SIZE_CMDID
+ */
+typedef PREPACK struct {
+    u16 voicePktSize;
+} POSTPACK WMI_SET_VOICE_PKT_SIZE_CMD;
+
+/*
+ * WMI_SET_MAX_SP_LEN_CMDID
+ */
+typedef enum {
+    DELIVER_ALL_PKT = 0x0,
+    DELIVER_2_PKT = 0x1,
+    DELIVER_4_PKT = 0x2,
+    DELIVER_6_PKT = 0x3,
+} APSD_SP_LEN_TYPE;
+
+typedef PREPACK struct {
+    u8 maxSPLen;
+} POSTPACK WMI_SET_MAX_SP_LEN_CMD;
+
+/*
+ * WMI_SET_DISC_TIMEOUT_CMDID
+ */
+typedef PREPACK struct {
+    u8 disconnectTimeout;          /* seconds */
+} POSTPACK WMI_DISC_TIMEOUT_CMD;
+
+typedef enum {
+    UPLINK_TRAFFIC = 0,
+    DNLINK_TRAFFIC = 1,
+    BIDIR_TRAFFIC = 2,
+} DIR_TYPE;
+
+typedef enum {
+    DISABLE_FOR_THIS_AC = 0,
+    ENABLE_FOR_THIS_AC  = 1,
+    ENABLE_FOR_ALL_AC   = 2,
+} VOICEPS_CAP_TYPE;
+
+typedef enum {
+    TRAFFIC_TYPE_APERIODIC = 0,
+    TRAFFIC_TYPE_PERIODIC = 1,
+}TRAFFIC_TYPE;
+
+/*
+ * WMI_SYNCHRONIZE_CMDID
+ */
+typedef PREPACK struct {
+    u8 dataSyncMap;
+} POSTPACK WMI_SYNC_CMD;
+
+/*
+ * WMI_CREATE_PSTREAM_CMDID
+ */
+typedef PREPACK struct {
+    u32 minServiceInt;           /* in milli-sec */
+    u32 maxServiceInt;           /* in milli-sec */
+    u32 inactivityInt;           /* in milli-sec */
+    u32 suspensionInt;           /* in milli-sec */
+    u32 serviceStartTime;
+    u32 minDataRate;             /* in bps */
+    u32 meanDataRate;            /* in bps */
+    u32 peakDataRate;            /* in bps */
+    u32 maxBurstSize;
+    u32 delayBound;
+    u32 minPhyRate;              /* in bps */
+    u32 sba;
+    u32 mediumTime;
+    u16 nominalMSDU;             /* in octects */
+    u16 maxMSDU;                 /* in octects */
+    u8 trafficClass;
+    u8 trafficDirection;        /* DIR_TYPE */
+    u8 rxQueueNum;
+    u8 trafficType;             /* TRAFFIC_TYPE */
+    u8 voicePSCapability;       /* VOICEPS_CAP_TYPE */
+    u8 tsid;
+    u8 userPriority;            /* 802.1D user priority */
+    u8 nominalPHY;              /* nominal phy rate */
+} POSTPACK WMI_CREATE_PSTREAM_CMD;
+
+/*
+ * WMI_DELETE_PSTREAM_CMDID
+ */
+typedef PREPACK struct {
+    u8 txQueueNumber;
+    u8 rxQueueNumber;
+    u8 trafficDirection;
+    u8 trafficClass;
+    u8 tsid;
+} POSTPACK WMI_DELETE_PSTREAM_CMD;
+
+/*
+ * WMI_SET_CHANNEL_PARAMS_CMDID
+ */
+typedef enum {
+    WMI_11A_MODE  = 0x1,
+    WMI_11G_MODE  = 0x2,
+    WMI_11AG_MODE = 0x3,
+    WMI_11B_MODE  = 0x4,
+    WMI_11GONLY_MODE = 0x5,    
+} WMI_PHY_MODE;
+
+#define WMI_MAX_CHANNELS        32
+
+typedef PREPACK struct {
+    u8 reserved1;
+    u8 scanParam;              /* set if enable scan */
+    u8 phyMode;                /* see WMI_PHY_MODE */
+    u8 numChannels;            /* how many channels follow */
+    u16 channelList[1];         /* channels in Mhz */
+} POSTPACK WMI_CHANNEL_PARAMS_CMD;
+
+
+/*
+ *  WMI_RSSI_THRESHOLD_PARAMS_CMDID
+ *  Setting the polltime to 0 would disable polling.
+ *  Threshold values are in the ascending order, and should agree to:
+ *  (lowThreshold_lowerVal < lowThreshold_upperVal < highThreshold_lowerVal
+ *      < highThreshold_upperVal)
+ */
+
+typedef PREPACK struct WMI_RSSI_THRESHOLD_PARAMS{
+    u32 pollTime;               /* Polling time as a factor of LI */
+    s16 thresholdAbove1_Val;          /* lowest of upper */
+    s16 thresholdAbove2_Val;
+    s16 thresholdAbove3_Val;
+    s16 thresholdAbove4_Val;
+    s16 thresholdAbove5_Val;
+    s16 thresholdAbove6_Val;          /* highest of upper */
+    s16 thresholdBelow1_Val;         /* lowest of bellow */
+    s16 thresholdBelow2_Val;
+    s16 thresholdBelow3_Val;
+    s16 thresholdBelow4_Val;
+    s16 thresholdBelow5_Val;
+    s16 thresholdBelow6_Val;         /* highest of bellow */
+    u8 weight;                  /* "alpha" */
+    u8 reserved[3];
+} POSTPACK  WMI_RSSI_THRESHOLD_PARAMS_CMD;
+
+/*
+ *  WMI_SNR_THRESHOLD_PARAMS_CMDID
+ *  Setting the polltime to 0 would disable polling.
+ */
+
+typedef PREPACK struct WMI_SNR_THRESHOLD_PARAMS{
+    u32 pollTime;               /* Polling time as a factor of LI */
+    u8 weight;                  /* "alpha" */
+    u8 thresholdAbove1_Val;      /* lowest of uppper*/
+    u8 thresholdAbove2_Val;
+    u8 thresholdAbove3_Val;
+    u8 thresholdAbove4_Val;      /* highest of upper */
+    u8 thresholdBelow1_Val;     /* lowest of bellow */
+    u8 thresholdBelow2_Val;
+    u8 thresholdBelow3_Val;
+    u8 thresholdBelow4_Val;     /* highest of bellow */
+    u8 reserved[3];
+} POSTPACK WMI_SNR_THRESHOLD_PARAMS_CMD;
+
+/*
+ *  WMI_LQ_THRESHOLD_PARAMS_CMDID
+ */
+typedef PREPACK struct WMI_LQ_THRESHOLD_PARAMS {
+    u8 enable;
+    u8 thresholdAbove1_Val;
+    u8 thresholdAbove2_Val;
+    u8 thresholdAbove3_Val;
+    u8 thresholdAbove4_Val;
+    u8 thresholdBelow1_Val;
+    u8 thresholdBelow2_Val;
+    u8 thresholdBelow3_Val;
+    u8 thresholdBelow4_Val;
+    u8 reserved[3];
+} POSTPACK  WMI_LQ_THRESHOLD_PARAMS_CMD;
+
+typedef enum {
+    WMI_LPREAMBLE_DISABLED = 0,
+    WMI_LPREAMBLE_ENABLED
+} WMI_LPREAMBLE_STATUS;
+
+typedef enum {
+    WMI_IGNORE_BARKER_IN_ERP = 0,
+    WMI_DONOT_IGNORE_BARKER_IN_ERP
+} WMI_PREAMBLE_POLICY;
+
+typedef PREPACK struct {
+    u8 status;
+    u8 preamblePolicy;
+}POSTPACK WMI_SET_LPREAMBLE_CMD;
+
+typedef PREPACK struct {
+    u16 threshold;
+}POSTPACK WMI_SET_RTS_CMD;
+
+/*
+ *  WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
+ *  Sets the error reporting event bitmask in target. Target clears it
+ *  upon an error. Subsequent errors are counted, but not reported
+ *  via event, unless the bitmask is set again.
+ */
+typedef PREPACK struct {
+    u32 bitmask;
+} POSTPACK  WMI_TARGET_ERROR_REPORT_BITMASK;
+
+/*
+ * WMI_SET_TX_PWR_CMDID
+ */
+typedef PREPACK struct {
+    u8 dbM;                  /* in dbM units */
+} POSTPACK WMI_SET_TX_PWR_CMD, WMI_TX_PWR_REPLY;
+
+/*
+ * WMI_SET_ASSOC_INFO_CMDID
+ *
+ * A maximum of 2 private IEs can be sent in the [Re]Assoc request.
+ * A 3rd one, the CCX version IE can also be set from the host.
+ */
+#define WMI_MAX_ASSOC_INFO_TYPE    2
+#define WMI_CCX_VER_IE             2 /* ieType to set CCX Version IE */
+
+#define WMI_MAX_ASSOC_INFO_LEN     240
+
+typedef PREPACK struct {
+    u8 ieType;
+    u8 bufferSize;
+    u8 assocInfo[1];       /* up to WMI_MAX_ASSOC_INFO_LEN */
+} POSTPACK WMI_SET_ASSOC_INFO_CMD;
+
+
+/*
+ * WMI_GET_TX_PWR_CMDID does not take any parameters
+ */
+
+/*
+ * WMI_ADD_BAD_AP_CMDID
+ */
+#define WMI_MAX_BAD_AP_INDEX      1
+
+typedef PREPACK struct {
+    u8 badApIndex;         /* 0 to WMI_MAX_BAD_AP_INDEX */
+    u8 bssid[ATH_MAC_LEN];
+} POSTPACK WMI_ADD_BAD_AP_CMD;
+
+/*
+ * WMI_DELETE_BAD_AP_CMDID
+ */
+typedef PREPACK struct {
+    u8 badApIndex;         /* 0 to WMI_MAX_BAD_AP_INDEX */
+} POSTPACK WMI_DELETE_BAD_AP_CMD;
+
+/*
+ * WMI_SET_ACCESS_PARAMS_CMDID
+ */
+#define WMI_DEFAULT_TXOP_ACPARAM    0       /* implies one MSDU */
+#define WMI_DEFAULT_ECWMIN_ACPARAM  4       /* corresponds to CWmin of 15 */
+#define WMI_DEFAULT_ECWMAX_ACPARAM  10      /* corresponds to CWmax of 1023 */
+#define WMI_MAX_CW_ACPARAM          15      /* maximum eCWmin or eCWmax */
+#define WMI_DEFAULT_AIFSN_ACPARAM   2
+#define WMI_MAX_AIFSN_ACPARAM       15
+typedef PREPACK struct {
+    u16 txop;                      /* in units of 32 usec */
+    u8 eCWmin;
+    u8 eCWmax;
+    u8 aifsn;
+    u8 ac;
+} POSTPACK WMI_SET_ACCESS_PARAMS_CMD;
+
+
+/*
+ * WMI_SET_RETRY_LIMITS_CMDID
+ *
+ * This command is used to customize the number of retries the
+ * wlan device will perform on a given frame.
+ */
+#define WMI_MIN_RETRIES 2
+#define WMI_MAX_RETRIES 13
+typedef enum {
+    MGMT_FRAMETYPE    = 0,
+    CONTROL_FRAMETYPE = 1,
+    DATA_FRAMETYPE    = 2
+} WMI_FRAMETYPE;
+
+typedef PREPACK struct {
+    u8 frameType;                      /* WMI_FRAMETYPE */
+    u8 trafficClass;                   /* applies only to DATA_FRAMETYPE */
+    u8 maxRetries;
+    u8 enableNotify;
+} POSTPACK WMI_SET_RETRY_LIMITS_CMD;
+
+/*
+ * WMI_SET_ROAM_CTRL_CMDID
+ *
+ * This command is used to influence the Roaming behaviour
+ * Set the host biases of the BSSs before setting the roam mode as bias
+ * based.
+ */
+
+/*
+ * Different types of Roam Control
+ */
+
+typedef enum {
+        WMI_FORCE_ROAM          = 1,      /* Roam to the specified BSSID */
+        WMI_SET_ROAM_MODE       = 2,      /* default ,progd bias, no roam */
+        WMI_SET_HOST_BIAS       = 3,     /* Set the Host Bias */
+        WMI_SET_LOWRSSI_SCAN_PARAMS = 4, /* Set lowrssi Scan parameters */
+} WMI_ROAM_CTRL_TYPE;
+
+#define WMI_MIN_ROAM_CTRL_TYPE WMI_FORCE_ROAM
+#define WMI_MAX_ROAM_CTRL_TYPE WMI_SET_LOWRSSI_SCAN_PARAMS
+
+/*
+ * ROAM MODES
+ */
+
+typedef enum {
+        WMI_DEFAULT_ROAM_MODE   = 1,  /* RSSI based ROAM */
+        WMI_HOST_BIAS_ROAM_MODE = 2, /* HOST BIAS based ROAM */
+        WMI_LOCK_BSS_MODE  = 3  /* Lock to the Current BSS - no Roam */
+} WMI_ROAM_MODE;
+
+/*
+ * BSS HOST BIAS INFO
+ */
+
+typedef PREPACK struct {
+        u8 bssid[ATH_MAC_LEN];
+        s8 bias;
+} POSTPACK WMI_BSS_BIAS;
+
+typedef PREPACK struct {
+        u8 numBss;
+        WMI_BSS_BIAS bssBias[1];
+} POSTPACK WMI_BSS_BIAS_INFO;
+
+typedef PREPACK struct WMI_LOWRSSI_SCAN_PARAMS {
+        u16 lowrssi_scan_period;
+        s16 lowrssi_scan_threshold;
+        s16 lowrssi_roam_threshold;
+        u8 roam_rssi_floor;
+        u8 reserved[1];              /* For alignment */
+} POSTPACK WMI_LOWRSSI_SCAN_PARAMS;
+
+typedef PREPACK struct {
+    PREPACK union {
+        u8 bssid[ATH_MAC_LEN]; /* WMI_FORCE_ROAM */
+        u8 roamMode;           /* WMI_SET_ROAM_MODE  */
+        WMI_BSS_BIAS_INFO bssBiasInfo; /* WMI_SET_HOST_BIAS */
+        WMI_LOWRSSI_SCAN_PARAMS lrScanParams;
+    } POSTPACK info;
+    u8 roamCtrlType ;
+} POSTPACK WMI_SET_ROAM_CTRL_CMD;
+
+/*
+ * WMI_SET_BT_WLAN_CONN_PRECEDENCE_CMDID
+ */
+typedef enum {
+    BT_WLAN_CONN_PRECDENCE_WLAN=0,  /* Default */
+    BT_WLAN_CONN_PRECDENCE_PAL,
+} BT_WLAN_CONN_PRECEDENCE;
+
+typedef PREPACK struct {
+    u8 precedence;
+} POSTPACK WMI_SET_BT_WLAN_CONN_PRECEDENCE;
+
+/*
+ * WMI_ENABLE_RM_CMDID
+ */
+typedef PREPACK struct {
+        u32 enable_radio_measurements;
+} POSTPACK WMI_ENABLE_RM_CMD;
+
+/*
+ * WMI_SET_MAX_OFFHOME_DURATION_CMDID
+ */
+typedef PREPACK struct {
+        u8 max_offhome_duration;
+} POSTPACK WMI_SET_MAX_OFFHOME_DURATION_CMD;
+
+typedef PREPACK struct {
+    u32 frequency;
+    u8 threshold;
+} POSTPACK WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD;
+/*---------------------- BTCOEX RELATED -------------------------------------*/
+/*----------------------COMMON to AR6002 and AR6003 -------------------------*/
+typedef enum {
+    BT_STREAM_UNDEF = 0,
+    BT_STREAM_SCO,             /* SCO stream */
+    BT_STREAM_A2DP,            /* A2DP stream */
+    BT_STREAM_SCAN,            /* BT Discovery or Page */
+    BT_STREAM_ESCO,
+    BT_STREAM_MAX
+} BT_STREAM_TYPE;
+
+typedef enum {
+    BT_PARAM_SCO_PSPOLL_LATENCY_ONE_FOURTH =1,
+    BT_PARAM_SCO_PSPOLL_LATENCY_HALF,
+    BT_PARAM_SCO_PSPOLL_LATENCY_THREE_FOURTH,
+} BT_PARAMS_SCO_PSPOLL_LATENCY;
+
+typedef enum {
+    BT_PARAMS_SCO_STOMP_SCO_NEVER =1,
+    BT_PARAMS_SCO_STOMP_SCO_ALWAYS,
+    BT_PARAMS_SCO_STOMP_SCO_IN_LOWRSSI,
+} BT_PARAMS_SCO_STOMP_RULES;
+
+typedef enum {
+    BT_STATUS_UNDEF = 0,
+    BT_STATUS_ON,
+    BT_STATUS_OFF,
+    BT_STATUS_MAX
+} BT_STREAM_STATUS;
+
+typedef PREPACK struct {
+    u8 streamType;
+    u8 status;
+} POSTPACK WMI_SET_BT_STATUS_CMD;
+
+typedef enum {
+    BT_ANT_TYPE_UNDEF=0,
+    BT_ANT_TYPE_DUAL,
+    BT_ANT_TYPE_SPLITTER,
+    BT_ANT_TYPE_SWITCH,
+    BT_ANT_TYPE_HIGH_ISO_DUAL
+} BT_ANT_FRONTEND_CONFIG;
+
+typedef enum {
+    BT_COLOCATED_DEV_BTS4020=0,
+    BT_COLCATED_DEV_CSR ,
+    BT_COLOCATED_DEV_VALKYRIE
+} BT_COLOCATED_DEV_TYPE;
+
+/*********************** Applicable to AR6002 ONLY ******************************/
+
+typedef enum {
+    BT_PARAM_SCO = 1,         /* SCO stream parameters */
+    BT_PARAM_A2DP ,
+    BT_PARAM_ANTENNA_CONFIG,
+    BT_PARAM_COLOCATED_BT_DEVICE,
+    BT_PARAM_ACLCOEX,
+    BT_PARAM_11A_SEPARATE_ANT,
+    BT_PARAM_MAX
+} BT_PARAM_TYPE;
+
+
+#define BT_SCO_ALLOW_CLOSE_RANGE_OPT    (1 << 0)
+#define BT_SCO_FORCE_AWAKE_OPT          (1 << 1)
+#define BT_SCO_SET_RSSI_OVERRIDE(flags)        ((flags) |= (1 << 2))
+#define BT_SCO_GET_RSSI_OVERRIDE(flags)        (((flags) >> 2) & 0x1)
+#define BT_SCO_SET_RTS_OVERRIDE(flags)   ((flags) |= (1 << 3))
+#define BT_SCO_GET_RTS_OVERRIDE(flags)   (((flags) >> 3) & 0x1)
+#define BT_SCO_GET_MIN_LOW_RATE_CNT(flags)     (((flags) >> 8) & 0xFF)
+#define BT_SCO_GET_MAX_LOW_RATE_CNT(flags)     (((flags) >> 16) & 0xFF)
+#define BT_SCO_SET_MIN_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 8)
+#define BT_SCO_SET_MAX_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 16)
+
+typedef PREPACK struct {
+    u32 numScoCyclesForceTrigger;  /* Number SCO cycles after which
+                                           force a pspoll. default = 10 */
+    u32 dataResponseTimeout;       /* Timeout Waiting for Downlink pkt
+                                           in response for ps-poll,
+                                           default = 10 msecs */
+    u32 stompScoRules;
+    u32 scoOptFlags;               /* SCO Options Flags :
+                                            bits:     meaning:
+                                             0        Allow Close Range Optimization
+                                             1        Force awake during close range
+                                             2        If set use host supplied RSSI for OPT
+                                             3        If set use host supplied RTS COUNT for OPT
+                                             4..7     Unused
+                                             8..15    Low Data Rate Min Cnt
+                                             16..23   Low Data Rate Max Cnt
+                                        */
+
+    u8 stompDutyCyleVal;           /* Sco cycles to limit ps-poll queuing
+                                           if stomped */
+    u8 stompDutyCyleMaxVal;        /*firm ware increases stomp duty cycle
+                                          gradually uptill this value on need basis*/
+    u8 psPollLatencyFraction;      /* Fraction of idle
+                                           period, within which
+                                           additional ps-polls
+                                           can be queued */
+    u8 noSCOSlots;                 /* Number of SCO Tx/Rx slots.
+                                           HVx, EV3, 2EV3 = 2 */
+    u8 noIdleSlots;                /* Number of Bluetooth idle slots between
+                                           consecutive SCO Tx/Rx slots
+                                           HVx, EV3 = 4
+                                           2EV3 = 10 */
+    u8 scoOptOffRssi;/*RSSI value below which we go to ps poll*/
+    u8 scoOptOnRssi; /*RSSI value above which we reenter opt mode*/
+    u8 scoOptRtsCount;
+} POSTPACK BT_PARAMS_SCO;
+
+#define BT_A2DP_ALLOW_CLOSE_RANGE_OPT  (1 << 0)
+#define BT_A2DP_FORCE_AWAKE_OPT        (1 << 1)
+#define BT_A2DP_SET_RSSI_OVERRIDE(flags)        ((flags) |= (1 << 2))
+#define BT_A2DP_GET_RSSI_OVERRIDE(flags)        (((flags) >> 2) & 0x1)
+#define BT_A2DP_SET_RTS_OVERRIDE(flags)   ((flags) |= (1 << 3))
+#define BT_A2DP_GET_RTS_OVERRIDE(flags)   (((flags) >> 3) & 0x1)
+#define BT_A2DP_GET_MIN_LOW_RATE_CNT(flags)     (((flags) >> 8) & 0xFF)
+#define BT_A2DP_GET_MAX_LOW_RATE_CNT(flags)     (((flags) >> 16) & 0xFF)
+#define BT_A2DP_SET_MIN_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 8)
+#define BT_A2DP_SET_MAX_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 16)
+
+typedef PREPACK struct {
+    u32 a2dpWlanUsageLimit; /* MAX time firmware uses the medium for
+                                    wlan, after it identifies the idle time
+                                    default (30 msecs) */
+    u32 a2dpBurstCntMin;   /* Minimum number of bluetooth data frames
+                                   to replenish Wlan Usage  limit (default 3) */
+    u32 a2dpDataRespTimeout;
+    u32 a2dpOptFlags;      /* A2DP Option flags:
+                                       bits:    meaning:
+                                        0       Allow Close Range Optimization
+                                        1       Force awake during close range
+                                        2        If set use host supplied RSSI for OPT
+                                        3        If set use host supplied RTS COUNT for OPT
+                                        4..7    Unused
+                                        8..15   Low Data Rate Min Cnt
+                                        16..23  Low Data Rate Max Cnt
+                                 */
+    u8 isCoLocatedBtRoleMaster;
+    u8 a2dpOptOffRssi;/*RSSI value below which we go to ps poll*/
+    u8 a2dpOptOnRssi; /*RSSI value above which we reenter opt mode*/
+    u8 a2dpOptRtsCount;
+}POSTPACK BT_PARAMS_A2DP;
+
+/* During BT ftp/ BT OPP or any another data based acl profile on bluetooth
+   (non a2dp).*/
+typedef PREPACK struct {
+    u32 aclWlanMediumUsageTime;  /* Wlan usage time during Acl (non-a2dp)
+                                       coexistence (default 30 msecs) */
+    u32 aclBtMediumUsageTime;   /* Bt usage time during acl coexistence
+                                       (default 30 msecs)*/
+    u32 aclDataRespTimeout;
+    u32 aclDetectTimeout;      /* ACL coexistence enabled if we get
+                                       10 Pkts in X msec(default 100 msecs) */
+    u32 aclmaxPktCnt;          /* No of ACL pkts to receive before
+                                         enabling ACL coex */
+
+}POSTPACK BT_PARAMS_ACLCOEX;
+
+typedef PREPACK struct {
+    PREPACK union {
+        BT_PARAMS_SCO scoParams;
+        BT_PARAMS_A2DP a2dpParams;
+        BT_PARAMS_ACLCOEX  aclCoexParams;
+        u8 antType;         /* 0 -Disabled (default)
+                                     1 - BT_ANT_TYPE_DUAL
+                                     2 - BT_ANT_TYPE_SPLITTER
+                                     3 - BT_ANT_TYPE_SWITCH */
+        u8 coLocatedBtDev;  /* 0 - BT_COLOCATED_DEV_BTS4020 (default)
+                                     1 - BT_COLCATED_DEV_CSR
+                                     2 - BT_COLOCATED_DEV_VALKYRIe
+                                   */
+    } POSTPACK info;
+    u8 paramType ;
+} POSTPACK WMI_SET_BT_PARAMS_CMD;
+
+/************************ END AR6002 BTCOEX *******************************/
+/*-----------------------AR6003 BTCOEX -----------------------------------*/
+
+/*  ---------------WMI_SET_BTCOEX_FE_ANT_CMDID --------------------------*/
+/* Indicates front end antenna configuration. This command needs to be issued
+ * right after initialization and after WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID.
+ * AR6003 enables coexistence and antenna switching based on the configuration.
+ */
+typedef enum {
+    WMI_BTCOEX_NOT_ENABLED = 0,
+    WMI_BTCOEX_FE_ANT_SINGLE =1,
+    WMI_BTCOEX_FE_ANT_DUAL=2,
+    WMI_BTCOEX_FE_ANT_DUAL_HIGH_ISO=3,
+    WMI_BTCOEX_FE_ANT_TYPE_MAX
+}WMI_BTCOEX_FE_ANT_TYPE;
+
+typedef PREPACK struct {
+        u8 btcoexFeAntType; /* 1 - WMI_BTCOEX_FE_ANT_SINGLE for single antenna front end
+                                2 - WMI_BTCOEX_FE_ANT_DUAL for dual antenna front end
+                                    (for isolations less 35dB, for higher isolation there
+                                    is not need to pass this command).
+                                    (not implemented)
+                              */
+}POSTPACK WMI_SET_BTCOEX_FE_ANT_CMD;
+
+/* -------------WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID ----------------*/
+/* Indicate the bluetooth chip to the firmware. Firmware can have different algorithm based
+ * bluetooth chip type.Based on bluetooth device, different coexistence protocol would be used.
+ */
+typedef PREPACK struct {
+        u8 btcoexCoLocatedBTdev; /*1 - Qcom BT (3 -wire PTA)
+                                    2 - CSR BT  (3 wire PTA)
+                                    3 - Atheros 3001 BT (3 wire PTA)
+                                    4 - STE bluetooth (4-wire ePTA)
+                                    5 - Atheros 3002 BT (4-wire MCI)
+                                    defaults= 3 (Atheros 3001 BT )
+                                    */
+}POSTPACK WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD;
+
+/* -------------WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID ------------*/
+/* Configuration parameters during bluetooth inquiry and page. Page configuration
+ * is applicable only on interfaces which can distinguish page (applicable only for ePTA -
+ * STE bluetooth).
+ * Bluetooth inquiry start and end is indicated via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID.
+ * During this the station will be  power-save mode.
+ */
+typedef PREPACK struct {
+        u32 btInquiryDataFetchFrequency;/* The frequency of querying the AP for data
+                                            (via pspoll) is configured by this parameter.
+                                            "default = 10 ms" */
+
+        u32 protectBmissDurPostBtInquiry;/* The firmware will continue to be in inquiry state
+                                             for configured duration, after inquiry completion
+                                             . This is to ensure other bluetooth transactions
+                                             (RDP, SDP profiles, link key exchange ...etc)
+                                             goes through smoothly without wifi stomping.
+                                             default = 10 secs*/
+
+        u32 maxpageStomp;                 /*Applicable only for STE-BT interface. Currently not
+                                             used */
+        u32 btInquiryPageFlag;           /* Not used */
+}POSTPACK WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD;
+
+/*---------------------WMI_SET_BTCOEX_SCO_CONFIG_CMDID ---------------*/
+/* Configure  SCO parameters. These parameters would be used whenever firmware is indicated
+ * of (e)SCO profile on bluetooth ( via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID).
+ * Configration of BTCOEX_SCO_CONFIG data structure are common configuration and applies
+ * ps-poll mode and opt mode.
+ * Ps-poll Mode - Station is in power-save and retrieves downlink data between sco gaps.
+ * Opt Mode - station is in awake state and access point can send data to station any time.
+ * BTCOEX_PSPOLLMODE_SCO_CONFIG - Configuration applied only during ps-poll mode.
+ * BTCOEX_OPTMODE_SCO_CONFIG - Configuration applied only during opt mode.
+ */
+#define WMI_SCO_CONFIG_FLAG_ALLOW_OPTIMIZATION   (1 << 0)
+#define WMI_SCO_CONFIG_FLAG_IS_EDR_CAPABLE       (1 << 1)
+#define WMI_SCO_CONFIG_FLAG_IS_BT_MASTER         (1 << 2)
+#define WMI_SCO_CONFIG_FLAG_FW_DETECT_OF_PER     (1 << 3)
+typedef PREPACK struct {
+        u32 scoSlots;                                   /* Number of SCO Tx/Rx slots.
+                                                                                   HVx, EV3, 2EV3 = 2 */
+        u32 scoIdleSlots;                               /* Number of Bluetooth idle slots between
+                                                                                   consecutive SCO Tx/Rx slots
+                                                                                   HVx, EV3 = 4
+                                                                                   2EV3 = 10
+                                         */
+        u32 scoFlags;                              /* SCO Options Flags :
+                                                                                  bits:    meaning:
+                                                                                  0   Allow Close Range Optimization
+                                                                                  1   Is EDR capable or Not
+                                                                                  2   IS Co-located Bt role Master
+                                          3   Firmware determines the periodicity of SCO.
+                                                                                 */
+
+    u32 linkId;                      /* applicable to STE-BT - not used */
+}POSTPACK BTCOEX_SCO_CONFIG;
+
+typedef PREPACK struct {
+        u32 scoCyclesForceTrigger;      /* Number SCO cycles after which
+                                                                                        force a pspoll. default = 10 */
+    u32 scoDataResponseTimeout;  /* Timeout Waiting for Downlink pkt
+                                                                                        in response for ps-poll,
+                                                                                        default = 20 msecs */
+
+        u32 scoStompDutyCyleVal;                 /* not implemented */
+
+        u32 scoStompDutyCyleMaxVal;     /*Not implemented */
+
+        u32 scoPsPollLatencyFraction;    /* Fraction of idle
+                                                                                        period, within which
+                                                                                        additional ps-polls can be queued
+                                            1 - 1/4 of idle duration
+                                            2 - 1/2 of idle duration
+                                            3 - 3/4 of idle duration
+                                            default =2 (1/2)
+                                           */
+}POSTPACK BTCOEX_PSPOLLMODE_SCO_CONFIG;
+
+typedef PREPACK struct {
+        u32 scoStompCntIn100ms;/*max number of SCO stomp in 100ms allowed in
+                                   opt mode. If exceeds the configured value,
+                                   switch to ps-poll mode
+                                  default = 3 */
+
+        u32 scoContStompMax;   /* max number of continuous stomp allowed in opt mode.
+                                   if exceeded switch to pspoll mode
+                                    default = 3 */
+
+        u32 scoMinlowRateMbps; /* Low rate threshold */
+
+        u32 scoLowRateCnt;     /* number of low rate pkts (< scoMinlowRateMbps) allowed in 100 ms.
+                                   If exceeded switch/stay to ps-poll mode, lower stay in opt mode.
+                                   default = 36
+                                 */
+
+        u32 scoHighPktRatio;   /*(Total Rx pkts in 100 ms + 1)/
+                                  ((Total tx pkts in 100 ms - No of high rate pkts in 100 ms) + 1) in 100 ms,
+                                  if exceeded switch/stay in opt mode and if lower switch/stay in  pspoll mode.
+                                  default = 5 (80% of high rates)
+                                 */
+
+        u32 scoMaxAggrSize;    /* Max number of Rx subframes allowed in this mode. (Firmware re-negogiates
+                                   max number of aggregates if it was negogiated to higher value
+                                   default = 1
+                                   Recommended value Basic rate headsets = 1, EDR (2-EV3)  =4.
+                                 */
+}POSTPACK BTCOEX_OPTMODE_SCO_CONFIG;
+
+typedef PREPACK struct {
+    u32 scanInterval;
+    u32 maxScanStompCnt;
+}POSTPACK BTCOEX_WLANSCAN_SCO_CONFIG;
+
+typedef PREPACK struct {
+        BTCOEX_SCO_CONFIG scoConfig;
+        BTCOEX_PSPOLLMODE_SCO_CONFIG scoPspollConfig;
+        BTCOEX_OPTMODE_SCO_CONFIG scoOptModeConfig;
+        BTCOEX_WLANSCAN_SCO_CONFIG scoWlanScanConfig;
+}POSTPACK WMI_SET_BTCOEX_SCO_CONFIG_CMD;
+
+/* ------------------WMI_SET_BTCOEX_A2DP_CONFIG_CMDID -------------------*/
+/* Configure A2DP profile parameters. These parameters would be used whenver firmware is indicated
+ * of A2DP profile on bluetooth ( via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID).
+ * Configuration of BTCOEX_A2DP_CONFIG data structure are common configuration and applies to
+ * ps-poll mode and opt mode.
+ * Ps-poll Mode - Station is in power-save and retrieves downlink data between a2dp data bursts.
+ * Opt Mode - station is in power save during a2dp bursts and awake in the gaps.
+ * BTCOEX_PSPOLLMODE_A2DP_CONFIG - Configuration applied only during ps-poll mode.
+ * BTCOEX_OPTMODE_A2DP_CONFIG - Configuration applied only during opt mode.
+ */
+
+#define WMI_A2DP_CONFIG_FLAG_ALLOW_OPTIMIZATION    (1 << 0)
+#define WMI_A2DP_CONFIG_FLAG_IS_EDR_CAPABLE        (1 << 1)
+#define WMI_A2DP_CONFIG_FLAG_IS_BT_ROLE_MASTER     (1 << 2)
+#define WMI_A2DP_CONFIG_FLAG_IS_A2DP_HIGH_PRI      (1 << 3)
+#define WMI_A2DP_CONFIG_FLAG_FIND_BT_ROLE          (1 << 4)
+
+typedef PREPACK struct {
+    u32 a2dpFlags;      /* A2DP Option flags:
+                                        bits:    meaning:
+                                    0       Allow Close Range Optimization
+                                1       IS EDR capable
+                                2       IS Co-located Bt role Master
+                                3       a2dp traffic is high priority
+                                4       Fw detect the role of bluetooth.
+                             */
+        u32 linkId;         /* Applicable only to STE-BT - not used */
+
+}POSTPACK BTCOEX_A2DP_CONFIG;
+
+typedef PREPACK struct {
+    u32 a2dpWlanMaxDur; /* MAX time firmware uses the medium for
+                                        wlan, after it identifies the idle time
+                                default (30 msecs) */
+
+    u32 a2dpMinBurstCnt;   /* Minimum number of bluetooth data frames
+                                                to replenish Wlan Usage  limit (default 3) */
+
+    u32 a2dpDataRespTimeout; /* Max duration firmware waits for downlink
+                                     by stomping on  bluetooth
+                                     after ps-poll is acknowledged.
+                                     default = 20 ms
+                                   */
+}POSTPACK BTCOEX_PSPOLLMODE_A2DP_CONFIG;
+
+typedef PREPACK struct {
+        u32 a2dpMinlowRateMbps;  /* Low rate threshold */
+
+        u32 a2dpLowRateCnt;    /* number of low rate pkts (< a2dpMinlowRateMbps) allowed in 100 ms.
+                                   If exceeded switch/stay to ps-poll mode, lower stay in opt mode.
+                                   default = 36
+                                 */
+
+        u32 a2dpHighPktRatio;   /*(Total Rx pkts in 100 ms + 1)/
+                                  ((Total tx pkts in 100 ms - No of high rate pkts in 100 ms) + 1) in 100 ms,
+                                  if exceeded switch/stay in opt mode and if lower switch/stay in  pspoll mode.
+                                  default = 5 (80% of high rates)
+                                 */
+
+        u32 a2dpMaxAggrSize;    /* Max number of Rx subframes allowed in this mode. (Firmware re-negogiates
+                                   max number of aggregates if it was negogiated to higher value
+                                   default = 1
+                                  Recommended value Basic rate headsets = 1, EDR (2-EV3)  =8.
+                                 */
+        u32 a2dpPktStompCnt;    /*number of a2dp pkts that can be stomped per burst.
+                                   default = 6*/
+
+}POSTPACK BTCOEX_OPTMODE_A2DP_CONFIG;
+
+typedef PREPACK struct {
+        BTCOEX_A2DP_CONFIG a2dpConfig;
+        BTCOEX_PSPOLLMODE_A2DP_CONFIG a2dppspollConfig;
+        BTCOEX_OPTMODE_A2DP_CONFIG a2dpOptConfig;
+}POSTPACK WMI_SET_BTCOEX_A2DP_CONFIG_CMD;
+
+/*------------ WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID---------------------*/
+/* Configure non-A2dp ACL profile parameters.The starts of ACL profile can either be
+ * indicated via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID orenabled via firmware detection
+ *  which is configured via "aclCoexFlags".
+ * Configration of BTCOEX_ACLCOEX_CONFIG data structure are common configuration and applies
+ * ps-poll mode and opt mode.
+ * Ps-poll Mode - Station is in power-save and retrieves downlink data during wlan medium.
+ * Opt Mode - station is in power save during bluetooth medium time and awake during wlan duration.
+ *             (Not implemented yet)
+ *
+ * BTCOEX_PSPOLLMODE_ACLCOEX_CONFIG - Configuration applied only during ps-poll mode.
+ * BTCOEX_OPTMODE_ACLCOEX_CONFIG - Configuration applied only during opt mode.
+ */
+
+#define WMI_ACLCOEX_FLAGS_ALLOW_OPTIMIZATION   (1 << 0)
+#define WMI_ACLCOEX_FLAGS_DISABLE_FW_DETECTION (1 << 1)
+
+typedef PREPACK struct {
+    u32 aclWlanMediumDur;           /* Wlan usage time during Acl (non-a2dp)
+                                                        coexistence (default 30 msecs)
+                                    */
+
+    u32 aclBtMediumDur;            /* Bt usage time during acl coexistence
+                                                             (default 30 msecs)
+                                   */
+
+        u32 aclDetectTimeout;      /* BT activity observation time limit.
+                                                                          In this time duration, number of bt pkts are counted.
+                                                                          If the Cnt reaches "aclPktCntLowerLimit" value
+                                                                          for "aclIterToEnableCoex" iteration continuously,
+                                                                          firmware gets into ACL coexistence mode.
+                                                                          Similarly, if bt traffic count during ACL coexistence
+                                                                          has not reached "aclPktCntLowerLimit" continuously
+                                                                          for "aclIterToEnableCoex", then ACL coexistence is
+                                                                          disabled.
+                                                                  -default 100 msecs
+                                    */
+
+         u32 aclPktCntLowerLimit;   /* Acl Pkt Cnt to be received in duration of
+                                                                                "aclDetectTimeout" for
+                                                                                "aclIterForEnDis" times to enabling ACL coex.
+                                        Similar logic is used to disable acl coexistence.
+                                        (If "aclPktCntLowerLimit"  cnt of acl pkts
+                                         are not seen by the for "aclIterForEnDis"
+                                         then acl coexistence is disabled).
+                                        default = 10
+                                   */
+
+         u32 aclIterForEnDis;      /* number of Iteration of "aclPktCntLowerLimit" for Enabling and
+                                       Disabling Acl Coexistence.
+                                       default = 3
+                                     */
+
+         u32 aclPktCntUpperLimit; /* This is upperBound limit, if there is more than
+                                                                          "aclPktCntUpperLimit" seen in "aclDetectTimeout",
+                                                                          ACL coexistence is enabled right away.
+                                                                          - default 15*/
+
+        u32 aclCoexFlags;                       /* A2DP Option flags:
+                                                  bits:    meaning:
+                                          0       Allow Close Range Optimization
+                                          1       disable Firmware detection
+                                      (Currently supported configuration is aclCoexFlags =0)
+                                                */
+        u32 linkId;                /* Applicable only for STE-BT - not used */
+
+}POSTPACK BTCOEX_ACLCOEX_CONFIG;
+
+typedef PREPACK struct {
+    u32 aclDataRespTimeout;   /* Max duration firmware waits for downlink
+                                      by stomping on  bluetooth
+                                      after ps-poll is acknowledged.
+                                     default = 20 ms */
+
+}POSTPACK BTCOEX_PSPOLLMODE_ACLCOEX_CONFIG;
+
+
+/* Not implemented yet*/
+typedef PREPACK struct {
+        u32 aclCoexMinlowRateMbps;
+        u32 aclCoexLowRateCnt;
+        u32 aclCoexHighPktRatio;
+        u32 aclCoexMaxAggrSize;
+        u32 aclPktStompCnt;
+}POSTPACK BTCOEX_OPTMODE_ACLCOEX_CONFIG;
+
+typedef PREPACK struct {
+        BTCOEX_ACLCOEX_CONFIG aclCoexConfig;
+        BTCOEX_PSPOLLMODE_ACLCOEX_CONFIG aclCoexPspollConfig;
+        BTCOEX_OPTMODE_ACLCOEX_CONFIG aclCoexOptConfig;
+}POSTPACK WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD;
+
+/* -----------WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID ------------------*/
+typedef enum {
+        WMI_BTCOEX_BT_PROFILE_SCO =1,
+        WMI_BTCOEX_BT_PROFILE_A2DP,
+        WMI_BTCOEX_BT_PROFILE_INQUIRY_PAGE,
+        WMI_BTCOEX_BT_PROFILE_ACLCOEX,
+}WMI_BTCOEX_BT_PROFILE;
+
+typedef PREPACK struct {
+        u32 btProfileType;
+        u32 btOperatingStatus;
+        u32 btLinkId;
+}WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD;
+
+/*--------------------- WMI_SET_BTCOEX_DEBUG_CMDID ---------------------*/
+/* Used for firmware development and debugging */
+typedef PREPACK struct {
+        u32 btcoexDbgParam1;
+        u32 btcoexDbgParam2;
+        u32 btcoexDbgParam3;
+        u32 btcoexDbgParam4;
+        u32 btcoexDbgParam5;
+}WMI_SET_BTCOEX_DEBUG_CMD;
+
+/*---------------------WMI_GET_BTCOEX_CONFIG_CMDID --------------------- */
+/* Command to firmware to get configuration parameters of the bt profile
+ * reported via WMI_BTCOEX_CONFIG_EVENTID */
+typedef PREPACK struct {
+        u32 btProfileType; /* 1 - SCO
+                               2 - A2DP
+                               3 - INQUIRY_PAGE
+                               4 - ACLCOEX
+                            */
+        u32 linkId;    /* not used */
+}WMI_GET_BTCOEX_CONFIG_CMD;
+
+/*------------------WMI_REPORT_BTCOEX_CONFIG_EVENTID------------------- */
+/* Event from firmware to host, sent in response to WMI_GET_BTCOEX_CONFIG_CMDID
+ * */
+typedef PREPACK struct {
+        u32 btProfileType;
+        u32 linkId; /* not used */
+        PREPACK union {
+                WMI_SET_BTCOEX_SCO_CONFIG_CMD scoConfigCmd;
+                WMI_SET_BTCOEX_A2DP_CONFIG_CMD a2dpConfigCmd;
+                WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD aclcoexConfig;
+        WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD btinquiryPageConfigCmd;
+    } POSTPACK info;
+} POSTPACK WMI_BTCOEX_CONFIG_EVENT;
+
+/*------------- WMI_REPORT_BTCOEX_BTCOEX_STATS_EVENTID--------------------*/
+/* Used for firmware development and debugging*/
+typedef PREPACK struct {
+        u32 highRatePktCnt;
+        u32 firstBmissCnt;
+        u32 psPollFailureCnt;
+        u32 nullFrameFailureCnt;
+        u32 optModeTransitionCnt;
+}BTCOEX_GENERAL_STATS;
+
+typedef PREPACK struct {
+        u32 scoStompCntAvg;
+        u32 scoStompIn100ms;
+        u32 scoMaxContStomp;
+        u32 scoAvgNoRetries;
+        u32 scoMaxNoRetriesIn100ms;
+}BTCOEX_SCO_STATS;
+
+typedef PREPACK struct {
+        u32 a2dpBurstCnt;
+        u32 a2dpMaxBurstCnt;
+        u32 a2dpAvgIdletimeIn100ms;
+        u32 a2dpAvgStompCnt;
+}BTCOEX_A2DP_STATS;
+
+typedef PREPACK struct {
+        u32 aclPktCntInBtTime;
+        u32 aclStompCntInWlanTime;
+        u32 aclPktCntIn100ms;
+}BTCOEX_ACLCOEX_STATS;
+
+typedef PREPACK struct {
+        BTCOEX_GENERAL_STATS coexStats;
+        BTCOEX_SCO_STATS scoStats;
+        BTCOEX_A2DP_STATS a2dpStats;
+        BTCOEX_ACLCOEX_STATS aclCoexStats;
+}WMI_BTCOEX_STATS_EVENT;
+
+
+/*--------------------------END OF BTCOEX -------------------------------------*/
+typedef PREPACK struct {
+    u32 sleepState;
+}WMI_REPORT_SLEEP_STATE_EVENT;
+
+typedef enum {
+    WMI_REPORT_SLEEP_STATUS_IS_DEEP_SLEEP =0,
+    WMI_REPORT_SLEEP_STATUS_IS_AWAKE
+} WMI_REPORT_SLEEP_STATUS;
+typedef enum {
+    DISCONN_EVT_IN_RECONN = 0,  /* default */
+    NO_DISCONN_EVT_IN_RECONN
+} TARGET_EVENT_REPORT_CONFIG;
+
+typedef PREPACK struct {
+    u32 evtConfig;
+} POSTPACK WMI_SET_TARGET_EVENT_REPORT_CMD;
+
+
+typedef PREPACK struct {
+    u16 cmd_buf_sz;     /* HCI cmd buffer size */
+    u8 buf[1];         /* Absolute HCI cmd */
+} POSTPACK WMI_HCI_CMD;
+
+/*
+ * Command Replies
+ */
+
+/*
+ * WMI_GET_CHANNEL_LIST_CMDID reply
+ */
+typedef PREPACK struct {
+    u8 reserved1;
+    u8 numChannels;            /* number of channels in reply */
+    u16 channelList[1];         /* channel in Mhz */
+} POSTPACK WMI_CHANNEL_LIST_REPLY;
+
+typedef enum {
+    A_SUCCEEDED = 0,
+    A_FAILED_DELETE_STREAM_DOESNOT_EXIST=250,
+    A_SUCCEEDED_MODIFY_STREAM=251,
+    A_FAILED_INVALID_STREAM = 252,
+    A_FAILED_MAX_THINSTREAMS = 253,
+    A_FAILED_CREATE_REMOVE_PSTREAM_FIRST = 254,
+} PSTREAM_REPLY_STATUS;
+
+typedef PREPACK struct {
+    u8 status;                 /* PSTREAM_REPLY_STATUS */
+    u8 txQueueNumber;
+    u8 rxQueueNumber;
+    u8 trafficClass;
+    u8 trafficDirection;       /* DIR_TYPE */
+} POSTPACK WMI_CRE_PRIORITY_STREAM_REPLY;
+
+typedef PREPACK struct {
+    u8 status;                 /* PSTREAM_REPLY_STATUS */
+    u8 txQueueNumber;
+    u8 rxQueueNumber;
+    u8 trafficDirection;       /* DIR_TYPE */
+    u8 trafficClass;
+} POSTPACK WMI_DEL_PRIORITY_STREAM_REPLY;
+
+/*
+ * List of Events (target to host)
+ */
+typedef enum {
+    WMI_READY_EVENTID           = 0x1001,
+    WMI_CONNECT_EVENTID,
+    WMI_DISCONNECT_EVENTID,
+    WMI_BSSINFO_EVENTID,
+    WMI_CMDERROR_EVENTID,
+    WMI_REGDOMAIN_EVENTID,
+    WMI_PSTREAM_TIMEOUT_EVENTID,
+    WMI_NEIGHBOR_REPORT_EVENTID,
+    WMI_TKIP_MICERR_EVENTID,
+    WMI_SCAN_COMPLETE_EVENTID,           /* 0x100a */
+    WMI_REPORT_STATISTICS_EVENTID,
+    WMI_RSSI_THRESHOLD_EVENTID,
+    WMI_ERROR_REPORT_EVENTID,
+    WMI_OPT_RX_FRAME_EVENTID,
+    WMI_REPORT_ROAM_TBL_EVENTID,
+    WMI_EXTENSION_EVENTID,
+    WMI_CAC_EVENTID,
+    WMI_SNR_THRESHOLD_EVENTID,
+    WMI_LQ_THRESHOLD_EVENTID,
+    WMI_TX_RETRY_ERR_EVENTID,            /* 0x1014 */
+    WMI_REPORT_ROAM_DATA_EVENTID,
+    WMI_TEST_EVENTID,
+    WMI_APLIST_EVENTID,
+    WMI_GET_WOW_LIST_EVENTID,
+    WMI_GET_PMKID_LIST_EVENTID,
+    WMI_CHANNEL_CHANGE_EVENTID,
+    WMI_PEER_NODE_EVENTID,
+    WMI_PSPOLL_EVENTID,
+    WMI_DTIMEXPIRY_EVENTID,
+    WMI_WLAN_VERSION_EVENTID,
+    WMI_SET_PARAMS_REPLY_EVENTID,
+    WMI_ADDBA_REQ_EVENTID,              /*0x1020 */
+    WMI_ADDBA_RESP_EVENTID,
+    WMI_DELBA_REQ_EVENTID,
+    WMI_TX_COMPLETE_EVENTID,
+    WMI_HCI_EVENT_EVENTID,
+    WMI_ACL_DATA_EVENTID,
+    WMI_REPORT_SLEEP_STATE_EVENTID,
+#ifdef WAPI_ENABLE
+    WMI_WAPI_REKEY_EVENTID,
+#endif
+    WMI_REPORT_BTCOEX_STATS_EVENTID,
+    WMI_REPORT_BTCOEX_CONFIG_EVENTID,
+        WMI_GET_PMK_EVENTID,
+
+        /* DFS Events */
+        WMI_DFS_HOST_ATTACH_EVENTID,
+        WMI_DFS_HOST_INIT_EVENTID,
+        WMI_DFS_RESET_DELAYLINES_EVENTID,
+        WMI_DFS_RESET_RADARQ_EVENTID,
+        WMI_DFS_RESET_AR_EVENTID,
+        WMI_DFS_RESET_ARQ_EVENTID,
+        WMI_DFS_SET_DUR_MULTIPLIER_EVENTID,
+        WMI_DFS_SET_BANGRADAR_EVENTID,
+        WMI_DFS_SET_DEBUGLEVEL_EVENTID,
+        WMI_DFS_PHYERR_EVENTID,
+        /* CCX Evants */
+        WMI_CCX_RM_STATUS_EVENTID,
+
+        /* P2P Events */
+        WMI_P2P_GO_NEG_RESULT_EVENTID,
+
+        WMI_WAC_SCAN_DONE_EVENTID,
+        WMI_WAC_REPORT_BSS_EVENTID,
+        WMI_WAC_START_WPS_EVENTID,
+        WMI_WAC_CTRL_REQ_REPLY_EVENTID,
+
+        /* RFKILL Events */
+        WMI_RFKILL_STATE_CHANGE_EVENTID,
+        WMI_RFKILL_GET_MODE_CMD_EVENTID,
+        WMI_THIN_RESERVED_START_EVENTID = 0x8000,
+
+        /*
+         * Events in this range are reserved for thinmode
+         * See wmi_thin.h for actual definitions
+         */
+        WMI_THIN_RESERVED_END_EVENTID = 0x8fff,
+
+        WMI_SET_CHANNEL_EVENTID,
+        WMI_ASSOC_REQ_EVENTID,
+
+        /* generic ACS event */
+        WMI_ACS_EVENTID,
+        WMI_REPORT_WMM_PARAMS_EVENTID
+} WMI_EVENT_ID;
+
+
+typedef enum {
+    WMI_11A_CAPABILITY   = 1,
+    WMI_11G_CAPABILITY   = 2,
+    WMI_11AG_CAPABILITY  = 3,
+    WMI_11NA_CAPABILITY  = 4,
+    WMI_11NG_CAPABILITY  = 5,
+    WMI_11NAG_CAPABILITY = 6,
+    // END CAPABILITY
+    WMI_11N_CAPABILITY_OFFSET = (WMI_11NA_CAPABILITY - WMI_11A_CAPABILITY),
+} WMI_PHY_CAPABILITY;
+
+typedef PREPACK struct {
+    u8 macaddr[ATH_MAC_LEN];
+    u8 phyCapability;              /* WMI_PHY_CAPABILITY */
+} POSTPACK WMI_READY_EVENT_1;
+
+typedef PREPACK struct {
+    u32 sw_version;
+    u32 abi_version;
+    u8 macaddr[ATH_MAC_LEN];
+    u8 phyCapability;              /* WMI_PHY_CAPABILITY */
+} POSTPACK WMI_READY_EVENT_2;
+
+#if defined(ATH_TARGET)
+#ifdef AR6002_REV2
+#define WMI_READY_EVENT WMI_READY_EVENT_1  /* AR6002_REV2 target code */
+#else
+#define WMI_READY_EVENT WMI_READY_EVENT_2  /* AR6001, AR6002_REV4, AR6002_REV5 */
+#endif
+#else
+#define WMI_READY_EVENT WMI_READY_EVENT_2 /* host code */
+#endif
+
+
+/*
+ * Connect Event
+ */
+typedef PREPACK struct {
+    u16 channel;
+    u8 bssid[ATH_MAC_LEN];
+    u16 listenInterval;
+    u16 beaconInterval;
+    u32 networkType;
+    u8 beaconIeLen;
+    u8 assocReqLen;
+    u8 assocRespLen;
+    u8 assocInfo[1];
+} POSTPACK WMI_CONNECT_EVENT;
+
+/*
+ * Disconnect Event
+ */
+typedef enum {
+    NO_NETWORK_AVAIL   = 0x01,
+    LOST_LINK          = 0x02,     /* bmiss */
+    DISCONNECT_CMD     = 0x03,
+    BSS_DISCONNECTED   = 0x04,
+    AUTH_FAILED        = 0x05,
+    ASSOC_FAILED       = 0x06,
+    NO_RESOURCES_AVAIL = 0x07,
+    CSERV_DISCONNECT   = 0x08,
+    INVALID_PROFILE    = 0x0a,
+    DOT11H_CHANNEL_SWITCH = 0x0b,
+    PROFILE_MISMATCH   = 0x0c,
+    CONNECTION_EVICTED = 0x0d,
+    IBSS_MERGE         = 0xe,
+} WMI_DISCONNECT_REASON;
+
+typedef PREPACK struct {
+    u16 protocolReasonStatus;  /* reason code, see 802.11 spec. */
+    u8 bssid[ATH_MAC_LEN];    /* set if known */
+    u8 disconnectReason ;      /* see WMI_DISCONNECT_REASON */
+    u8 assocRespLen;
+    u8 assocInfo[1];
+} POSTPACK WMI_DISCONNECT_EVENT;
+
+/*
+ * BSS Info Event.
+ * Mechanism used to inform host of the presence and characteristic of
+ * wireless networks present.  Consists of bss info header followed by
+ * the beacon or probe-response frame body.  The 802.11 header is not included.
+ */
+typedef enum {
+    BEACON_FTYPE = 0x1,
+    PROBERESP_FTYPE,
+    ACTION_MGMT_FTYPE,
+    PROBEREQ_FTYPE,
+} WMI_BI_FTYPE;
+
+enum {
+    BSS_ELEMID_CHANSWITCH = 0x01,
+    BSS_ELEMID_ATHEROS = 0x02,
+};
+
+typedef PREPACK struct {
+    u16 channel;
+    u8 frameType;          /* see WMI_BI_FTYPE */
+    u8 snr;
+    s16 rssi;
+    u8 bssid[ATH_MAC_LEN];
+    u32 ieMask;
+} POSTPACK WMI_BSS_INFO_HDR;
+
+/*
+ * BSS INFO HDR version 2.0
+ * With 6 bytes HTC header and 6 bytes of WMI header
+ * WMI_BSS_INFO_HDR cannot be accommodated in the removed 802.11 management
+ * header space.
+ * - Reduce the ieMask to 2 bytes as only two bit flags are used
+ * - Remove rssi and compute it on the host. rssi = snr - 95
+ */
+typedef PREPACK struct {
+    u16 channel;
+    u8 frameType;          /* see WMI_BI_FTYPE */
+    u8 snr;
+    u8 bssid[ATH_MAC_LEN];
+    u16 ieMask;
+} POSTPACK WMI_BSS_INFO_HDR2;
+
+/*
+ * Command Error Event
+ */
+typedef enum {
+    INVALID_PARAM  = 0x01,
+    ILLEGAL_STATE  = 0x02,
+    INTERNAL_ERROR = 0x03,
+} WMI_ERROR_CODE;
+
+typedef PREPACK struct {
+    u16 commandId;
+    u8 errorCode;
+} POSTPACK WMI_CMD_ERROR_EVENT;
+
+/*
+ * New Regulatory Domain Event
+ */
+typedef PREPACK struct {
+    u32 regDomain;
+} POSTPACK WMI_REG_DOMAIN_EVENT;
+
+typedef PREPACK struct {
+    u8 txQueueNumber;
+    u8 rxQueueNumber;
+    u8 trafficDirection;
+    u8 trafficClass;
+} POSTPACK WMI_PSTREAM_TIMEOUT_EVENT;
+
+typedef PREPACK struct {
+    u8 reserve1;
+    u8 reserve2;
+    u8 reserve3;
+    u8 trafficClass;
+} POSTPACK WMI_ACM_REJECT_EVENT;
+
+/*
+ * The WMI_NEIGHBOR_REPORT Event is generated by the target to inform
+ * the host of BSS's it has found that matches the current profile.
+ * It can be used by the host to cache PMKs and/to initiate pre-authentication
+ * if the BSS supports it.  The first bssid is always the current associated
+ * BSS.
+ * The bssid and bssFlags information repeats according to the number
+ * or APs reported.
+ */
+typedef enum {
+    WMI_DEFAULT_BSS_FLAGS   = 0x00,
+    WMI_PREAUTH_CAPABLE_BSS = 0x01,
+    WMI_PMKID_VALID_BSS     = 0x02,
+} WMI_BSS_FLAGS;
+
+typedef PREPACK struct {
+    u8 bssid[ATH_MAC_LEN];
+    u8 bssFlags;            /* see WMI_BSS_FLAGS */
+} POSTPACK WMI_NEIGHBOR_INFO;
+
+typedef PREPACK struct {
+    s8 numberOfAps;
+    WMI_NEIGHBOR_INFO neighbor[1];
+} POSTPACK WMI_NEIGHBOR_REPORT_EVENT;
+
+/*
+ * TKIP MIC Error Event
+ */
+typedef PREPACK struct {
+    u8 keyid;
+    u8 ismcast;
+} POSTPACK WMI_TKIP_MICERR_EVENT;
+
+/*
+ * WMI_SCAN_COMPLETE_EVENTID - no parameters (old), staus parameter (new)
+ */
+typedef PREPACK struct {
+    s32 status;
+} POSTPACK WMI_SCAN_COMPLETE_EVENT;
+
+#define MAX_OPT_DATA_LEN 1400
+
+/*
+ * WMI_SET_ADHOC_BSSID_CMDID
+ */
+typedef PREPACK struct {
+    u8 bssid[ATH_MAC_LEN];
+} POSTPACK WMI_SET_ADHOC_BSSID_CMD;
+
+/*
+ * WMI_SET_OPT_MODE_CMDID
+ */
+typedef enum {
+    SPECIAL_OFF,
+    SPECIAL_ON,
+} OPT_MODE_TYPE;
+
+typedef PREPACK struct {
+    u8 optMode;
+} POSTPACK WMI_SET_OPT_MODE_CMD;
+
+/*
+ * WMI_TX_OPT_FRAME_CMDID
+ */
+typedef enum {
+    OPT_PROBE_REQ   = 0x01,
+    OPT_PROBE_RESP  = 0x02,
+    OPT_CPPP_START  = 0x03,
+    OPT_CPPP_STOP   = 0x04,
+} WMI_OPT_FTYPE;
+
+typedef PREPACK struct {
+    u16 optIEDataLen;
+    u8 frmType;
+    u8 dstAddr[ATH_MAC_LEN];
+    u8 bssid[ATH_MAC_LEN];
+    u8 reserved;               /* For alignment */
+    u8 optIEData[1];
+} POSTPACK WMI_OPT_TX_FRAME_CMD;
+
+/*
+ * Special frame receive Event.
+ * Mechanism used to inform host of the receiption of the special frames.
+ * Consists of special frame info header followed by special frame body.
+ * The 802.11 header is not included.
+ */
+typedef PREPACK struct {
+    u16 channel;
+    u8 frameType;          /* see WMI_OPT_FTYPE */
+    s8 snr;
+    u8 srcAddr[ATH_MAC_LEN];
+    u8 bssid[ATH_MAC_LEN];
+} POSTPACK WMI_OPT_RX_INFO_HDR;
+
+/*
+ * Reporting statistics.
+ */
+typedef PREPACK struct {
+    u32 tx_packets;
+    u32 tx_bytes;
+    u32 tx_unicast_pkts;
+    u32 tx_unicast_bytes;
+    u32 tx_multicast_pkts;
+    u32 tx_multicast_bytes;
+    u32 tx_broadcast_pkts;
+    u32 tx_broadcast_bytes;
+    u32 tx_rts_success_cnt;
+    u32 tx_packet_per_ac[4];
+    u32 tx_errors_per_ac[4];
+
+    u32 tx_errors;
+    u32 tx_failed_cnt;
+    u32 tx_retry_cnt;
+    u32 tx_mult_retry_cnt;
+    u32 tx_rts_fail_cnt;
+    s32 tx_unicast_rate;
+}POSTPACK tx_stats_t;
+
+typedef PREPACK struct {
+    u32 rx_packets;
+    u32 rx_bytes;
+    u32 rx_unicast_pkts;
+    u32 rx_unicast_bytes;
+    u32 rx_multicast_pkts;
+    u32 rx_multicast_bytes;
+    u32 rx_broadcast_pkts;
+    u32 rx_broadcast_bytes;
+    u32 rx_fragment_pkt;
+
+    u32 rx_errors;
+    u32 rx_crcerr;
+    u32 rx_key_cache_miss;
+    u32 rx_decrypt_err;
+    u32 rx_duplicate_frames;
+    s32 rx_unicast_rate;
+}POSTPACK rx_stats_t;
+
+typedef PREPACK struct {
+    u32 tkip_local_mic_failure;
+    u32 tkip_counter_measures_invoked;
+    u32 tkip_replays;
+    u32 tkip_format_errors;
+    u32 ccmp_format_errors;
+    u32 ccmp_replays;
+}POSTPACK tkip_ccmp_stats_t;
+
+typedef PREPACK struct {
+    u32 power_save_failure_cnt;
+    u16 stop_tx_failure_cnt;
+    u16 atim_tx_failure_cnt;
+    u16 atim_rx_failure_cnt;
+    u16 bcn_rx_failure_cnt;
+}POSTPACK pm_stats_t;
+
+typedef PREPACK struct {
+    u32 cs_bmiss_cnt;
+    u32 cs_lowRssi_cnt;
+    u16 cs_connect_cnt;
+    u16 cs_disconnect_cnt;
+    s16 cs_aveBeacon_rssi;
+    u16 cs_roam_count;
+    s16 cs_rssi;
+    u8 cs_snr;
+    u8 cs_aveBeacon_snr;
+    u8 cs_lastRoam_msec;
+} POSTPACK cserv_stats_t;
+
+typedef PREPACK struct {
+    tx_stats_t          tx_stats;
+    rx_stats_t          rx_stats;
+    tkip_ccmp_stats_t   tkipCcmpStats;
+}POSTPACK wlan_net_stats_t;
+
+typedef PREPACK struct {
+    u32 arp_received;
+    u32 arp_matched;
+    u32 arp_replied;
+} POSTPACK arp_stats_t;
+
+typedef PREPACK struct {
+    u32 wow_num_pkts_dropped;
+    u16 wow_num_events_discarded;
+    u8 wow_num_host_pkt_wakeups;
+    u8 wow_num_host_event_wakeups;
+} POSTPACK wlan_wow_stats_t;
+
+typedef PREPACK struct {
+    u32 lqVal;
+    s32 noise_floor_calibation;
+    pm_stats_t          pmStats;
+    wlan_net_stats_t    txrxStats;
+    wlan_wow_stats_t    wowStats;
+    arp_stats_t         arpStats;
+    cserv_stats_t       cservStats;
+} POSTPACK WMI_TARGET_STATS;
+
+/*
+ * WMI_RSSI_THRESHOLD_EVENTID.
+ * Indicate the RSSI events to host. Events are indicated when we breach a
+ * thresold value.
+ */
+typedef enum{
+    WMI_RSSI_THRESHOLD1_ABOVE = 0,
+    WMI_RSSI_THRESHOLD2_ABOVE,
+    WMI_RSSI_THRESHOLD3_ABOVE,
+    WMI_RSSI_THRESHOLD4_ABOVE,
+    WMI_RSSI_THRESHOLD5_ABOVE,
+    WMI_RSSI_THRESHOLD6_ABOVE,
+    WMI_RSSI_THRESHOLD1_BELOW,
+    WMI_RSSI_THRESHOLD2_BELOW,
+    WMI_RSSI_THRESHOLD3_BELOW,
+    WMI_RSSI_THRESHOLD4_BELOW,
+    WMI_RSSI_THRESHOLD5_BELOW,
+    WMI_RSSI_THRESHOLD6_BELOW
+}WMI_RSSI_THRESHOLD_VAL;
+
+typedef PREPACK struct {
+    s16 rssi;
+    u8 range;
+}POSTPACK WMI_RSSI_THRESHOLD_EVENT;
+
+/*
+ *  WMI_ERROR_REPORT_EVENTID
+ */
+typedef enum{
+    WMI_TARGET_PM_ERR_FAIL      = 0x00000001,
+    WMI_TARGET_KEY_NOT_FOUND    = 0x00000002,
+    WMI_TARGET_DECRYPTION_ERR   = 0x00000004,
+    WMI_TARGET_BMISS            = 0x00000008,
+    WMI_PSDISABLE_NODE_JOIN     = 0x00000010,
+    WMI_TARGET_COM_ERR          = 0x00000020,
+    WMI_TARGET_FATAL_ERR        = 0x00000040
+} WMI_TARGET_ERROR_VAL;
+
+typedef PREPACK struct {
+    u32 errorVal;
+}POSTPACK  WMI_TARGET_ERROR_REPORT_EVENT;
+
+typedef PREPACK struct {
+    u8 retrys;
+}POSTPACK  WMI_TX_RETRY_ERR_EVENT;
+
+typedef enum{
+    WMI_SNR_THRESHOLD1_ABOVE = 1,
+    WMI_SNR_THRESHOLD1_BELOW,
+    WMI_SNR_THRESHOLD2_ABOVE,
+    WMI_SNR_THRESHOLD2_BELOW,
+    WMI_SNR_THRESHOLD3_ABOVE,
+    WMI_SNR_THRESHOLD3_BELOW,
+    WMI_SNR_THRESHOLD4_ABOVE,
+    WMI_SNR_THRESHOLD4_BELOW
+} WMI_SNR_THRESHOLD_VAL;
+
+typedef PREPACK struct {
+    u8 range;  /* WMI_SNR_THRESHOLD_VAL */
+    u8 snr;
+}POSTPACK  WMI_SNR_THRESHOLD_EVENT;
+
+typedef enum{
+    WMI_LQ_THRESHOLD1_ABOVE = 1,
+    WMI_LQ_THRESHOLD1_BELOW,
+    WMI_LQ_THRESHOLD2_ABOVE,
+    WMI_LQ_THRESHOLD2_BELOW,
+    WMI_LQ_THRESHOLD3_ABOVE,
+    WMI_LQ_THRESHOLD3_BELOW,
+    WMI_LQ_THRESHOLD4_ABOVE,
+    WMI_LQ_THRESHOLD4_BELOW
+} WMI_LQ_THRESHOLD_VAL;
+
+typedef PREPACK struct {
+    s32 lq;
+    u8 range;  /* WMI_LQ_THRESHOLD_VAL */
+}POSTPACK  WMI_LQ_THRESHOLD_EVENT;
+/*
+ * WMI_REPORT_ROAM_TBL_EVENTID
+ */
+#define MAX_ROAM_TBL_CAND   5
+
+typedef PREPACK struct {
+    s32 roam_util;
+    u8 bssid[ATH_MAC_LEN];
+    s8 rssi;
+    s8 rssidt;
+    s8 last_rssi;
+    s8 util;
+    s8 bias;
+    u8 reserved; /* For alignment */
+} POSTPACK WMI_BSS_ROAM_INFO;
+
+
+typedef PREPACK struct {
+    u16 roamMode;
+    u16 numEntries;
+    WMI_BSS_ROAM_INFO bssRoamInfo[1];
+} POSTPACK WMI_TARGET_ROAM_TBL;
+
+/*
+ * WMI_HCI_EVENT_EVENTID
+ */
+typedef PREPACK struct {
+    u16 evt_buf_sz;     /* HCI event buffer size */
+    u8 buf[1];         /* HCI  event */
+} POSTPACK WMI_HCI_EVENT;
+
+/*
+ *  WMI_CAC_EVENTID
+ */
+typedef enum {
+    CAC_INDICATION_ADMISSION = 0x00,
+    CAC_INDICATION_ADMISSION_RESP = 0x01,
+    CAC_INDICATION_DELETE = 0x02,
+    CAC_INDICATION_NO_RESP = 0x03,
+}CAC_INDICATION;
+
+#define WMM_TSPEC_IE_LEN   63
+
+typedef PREPACK struct {
+    u8 ac;
+    u8 cac_indication;
+    u8 statusCode;
+    u8 tspecSuggestion[WMM_TSPEC_IE_LEN];
+}POSTPACK  WMI_CAC_EVENT;
+
+/*
+ * WMI_APLIST_EVENTID
+ */
+
+typedef enum {
+    APLIST_VER1 = 1,
+} APLIST_VER;
+
+typedef PREPACK struct {
+    u8 bssid[ATH_MAC_LEN];
+    u16 channel;
+} POSTPACK  WMI_AP_INFO_V1;
+
+typedef PREPACK union {
+    WMI_AP_INFO_V1  apInfoV1;
+} POSTPACK WMI_AP_INFO;
+
+typedef PREPACK struct {
+    u8 apListVer;
+    u8 numAP;
+    WMI_AP_INFO apList[1];
+} POSTPACK WMI_APLIST_EVENT;
+
+/*
+ * developer commands
+ */
+
+/*
+ * WMI_SET_BITRATE_CMDID
+ *
+ * Get bit rate cmd uses same definition as set bit rate cmd
+ */
+typedef enum {
+    RATE_AUTO   = -1,
+    RATE_1Mb    = 0,
+    RATE_2Mb    = 1,
+    RATE_5_5Mb  = 2,
+    RATE_11Mb   = 3,
+    RATE_6Mb    = 4,
+    RATE_9Mb    = 5,
+    RATE_12Mb   = 6,
+    RATE_18Mb   = 7,
+    RATE_24Mb   = 8,
+    RATE_36Mb   = 9,
+    RATE_48Mb   = 10,
+    RATE_54Mb   = 11,
+    RATE_MCS_0_20 = 12,
+    RATE_MCS_1_20 = 13,
+    RATE_MCS_2_20 = 14,
+    RATE_MCS_3_20 = 15,
+    RATE_MCS_4_20 = 16,
+    RATE_MCS_5_20 = 17,
+    RATE_MCS_6_20 = 18,
+    RATE_MCS_7_20 = 19,
+    RATE_MCS_0_40 = 20,
+    RATE_MCS_1_40 = 21,
+    RATE_MCS_2_40 = 22,
+    RATE_MCS_3_40 = 23,
+    RATE_MCS_4_40 = 24,
+    RATE_MCS_5_40 = 25,
+    RATE_MCS_6_40 = 26,
+    RATE_MCS_7_40 = 27,
+} WMI_BIT_RATE;
+
+typedef PREPACK struct {
+    s8 rateIndex;          /* see WMI_BIT_RATE */
+    s8 mgmtRateIndex;
+    s8 ctlRateIndex;
+} POSTPACK WMI_BIT_RATE_CMD;
+
+
+typedef PREPACK struct {
+    s8 rateIndex;          /* see WMI_BIT_RATE */
+} POSTPACK  WMI_BIT_RATE_REPLY;
+
+
+/*
+ * WMI_SET_FIXRATES_CMDID
+ *
+ * Get fix rates cmd uses same definition as set fix rates cmd
+ */
+#define FIX_RATE_1Mb            ((u32)0x1)
+#define FIX_RATE_2Mb            ((u32)0x2)
+#define FIX_RATE_5_5Mb          ((u32)0x4)
+#define FIX_RATE_11Mb           ((u32)0x8)
+#define FIX_RATE_6Mb            ((u32)0x10)
+#define FIX_RATE_9Mb            ((u32)0x20)
+#define FIX_RATE_12Mb           ((u32)0x40)
+#define FIX_RATE_18Mb           ((u32)0x80)
+#define FIX_RATE_24Mb           ((u32)0x100)
+#define FIX_RATE_36Mb           ((u32)0x200)
+#define FIX_RATE_48Mb           ((u32)0x400)
+#define FIX_RATE_54Mb           ((u32)0x800)
+#define FIX_RATE_MCS_0_20       ((u32)0x1000)
+#define FIX_RATE_MCS_1_20       ((u32)0x2000)
+#define FIX_RATE_MCS_2_20       ((u32)0x4000)
+#define FIX_RATE_MCS_3_20       ((u32)0x8000)
+#define FIX_RATE_MCS_4_20       ((u32)0x10000)
+#define FIX_RATE_MCS_5_20       ((u32)0x20000)
+#define FIX_RATE_MCS_6_20       ((u32)0x40000)
+#define FIX_RATE_MCS_7_20       ((u32)0x80000)
+#define FIX_RATE_MCS_0_40       ((u32)0x100000)
+#define FIX_RATE_MCS_1_40       ((u32)0x200000)
+#define FIX_RATE_MCS_2_40       ((u32)0x400000)
+#define FIX_RATE_MCS_3_40       ((u32)0x800000)
+#define FIX_RATE_MCS_4_40       ((u32)0x1000000)
+#define FIX_RATE_MCS_5_40       ((u32)0x2000000)
+#define FIX_RATE_MCS_6_40       ((u32)0x4000000)
+#define FIX_RATE_MCS_7_40       ((u32)0x8000000)
+
+typedef PREPACK struct {
+    u32 fixRateMask;          /* see WMI_BIT_RATE */
+} POSTPACK WMI_FIX_RATES_CMD, WMI_FIX_RATES_REPLY;
+
+typedef PREPACK struct {
+    u8 bEnableMask;
+    u8 frameType;               /*type and subtype*/
+    u32 frameRateMask;          /* see WMI_BIT_RATE */
+} POSTPACK WMI_FRAME_RATES_CMD, WMI_FRAME_RATES_REPLY;
+
+/*
+ * WMI_SET_RECONNECT_AUTH_MODE_CMDID
+ *
+ * Set authentication mode
+ */
+typedef enum {
+    RECONN_DO_AUTH = 0x00,
+    RECONN_NOT_AUTH = 0x01
+} WMI_AUTH_MODE;
+
+typedef PREPACK struct {
+    u8 mode;
+} POSTPACK WMI_SET_AUTH_MODE_CMD;
+
+/*
+ * WMI_SET_REASSOC_MODE_CMDID
+ *
+ * Set authentication mode
+ */
+typedef enum {
+    REASSOC_DO_DISASSOC = 0x00,
+    REASSOC_DONOT_DISASSOC = 0x01
+} WMI_REASSOC_MODE;
+
+typedef PREPACK struct {
+    u8 mode;
+}POSTPACK WMI_SET_REASSOC_MODE_CMD;
+
+typedef enum {
+    ROAM_DATA_TIME = 1,            /* Get The Roam Time Data */
+} ROAM_DATA_TYPE;
+
+typedef PREPACK struct {
+    u32 disassoc_time;
+    u32 no_txrx_time;
+    u32 assoc_time;
+    u32 allow_txrx_time;
+    u8 disassoc_bssid[ATH_MAC_LEN];
+    s8 disassoc_bss_rssi;
+    u8 assoc_bssid[ATH_MAC_LEN];
+    s8 assoc_bss_rssi;
+} POSTPACK WMI_TARGET_ROAM_TIME;
+
+typedef PREPACK struct {
+    PREPACK union {
+        WMI_TARGET_ROAM_TIME roamTime;
+    } POSTPACK u;
+    u8 roamDataType ;
+} POSTPACK WMI_TARGET_ROAM_DATA;
+
+typedef enum {
+    WMI_WMM_DISABLED = 0,
+    WMI_WMM_ENABLED
+} WMI_WMM_STATUS;
+
+typedef PREPACK struct {
+    u8 status;
+}POSTPACK WMI_SET_WMM_CMD;
+
+typedef PREPACK struct {
+    u8 status;
+}POSTPACK WMI_SET_QOS_SUPP_CMD;
+
+typedef enum {
+    WMI_TXOP_DISABLED = 0,
+    WMI_TXOP_ENABLED
+} WMI_TXOP_CFG;
+
+typedef PREPACK struct {
+    u8 txopEnable;
+}POSTPACK WMI_SET_WMM_TXOP_CMD;
+
+typedef PREPACK struct {
+    u8 keepaliveInterval;
+} POSTPACK WMI_SET_KEEPALIVE_CMD;
+
+typedef PREPACK struct {
+    u32 configured;
+    u8 keepaliveInterval;
+} POSTPACK WMI_GET_KEEPALIVE_CMD;
+
+/*
+ * Add Application specified IE to a management frame
+ */
+#define WMI_MAX_IE_LEN  255
+
+typedef PREPACK struct {
+    u8 mgmtFrmType;  /* one of WMI_MGMT_FRAME_TYPE */
+    u8 ieLen;    /* Length  of the IE that should be added to the MGMT frame */
+    u8 ieInfo[1];
+} POSTPACK WMI_SET_APPIE_CMD;
+
+/*
+ * Notify the WSC registration status to the target
+ */
+#define WSC_REG_ACTIVE     1
+#define WSC_REG_INACTIVE   0
+/* Generic Hal Interface for setting hal paramters. */
+/* Add new Set HAL Param cmdIds here for newer params */
+typedef enum {
+   WHAL_SETCABTO_CMDID = 1,
+}WHAL_CMDID;
+
+typedef PREPACK struct {
+    u8 cabTimeOut;
+} POSTPACK WHAL_SETCABTO_PARAM;
+
+typedef PREPACK struct {
+    u8 whalCmdId;
+    u8 data[1];
+} POSTPACK WHAL_PARAMCMD;
+
+
+#define WOW_MAX_FILTER_LISTS 1 /*4*/
+#define WOW_MAX_FILTERS_PER_LIST 4
+#define WOW_PATTERN_SIZE 64
+#define WOW_MASK_SIZE 64
+
+#define MAC_MAX_FILTERS_PER_LIST 4
+
+typedef PREPACK struct {
+    u8 wow_valid_filter;
+    u8 wow_filter_id;
+    u8 wow_filter_size;
+    u8 wow_filter_offset;
+    u8 wow_filter_mask[WOW_MASK_SIZE];
+    u8 wow_filter_pattern[WOW_PATTERN_SIZE];
+} POSTPACK WOW_FILTER;
+
+
+typedef PREPACK struct {
+    u8 wow_valid_list;
+    u8 wow_list_id;
+    u8 wow_num_filters;
+    u8 wow_total_list_size;
+    WOW_FILTER list[WOW_MAX_FILTERS_PER_LIST];
+} POSTPACK WOW_FILTER_LIST;
+
+typedef PREPACK struct {
+    u8 valid_filter;
+    u8 mac_addr[ATH_MAC_LEN];
+} POSTPACK MAC_FILTER;
+
+
+typedef PREPACK struct {
+    u8 total_list_size;
+    u8 enable;
+    MAC_FILTER list[MAC_MAX_FILTERS_PER_LIST];
+} POSTPACK MAC_FILTER_LIST;
+
+#define MAX_IP_ADDRS  2
+typedef PREPACK struct {
+    u32 ips[MAX_IP_ADDRS];  /* IP in Network Byte Order */
+} POSTPACK WMI_SET_IP_CMD;
+
+typedef PREPACK struct {
+    u32 awake;
+    u32 asleep;
+} POSTPACK WMI_SET_HOST_SLEEP_MODE_CMD;
+
+typedef enum {
+    WOW_FILTER_SSID = 0x1
+} WMI_WOW_FILTER;
+
+typedef PREPACK struct {
+    u32 enable_wow;
+    WMI_WOW_FILTER filter;
+    u16 hostReqDelay;
+} POSTPACK WMI_SET_WOW_MODE_CMD;
+
+typedef PREPACK struct {
+    u8 filter_list_id;
+} POSTPACK WMI_GET_WOW_LIST_CMD;
+
+/*
+ * WMI_GET_WOW_LIST_CMD reply
+ */
+typedef PREPACK struct {
+    u8 num_filters;     /* number of patterns in reply */
+    u8 this_filter_num; /*  this is filter # x of total num_filters */
+    u8 wow_mode;
+    u8 host_mode;
+    WOW_FILTER  wow_filters[1];
+} POSTPACK WMI_GET_WOW_LIST_REPLY;
+
+typedef PREPACK struct {
+    u8 filter_list_id;
+    u8 filter_size;
+    u8 filter_offset;
+    u8 filter[1];
+} POSTPACK WMI_ADD_WOW_PATTERN_CMD;
+
+typedef PREPACK struct {
+    u16 filter_list_id;
+    u16 filter_id;
+} POSTPACK WMI_DEL_WOW_PATTERN_CMD;
+
+typedef PREPACK struct {
+    u8 macaddr[ATH_MAC_LEN];
+} POSTPACK WMI_SET_MAC_ADDRESS_CMD;
+
+/*
+ * WMI_SET_AKMP_PARAMS_CMD
+ */
+
+#define WMI_AKMP_MULTI_PMKID_EN   0x000001
+
+typedef PREPACK struct {
+    u32 akmpInfo;
+} POSTPACK WMI_SET_AKMP_PARAMS_CMD;
+
+typedef PREPACK struct {
+    u8 pmkid[WMI_PMKID_LEN];
+} POSTPACK WMI_PMKID;
+
+/*
+ * WMI_SET_PMKID_LIST_CMD
+ */
+#define WMI_MAX_PMKID_CACHE   8
+
+typedef PREPACK struct {
+    u32 numPMKID;
+    WMI_PMKID   pmkidList[WMI_MAX_PMKID_CACHE];
+} POSTPACK WMI_SET_PMKID_LIST_CMD;
+
+/*
+ * WMI_GET_PMKID_LIST_CMD  Reply
+ * Following the Number of PMKIDs is the list of PMKIDs
+ */
+typedef PREPACK struct {
+    u32 numPMKID;
+    u8 bssidList[ATH_MAC_LEN][1];
+    WMI_PMKID   pmkidList[1];
+} POSTPACK WMI_PMKID_LIST_REPLY;
+
+typedef PREPACK struct {
+    u16 oldChannel;
+    u32 newChannel;
+} POSTPACK WMI_CHANNEL_CHANGE_EVENT;
+
+typedef PREPACK struct {
+    u32 version;
+} POSTPACK WMI_WLAN_VERSION_EVENT;
+
+
+/* WMI_ADDBA_REQ_EVENTID */
+typedef PREPACK struct {
+    u8 tid;
+    u8 win_sz;
+    u16 st_seq_no;
+    u8 status;         /* f/w response for ADDBA Req; OK(0) or failure(!=0) */
+} POSTPACK WMI_ADDBA_REQ_EVENT;
+
+/* WMI_ADDBA_RESP_EVENTID */
+typedef PREPACK struct {
+    u8 tid;
+    u8 status;         /* OK(0), failure (!=0) */
+    u16 amsdu_sz;       /* Three values: Not supported(0), 3839, 8k */
+} POSTPACK WMI_ADDBA_RESP_EVENT;
+
+/* WMI_DELBA_EVENTID
+ * f/w received a DELBA for peer and processed it.
+ * Host is notified of this
+ */
+typedef PREPACK struct {
+    u8 tid;
+    u8 is_peer_initiator;
+    u16 reason_code;
+} POSTPACK WMI_DELBA_EVENT;
+
+
+#ifdef WAPI_ENABLE
+#define WAPI_REKEY_UCAST    1
+#define WAPI_REKEY_MCAST    2
+typedef PREPACK struct {
+    u8 type;
+    u8 macAddr[ATH_MAC_LEN];
+} POSTPACK WMI_WAPIREKEY_EVENT;
+#endif
+
+
+/* WMI_ALLOW_AGGR_CMDID
+ * Configures tid's to allow ADDBA negotiations
+ * on each tid, in each direction
+ */
+typedef PREPACK struct {
+    u16 tx_allow_aggr;  /* 16-bit mask to allow uplink ADDBA negotiation - bit position indicates tid*/
+    u16 rx_allow_aggr;  /* 16-bit mask to allow donwlink ADDBA negotiation - bit position indicates tid*/
+} POSTPACK WMI_ALLOW_AGGR_CMD;
+
+/* WMI_ADDBA_REQ_CMDID
+ * f/w starts performing ADDBA negotiations with peer
+ * on the given tid
+ */
+typedef PREPACK struct {
+    u8 tid;
+} POSTPACK WMI_ADDBA_REQ_CMD;
+
+/* WMI_DELBA_REQ_CMDID
+ * f/w would teardown BA with peer.
+ * is_send_initiator indicates if it's or tx or rx side
+ */
+typedef PREPACK struct {
+    u8 tid;
+    u8 is_sender_initiator;
+
+} POSTPACK WMI_DELBA_REQ_CMD;
+
+#define PEER_NODE_JOIN_EVENT 0x00
+#define PEER_NODE_LEAVE_EVENT 0x01
+#define PEER_FIRST_NODE_JOIN_EVENT 0x10
+#define PEER_LAST_NODE_LEAVE_EVENT 0x11
+typedef PREPACK struct {
+    u8 eventCode;
+    u8 peerMacAddr[ATH_MAC_LEN];
+} POSTPACK WMI_PEER_NODE_EVENT;
+
+#define IEEE80211_FRAME_TYPE_MGT          0x00
+#define IEEE80211_FRAME_TYPE_CTL          0x04
+
+/*
+ * Transmit complete event data structure(s)
+ */
+
+
+typedef PREPACK struct {
+#define TX_COMPLETE_STATUS_SUCCESS 0
+#define TX_COMPLETE_STATUS_RETRIES 1
+#define TX_COMPLETE_STATUS_NOLINK  2
+#define TX_COMPLETE_STATUS_TIMEOUT 3
+#define TX_COMPLETE_STATUS_OTHER   4
+
+    u8 status; /* one of TX_COMPLETE_STATUS_... */
+    u8 pktID; /* packet ID to identify parent packet */
+    u8 rateIdx; /* rate index on successful transmission */
+    u8 ackFailures; /* number of ACK failures in tx attempt */
+#if 0 /* optional params currently omitted. */
+    u32 queueDelay; // usec delay measured Tx Start time - host delivery time
+    u32 mediaDelay; // usec delay measured ACK rx time - host delivery time
+#endif
+} POSTPACK TX_COMPLETE_MSG_V1; /* version 1 of tx complete msg */
+
+typedef PREPACK struct {
+    u8 numMessages; /* number of tx comp msgs following this struct */
+    u8 msgLen; /* length in bytes for each individual msg following this struct */
+    u8 msgType; /* version of tx complete msg data following this struct */
+    u8 reserved; /* individual messages follow this header */
+} POSTPACK WMI_TX_COMPLETE_EVENT;
+
+#define WMI_TXCOMPLETE_VERSION_1 (0x01)
+
+
+/*
+ * ------- AP Mode definitions --------------
+ */
+
+/*
+ * !!! Warning !!!
+ * -Changing the following values needs compilation of both driver and firmware
+ */
+#ifdef AR6002_REV2
+#define AP_MAX_NUM_STA          4
+#else
+#define AP_MAX_NUM_STA          8
+#endif
+#define AP_ACL_SIZE             10
+#define IEEE80211_MAX_IE        256
+#define MCAST_AID               0xFF /* Spl. AID used to set DTIM flag in the beacons */
+#define DEF_AP_COUNTRY_CODE     "US "
+#define DEF_AP_WMODE_G          WMI_11G_MODE
+#define DEF_AP_WMODE_AG         WMI_11AG_MODE
+#define DEF_AP_DTIM             5
+#define DEF_BEACON_INTERVAL     100
+
+/* AP mode disconnect reasons */
+#define AP_DISCONNECT_STA_LEFT      101
+#define AP_DISCONNECT_FROM_HOST     102
+#define AP_DISCONNECT_COMM_TIMEOUT  103
+
+/*
+ * Used with WMI_AP_HIDDEN_SSID_CMDID
+ */
+#define HIDDEN_SSID_FALSE   0
+#define HIDDEN_SSID_TRUE    1
+typedef PREPACK struct {
+    u8 hidden_ssid;
+} POSTPACK WMI_AP_HIDDEN_SSID_CMD;
+
+/*
+ * Used with WMI_AP_ACL_POLICY_CMDID
+ */
+#define AP_ACL_DISABLE          0x00
+#define AP_ACL_ALLOW_MAC        0x01
+#define AP_ACL_DENY_MAC         0x02
+#define AP_ACL_RETAIN_LIST_MASK 0x80
+typedef PREPACK struct {
+    u8 policy;
+} POSTPACK WMI_AP_ACL_POLICY_CMD;
+
+/*
+ * Used with WMI_AP_ACL_MAC_LIST_CMDID
+ */
+#define ADD_MAC_ADDR    1
+#define DEL_MAC_ADDR    2
+typedef PREPACK struct {
+    u8 action;
+    u8 index;
+    u8 mac[ATH_MAC_LEN];
+    u8 wildcard;
+} POSTPACK WMI_AP_ACL_MAC_CMD;
+
+typedef PREPACK struct {
+    u16 index;
+    u8 acl_mac[AP_ACL_SIZE][ATH_MAC_LEN];
+    u8 wildcard[AP_ACL_SIZE];
+    u8 policy;
+} POSTPACK WMI_AP_ACL;
+
+/*
+ * Used with WMI_AP_SET_NUM_STA_CMDID
+ */
+typedef PREPACK struct {
+    u8 num_sta;
+} POSTPACK WMI_AP_SET_NUM_STA_CMD;
+
+/*
+ * Used with WMI_AP_SET_MLME_CMDID
+ */
+typedef PREPACK struct {
+    u8 mac[ATH_MAC_LEN];
+    u16 reason;              /* 802.11 reason code */
+    u8 cmd;                 /* operation to perform */
+#define WMI_AP_MLME_ASSOC       1   /* associate station */
+#define WMI_AP_DISASSOC         2   /* disassociate station */
+#define WMI_AP_DEAUTH           3   /* deauthenticate station */
+#define WMI_AP_MLME_AUTHORIZE   4   /* authorize station */
+#define WMI_AP_MLME_UNAUTHORIZE 5   /* unauthorize station */
+} POSTPACK WMI_AP_SET_MLME_CMD;
+
+typedef PREPACK struct {
+    u32 period;
+} POSTPACK WMI_AP_CONN_INACT_CMD;
+
+typedef PREPACK struct {
+    u32 period_min;
+    u32 dwell_ms;
+} POSTPACK WMI_AP_PROT_SCAN_TIME_CMD;
+
+typedef PREPACK struct {
+    u32 flag;
+    u16 aid;
+} POSTPACK WMI_AP_SET_PVB_CMD;
+
+#define WMI_DISABLE_REGULATORY_CODE "FF"
+
+typedef PREPACK struct {
+    u8 countryCode[3];
+} POSTPACK WMI_AP_SET_COUNTRY_CMD;
+
+typedef PREPACK struct {
+    u8 dtim;
+} POSTPACK WMI_AP_SET_DTIM_CMD;
+
+typedef PREPACK struct {
+    u8 band; /* specifies which band to apply these values */
+    u8 enable; /* allows 11n to be disabled on a per band basis */
+    u8 chan_width_40M_supported;
+    u8 short_GI_20MHz;
+    u8 short_GI_40MHz;
+    u8 intolerance_40MHz;
+    u8 max_ampdu_len_exp;
+} POSTPACK WMI_SET_HT_CAP_CMD;
+
+typedef PREPACK struct {
+    u8 sta_chan_width;
+} POSTPACK WMI_SET_HT_OP_CMD;
+
+typedef PREPACK struct {
+    u32 rateMasks[8];
+} POSTPACK WMI_SET_TX_SELECT_RATES_CMD;
+
+typedef PREPACK struct {
+    u32 sgiMask;
+    u8 sgiPERThreshold;
+} POSTPACK WMI_SET_TX_SGI_PARAM_CMD;
+
+#define DEFAULT_SGI_MASK 0x08080000
+#define DEFAULT_SGI_PER 10
+
+typedef PREPACK struct {
+    u32 rateField; /* 1 bit per rate corresponding to index */
+    u8 id;
+    u8 shortTrys;
+    u8 longTrys;
+    u8 reserved; /* padding */
+} POSTPACK WMI_SET_RATE_POLICY_CMD;
+
+typedef PREPACK struct {
+    u8 metaVersion; /* version of meta data for rx packets <0 = default> (0-7 = valid) */
+    u8 dot11Hdr; /* 1 == leave .11 header intact , 0 == replace .11 header with .3 <default> */
+    u8 defragOnHost; /* 1 == defragmentation is performed by host, 0 == performed by target <default> */
+    u8 reserved[1]; /* alignment */
+} POSTPACK WMI_RX_FRAME_FORMAT_CMD;
+
+
+typedef PREPACK struct {
+    u8 enable;     /* 1 == device operates in thin mode , 0 == normal mode <default> */
+    u8 reserved[3];
+} POSTPACK WMI_SET_THIN_MODE_CMD;
+
+/* AP mode events */
+/* WMI_PS_POLL_EVENT */
+typedef PREPACK struct {
+    u16 aid;
+} POSTPACK WMI_PSPOLL_EVENT;
+
+typedef PREPACK struct {
+    u32 tx_bytes;
+    u32 tx_pkts;
+    u32 tx_error;
+    u32 tx_discard;
+    u32 rx_bytes;
+    u32 rx_pkts;
+    u32 rx_error;
+    u32 rx_discard;
+    u32 aid;
+} POSTPACK WMI_PER_STA_STAT;
+
+#define AP_GET_STATS    0
+#define AP_CLEAR_STATS  1
+
+typedef PREPACK struct {
+    u32 action;
+    WMI_PER_STA_STAT    sta[AP_MAX_NUM_STA+1];
+} POSTPACK WMI_AP_MODE_STAT;
+#define WMI_AP_MODE_STAT_SIZE(numSta) (sizeof(u32) + ((numSta + 1) * sizeof(WMI_PER_STA_STAT)))
+
+#define AP_11BG_RATESET1        1
+#define AP_11BG_RATESET2        2
+#define DEF_AP_11BG_RATESET     AP_11BG_RATESET1
+typedef PREPACK struct {
+    u8 rateset;
+} POSTPACK WMI_AP_SET_11BG_RATESET_CMD;
+/*
+ * End of AP mode definitions
+ */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMI_H_ */
diff --git a/drivers/staging/ath6kl/include/common/wmix.h b/drivers/staging/ath6kl/include/common/wmix.h
new file mode 100644
index 00000000000..9435eab1b7f
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common/wmix.h
@@ -0,0 +1,271 @@
+//------------------------------------------------------------------------------
+// <copyright file="wmix.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+/*
+ * This file contains extensions of the WMI protocol specified in the
+ * Wireless Module Interface (WMI).  It includes definitions of all
+ * extended commands and events.  Extensions include useful commands
+ * that are not directly related to wireless activities.  They may
+ * be hardware-specific, and they might not be supported on all
+ * implementations.
+ *
+ * Extended WMIX commands are encapsulated in a WMI message with
+ * cmd=WMI_EXTENSION_CMD.
+ */
+
+#ifndef _WMIX_H_
+#define _WMIX_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "dbglog.h"
+
+/*
+ * Extended WMI commands are those that are needed during wireless
+ * operation, but which are not really wireless commands.  This allows,
+ * for instance, platform-specific commands.  Extended WMI commands are
+ * embedded in a WMI command message with WMI_COMMAND_ID=WMI_EXTENSION_CMDID.
+ * Extended WMI events are similarly embedded in a WMI event message with
+ * WMI_EVENT_ID=WMI_EXTENSION_EVENTID.
+ */
+typedef PREPACK struct {
+    u32 commandId;
+} POSTPACK WMIX_CMD_HDR;
+
+typedef enum {
+    WMIX_DSETOPEN_REPLY_CMDID           = 0x2001,
+    WMIX_DSETDATA_REPLY_CMDID,
+    WMIX_GPIO_OUTPUT_SET_CMDID,
+    WMIX_GPIO_INPUT_GET_CMDID,
+    WMIX_GPIO_REGISTER_SET_CMDID,
+    WMIX_GPIO_REGISTER_GET_CMDID,
+    WMIX_GPIO_INTR_ACK_CMDID,
+    WMIX_HB_CHALLENGE_RESP_CMDID,
+    WMIX_DBGLOG_CFG_MODULE_CMDID,
+    WMIX_PROF_CFG_CMDID,                 /* 0x200a */
+    WMIX_PROF_ADDR_SET_CMDID,
+    WMIX_PROF_START_CMDID,
+    WMIX_PROF_STOP_CMDID,
+    WMIX_PROF_COUNT_GET_CMDID,
+} WMIX_COMMAND_ID;
+
+typedef enum {
+    WMIX_DSETOPENREQ_EVENTID            = 0x3001,
+    WMIX_DSETCLOSE_EVENTID,
+    WMIX_DSETDATAREQ_EVENTID,
+    WMIX_GPIO_INTR_EVENTID,
+    WMIX_GPIO_DATA_EVENTID,
+    WMIX_GPIO_ACK_EVENTID,
+    WMIX_HB_CHALLENGE_RESP_EVENTID,
+    WMIX_DBGLOG_EVENTID,
+    WMIX_PROF_COUNT_EVENTID,
+} WMIX_EVENT_ID;
+
+/*
+ * =============DataSet support=================
+ */
+
+/*
+ * WMIX_DSETOPENREQ_EVENTID
+ * DataSet Open Request Event
+ */
+typedef PREPACK struct {
+    u32 dset_id;
+    u32 targ_dset_handle;  /* echo'ed, not used by Host, */
+    u32 targ_reply_fn;     /* echo'ed, not used by Host, */
+    u32 targ_reply_arg;    /* echo'ed, not used by Host, */
+} POSTPACK WMIX_DSETOPENREQ_EVENT;
+
+/*
+ * WMIX_DSETCLOSE_EVENTID
+ * DataSet Close Event
+ */
+typedef PREPACK struct {
+    u32 access_cookie;
+} POSTPACK WMIX_DSETCLOSE_EVENT;
+
+/*
+ * WMIX_DSETDATAREQ_EVENTID
+ * DataSet Data Request Event
+ */
+typedef PREPACK struct {
+    u32 access_cookie;
+    u32 offset;
+    u32 length;
+    u32 targ_buf;         /* echo'ed, not used by Host, */
+    u32 targ_reply_fn;    /* echo'ed, not used by Host, */
+    u32 targ_reply_arg;   /* echo'ed, not used by Host, */
+} POSTPACK WMIX_DSETDATAREQ_EVENT;
+
+typedef PREPACK struct {
+    u32 status;
+    u32 targ_dset_handle;
+    u32 targ_reply_fn;
+    u32 targ_reply_arg;
+    u32 access_cookie;
+    u32 size;
+    u32 version;
+} POSTPACK WMIX_DSETOPEN_REPLY_CMD;
+
+typedef PREPACK struct {
+    u32 status;
+    u32 targ_buf;
+    u32 targ_reply_fn;
+    u32 targ_reply_arg;
+    u32 length;
+    u8 buf[1];
+} POSTPACK WMIX_DSETDATA_REPLY_CMD;
+
+
+/* 
+ * =============GPIO support=================
+ * All masks are 18-bit masks with bit N operating on GPIO pin N.
+ */
+
+
+/*
+ * Set GPIO pin output state.
+ * In order for output to be driven, a pin must be enabled for output.
+ * This can be done during initialization through the GPIO Configuration
+ * DataSet, or during operation with the enable_mask.
+ *
+ * If a request is made to simultaneously set/clear or set/disable or
+ * clear/disable or disable/enable, results are undefined.
+ */
+typedef PREPACK struct {
+    u32 set_mask;             /* pins to set */
+    u32 clear_mask;           /* pins to clear */
+    u32 enable_mask;          /* pins to enable for output */
+    u32 disable_mask;         /* pins to disable/tristate */
+} POSTPACK WMIX_GPIO_OUTPUT_SET_CMD;
+
+/* 
+ * Set a GPIO register.  For debug/exceptional cases.
+ * Values for gpioreg_id are GPIO_REGISTER_IDs, defined in a
+ * platform-dependent header.
+ */
+typedef PREPACK struct {
+    u32 gpioreg_id;           /* GPIO register ID */
+    u32 value;                /* value to write */
+} POSTPACK WMIX_GPIO_REGISTER_SET_CMD;
+
+/* Get a GPIO register.  For debug/exceptional cases. */
+typedef PREPACK struct {
+    u32 gpioreg_id;           /* GPIO register to read */
+} POSTPACK WMIX_GPIO_REGISTER_GET_CMD;
+
+/*
+ * Host acknowledges and re-arms GPIO interrupts.  A single
+ * message should be used to acknowledge all interrupts that
+ * were delivered in an earlier WMIX_GPIO_INTR_EVENT message.
+ */
+typedef PREPACK struct {
+    u32 ack_mask;             /* interrupts to acknowledge */
+} POSTPACK WMIX_GPIO_INTR_ACK_CMD;
+
+/*
+ * Target informs Host of GPIO interrupts that have occurred since the
+ * last WMIX_GIPO_INTR_ACK_CMD was received.  Additional information --
+ * the current GPIO input values is provided -- in order to support
+ * use of a GPIO interrupt as a Data Valid signal for other GPIO pins.
+ */
+typedef PREPACK struct {
+    u32 intr_mask;            /* pending GPIO interrupts */
+    u32 input_values;         /* recent GPIO input values */
+} POSTPACK WMIX_GPIO_INTR_EVENT;
+
+/*
+ * Target responds to Host's earlier WMIX_GPIO_INPUT_GET_CMDID request
+ * using a GPIO_DATA_EVENT with
+ *   value set to the mask of GPIO pin inputs and
+ *   reg_id set to GPIO_ID_NONE
+ * 
+ *
+ * Target responds to Hosts's earlier WMIX_GPIO_REGISTER_GET_CMDID request
+ * using a GPIO_DATA_EVENT with
+ *   value set to the value of the requested register and
+ *   reg_id identifying the register (reflects the original request)
+ * NB: reg_id supports the future possibility of unsolicited
+ * WMIX_GPIO_DATA_EVENTs (for polling GPIO input), and it may
+ * simplify Host GPIO support.
+ */
+typedef PREPACK struct {
+    u32 value;
+    u32 reg_id;
+} POSTPACK WMIX_GPIO_DATA_EVENT;
+
+/*
+ * =============Error Detection support=================
+ */
+
+/*
+ * WMIX_HB_CHALLENGE_RESP_CMDID
+ * Heartbeat Challenge Response command
+ */
+typedef PREPACK struct {
+    u32 cookie;
+    u32 source;
+} POSTPACK WMIX_HB_CHALLENGE_RESP_CMD;
+
+/*
+ * WMIX_HB_CHALLENGE_RESP_EVENTID
+ * Heartbeat Challenge Response Event
+ */
+#define WMIX_HB_CHALLENGE_RESP_EVENT WMIX_HB_CHALLENGE_RESP_CMD
+
+typedef PREPACK struct {
+    struct dbglog_config_s config;
+} POSTPACK WMIX_DBGLOG_CFG_MODULE_CMD;
+
+/*
+ * =============Target Profiling support=================
+ */
+
+typedef PREPACK struct {
+    u32 period; /* Time (in 30.5us ticks) between samples */
+    u32 nbins;
+} POSTPACK WMIX_PROF_CFG_CMD;
+
+typedef PREPACK struct {
+    u32 addr;
+} POSTPACK WMIX_PROF_ADDR_SET_CMD;
+
+/*
+ * Target responds to Hosts's earlier WMIX_PROF_COUNT_GET_CMDID request
+ * using a WMIX_PROF_COUNT_EVENT with
+ *   addr set to the next address
+ *   count set to the corresponding count
+ */
+typedef PREPACK struct {
+    u32 addr;
+    u32 count;
+} POSTPACK WMIX_PROF_COUNT_EVENT;
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMIX_H_ */
diff --git a/drivers/staging/ath6kl/include/common_drv.h b/drivers/staging/ath6kl/include/common_drv.h
new file mode 100644
index 00000000000..34db29958bc
--- /dev/null
+++ b/drivers/staging/ath6kl/include/common_drv.h
@@ -0,0 +1,104 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef COMMON_DRV_H_
+#define COMMON_DRV_H_
+
+#include "hif.h"
+#include "htc_packet.h"
+#include "htc_api.h"
+
+/* structure that is the state information for the default credit distribution callback
+ * drivers should instantiate (zero-init as well) this structure in their driver instance
+ * and pass it as a context to the HTC credit distribution functions */
+struct common_credit_state_info {
+    int TotalAvailableCredits;      /* total credits in the system at startup */
+    int CurrentFreeCredits;         /* credits available in the pool that have not been
+                                       given out to endpoints */
+    struct htc_endpoint_credit_dist *pLowestPriEpDist;  /* pointer to the lowest priority endpoint dist struct */
+};
+
+struct hci_transport_callbacks {
+    s32 (*setupTransport)(void *ar);
+    void (*cleanupTransport)(void *ar);
+};
+
+struct hci_transport_misc_handles {
+   void *netDevice;
+   void *hifDevice;
+   void *htcHandle;
+};
+
+/* HTC TX packet tagging definitions */
+#define AR6K_CONTROL_PKT_TAG    HTC_TX_PACKET_TAG_USER_DEFINED
+#define AR6K_DATA_PKT_TAG       (AR6K_CONTROL_PKT_TAG + 1)
+
+#define AR6002_VERSION_REV1     0x20000086
+#define AR6002_VERSION_REV2     0x20000188
+#define AR6003_VERSION_REV1     0x300002ba
+#define AR6003_VERSION_REV2     0x30000384
+
+#define AR6002_CUST_DATA_SIZE 112
+#define AR6003_CUST_DATA_SIZE 16
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* OS-independent APIs */
+int ar6000_setup_credit_dist(HTC_HANDLE HTCHandle, struct common_credit_state_info *pCredInfo);
+
+int ar6000_ReadRegDiag(struct hif_device *hifDevice, u32 *address, u32 *data);
+
+int ar6000_WriteRegDiag(struct hif_device *hifDevice, u32 *address, u32 *data);
+
+int ar6000_ReadDataDiag(struct hif_device *hifDevice, u32 address,  u8 *data, u32 length);
+
+int ar6000_reset_device(struct hif_device *hifDevice, u32 TargetType, bool waitForCompletion, bool coldReset);
+
+void ar6000_dump_target_assert_info(struct hif_device *hifDevice, u32 TargetType);
+
+int ar6000_set_htc_params(struct hif_device *hifDevice,
+                               u32 TargetType,
+                               u32 MboxIsrYieldValue,
+                               u8 HtcControlBuffers);
+
+int ar6000_set_hci_bridge_flags(struct hif_device *hifDevice,
+                                     u32 TargetType,
+                                     u32 Flags);
+
+void ar6000_copy_cust_data_from_target(struct hif_device *hifDevice, u32 TargetType);
+
+u8 *ar6000_get_cust_data_buffer(u32 TargetType);
+
+int ar6000_setBTState(void *context, u8 *pInBuf, u32 InBufSize);
+
+int ar6000_setDevicePowerState(void *context, u8 *pInBuf, u32 InBufSize);
+
+int ar6000_setWowMode(void *context, u8 *pInBuf, u32 InBufSize);
+
+int ar6000_setHostMode(void *context, u8 *pInBuf, u32 InBufSize);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*COMMON_DRV_H_*/
diff --git a/drivers/staging/ath6kl/include/dbglog_api.h b/drivers/staging/ath6kl/include/dbglog_api.h
new file mode 100644
index 00000000000..a53aed316e3
--- /dev/null
+++ b/drivers/staging/ath6kl/include/dbglog_api.h
@@ -0,0 +1,52 @@
+//------------------------------------------------------------------------------
+// <copyright file="dbglog_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains host side debug primitives.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _DBGLOG_API_H_
+#define _DBGLOG_API_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "dbglog.h"
+
+#define DBGLOG_HOST_LOG_BUFFER_SIZE            DBGLOG_LOG_BUFFER_SIZE
+
+#define DBGLOG_GET_DBGID(arg) \
+    ((arg & DBGLOG_DBGID_MASK) >> DBGLOG_DBGID_OFFSET)
+
+#define DBGLOG_GET_MODULEID(arg) \
+    ((arg & DBGLOG_MODULEID_MASK) >> DBGLOG_MODULEID_OFFSET)
+
+#define DBGLOG_GET_NUMARGS(arg) \
+    ((arg & DBGLOG_NUM_ARGS_MASK) >> DBGLOG_NUM_ARGS_OFFSET)
+
+#define DBGLOG_GET_TIMESTAMP(arg) \
+    ((arg & DBGLOG_TIMESTAMP_MASK) >> DBGLOG_TIMESTAMP_OFFSET)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DBGLOG_API_H_ */
diff --git a/drivers/staging/ath6kl/include/dl_list.h b/drivers/staging/ath6kl/include/dl_list.h
new file mode 100644
index 00000000000..13b1e6956c2
--- /dev/null
+++ b/drivers/staging/ath6kl/include/dl_list.h
@@ -0,0 +1,153 @@
+//------------------------------------------------------------------------------
+// <copyright file="dl_list.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Double-link list definitions (adapted from Atheros SDIO stack)
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef __DL_LIST_H___
+#define __DL_LIST_H___
+
+#include "a_osapi.h"
+
+#define A_CONTAINING_STRUCT(address, struct_type, field_name)\
+            ((struct_type *)((unsigned long)(address) - (unsigned long)(&((struct_type *)0)->field_name)))
+         
+/* list functions */
+/* pointers for the list */
+struct dl_list {
+        struct dl_list *pPrev;
+        struct dl_list *pNext;
+};
+/*
+ * DL_LIST_INIT , initialize doubly linked list
+*/
+#define DL_LIST_INIT(pList)\
+    {(pList)->pPrev = pList; (pList)->pNext = pList;}
+
+/* faster macro to init list and add a single item */    
+#define DL_LIST_INIT_AND_ADD(pList,pItem) \
+{   (pList)->pPrev = (pItem); \
+    (pList)->pNext = (pItem); \
+    (pItem)->pNext = (pList); \
+    (pItem)->pPrev = (pList); \
+}
+    
+#define DL_LIST_IS_EMPTY(pList) (((pList)->pPrev == (pList)) && ((pList)->pNext == (pList)))
+#define DL_LIST_GET_ITEM_AT_HEAD(pList) (pList)->pNext
+#define DL_LIST_GET_ITEM_AT_TAIL(pList) (pList)->pPrev
+/*
+ * ITERATE_OVER_LIST pStart is the list, pTemp is a temp list member
+ * NOT: do not use this function if the items in the list are deleted inside the
+ * iteration loop
+*/
+#define ITERATE_OVER_LIST(pStart, pTemp) \
+    for((pTemp) =(pStart)->pNext; pTemp != (pStart); (pTemp) = (pTemp)->pNext)
+
+
+/* safe iterate macro that allows the item to be removed from the list
+ * the iteration continues to the next item in the list
+ */
+#define ITERATE_OVER_LIST_ALLOW_REMOVE(pStart,pItem,st,offset)  \
+{                                                       \
+    struct dl_list *  pTemp;                                     \
+    pTemp = (pStart)->pNext;                            \
+    while (pTemp != (pStart)) {                         \
+        (pItem) = A_CONTAINING_STRUCT(pTemp,st,offset);   \
+         pTemp = pTemp->pNext;                          \
+
+#define ITERATE_END }}
+
+/*
+ * DL_ListInsertTail - insert pAdd to the end of the list
+*/
+static INLINE struct dl_list *DL_ListInsertTail(struct dl_list *pList, struct dl_list *pAdd) {
+        /* insert at tail */
+    pAdd->pPrev = pList->pPrev;
+    pAdd->pNext = pList;
+    pList->pPrev->pNext = pAdd;
+    pList->pPrev = pAdd;
+    return pAdd;
+}
+
+/*
+ * DL_ListInsertHead - insert pAdd into the head of the list
+*/
+static INLINE struct dl_list * DL_ListInsertHead(struct dl_list * pList, struct dl_list * pAdd) {
+        /* insert at head */
+    pAdd->pPrev = pList;
+    pAdd->pNext = pList->pNext;
+    pList->pNext->pPrev = pAdd;
+    pList->pNext = pAdd;
+    return pAdd;
+}
+
+#define DL_ListAdd(pList,pItem) DL_ListInsertHead((pList),(pItem))
+/*
+ * DL_ListRemove - remove pDel from list
+*/
+static INLINE struct dl_list * DL_ListRemove(struct dl_list * pDel) {
+    pDel->pNext->pPrev = pDel->pPrev;
+    pDel->pPrev->pNext = pDel->pNext;
+        /* point back to itself just to be safe, incase remove is called again */
+    pDel->pNext = pDel;
+    pDel->pPrev = pDel;
+    return pDel;
+}
+
+/*
+ * DL_ListRemoveItemFromHead - get a list item from the head
+*/
+static INLINE struct dl_list * DL_ListRemoveItemFromHead(struct dl_list * pList) {
+    struct dl_list * pItem = NULL;
+    if (pList->pNext != pList) {
+        pItem = pList->pNext;
+            /* remove the first item from head */
+        DL_ListRemove(pItem);
+    }
+    return pItem;
+}
+
+static INLINE struct dl_list * DL_ListRemoveItemFromTail(struct dl_list * pList) {
+    struct dl_list * pItem = NULL;
+    if (pList->pPrev != pList) {
+        pItem = pList->pPrev;
+            /* remove the item from tail */
+        DL_ListRemove(pItem);
+    }
+    return pItem;
+}
+
+/* transfer src list items to the tail of the destination list */
+static INLINE void DL_ListTransferItemsToTail(struct dl_list * pDest, struct dl_list * pSrc) {
+        /* only concatenate if src is not empty */
+    if (!DL_LIST_IS_EMPTY(pSrc)) {
+            /* cut out circular list in src and re-attach to end of dest */
+        pSrc->pPrev->pNext = pDest;
+        pSrc->pNext->pPrev = pDest->pPrev;
+        pDest->pPrev->pNext = pSrc->pNext; 
+        pDest->pPrev = pSrc->pPrev;
+            /* terminate src list, it is now empty */      
+        pSrc->pPrev = pSrc;
+        pSrc->pNext = pSrc;
+    }
+}
+
+#endif /* __DL_LIST_H___ */
diff --git a/drivers/staging/ath6kl/include/dset_api.h b/drivers/staging/ath6kl/include/dset_api.h
new file mode 100644
index 00000000000..fe901ba40ec
--- /dev/null
+++ b/drivers/staging/ath6kl/include/dset_api.h
@@ -0,0 +1,65 @@
+//------------------------------------------------------------------------------
+// <copyright file="dset_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Host-side DataSet API.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _DSET_API_H_
+#define _DSET_API_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/*
+ * Host-side DataSet support is optional, and is not
+ * currently required for correct operation.  To disable
+ * Host-side DataSet support, set this to 0.
+ */
+#ifndef CONFIG_HOST_DSET_SUPPORT
+#define CONFIG_HOST_DSET_SUPPORT 1
+#endif
+
+/* Called to send a DataSet Open Reply back to the Target. */
+int wmi_dset_open_reply(struct wmi_t *wmip,
+                             u32 status,
+                             u32 access_cookie,
+                             u32 size,
+                             u32 version,
+                             u32 targ_handle,
+                             u32 targ_reply_fn,
+                             u32 targ_reply_arg);
+
+/* Called to send a DataSet Data Reply back to the Target. */
+int wmi_dset_data_reply(struct wmi_t *wmip,
+                             u32 status,
+                             u8 *host_buf,
+                             u32 length,
+                             u32 targ_buf,
+                             u32 targ_reply_fn,
+                             u32 targ_reply_arg);
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+
+#endif /* _DSET_API_H_ */
diff --git a/drivers/staging/ath6kl/include/hci_transport_api.h b/drivers/staging/ath6kl/include/hci_transport_api.h
new file mode 100644
index 00000000000..5e903fad23f
--- /dev/null
+++ b/drivers/staging/ath6kl/include/hci_transport_api.h
@@ -0,0 +1,259 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HCI_TRANSPORT_API_H_
+#define _HCI_TRANSPORT_API_H_
+
+    /* Bluetooth HCI packets are stored in HTC packet containers */
+#include "htc_packet.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+typedef void *HCI_TRANSPORT_HANDLE;
+
+typedef HTC_ENDPOINT_ID HCI_TRANSPORT_PACKET_TYPE; 
+
+    /* we map each HCI packet class to a static Endpoint ID */
+#define HCI_COMMAND_TYPE   ENDPOINT_1
+#define HCI_EVENT_TYPE     ENDPOINT_2
+#define HCI_ACL_TYPE       ENDPOINT_3
+#define HCI_PACKET_INVALID ENDPOINT_MAX
+
+#define HCI_GET_PACKET_TYPE(pP)    (pP)->Endpoint
+#define HCI_SET_PACKET_TYPE(pP,s)  (pP)->Endpoint = (s)
+
+/* callback when an HCI packet was completely sent */
+typedef void   (*HCI_TRANSPORT_SEND_PKT_COMPLETE)(void *, struct htc_packet *);
+/* callback when an HCI packet is received */
+typedef void   (*HCI_TRANSPORT_RECV_PKT)(void *, struct htc_packet *);
+/* Optional receive buffer re-fill callback,
+ * On some OSes (like Linux) packets are allocated from a global pool and indicated up
+ * to the network stack.  The driver never gets the packets back from the OS.  For these OSes
+ * a refill callback can be used to allocate and re-queue buffers into HTC.
+ * A refill callback is used for the reception of ACL and EVENT packets.  The caller must
+ * set the watermark trigger point to cause a refill.
+ */
+typedef void   (*HCI_TRANSPORT_RECV_REFILL)(void *, HCI_TRANSPORT_PACKET_TYPE Type, int BuffersAvailable);
+/* Optional receive packet refill
+ * On some systems packet buffers are an extremely limited resource.  Rather than
+ * queue largest-possible-sized buffers to the HCI bridge, some systems would rather
+ * allocate a specific size as the packet is received.  The trade off is
+ * slightly more processing (callback invoked for each RX packet)
+ * for the benefit of committing fewer buffer resources into the bridge.
+ *
+ * The callback is provided the length of the pending packet to fetch. This includes the
+ * full transport header, HCI header, plus the length of payload.  The callback can return a pointer to
+ * the allocated HTC packet for immediate use.
+ *
+ * NOTE*** This callback is mutually exclusive with the the refill callback above.
+ *
+ * */
+typedef struct htc_packet *(*HCI_TRANSPORT_RECV_ALLOC)(void *, HCI_TRANSPORT_PACKET_TYPE Type, int Length);
+
+typedef enum _HCI_SEND_FULL_ACTION {
+    HCI_SEND_FULL_KEEP = 0,  /* packet that overflowed should be kept in the queue */
+    HCI_SEND_FULL_DROP = 1,  /* packet that overflowed should be dropped */
+} HCI_SEND_FULL_ACTION;
+
+/* callback when an HCI send queue exceeds the caller's MaxSendQueueDepth threshold,
+ * the callback must return the send full action to take (either DROP or KEEP) */
+typedef HCI_SEND_FULL_ACTION  (*HCI_TRANSPORT_SEND_FULL)(void *, struct htc_packet *);
+
+struct hci_transport_properties {
+    int    HeadRoom;      /* number of bytes in front of HCI packet for header space */
+    int    TailRoom;      /* number of bytes at the end of the HCI packet for tail space */
+    int    IOBlockPad;    /* I/O block padding required (always a power of 2) */
+};
+
+struct hci_transport_config_info {
+    int      ACLRecvBufferWaterMark;     /* low watermark to trigger recv refill */
+    int      EventRecvBufferWaterMark;   /* low watermark to trigger recv refill */  
+    int      MaxSendQueueDepth;          /* max number of packets in the single send queue */
+    void     *pContext;                  /* context for all callbacks */
+    void     (*TransportFailure)(void *pContext, int Status); /* transport failure callback */
+    int (*TransportReady)(HCI_TRANSPORT_HANDLE, struct hci_transport_properties *,void *pContext); /* transport is ready */
+    void     (*TransportRemoved)(void *pContext);                  /* transport was removed */
+        /* packet processing callbacks */
+    HCI_TRANSPORT_SEND_PKT_COMPLETE    pHCISendComplete;
+    HCI_TRANSPORT_RECV_PKT             pHCIPktRecv;
+    HCI_TRANSPORT_RECV_REFILL          pHCIPktRecvRefill;
+    HCI_TRANSPORT_RECV_ALLOC           pHCIPktRecvAlloc;
+    HCI_TRANSPORT_SEND_FULL            pHCISendFull;
+};
+
+/* ------ Function Prototypes ------ */
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Attach to the HCI transport module
+  @function name: HCI_TransportAttach
+  @input:  HTCHandle - HTC handle (see HTC apis)
+           pInfo - initialization information
+  @output:
+  @return: HCI_TRANSPORT_HANDLE on success, NULL on failure
+  @notes:    The HTC module provides HCI transport services.
+  @example:
+  @see also: HCI_TransportDetach
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+HCI_TRANSPORT_HANDLE HCI_TransportAttach(void *HTCHandle, struct hci_transport_config_info *pInfo);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Detach from the HCI transport module
+  @function name: HCI_TransportDetach
+  @input:  HciTrans - HCI transport handle
+           pInfo - initialization information
+  @output:
+  @return: 
+  @notes:  
+  @example:
+  @see also: 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void HCI_TransportDetach(HCI_TRANSPORT_HANDLE HciTrans);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Add receive packets to the HCI transport
+  @function name: HCI_TransportAddReceivePkts
+  @input:  HciTrans - HCI transport handle
+           pQueue - a queue holding one or more packets
+  @output:
+  @return: 0 on success
+  @notes:  user must supply HTC packets for capturing incomming HCI packets.  The caller
+           must initialize each HTC packet using the SET_HTC_PACKET_INFO_RX_REFILL()
+           macro. Each packet in the queue must be of the same type and length 
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HCI_TransportAddReceivePkts(HCI_TRANSPORT_HANDLE HciTrans, struct htc_packet_queue *pQueue);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Send an HCI packet packet
+  @function name: HCI_TransportSendPkt
+  @input:  HciTrans - HCI transport handle
+           pPacket - packet to send
+           Synchronous - send the packet synchronously (blocking)
+  @output:
+  @return: 0
+  @notes:  Caller must initialize packet using SET_HTC_PACKET_INFO_TX() and
+           HCI_SET_PACKET_TYPE() macros to prepare the packet. 
+           If Synchronous is set to false the call is fully asynchronous.  On error or completion,
+           the registered send complete callback will be called.
+           If Synchronous is set to true, the call will block until the packet is sent, if the
+           interface cannot send the packet within a 2 second timeout, the function will return 
+           the failure code : A_EBUSY.
+           
+           Synchronous Mode should only be used at start-up to initialize the HCI device using 
+           custom HCI commands.  It should NOT be mixed with Asynchronous operations.  Mixed synchronous
+           and asynchronous operation behavior is undefined.
+           
+  @example:
+  @see also: 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HCI_TransportSendPkt(HCI_TRANSPORT_HANDLE HciTrans, struct htc_packet *pPacket, bool Synchronous);
+
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Stop HCI transport
+  @function name: HCI_TransportStop
+  @input:  HciTrans - hci transport handle 
+  @output:
+  @return:
+  @notes: HCI transport communication will be halted.  All receive and pending TX packets will
+          be flushed.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HCI_TransportStop(HCI_TRANSPORT_HANDLE HciTrans);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Start the HCI transport
+  @function name: HCI_TransportStart
+  @input:  HciTrans - hci transport handle 
+  @output:
+  @return: 0 on success
+  @notes: HCI transport communication will begin, the caller can expect the arrival
+          of HCI recv packets as soon as this call returns.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HCI_TransportStart(HCI_TRANSPORT_HANDLE HciTrans);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Enable or Disable Asynchronous Recv
+  @function name: HCI_TransportEnableDisableAsyncRecv
+  @input:  HciTrans - hci transport handle 
+           Enable - enable or disable asynchronous recv
+  @output:
+  @return: 0 on success
+  @notes: This API must be called when HCI recv is handled synchronously
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HCI_TransportEnableDisableAsyncRecv(HCI_TRANSPORT_HANDLE HciTrans, bool Enable);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Receive an event packet from the HCI transport synchronously using polling
+  @function name: HCI_TransportRecvHCIEventSync
+  @input:  HciTrans - hci transport handle 
+           pPacket - HTC packet to hold the recv data
+           MaxPollMS - maximum polling duration in Milliseconds;
+  @output: 
+  @return: 0 on success
+  @notes: This API should be used only during HCI device initialization, the caller must call
+          HCI_TransportEnableDisableAsyncRecv with Enable=false prior to using this API.
+          This API will only capture HCI Event packets.
+  @example:
+  @see also: HCI_TransportEnableDisableAsyncRecv
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HCI_TransportRecvHCIEventSync(HCI_TRANSPORT_HANDLE HciTrans,
+                                          struct htc_packet           *pPacket,
+                                          int                  MaxPollMS);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Set the desired baud rate for the underlying transport layer
+  @function name: HCI_TransportSetBaudRate
+  @input:  HciTrans - hci transport handle 
+           Baud - baud rate in bps
+  @output: 
+  @return: 0 on success
+  @notes: This API should be used only after HCI device initialization
+  @example:
+  @see also: 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HCI_TransportSetBaudRate(HCI_TRANSPORT_HANDLE HciTrans, u32 Baud);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Enable/Disable HCI Transport Power Management
+  @function name: HCI_TransportEnablePowerMgmt
+  @input:  HciTrans - hci transport handle 
+           Enable - 1 = Enable, 0 = Disable
+  @output: 
+  @return: 0 on success
+  @notes: 
+  @example:
+  @see also: 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int HCI_TransportEnablePowerMgmt(HCI_TRANSPORT_HANDLE HciTrans, bool Enable);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HCI_TRANSPORT_API_H_ */
diff --git a/drivers/staging/ath6kl/include/hif.h b/drivers/staging/ath6kl/include/hif.h
new file mode 100644
index 00000000000..24200e778c3
--- /dev/null
+++ b/drivers/staging/ath6kl/include/hif.h
@@ -0,0 +1,456 @@
+//------------------------------------------------------------------------------
+// <copyright file="hif.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HIF specific declarations and prototypes
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HIF_H_
+#define _HIF_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/* Header files */
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_osapi.h"
+#include "dl_list.h"
+
+
+typedef struct htc_callbacks HTC_CALLBACKS;
+struct hif_device;
+
+/*
+ * direction - Direction of transfer (HIF_READ/HIF_WRITE).
+ */
+#define HIF_READ                    0x00000001
+#define HIF_WRITE                   0x00000002
+#define HIF_DIR_MASK                (HIF_READ | HIF_WRITE)
+
+/*
+ *     type - An interface may support different kind of read/write commands.
+ *            For example: SDIO supports CMD52/CMD53s. In case of MSIO it
+ *            translates to using different kinds of TPCs. The command type
+ *            is thus divided into a basic and an extended command and can
+ *            be specified using HIF_BASIC_IO/HIF_EXTENDED_IO.
+ */
+#define HIF_BASIC_IO                0x00000004
+#define HIF_EXTENDED_IO             0x00000008
+#define HIF_TYPE_MASK               (HIF_BASIC_IO | HIF_EXTENDED_IO)
+
+/*
+ *     emode - This indicates the whether the command is to be executed in a
+ *             blocking or non-blocking fashion (HIF_SYNCHRONOUS/
+ *             HIF_ASYNCHRONOUS). The read/write data paths in HTC have been
+ *             implemented using the asynchronous mode allowing the the bus
+ *             driver to indicate the completion of operation through the
+ *             registered callback routine. The requirement primarily comes
+ *             from the contexts these operations get called from (a driver's
+ *             transmit context or the ISR context in case of receive).
+ *             Support for both of these modes is essential.
+ */
+#define HIF_SYNCHRONOUS             0x00000010
+#define HIF_ASYNCHRONOUS            0x00000020
+#define HIF_EMODE_MASK              (HIF_SYNCHRONOUS | HIF_ASYNCHRONOUS)
+
+/*
+ *     dmode - An interface may support different kinds of commands based on
+ *             the tradeoff between the amount of data it can carry and the
+ *             setup time. Byte and Block modes are supported (HIF_BYTE_BASIS/
+ *             HIF_BLOCK_BASIS). In case of latter, the data is rounded off
+ *             to the nearest block size by padding. The size of the block is
+ *             configurable at compile time using the HIF_BLOCK_SIZE and is
+ *             negotiated with the target during initialization after the
+ *             AR6000 interrupts are enabled.
+ */
+#define HIF_BYTE_BASIS              0x00000040
+#define HIF_BLOCK_BASIS             0x00000080
+#define HIF_DMODE_MASK              (HIF_BYTE_BASIS | HIF_BLOCK_BASIS)
+
+/*
+ *     amode - This indicates if the address has to be incremented on AR6000 
+ *             after every read/write operation (HIF?FIXED_ADDRESS/
+ *             HIF_INCREMENTAL_ADDRESS).
+ */
+#define HIF_FIXED_ADDRESS           0x00000100
+#define HIF_INCREMENTAL_ADDRESS     0x00000200
+#define HIF_AMODE_MASK              (HIF_FIXED_ADDRESS | HIF_INCREMENTAL_ADDRESS)
+
+#define HIF_WR_ASYNC_BYTE_FIX   \
+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_WR_ASYNC_BYTE_INC   \
+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_WR_ASYNC_BLOCK_INC  \
+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_WR_SYNC_BYTE_FIX    \
+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_WR_SYNC_BYTE_INC    \
+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_WR_SYNC_BLOCK_INC  \
+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_WR_ASYNC_BLOCK_FIX \
+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_WR_SYNC_BLOCK_FIX  \
+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_RD_SYNC_BYTE_INC    \
+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_RD_SYNC_BYTE_FIX    \
+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_RD_ASYNC_BYTE_FIX   \
+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_RD_ASYNC_BLOCK_FIX  \
+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_RD_ASYNC_BYTE_INC   \
+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_RD_ASYNC_BLOCK_INC  \
+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_RD_SYNC_BLOCK_INC  \
+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_RD_SYNC_BLOCK_FIX  \
+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
+    
+typedef enum {
+    HIF_DEVICE_POWER_STATE = 0,
+    HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
+    HIF_DEVICE_GET_MBOX_ADDR,
+    HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
+    HIF_DEVICE_GET_IRQ_PROC_MODE,
+    HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC,
+    HIF_DEVICE_POWER_STATE_CHANGE,
+    HIF_DEVICE_GET_IRQ_YIELD_PARAMS,
+    HIF_CONFIGURE_QUERY_SCATTER_REQUEST_SUPPORT,
+    HIF_DEVICE_GET_OS_DEVICE,
+    HIF_DEVICE_DEBUG_BUS_STATE,
+} HIF_DEVICE_CONFIG_OPCODE;
+
+/*
+ * HIF CONFIGURE definitions:
+ *
+ *   HIF_DEVICE_GET_MBOX_BLOCK_SIZE
+ *   input : none
+ *   output : array of 4 u32s
+ *   notes: block size is returned for each mailbox (4)
+ *
+ *   HIF_DEVICE_GET_MBOX_ADDR
+ *   input : none
+ *   output : struct hif_device_mbox_info
+ *   notes: 
+ *
+ *   HIF_DEVICE_GET_PENDING_EVENTS_FUNC
+ *   input : none
+ *   output: HIF_PENDING_EVENTS_FUNC function pointer
+ *   notes: this is optional for the HIF layer, if the request is
+ *          not handled then it indicates that the upper layer can use
+ *          the standard device methods to get pending events (IRQs, mailbox messages etc..)
+ *          otherwise it can call the function pointer to check pending events.
+ *
+ *   HIF_DEVICE_GET_IRQ_PROC_MODE
+ *   input : none
+ *   output : HIF_DEVICE_IRQ_PROCESSING_MODE (interrupt processing mode)
+ *   note: the hif layer interfaces with the underlying OS-specific bus driver. The HIF
+ *         layer can report whether IRQ processing is requires synchronous behavior or
+ *         can be processed using asynchronous bus requests (typically faster).
+ *
+ *   HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC
+ *   input :
+ *   output : HIF_MASK_UNMASK_RECV_EVENT function pointer
+ *   notes: this is optional for the HIF layer.  The HIF layer may require a special mechanism
+ *          to mask receive message events.  The upper layer can call this pointer when it needs
+ *          to mask/unmask receive events (in case it runs out of buffers).
+ *
+ *   HIF_DEVICE_POWER_STATE_CHANGE
+ *
+ *   input : HIF_DEVICE_POWER_CHANGE_TYPE
+ *   output : none
+ *   note: this is optional for the HIF layer.  The HIF layer can handle power on/off state change
+ *         requests in an interconnect specific way.  This is highly OS and bus driver dependent.
+ *         The caller must guarantee that no HIF read/write requests will be made after the device
+ *         is powered down.
+ *
+ *   HIF_DEVICE_GET_IRQ_YIELD_PARAMS
+ * 
+ *   input : none
+ *   output : struct hif_device_irq_yield_params
+ *   note: This query checks if the HIF layer wishes to impose a processing yield count for the DSR handler.
+ *   The DSR callback handler will exit after a fixed number of RX packets or events are processed.  
+ *   This query is only made if the device reports an IRQ processing mode of HIF_DEVICE_IRQ_SYNC_ONLY. 
+ *   The HIF implementation can ignore this command if it does not desire the DSR callback to yield.
+ *   The HIF layer can indicate the maximum number of IRQ processing units (RX packets) before the
+ *   DSR handler callback must yield and return control back to the HIF layer.  When a yield limit is 
+ *   used the DSR callback will not call HIFAckInterrupts() as it would normally do before returning.  
+ *   The HIF implementation that requires a yield count must call HIFAckInterrupt() when it is prepared
+ *   to process interrupts again.
+ *   
+ *   HIF_CONFIGURE_QUERY_SCATTER_REQUEST_SUPPORT
+ *   input : none
+ *   output : struct hif_device_scatter_support_info
+ *   note:  This query checks if the HIF layer implements the SCATTER request interface.  Scatter requests
+ *   allows upper layers to submit mailbox I/O operations using a list of buffers.  This is useful for
+ *   multi-message transfers that can better utilize the bus interconnect.
+ * 
+ * 
+ *   HIF_DEVICE_GET_OS_DEVICE
+ *   intput : none
+ *   output : struct hif_device_os_device_info;
+ *   note: On some operating systems, the HIF layer has a parent device object for the bus.  This object
+ *         may be required to register certain types of logical devices.
+ * 
+ *   HIF_DEVICE_DEBUG_BUS_STATE
+ *   input : none
+ *   output : none
+ *   note: This configure option triggers the HIF interface to dump as much bus interface state.  This 
+ *   configuration request is optional (No-OP on some HIF implementations)
+ * 
+ */
+
+struct hif_mbox_properties {
+    u32 ExtendedAddress;  /* extended address for larger writes */
+    u32 ExtendedSize;
+};
+
+#define HIF_MBOX_FLAG_NO_BUNDLING   (1 << 0)   /* do not allow bundling over the mailbox */
+
+typedef enum _MBOX_BUF_IF_TYPE {
+    MBOX_BUS_IF_SDIO = 0,
+    MBOX_BUS_IF_SPI = 1,    
+} MBOX_BUF_IF_TYPE;
+
+struct hif_device_mbox_info {
+    u32 MboxAddresses[4];  /* must be first element for legacy HIFs that return the address in
+                                   and ARRAY of 32-bit words */
+    
+        /* the following describe extended mailbox properties */
+    struct hif_mbox_properties MboxProp[4];
+        /* if the HIF supports the GMbox extended address region it can report it
+         * here, some interfaces cannot support the GMBOX address range and not set this */
+    u32 GMboxAddress;
+    u32 GMboxSize;
+    u32 Flags;             /* flags to describe mbox behavior or usage */
+    MBOX_BUF_IF_TYPE MboxBusIFType;   /* mailbox bus interface type */
+};
+
+typedef enum {
+    HIF_DEVICE_IRQ_SYNC_ONLY,   /* for HIF implementations that require the DSR to process all
+                                   interrupts before returning */
+    HIF_DEVICE_IRQ_ASYNC_SYNC,  /* for HIF implementations that allow DSR to process interrupts
+                                   using ASYNC I/O (that is HIFAckInterrupt can be called at a
+                                   later time */
+} HIF_DEVICE_IRQ_PROCESSING_MODE;
+
+typedef enum {
+    HIF_DEVICE_POWER_UP,    /* HIF layer should power up interface and/or module */
+    HIF_DEVICE_POWER_DOWN,  /* HIF layer should initiate bus-specific measures to minimize power */
+    HIF_DEVICE_POWER_CUT    /* HIF layer should initiate bus-specific AND/OR platform-specific measures
+                               to completely power-off the module and associated hardware (i.e. cut power supplies)
+                            */
+} HIF_DEVICE_POWER_CHANGE_TYPE;
+
+struct hif_device_irq_yield_params {
+    int     RecvPacketYieldCount; /* max number of packets to force DSR to return */
+};
+
+
+struct hif_scatter_item {
+    u8 *pBuffer;             /* CPU accessible address of buffer */
+    int          Length;              /* length of transfer to/from this buffer */
+    void        *pCallerContexts[2];  /* space for caller to insert a context associated with this item */
+};
+
+struct hif_scatter_req;
+typedef void ( *HIF_SCATTER_COMP_CB)(struct hif_scatter_req *);
+
+typedef enum _HIF_SCATTER_METHOD {
+    HIF_SCATTER_NONE = 0,
+    HIF_SCATTER_DMA_REAL,              /* Real SG support no restrictions */
+    HIF_SCATTER_DMA_BOUNCE,            /* Uses SG DMA but HIF layer uses an internal bounce buffer */    
+} HIF_SCATTER_METHOD;
+
+struct hif_scatter_req {
+    struct dl_list             ListLink;           /* link management */
+    u32 Address;            /* address for the read/write operation */
+    u32 Request;            /* request flags */
+    u32 TotalLength;        /* total length of entire transfer */
+    u32 CallerFlags;        /* caller specific flags can be stored here */
+    HIF_SCATTER_COMP_CB CompletionRoutine;  /* completion routine set by caller */
+    int            CompletionStatus;   /* status of completion */
+    void                *Context;           /* caller context for this request */
+    int                 ValidScatterEntries;  /* number of valid entries set by caller */
+    HIF_SCATTER_METHOD  ScatterMethod;        /* scatter method handled by HIF */  
+    void                *HIFPrivate[4];     /* HIF private area */
+    u8 *pScatterBounceBuffer;  /* bounce buffer for upper layers to copy to/from */
+    struct hif_scatter_item    ScatterList[1];     /* start of scatter list */
+};
+
+typedef struct hif_scatter_req * ( *HIF_ALLOCATE_SCATTER_REQUEST)(struct hif_device *device);
+typedef void ( *HIF_FREE_SCATTER_REQUEST)(struct hif_device *device, struct hif_scatter_req *request);
+typedef int ( *HIF_READWRITE_SCATTER)(struct hif_device *device, struct hif_scatter_req *request);
+
+struct hif_device_scatter_support_info {
+        /* information returned from HIF layer */
+    HIF_ALLOCATE_SCATTER_REQUEST    pAllocateReqFunc;
+    HIF_FREE_SCATTER_REQUEST        pFreeReqFunc;
+    HIF_READWRITE_SCATTER           pReadWriteScatterFunc;    
+    int                             MaxScatterEntries;
+    int                             MaxTransferSizePerScatterReq;
+};
+                      
+struct hif_device_os_device_info {
+    void    *pOSDevice;
+};
+                      
+#define HIF_MAX_DEVICES                 1
+
+struct htc_callbacks {
+    void      *context;     /* context to pass to the dsrhandler
+                               note : rwCompletionHandler is provided the context passed to HIFReadWrite  */
+    int (* rwCompletionHandler)(void *rwContext, int status);
+    int (* dsrHandler)(void *context);
+};
+
+typedef struct osdrv_callbacks {
+    void      *context;     /* context to pass for all callbacks except deviceRemovedHandler 
+                               the deviceRemovedHandler is only called if the device is claimed */
+    int (* deviceInsertedHandler)(void *context, void *hif_handle);
+    int (* deviceRemovedHandler)(void *claimedContext, void *hif_handle);
+    int (* deviceSuspendHandler)(void *context);
+    int (* deviceResumeHandler)(void *context);
+    int (* deviceWakeupHandler)(void *context);
+    int (* devicePowerChangeHandler)(void *context, HIF_DEVICE_POWER_CHANGE_TYPE config);
+} OSDRV_CALLBACKS;
+
+#define HIF_OTHER_EVENTS     (1 << 0)   /* other interrupts (non-Recv) are pending, host
+                                           needs to read the register table to figure out what */
+#define HIF_RECV_MSG_AVAIL   (1 << 1)   /* pending recv packet */
+
+struct hif_pending_events_info {
+    u32 Events;
+    u32 LookAhead;
+    u32 AvailableRecvBytes;
+#ifdef THREAD_X
+    u32 Polling;
+    u32 INT_CAUSE_REG;
+#endif
+};
+
+    /* function to get pending events , some HIF modules use special mechanisms
+     * to detect packet available and other interrupts */
+typedef int ( *HIF_PENDING_EVENTS_FUNC)(struct hif_device              *device,
+                                             struct hif_pending_events_info *pEvents,
+                                             void                    *AsyncContext);
+
+#define HIF_MASK_RECV    true
+#define HIF_UNMASK_RECV  false
+    /* function to mask recv events */
+typedef int ( *HIF_MASK_UNMASK_RECV_EVENT)(struct hif_device  *device,
+                                                bool      Mask,
+                                                void        *AsyncContext);
+
+
+/*
+ * This API is used to perform any global initialization of the HIF layer
+ * and to set OS driver callbacks (i.e. insertion/removal) to the HIF layer
+ * 
+ */
+int HIFInit(OSDRV_CALLBACKS *callbacks);
+
+/* This API claims the HIF device and provides a context for handling removal.
+ * The device removal callback is only called when the OSDRV layer claims
+ * a device.  The claimed context must be non-NULL */
+void HIFClaimDevice(struct hif_device *device, void *claimedContext);
+/* release the claimed device */
+void HIFReleaseDevice(struct hif_device *device);
+
+/* This API allows the HTC layer to attach to the HIF device */
+int HIFAttachHTC(struct hif_device *device, HTC_CALLBACKS *callbacks);
+/* This API detaches the HTC layer from the HIF device */
+void     HIFDetachHTC(struct hif_device *device);
+
+/*
+ * This API is used to provide the read/write interface over the specific bus
+ * interface.
+ * address - Starting address in the AR6000's address space. For mailbox
+ *           writes, it refers to the start of the mbox boundary. It should
+ *           be ensured that the last byte falls on the mailbox's EOM. For
+ *           mailbox reads, it refers to the end of the mbox boundary.
+ * buffer - Pointer to the buffer containg the data to be transmitted or
+ *          received.
+ * length - Amount of data to be transmitted or received.
+ * request - Characterizes the attributes of the command.
+ */
+int
+HIFReadWrite(struct hif_device    *device,
+             u32 address,
+             u8       *buffer,
+             u32 length,
+             u32 request,
+             void          *context);
+
+/*
+ * This can be initiated from the unload driver context when the OSDRV layer has no more use for
+ * the device.
+ */
+void HIFShutDownDevice(struct hif_device *device);
+
+/*
+ * This should translate to an acknowledgment to the bus driver indicating that
+ * the previous interrupt request has been serviced and the all the relevant
+ * sources have been cleared. HTC is ready to process more interrupts.
+ * This should prevent the bus driver from raising an interrupt unless the
+ * previous one has been serviced and acknowledged using the previous API.
+ */
+void HIFAckInterrupt(struct hif_device *device);
+
+void HIFMaskInterrupt(struct hif_device *device);
+
+void HIFUnMaskInterrupt(struct hif_device *device);
+ 
+#ifdef THREAD_X
+/*
+ * This set of functions are to be used by the bus driver to notify
+ * the HIF module about various events.
+ * These are not implemented if the bus driver provides an alternative
+ * way for this notification though callbacks for instance.
+ */
+int HIFInsertEventNotify(void);
+
+int HIFRemoveEventNotify(void);
+
+int HIFIRQEventNotify(void);
+
+int HIFRWCompleteEventNotify(void);
+#endif
+
+int
+HIFConfigureDevice(struct hif_device *device, HIF_DEVICE_CONFIG_OPCODE opcode,
+                   void *config, u32 configLen);
+
+/* 
+ * This API wait for the remaining MBOX messages to be drained
+ * This should be moved to HTC AR6K layer
+ */
+int hifWaitForPendingRecv(struct hif_device *device);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HIF_H_ */
diff --git a/drivers/staging/ath6kl/include/host_version.h b/drivers/staging/ath6kl/include/host_version.h
new file mode 100644
index 00000000000..74f1982c681
--- /dev/null
+++ b/drivers/staging/ath6kl/include/host_version.h
@@ -0,0 +1,52 @@
+//------------------------------------------------------------------------------
+// <copyright file="host_version.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains version information for the sample host driver for the
+// AR6000 chip
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HOST_VERSION_H_
+#define _HOST_VERSION_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <AR6002/AR6K_version.h>
+
+/*
+ * The version number is made up of major, minor, patch and build
+ * numbers. These are 16 bit numbers.  The build and release script will
+ * set the build number using a Perforce counter.  Here the build number is
+ * set to 9999 so that builds done without the build-release script are easily
+ * identifiable.
+ */
+
+#define ATH_SW_VER_MAJOR      __VER_MAJOR_
+#define ATH_SW_VER_MINOR      __VER_MINOR_
+#define ATH_SW_VER_PATCH      __VER_PATCH_
+#define ATH_SW_VER_BUILD      __BUILD_NUMBER_ 
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HOST_VERSION_H_ */
diff --git a/drivers/staging/ath6kl/include/htc_api.h b/drivers/staging/ath6kl/include/htc_api.h
new file mode 100644
index 00000000000..4fb767559f8
--- /dev/null
+++ b/drivers/staging/ath6kl/include/htc_api.h
@@ -0,0 +1,575 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_api.h" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HTC_API_H_
+#define _HTC_API_H_
+
+#include "htc_packet.h"
+#include <htc.h>
+#include <htc_services.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/* TODO.. for BMI */
+#define ENDPOINT1 0
+// TODO -remove me, but we have to fix BMI first
+#define HTC_MAILBOX_NUM_MAX    4
+
+/* this is the amount of header room required by users of HTC */
+#define HTC_HEADER_LEN         HTC_HDR_LENGTH
+
+typedef void *HTC_HANDLE;
+
+typedef u16 HTC_SERVICE_ID;
+
+struct htc_init_info {
+    void   *pContext;           /* context for target failure notification */
+    void   (*TargetFailure)(void *Instance, int Status);
+};
+
+/* per service connection send completion */
+typedef void   (*HTC_EP_SEND_PKT_COMPLETE)(void *,struct htc_packet *);
+/* per service connection callback when a plurality of packets have been sent
+ * The struct htc_packet_queue is a temporary queue object (e.g. freed on return from the callback)
+ * to hold a list of completed send packets.
+ * If the handler cannot fully traverse the packet queue before returning, it should
+ * transfer the items of the queue into the caller's private queue using:
+ *   HTC_PACKET_ENQUEUE() */
+typedef void   (*HTC_EP_SEND_PKT_COMP_MULTIPLE)(void *,struct htc_packet_queue *);
+/* per service connection pkt received */
+typedef void   (*HTC_EP_RECV_PKT)(void *,struct htc_packet *);
+/* per service connection callback when a plurality of packets are received
+ * The struct htc_packet_queue is a temporary queue object (e.g. freed on return from the callback)
+ * to hold a list of recv packets.
+ * If the handler cannot fully traverse the packet queue before returning, it should
+ * transfer the items of the queue into the caller's private queue using:
+ *   HTC_PACKET_ENQUEUE() */
+typedef void   (*HTC_EP_RECV_PKT_MULTIPLE)(void *,struct htc_packet_queue *);
+
+/* Optional per service connection receive buffer re-fill callback,
+ * On some OSes (like Linux) packets are allocated from a global pool and indicated up
+ * to the network stack.  The driver never gets the packets back from the OS.  For these OSes
+ * a refill callback can be used to allocate and re-queue buffers into HTC.
+ *
+ * On other OSes, the network stack can call into the driver's OS-specifc "return_packet" handler and
+ * the driver can re-queue these buffers into HTC. In this regard a refill callback is
+ * unnecessary */
+typedef void   (*HTC_EP_RECV_REFILL)(void *, HTC_ENDPOINT_ID Endpoint);
+
+/* Optional per service connection receive buffer allocation callback.
+ * On some systems packet buffers are an extremely limited resource.  Rather than
+ * queue largest-possible-sized buffers to HTC, some systems would rather
+ * allocate a specific size as the packet is received.  The trade off is
+ * slightly more processing (callback invoked for each RX packet)
+ * for the benefit of committing fewer buffer resources into HTC.
+ *
+ * The callback is provided the length of the pending packet to fetch. This includes the
+ * HTC header length plus the length of payload.  The callback can return a pointer to
+ * the allocated HTC packet for immediate use.
+ *
+ * Alternatively a variant of this handler can be used to allocate large receive packets as needed.  
+ * For example an application can use the refill mechanism for normal packets and the recv-alloc mechanism to 
+ * handle the case where a large packet buffer is required.  This can significantly reduce the
+ * amount of "committed" memory used to receive packets.
+ *  
+ * */
+typedef struct htc_packet *(*HTC_EP_RECV_ALLOC)(void *, HTC_ENDPOINT_ID Endpoint, int Length);
+
+typedef enum _HTC_SEND_FULL_ACTION {
+    HTC_SEND_FULL_KEEP = 0,  /* packet that overflowed should be kept in the queue */
+    HTC_SEND_FULL_DROP = 1,  /* packet that overflowed should be dropped */
+} HTC_SEND_FULL_ACTION;
+
+/* Optional per service connection callback when a send queue is full. This can occur if the
+ * host continues queueing up TX packets faster than credits can arrive
+ * To prevent the host (on some Oses like Linux) from continuously queueing packets
+ * and consuming resources, this callback is provided so that that the host
+ * can disable TX in the subsystem (i.e. network stack).
+ * This callback is invoked for each packet that "overflows" the HTC queue. The callback can
+ * determine whether the new packet that overflowed the queue can be kept (HTC_SEND_FULL_KEEP) or
+ * dropped (HTC_SEND_FULL_DROP).  If a packet is dropped, the EpTxComplete handler will be called
+ * and the packet's status field will be set to A_NO_RESOURCE.
+ * Other OSes require a "per-packet" indication for each completed TX packet, this
+ * closed loop mechanism will prevent the network stack from overunning the NIC
+ * The packet to keep or drop is passed for inspection to the registered handler the handler
+ * must ONLY inspect the packet, it may not free or reclaim the packet. */
+typedef HTC_SEND_FULL_ACTION (*HTC_EP_SEND_QUEUE_FULL)(void *, struct htc_packet *pPacket);
+
+struct htc_ep_callbacks {
+    void                     *pContext;     /* context for each callback */
+    HTC_EP_SEND_PKT_COMPLETE EpTxComplete;  /* tx completion callback for connected endpoint */
+    HTC_EP_RECV_PKT          EpRecv;        /* receive callback for connected endpoint */
+    HTC_EP_RECV_REFILL       EpRecvRefill;  /* OPTIONAL receive re-fill callback for connected endpoint */
+    HTC_EP_SEND_QUEUE_FULL   EpSendFull;    /* OPTIONAL send full callback */
+    HTC_EP_RECV_ALLOC        EpRecvAlloc;   /* OPTIONAL recv allocation callback */
+    HTC_EP_RECV_ALLOC        EpRecvAllocThresh;  /* OPTIONAL recv allocation callback based on a threshold */
+    HTC_EP_SEND_PKT_COMP_MULTIPLE EpTxCompleteMultiple; /* OPTIONAL completion handler for multiple complete
+                                                             indications (EpTxComplete must be NULL) */
+    HTC_EP_RECV_PKT_MULTIPLE      EpRecvPktMultiple;      /* OPTIONAL completion handler for multiple
+                                                             recv packet indications (EpRecv must be NULL) */           
+    int                      RecvAllocThreshold;    /* if EpRecvAllocThresh is non-NULL, HTC will compare the 
+                                                       threshold value to the current recv packet length and invoke
+                                                       the EpRecvAllocThresh callback to acquire a packet buffer */
+    int                      RecvRefillWaterMark;   /* if a EpRecvRefill handler is provided, this value
+                                                       can be used to set a trigger refill callback 
+                                                       when the recv queue drops below this value 
+                                                       if set to 0, the refill is only called when packets 
+                                                       are empty */
+};
+
+/* service connection information */
+struct htc_service_connect_req {
+    HTC_SERVICE_ID   ServiceID;                 /* service ID to connect to */
+    u16 ConnectionFlags;           /* connection flags, see htc protocol definition */
+    u8 *pMetaData;                 /* ptr to optional service-specific meta-data */
+    u8 MetaDataLength;            /* optional meta data length */
+    struct htc_ep_callbacks EpCallbacks;               /* endpoint callbacks */
+    int              MaxSendQueueDepth;         /* maximum depth of any send queue */
+    u32 LocalConnectionFlags;      /* HTC flags for the host-side (local) connection */
+    unsigned int     MaxSendMsgSize;            /* override max message size in send direction */
+};
+
+#define HTC_LOCAL_CONN_FLAGS_ENABLE_SEND_BUNDLE_PADDING (1 << 0)  /* enable send bundle padding for this endpoint */
+
+/* service connection response information */
+struct htc_service_connect_resp {
+    u8 *pMetaData;         /* caller supplied buffer to optional meta-data */
+    u8 BufferLength;       /* length of caller supplied buffer */
+    u8 ActualLength;       /* actual length of meta data */
+    HTC_ENDPOINT_ID Endpoint;           /* endpoint to communicate over */
+    unsigned int    MaxMsgLength;       /* max length of all messages over this endpoint */
+    u8 ConnectRespCode;    /* connect response code from target */
+};
+
+/* endpoint distribution structure */
+struct htc_endpoint_credit_dist {
+    struct htc_endpoint_credit_dist *pNext;
+    struct htc_endpoint_credit_dist *pPrev;
+    HTC_SERVICE_ID      ServiceID;          /* Service ID (set by HTC) */
+    HTC_ENDPOINT_ID     Endpoint;           /* endpoint for this distribution struct (set by HTC) */
+    u32 DistFlags;          /* distribution flags, distribution function can
+                                               set default activity using SET_EP_ACTIVE() macro */
+    int                 TxCreditsNorm;      /* credits for normal operation, anything above this
+                                               indicates the endpoint is over-subscribed, this field
+                                               is only relevant to the credit distribution function */
+    int                 TxCreditsMin;       /* floor for credit distribution, this field is
+                                               only relevant to the credit distribution function */
+    int                 TxCreditsAssigned;  /* number of credits assigned to this EP, this field
+                                               is only relevant to the credit dist function */
+    int                 TxCredits;          /* current credits available, this field is used by
+                                               HTC to determine whether a message can be sent or
+                                               must be queued */
+    int                 TxCreditsToDist;    /* pending credits to distribute on this endpoint, this
+                                               is set by HTC when credit reports arrive.
+                                               The credit distribution functions sets this to zero
+                                               when it distributes the credits */
+    int                 TxCreditsSeek;      /* this is the number of credits that the current pending TX
+                                               packet needs to transmit.  This is set by HTC when
+                                               and endpoint needs credits in order to transmit */
+    int                 TxCreditSize;       /* size in bytes of each credit (set by HTC) */
+    int                 TxCreditsPerMaxMsg; /* credits required for a maximum sized messages (set by HTC) */
+    void                *pHTCReserved;      /* reserved for HTC use */    
+    int                 TxQueueDepth;       /* current depth of TX queue , i.e. messages waiting for credits
+                                               This field is valid only when HTC_CREDIT_DIST_ACTIVITY_CHANGE
+                                               or HTC_CREDIT_DIST_SEND_COMPLETE is indicated on an endpoint
+                                               that has non-zero credits to recover
+                                              */
+};
+
+#define HTC_EP_ACTIVE                            ((u32) (1u << 31))
+
+/* macro to check if an endpoint has gone active, useful for credit
+ * distributions */
+#define IS_EP_ACTIVE(epDist)  ((epDist)->DistFlags & HTC_EP_ACTIVE)
+#define SET_EP_ACTIVE(epDist) (epDist)->DistFlags |= HTC_EP_ACTIVE
+
+    /* credit distibution code that is passed into the distrbution function,
+     * there are mandatory and optional codes that must be handled */
+typedef enum _HTC_CREDIT_DIST_REASON {
+    HTC_CREDIT_DIST_SEND_COMPLETE = 0,     /* credits available as a result of completed
+                                              send operations (MANDATORY) resulting in credit reports */
+    HTC_CREDIT_DIST_ACTIVITY_CHANGE = 1,   /* a change in endpoint activity occurred (OPTIONAL) */
+    HTC_CREDIT_DIST_SEEK_CREDITS,          /* an endpoint needs to "seek" credits (OPTIONAL) */
+    HTC_DUMP_CREDIT_STATE                  /* for debugging, dump any state information that is kept by
+                                              the distribution function */
+} HTC_CREDIT_DIST_REASON;
+
+typedef void (*HTC_CREDIT_DIST_CALLBACK)(void                     *Context,
+                                         struct htc_endpoint_credit_dist *pEPList,
+                                         HTC_CREDIT_DIST_REASON   Reason);
+
+typedef void (*HTC_CREDIT_INIT_CALLBACK)(void *Context,
+                                         struct htc_endpoint_credit_dist *pEPList,
+                                         int                      TotalCredits);
+
+    /* endpoint statistics action */
+typedef enum _HTC_ENDPOINT_STAT_ACTION {
+    HTC_EP_STAT_SAMPLE = 0,                /* only read statistics */
+    HTC_EP_STAT_SAMPLE_AND_CLEAR = 1,      /* sample and immediately clear statistics */
+    HTC_EP_STAT_CLEAR                      /* clear only */
+} HTC_ENDPOINT_STAT_ACTION;
+
+    /* endpoint statistics */
+struct htc_endpoint_stats {
+    u32 TxCreditLowIndications;  /* number of times the host set the credit-low flag in a send message on
+                                        this endpoint */
+    u32 TxIssued;               /* running count of total TX packets issued */
+    u32 TxPacketsBundled;       /* running count of TX packets that were issued in bundles */
+    u32 TxBundles;              /* running count of TX bundles that were issued */
+    u32 TxDropped;              /* tx packets that were dropped */
+    u32 TxCreditRpts;           /* running count of total credit reports received for this endpoint */
+    u32 TxCreditRptsFromRx;     /* credit reports received from this endpoint's RX packets */
+    u32 TxCreditRptsFromOther;  /* credit reports received from RX packets of other endpoints */
+    u32 TxCreditRptsFromEp0;    /* credit reports received from endpoint 0 RX packets */
+    u32 TxCreditsFromRx;        /* count of credits received via Rx packets on this endpoint */
+    u32 TxCreditsFromOther;     /* count of credits received via another endpoint */
+    u32 TxCreditsFromEp0;       /* count of credits received via another endpoint */
+    u32 TxCreditsConsummed;     /* count of consummed credits */
+    u32 TxCreditsReturned;      /* count of credits returned */
+    u32 RxReceived;             /* count of RX packets received */
+    u32 RxLookAheads;           /* count of lookahead records
+                                         found in messages received on this endpoint */
+    u32 RxPacketsBundled;       /* count of recv packets received in a bundle */
+    u32 RxBundleLookAheads;     /* count of number of bundled lookaheads */
+    u32 RxBundleIndFromHdr;     /* count of the number of bundle indications from the HTC header */
+    u32 RxAllocThreshHit;       /* count of the number of times the recv allocation threshold was hit */
+    u32 RxAllocThreshBytes;     /* total number of bytes */
+};
+
+/* ------ Function Prototypes ------ */
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Create an instance of HTC over the underlying HIF device
+  @function name: HTCCreate
+  @input:  HifDevice - hif device handle,
+           pInfo - initialization information
+  @output:
+  @return: HTC_HANDLE on success, NULL on failure
+  @notes: 
+  @example:
+  @see also: HTCDestroy
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+HTC_HANDLE HTCCreate(void *HifDevice, struct htc_init_info *pInfo);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Get the underlying HIF device handle
+  @function name: HTCGetHifDevice
+  @input:  HTCHandle - handle passed into the AddInstance callback
+  @output:
+  @return: opaque HIF device handle usable in HIF API calls.
+  @notes:
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void       *HTCGetHifDevice(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Set credit distribution parameters
+  @function name: HTCSetCreditDistribution
+  @input:  HTCHandle - HTC handle
+           pCreditDistCont - caller supplied context to pass into distribution functions
+           CreditDistFunc - Distribution function callback
+           CreditDistInit - Credit Distribution initialization callback
+           ServicePriorityOrder - Array containing list of service IDs, lowest index is highest
+                                  priority
+           ListLength - number of elements in ServicePriorityOrder
+  @output:
+  @return:
+  @notes:  The user can set a custom credit distribution function to handle special requirements
+           for each endpoint.  A default credit distribution routine can be used by setting
+           CreditInitFunc to NULL.  The default credit distribution is only provided for simple
+           "fair" credit distribution without regard to any prioritization.
+
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCSetCreditDistribution(HTC_HANDLE               HTCHandle,
+                                     void                     *pCreditDistContext,
+                                     HTC_CREDIT_DIST_CALLBACK CreditDistFunc,
+                                     HTC_CREDIT_INIT_CALLBACK CreditInitFunc,
+                                     HTC_SERVICE_ID           ServicePriorityOrder[],
+                                     int                      ListLength);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Wait for the target to indicate the HTC layer is ready
+  @function name: HTCWaitTarget
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes:  This API blocks until the target responds with an HTC ready message.
+           The caller should not connect services until the target has indicated it is
+           ready.
+  @example:
+  @see also: HTCConnectService
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HTCWaitTarget(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Start target service communications
+  @function name: HTCStart
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes: This API indicates to the target that the service connection phase is complete
+          and the target can freely start all connected services.  This API should only be
+          called AFTER all service connections have been made.  TCStart will issue a
+          SETUP_COMPLETE message to the target to indicate that all service connections
+          have been made and the target can start communicating over the endpoints.
+  @example:
+  @see also: HTCConnectService
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HTCStart(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Add receive packet to HTC
+  @function name: HTCAddReceivePkt
+  @input:  HTCHandle - HTC handle
+           pPacket - HTC receive packet to add
+  @output:
+  @return: 0 on success
+  @notes:  user must supply HTC packets for capturing incomming HTC frames.  The caller
+           must initialize each HTC packet using the SET_HTC_PACKET_INFO_RX_REFILL()
+           macro.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HTCAddReceivePkt(HTC_HANDLE HTCHandle, struct htc_packet *pPacket);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Connect to an HTC service
+  @function name: HTCConnectService
+  @input:  HTCHandle - HTC handle
+           pReq - connection details
+  @output: pResp - connection response
+  @return:
+  @notes:  Service connections must be performed before HTCStart.  User provides callback handlers
+           for various endpoint events.
+  @example:
+  @see also: HTCStart
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HTCConnectService(HTC_HANDLE HTCHandle,
+                              struct htc_service_connect_req  *pReq,
+                              struct htc_service_connect_resp *pResp);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Send an HTC packet
+  @function name: HTCSendPkt
+  @input:  HTCHandle - HTC handle
+           pPacket - packet to send
+  @output:
+  @return: 0
+  @notes:  Caller must initialize packet using SET_HTC_PACKET_INFO_TX() macro.
+           This interface is fully asynchronous.  On error, HTC SendPkt will
+           call the registered Endpoint callback to cleanup the packet.
+  @example:
+  @see also: HTCFlushEndpoint
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HTCSendPkt(HTC_HANDLE HTCHandle, struct htc_packet *pPacket);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Stop HTC service communications
+  @function name: HTCStop
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes: HTC communications is halted.  All receive and pending TX packets will
+          be flushed.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCStop(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Destroy HTC service
+  @function name: HTCDestroy
+  @input: HTCHandle 
+  @output:
+  @return:
+  @notes:  This cleans up all resources allocated by HTCCreate().
+  @example:
+  @see also: HTCCreate
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCDestroy(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Flush pending TX packets
+  @function name: HTCFlushEndpoint
+  @input:  HTCHandle - HTC handle
+           Endpoint - Endpoint to flush
+           Tag - flush tag
+  @output:
+  @return:
+  @notes:  The Tag parameter is used to selectively flush packets with matching tags.
+           The value of 0 forces all packets to be flush regardless of tag.
+  @example:
+  @see also: HTCSendPkt
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCFlushEndpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint, HTC_TX_TAG Tag);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Dump credit distribution state
+  @function name: HTCDumpCreditStates
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes:  This dumps all credit distribution information to the debugger
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCDumpCreditStates(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Indicate a traffic activity change on an endpoint
+  @function name: HTCIndicateActivityChange
+  @input:  HTCHandle - HTC handle
+           Endpoint - endpoint in which activity has changed
+           Active - true if active, false if it has become inactive
+  @output:
+  @return:
+  @notes:  This triggers the registered credit distribution function to
+           re-adjust credits for active/inactive endpoints.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCIndicateActivityChange(HTC_HANDLE      HTCHandle,
+                                      HTC_ENDPOINT_ID Endpoint,
+                                      bool          Active);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Get endpoint statistics
+  @function name: HTCGetEndpointStatistics
+  @input:  HTCHandle - HTC handle
+           Endpoint - Endpoint identifier
+           Action - action to take with statistics
+  @output:
+           pStats - statistics that were sampled (can be NULL if Action is HTC_EP_STAT_CLEAR)
+
+  @return: true if statistics profiling is enabled, otherwise false.
+
+  @notes:  Statistics is a compile-time option and this function may return false
+           if HTC is not compiled with profiling.
+
+           The caller can specify the statistic "action" to take when sampling
+           the statistics.  This includes:
+
+           HTC_EP_STAT_SAMPLE: The pStats structure is filled with the current values.
+           HTC_EP_STAT_SAMPLE_AND_CLEAR: The structure is filled and the current statistics
+                             are cleared.
+           HTC_EP_STAT_CLEA : the statistics are cleared, the called can pass a NULL value for
+                   pStats
+
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+bool       HTCGetEndpointStatistics(HTC_HANDLE               HTCHandle,
+                                      HTC_ENDPOINT_ID          Endpoint,
+                                      HTC_ENDPOINT_STAT_ACTION Action,
+                                      struct htc_endpoint_stats       *pStats);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Unblock HTC message reception
+  @function name: HTCUnblockRecv
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes:
+           HTC will block the receiver if the EpRecvAlloc callback fails to provide a packet.
+           The caller can use this API to indicate to HTC when resources (buffers) are available
+           such that the  receiver can be unblocked and HTC may re-attempt fetching the pending message.
+
+           This API is not required if the user uses the EpRecvRefill callback or uses the HTCAddReceivePacket()
+           API to recycle or provide receive packets to HTC.
+
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void HTCUnblockRecv(HTC_HANDLE HTCHandle);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: send a series of HTC packets  
+  @function name: HTCSendPktsMultiple
+  @input:  HTCHandle - HTC handle
+           pPktQueue - local queue holding packets to send
+  @output:
+  @return: 0
+  @notes:  Caller must initialize each packet using SET_HTC_PACKET_INFO_TX() macro.
+           The queue must only contain packets directed at the same endpoint.
+           Caller supplies a pointer to an struct htc_packet_queue structure holding the TX packets in FIFO order.
+           This API will remove the packets from the pkt queue and place them into the HTC Tx Queue
+           and bundle messages where possible.
+           The caller may allocate the pkt queue on the stack to hold the packets.           
+           This interface is fully asynchronous.  On error, HTCSendPkts will
+           call the registered Endpoint callback to cleanup the packet.
+  @example:
+  @see also: HTCFlushEndpoint
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HTCSendPktsMultiple(HTC_HANDLE HTCHandle, struct htc_packet_queue *pPktQueue);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Add multiple receive packets to HTC
+  @function name: HTCAddReceivePktMultiple
+  @input:  HTCHandle - HTC handle
+           pPktQueue - HTC receive packet queue holding packets to add
+  @output:
+  @return: 0 on success
+  @notes:  user must supply HTC packets for capturing incomming HTC frames.  The caller
+           must initialize each HTC packet using the SET_HTC_PACKET_INFO_RX_REFILL()
+           macro. The queue must only contain recv packets for the same endpoint.
+           Caller supplies a pointer to an struct htc_packet_queue structure holding the recv packet.
+           This API will remove the packets from the pkt queue and place them into internal
+           recv packet list.
+           The caller may allocate the pkt queue on the stack to hold the packets.           
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int    HTCAddReceivePktMultiple(HTC_HANDLE HTCHandle, struct htc_packet_queue *pPktQueue);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Check if an endpoint is marked active
+  @function name: HTCIsEndpointActive
+  @input:  HTCHandle - HTC handle
+           Endpoint - endpoint to check for active state
+  @output:
+  @return: returns true if Endpoint is Active
+  @notes:  
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+bool      HTCIsEndpointActive(HTC_HANDLE      HTCHandle,
+                                HTC_ENDPOINT_ID Endpoint);
+
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Get the number of recv buffers currently queued into an HTC endpoint
+  @function name: HTCGetNumRecvBuffers
+  @input:  HTCHandle - HTC handle
+           Endpoint - endpoint to check
+  @output:
+  @return: returns number of buffers in queue
+  @notes:  
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int         HTCGetNumRecvBuffers(HTC_HANDLE      HTCHandle,
+                                 HTC_ENDPOINT_ID Endpoint);
+                                                                      
+/* internally used functions for testing... */
+void HTCEnableRecv(HTC_HANDLE HTCHandle);
+void HTCDisableRecv(HTC_HANDLE HTCHandle);
+int HTCWaitForPendingRecv(HTC_HANDLE   HTCHandle,
+                               u32 TimeoutInMs,
+                               bool      *pbIsRecvPending);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HTC_API_H_ */
diff --git a/drivers/staging/ath6kl/include/htc_packet.h b/drivers/staging/ath6kl/include/htc_packet.h
new file mode 100644
index 00000000000..ba65c34ebc9
--- /dev/null
+++ b/drivers/staging/ath6kl/include/htc_packet.h
@@ -0,0 +1,227 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_packet.h" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef HTC_PACKET_H_
+#define HTC_PACKET_H_
+
+
+#include "dl_list.h"
+
+/* ------ Endpoint IDS ------ */
+typedef enum
+{
+    ENDPOINT_UNUSED = -1,
+    ENDPOINT_0 = 0,
+    ENDPOINT_1 = 1,
+    ENDPOINT_2 = 2,
+    ENDPOINT_3,
+    ENDPOINT_4,
+    ENDPOINT_5,
+    ENDPOINT_6,
+    ENDPOINT_7,
+    ENDPOINT_8,
+    ENDPOINT_MAX,
+} HTC_ENDPOINT_ID;
+
+struct htc_packet;
+
+typedef void (* HTC_PACKET_COMPLETION)(void *,struct htc_packet *);
+
+typedef u16 HTC_TX_TAG;
+
+struct htc_tx_packet_info {
+    HTC_TX_TAG    Tag;            /* tag used to selective flush packets */
+    int           CreditsUsed;    /* number of credits used for this TX packet (HTC internal) */
+    u8 SendFlags;      /* send flags (HTC internal) */
+    int           SeqNo;          /* internal seq no for debugging (HTC internal) */
+};
+
+#define HTC_TX_PACKET_TAG_ALL          0    /* a tag of zero is reserved and used to flush ALL packets */
+#define HTC_TX_PACKET_TAG_INTERNAL     1                                /* internal tags start here */
+#define HTC_TX_PACKET_TAG_USER_DEFINED (HTC_TX_PACKET_TAG_INTERNAL + 9) /* user-defined tags start here */
+
+struct htc_rx_packet_info {
+    u32 ExpectedHdr;        /* HTC internal use */
+    u32 HTCRxFlags;         /* HTC internal use */
+    u32 IndicationFlags;    /* indication flags set on each RX packet indication */
+};
+
+#define HTC_RX_FLAGS_INDICATE_MORE_PKTS  (1 << 0)   /* more packets on this endpoint are being fetched */
+
+/* wrapper around endpoint-specific packets */
+struct htc_packet {
+    struct dl_list         ListLink;       /* double link */
+    void            *pPktContext;   /* caller's per packet specific context */
+
+    u8 *pBufferStart;  /* the true buffer start , the caller can
+                                       store the real buffer start here.  In
+                                       receive callbacks, the HTC layer sets pBuffer
+                                       to the start of the payload past the header. This
+                                       field allows the caller to reset pBuffer when it
+                                       recycles receive packets back to HTC */
+    /*
+     * Pointer to the start of the buffer. In the transmit
+     * direction this points to the start of the payload. In the
+     * receive direction, however, the buffer when queued up
+     * points to the start of the HTC header but when returned
+     * to the caller points to the start of the payload
+     */
+    u8 *pBuffer;       /* payload start (RX/TX) */
+    u32 BufferLength;   /* length of buffer */
+    u32 ActualLength;   /* actual length of payload */
+    HTC_ENDPOINT_ID Endpoint;       /* endpoint that this packet was sent/recv'd from */
+    int        Status;         /* completion status */
+    union {
+        struct htc_tx_packet_info  AsTx;   /* Tx Packet specific info */
+        struct htc_rx_packet_info  AsRx;   /* Rx Packet specific info */
+    } PktInfo;
+
+    /* the following fields are for internal HTC use */
+    HTC_PACKET_COMPLETION Completion;   /* completion */
+    void                  *pContext;    /* HTC private completion context */
+};
+
+
+
+#define COMPLETE_HTC_PACKET(p,status)        \
+{                                            \
+    (p)->Status = (status);                  \
+    (p)->Completion((p)->pContext,(p));      \
+}
+
+#define INIT_HTC_PACKET_INFO(p,b,len)             \
+{                                                 \
+    (p)->pBufferStart = (b);                      \
+    (p)->BufferLength = (len);                    \
+}
+
+/* macro to set an initial RX packet for refilling HTC */
+#define SET_HTC_PACKET_INFO_RX_REFILL(p,c,b,len,ep) \
+{                                                 \
+    (p)->pPktContext = (c);                       \
+    (p)->pBuffer = (b);                           \
+    (p)->pBufferStart = (b);                      \
+    (p)->BufferLength = (len);                    \
+    (p)->Endpoint = (ep);                         \
+}
+
+/* fast macro to recycle an RX packet that will be re-queued to HTC */
+#define HTC_PACKET_RESET_RX(p)              \
+    { (p)->pBuffer = (p)->pBufferStart; (p)->ActualLength = 0; }  
+
+/* macro to set packet parameters for TX */
+#define SET_HTC_PACKET_INFO_TX(p,c,b,len,ep,tag)  \
+{                                                 \
+    (p)->pPktContext = (c);                       \
+    (p)->pBuffer = (b);                           \
+    (p)->ActualLength = (len);                    \
+    (p)->Endpoint = (ep);                         \
+    (p)->PktInfo.AsTx.Tag = (tag);                \
+}
+
+/* HTC Packet Queueing Macros */
+struct htc_packet_queue {
+    struct dl_list     QueueHead;
+    int         Depth;    
+};
+ 
+/* initialize queue */
+#define INIT_HTC_PACKET_QUEUE(pQ)   \
+{                                   \
+    DL_LIST_INIT(&(pQ)->QueueHead); \
+    (pQ)->Depth = 0;                \
+}
+
+/* enqueue HTC packet to the tail of the queue */
+#define HTC_PACKET_ENQUEUE(pQ,p)                        \
+{   DL_ListInsertTail(&(pQ)->QueueHead,&(p)->ListLink); \
+    (pQ)->Depth++;                                      \
+}
+
+/* enqueue HTC packet to the tail of the queue */
+#define HTC_PACKET_ENQUEUE_TO_HEAD(pQ,p)                \
+{   DL_ListInsertHead(&(pQ)->QueueHead,&(p)->ListLink); \
+    (pQ)->Depth++;                                      \
+}
+/* test if a queue is empty */
+#define HTC_QUEUE_EMPTY(pQ)       ((pQ)->Depth == 0)
+/* get packet at head without removing it */
+static INLINE struct htc_packet *HTC_GET_PKT_AT_HEAD(struct htc_packet_queue *queue)   {
+    if (queue->Depth == 0) {
+        return NULL; 
+    }  
+    return A_CONTAINING_STRUCT((DL_LIST_GET_ITEM_AT_HEAD(&queue->QueueHead)),struct htc_packet,ListLink);
+}
+/* remove a packet from a queue, where-ever it is in the queue */
+#define HTC_PACKET_REMOVE(pQ,p)     \
+{                                   \
+    DL_ListRemove(&(p)->ListLink);  \
+    (pQ)->Depth--;                  \
+}
+
+/* dequeue an HTC packet from the head of the queue */
+static INLINE struct htc_packet *HTC_PACKET_DEQUEUE(struct htc_packet_queue *queue) {
+    struct dl_list    *pItem = DL_ListRemoveItemFromHead(&queue->QueueHead);
+    if (pItem != NULL) {
+        queue->Depth--;
+        return A_CONTAINING_STRUCT(pItem, struct htc_packet, ListLink);
+    }
+    return NULL;
+}
+
+/* dequeue an HTC packet from the tail of the queue */
+static INLINE struct htc_packet *HTC_PACKET_DEQUEUE_TAIL(struct htc_packet_queue *queue) {
+    struct dl_list    *pItem = DL_ListRemoveItemFromTail(&queue->QueueHead);
+    if (pItem != NULL) {
+        queue->Depth--;
+        return A_CONTAINING_STRUCT(pItem, struct htc_packet, ListLink);
+    }
+    return NULL;
+}
+
+#define HTC_PACKET_QUEUE_DEPTH(pQ) (pQ)->Depth
+
+
+#define HTC_GET_ENDPOINT_FROM_PKT(p) (p)->Endpoint
+#define HTC_GET_TAG_FROM_PKT(p)      (p)->PktInfo.AsTx.Tag
+
+    /* transfer the packets from one queue to the tail of another queue */
+#define HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(pQDest,pQSrc) \
+{                                                                           \
+    DL_ListTransferItemsToTail(&(pQDest)->QueueHead,&(pQSrc)->QueueHead);   \
+    (pQDest)->Depth += (pQSrc)->Depth;                                      \
+    (pQSrc)->Depth = 0;                                                     \
+}
+
+    /* fast version to init and add a single packet to a queue */
+#define INIT_HTC_PACKET_QUEUE_AND_ADD(pQ,pP) \
+{                                            \
+    DL_LIST_INIT_AND_ADD(&(pQ)->QueueHead,&(pP)->ListLink)  \
+    (pQ)->Depth = 1;                                        \
+}
+    
+#define HTC_PACKET_QUEUE_ITERATE_ALLOW_REMOVE(pQ, pPTemp) \
+    ITERATE_OVER_LIST_ALLOW_REMOVE(&(pQ)->QueueHead,(pPTemp), struct htc_packet, ListLink) 
+
+#define HTC_PACKET_QUEUE_ITERATE_END ITERATE_END
+        
+#endif /*HTC_PACKET_H_*/
diff --git a/drivers/staging/ath6kl/include/wlan_api.h b/drivers/staging/ath6kl/include/wlan_api.h
new file mode 100644
index 00000000000..9eea5875dd3
--- /dev/null
+++ b/drivers/staging/ath6kl/include/wlan_api.h
@@ -0,0 +1,128 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the API for the host wlan module
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HOST_WLAN_API_H_
+#define _HOST_WLAN_API_H_
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <a_osapi.h>
+
+struct ieee80211_node_table;
+struct ieee80211_frame;
+
+struct ieee80211_common_ie {
+    u16 ie_chan;
+    u8 *ie_tstamp;
+    u8 *ie_ssid;
+    u8 *ie_rates;
+    u8 *ie_xrates;
+    u8 *ie_country;
+    u8 *ie_wpa;
+    u8 *ie_rsn;
+    u8 *ie_wmm;
+    u8 *ie_ath;
+    u16 ie_capInfo;
+    u16 ie_beaconInt;
+    u8 *ie_tim;
+    u8 *ie_chswitch;
+    u8 ie_erp;
+    u8 *ie_wsc;
+    u8 *ie_htcap;
+    u8 *ie_htop;
+#ifdef WAPI_ENABLE
+    u8 *ie_wapi;
+#endif
+};
+
+typedef struct bss {
+    u8 ni_macaddr[6];
+    u8 ni_snr;
+    s16 ni_rssi;
+    struct bss                   *ni_list_next;
+    struct bss                   *ni_list_prev;
+    struct bss                   *ni_hash_next;
+    struct bss                   *ni_hash_prev;
+    struct ieee80211_common_ie   ni_cie;
+    u8 *ni_buf;
+    u16 ni_framelen;
+    struct ieee80211_node_table *ni_table;
+    u32 ni_refcnt;
+    int                          ni_scangen;
+
+    u32 ni_tstamp;
+    u32 ni_actcnt;
+#ifdef OS_ROAM_MANAGEMENT
+    u32 ni_si_gen;
+#endif
+} bss_t;
+
+typedef void wlan_node_iter_func(void *arg, bss_t *);
+
+bss_t *wlan_node_alloc(struct ieee80211_node_table *nt, int wh_size);
+void wlan_node_free(bss_t *ni);
+void wlan_setup_node(struct ieee80211_node_table *nt, bss_t *ni,
+                const u8 *macaddr);
+bss_t *wlan_find_node(struct ieee80211_node_table *nt, const u8 *macaddr);
+void wlan_node_reclaim(struct ieee80211_node_table *nt, bss_t *ni);
+void wlan_free_allnodes(struct ieee80211_node_table *nt);
+void wlan_iterate_nodes(struct ieee80211_node_table *nt, wlan_node_iter_func *f,
+                        void *arg);
+
+void wlan_node_table_init(void *wmip, struct ieee80211_node_table *nt);
+void wlan_node_table_reset(struct ieee80211_node_table *nt);
+void wlan_node_table_cleanup(struct ieee80211_node_table *nt);
+
+int wlan_parse_beacon(u8 *buf, int framelen,
+                           struct ieee80211_common_ie *cie);
+
+u16 wlan_ieee2freq(int chan);
+u32 wlan_freq2ieee(u16 freq);
+
+void wlan_set_nodeage(struct ieee80211_node_table *nt, u32 nodeAge);
+
+void
+wlan_refresh_inactive_nodes (struct ieee80211_node_table *nt);
+
+bss_t *
+wlan_find_Ssidnode (struct ieee80211_node_table *nt, u8 *pSsid,
+                    u32 ssidLength, bool bIsWPA2, bool bMatchSSID);
+
+void
+wlan_node_return (struct ieee80211_node_table *nt, bss_t *ni);
+
+bss_t *wlan_node_remove(struct ieee80211_node_table *nt, u8 *bssid);
+
+bss_t *
+wlan_find_matching_Ssidnode (struct ieee80211_node_table *nt, u8 *pSsid,
+                    u32 ssidLength, u32 dot11AuthMode, u32 authMode,
+                   u32 pairwiseCryptoType, u32 grpwiseCryptoTyp);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HOST_WLAN_API_H_ */
diff --git a/drivers/staging/ath6kl/include/wmi_api.h b/drivers/staging/ath6kl/include/wmi_api.h
new file mode 100644
index 00000000000..c8583e0c4a9
--- /dev/null
+++ b/drivers/staging/ath6kl/include/wmi_api.h
@@ -0,0 +1,441 @@
+//------------------------------------------------------------------------------
+// <copyright file="wmi_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the definitions for the Wireless Module Interface (WMI).
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _WMI_API_H_
+#define _WMI_API_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+    /* WMI converts a dix frame with an ethernet payload (up to 1500 bytes) 
+     * to an 802.3 frame (adds SNAP header) and adds on a WMI data header */
+#define WMI_MAX_TX_DATA_FRAME_LENGTH (1500 + sizeof(WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) + sizeof(ATH_LLC_SNAP_HDR))
+
+    /* A normal WMI data frame */
+#define WMI_MAX_NORMAL_RX_DATA_FRAME_LENGTH (1500 + sizeof(WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) + sizeof(ATH_LLC_SNAP_HDR))
+    
+    /* An AMSDU frame */ /* The MAX AMSDU length of AR6003 is 3839 */
+#define WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH  (3840 + sizeof(WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) + sizeof(ATH_LLC_SNAP_HDR))
+
+/*
+ * IP QoS Field definitions according to 802.1p
+ */
+#define BEST_EFFORT_PRI         0
+#define BACKGROUND_PRI          1
+#define EXCELLENT_EFFORT_PRI    3
+#define CONTROLLED_LOAD_PRI     4
+#define VIDEO_PRI               5
+#define VOICE_PRI               6
+#define NETWORK_CONTROL_PRI     7
+#define MAX_NUM_PRI             8
+
+#define UNDEFINED_PRI           (0xff)
+
+#define WMI_IMPLICIT_PSTREAM_INACTIVITY_INT 5000 /* 5 seconds */
+
+#define A_ROUND_UP(x, y)  ((((x) + ((y) - 1)) / (y)) * (y))
+
+typedef enum {
+    ATHEROS_COMPLIANCE = 0x1,
+}TSPEC_PARAM_COMPLIANCE;
+
+struct wmi_t;
+
+void *wmi_init(void *devt);
+
+void wmi_qos_state_init(struct wmi_t *wmip);
+void wmi_shutdown(struct wmi_t *wmip);
+HTC_ENDPOINT_ID wmi_get_control_ep(struct wmi_t * wmip);
+void wmi_set_control_ep(struct wmi_t * wmip, HTC_ENDPOINT_ID eid);
+u16 wmi_get_mapped_qos_queue(struct wmi_t *, u8 );
+int wmi_dix_2_dot3(struct wmi_t *wmip, void *osbuf);
+int wmi_data_hdr_add(struct wmi_t *wmip, void *osbuf, u8 msgType, bool bMoreData, WMI_DATA_HDR_DATA_TYPE data_type,u8 metaVersion, void *pTxMetaS);
+int wmi_dot3_2_dix(void *osbuf);
+
+int wmi_dot11_hdr_remove (struct wmi_t *wmip, void *osbuf);
+int wmi_dot11_hdr_add(struct wmi_t *wmip, void *osbuf, NETWORK_TYPE mode);
+
+int wmi_data_hdr_remove(struct wmi_t *wmip, void *osbuf);
+int wmi_syncpoint(struct wmi_t *wmip);
+int wmi_syncpoint_reset(struct wmi_t *wmip);
+u8 wmi_implicit_create_pstream(struct wmi_t *wmip, void *osbuf, u32 layer2Priority, bool wmmEnabled);
+
+u8 wmi_determine_userPriority (u8 *pkt, u32 layer2Pri);
+
+int wmi_control_rx(struct wmi_t *wmip, void *osbuf);
+void wmi_iterate_nodes(struct wmi_t *wmip, wlan_node_iter_func *f, void *arg);
+void wmi_free_allnodes(struct wmi_t *wmip);
+bss_t *wmi_find_node(struct wmi_t *wmip, const u8 *macaddr);
+void wmi_free_node(struct wmi_t *wmip, const u8 *macaddr);
+
+
+typedef enum {
+    NO_SYNC_WMIFLAG = 0,
+    SYNC_BEFORE_WMIFLAG,            /* transmit all queued data before cmd */
+    SYNC_AFTER_WMIFLAG,             /* any new data waits until cmd execs */
+    SYNC_BOTH_WMIFLAG,
+    END_WMIFLAG                     /* end marker */
+} WMI_SYNC_FLAG;
+
+int wmi_cmd_send(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
+                      WMI_SYNC_FLAG flag);
+
+int wmi_connect_cmd(struct wmi_t *wmip,
+                         NETWORK_TYPE netType,
+                         DOT11_AUTH_MODE dot11AuthMode,
+                         AUTH_MODE authMode,
+                         CRYPTO_TYPE pairwiseCrypto,
+                         u8 pairwiseCryptoLen,
+                         CRYPTO_TYPE groupCrypto,
+                         u8 groupCryptoLen,
+                         int ssidLength,
+                         u8 *ssid,
+                         u8 *bssid,
+                         u16 channel,
+                         u32 ctrl_flags);
+
+int wmi_reconnect_cmd(struct wmi_t *wmip,
+                           u8 *bssid,
+                           u16 channel);
+int wmi_disconnect_cmd(struct wmi_t *wmip);
+int wmi_getrev_cmd(struct wmi_t *wmip);
+int wmi_startscan_cmd(struct wmi_t *wmip, WMI_SCAN_TYPE scanType,
+                           u32 forceFgScan, u32 isLegacy,
+                           u32 homeDwellTime, u32 forceScanInterval,
+                           s8 numChan, u16 *channelList);
+int wmi_scanparams_cmd(struct wmi_t *wmip, u16 fg_start_sec,
+                            u16 fg_end_sec, u16 bg_sec,
+                            u16 minact_chdw_msec,
+                            u16 maxact_chdw_msec, u16 pas_chdw_msec,
+                            u8 shScanRatio, u8 scanCtrlFlags,
+                            u32 max_dfsch_act_time,
+                            u16 maxact_scan_per_ssid);
+int wmi_bssfilter_cmd(struct wmi_t *wmip, u8 filter, u32 ieMask);
+int wmi_probedSsid_cmd(struct wmi_t *wmip, u8 index, u8 flag,
+                            u8 ssidLength, u8 *ssid);
+int wmi_listeninterval_cmd(struct wmi_t *wmip, u16 listenInterval, u16 listenBeacons);
+int wmi_bmisstime_cmd(struct wmi_t *wmip, u16 bmisstime, u16 bmissbeacons);
+int wmi_associnfo_cmd(struct wmi_t *wmip, u8 ieType,
+                           u8 ieLen, u8 *ieInfo);
+int wmi_powermode_cmd(struct wmi_t *wmip, u8 powerMode);
+int wmi_ibsspmcaps_cmd(struct wmi_t *wmip, u8 pmEnable, u8 ttl,
+                            u16 atim_windows, u16 timeout_value);
+int wmi_apps_cmd(struct wmi_t *wmip, u8 psType, u32 idle_time,
+                   u32 ps_period, u8 sleep_period);
+int wmi_pmparams_cmd(struct wmi_t *wmip, u16 idlePeriod,
+                           u16 psPollNum, u16 dtimPolicy,
+                           u16 wakup_tx_policy, u16 num_tx_to_wakeup,
+                           u16 ps_fail_event_policy);
+int wmi_disctimeout_cmd(struct wmi_t *wmip, u8 timeout);
+int wmi_sync_cmd(struct wmi_t *wmip, u8 syncNumber);
+int wmi_create_pstream_cmd(struct wmi_t *wmip, WMI_CREATE_PSTREAM_CMD *pstream);
+int wmi_delete_pstream_cmd(struct wmi_t *wmip, u8 trafficClass, u8 streamID);
+int wmi_set_framerate_cmd(struct wmi_t *wmip, u8 bEnable, u8 type, u8 subType, u16 rateMask);
+int wmi_set_bitrate_cmd(struct wmi_t *wmip, s32 dataRate, s32 mgmtRate, s32 ctlRate);
+int wmi_get_bitrate_cmd(struct wmi_t *wmip);
+s8 wmi_validate_bitrate(struct wmi_t *wmip, s32 rate, s8 *rate_idx);
+int wmi_get_regDomain_cmd(struct wmi_t *wmip);
+int wmi_get_channelList_cmd(struct wmi_t *wmip);
+int wmi_set_channelParams_cmd(struct wmi_t *wmip, u8 scanParam,
+                                   WMI_PHY_MODE mode, s8 numChan,
+                                   u16 *channelList);
+
+int wmi_set_snr_threshold_params(struct wmi_t *wmip,
+                                       WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd);
+int wmi_set_rssi_threshold_params(struct wmi_t *wmip,
+                                        WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd);
+int wmi_clr_rssi_snr(struct wmi_t *wmip);
+int wmi_set_lq_threshold_params(struct wmi_t *wmip,
+                                      WMI_LQ_THRESHOLD_PARAMS_CMD *lqCmd);
+int wmi_set_rts_cmd(struct wmi_t *wmip, u16 threshold);
+int wmi_set_lpreamble_cmd(struct wmi_t *wmip, u8 status, u8 preamblePolicy);
+
+int wmi_set_error_report_bitmask(struct wmi_t *wmip, u32 bitmask);
+
+int wmi_get_challenge_resp_cmd(struct wmi_t *wmip, u32 cookie,
+                                    u32 source);
+
+int wmi_config_debug_module_cmd(struct wmi_t *wmip, u16 mmask,
+                                     u16 tsr, bool rep, u16 size,
+                                     u32 valid);
+
+int wmi_get_stats_cmd(struct wmi_t *wmip);
+
+int wmi_addKey_cmd(struct wmi_t *wmip, u8 keyIndex,
+                        CRYPTO_TYPE keyType, u8 keyUsage,
+                        u8 keyLength,u8 *keyRSC,
+                        u8 *keyMaterial, u8 key_op_ctrl, u8 *mac,
+                        WMI_SYNC_FLAG sync_flag);
+int wmi_add_krk_cmd(struct wmi_t *wmip, u8 *krk);
+int wmi_delete_krk_cmd(struct wmi_t *wmip);
+int wmi_deleteKey_cmd(struct wmi_t *wmip, u8 keyIndex);
+int wmi_set_akmp_params_cmd(struct wmi_t *wmip,
+                                 WMI_SET_AKMP_PARAMS_CMD *akmpParams);
+int wmi_get_pmkid_list_cmd(struct wmi_t *wmip);
+int wmi_set_pmkid_list_cmd(struct wmi_t *wmip,
+                                WMI_SET_PMKID_LIST_CMD *pmkInfo);
+int wmi_abort_scan_cmd(struct wmi_t *wmip);
+int wmi_set_txPwr_cmd(struct wmi_t *wmip, u8 dbM);
+int wmi_get_txPwr_cmd(struct wmi_t *wmip);
+int wmi_addBadAp_cmd(struct wmi_t *wmip, u8 apIndex, u8 *bssid);
+int wmi_deleteBadAp_cmd(struct wmi_t *wmip, u8 apIndex);
+int wmi_set_tkip_countermeasures_cmd(struct wmi_t *wmip, bool en);
+int wmi_setPmkid_cmd(struct wmi_t *wmip, u8 *bssid, u8 *pmkId,
+                          bool set);
+int wmi_set_access_params_cmd(struct wmi_t *wmip, u8 ac, u16 txop,
+                                   u8 eCWmin, u8 eCWmax,
+                                   u8 aifsn);
+int wmi_set_retry_limits_cmd(struct wmi_t *wmip, u8 frameType,
+                                  u8 trafficClass, u8 maxRetries,
+                                  u8 enableNotify);
+
+void wmi_get_current_bssid(struct wmi_t *wmip, u8 *bssid);
+
+int wmi_get_roam_tbl_cmd(struct wmi_t *wmip);
+int wmi_get_roam_data_cmd(struct wmi_t *wmip, u8 roamDataType);
+int wmi_set_roam_ctrl_cmd(struct wmi_t *wmip, WMI_SET_ROAM_CTRL_CMD *p,
+                               u8 size);
+int wmi_set_powersave_timers_cmd(struct wmi_t *wmip,
+                            WMI_POWERSAVE_TIMERS_POLICY_CMD *pCmd,
+                            u8 size);
+
+int wmi_set_opt_mode_cmd(struct wmi_t *wmip, u8 optMode);
+int wmi_opt_tx_frame_cmd(struct wmi_t *wmip,
+                              u8 frmType,
+                              u8 *dstMacAddr,
+                              u8 *bssid,
+                              u16 optIEDataLen,
+                              u8 *optIEData);
+
+int wmi_set_adhoc_bconIntvl_cmd(struct wmi_t *wmip, u16 intvl);
+int wmi_set_voice_pkt_size_cmd(struct wmi_t *wmip, u16 voicePktSize);
+int wmi_set_max_sp_len_cmd(struct wmi_t *wmip, u8 maxSpLen);
+u8 convert_userPriority_to_trafficClass(u8 userPriority);
+u8 wmi_get_power_mode_cmd(struct wmi_t *wmip);
+int wmi_verify_tspec_params(WMI_CREATE_PSTREAM_CMD *pCmd, int tspecCompliance);
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+int wmi_test_cmd(struct wmi_t *wmip, u8 *buf, u32 len);
+#endif
+
+int wmi_set_bt_status_cmd(struct wmi_t *wmip, u8 streamType, u8 status);
+int wmi_set_bt_params_cmd(struct wmi_t *wmip, WMI_SET_BT_PARAMS_CMD* cmd);
+
+int wmi_set_btcoex_fe_ant_cmd(struct wmi_t *wmip, WMI_SET_BTCOEX_FE_ANT_CMD * cmd);
+
+int wmi_set_btcoex_colocated_bt_dev_cmd(struct wmi_t *wmip,
+                                                WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD * cmd);
+
+int wmi_set_btcoex_btinquiry_page_config_cmd(struct wmi_t *wmip,
+                                                WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD *cmd);
+
+int wmi_set_btcoex_sco_config_cmd(struct wmi_t *wmip,
+                                              WMI_SET_BTCOEX_SCO_CONFIG_CMD * cmd);
+
+int wmi_set_btcoex_a2dp_config_cmd(struct wmi_t *wmip,
+                                                 WMI_SET_BTCOEX_A2DP_CONFIG_CMD* cmd);
+
+
+int wmi_set_btcoex_aclcoex_config_cmd(struct wmi_t *wmip, WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD* cmd);
+
+int wmi_set_btcoex_debug_cmd(struct wmi_t *wmip, WMI_SET_BTCOEX_DEBUG_CMD * cmd);
+
+int wmi_set_btcoex_bt_operating_status_cmd(struct wmi_t * wmip,
+                                                        WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD * cmd);
+
+int wmi_get_btcoex_config_cmd(struct wmi_t * wmip, WMI_GET_BTCOEX_CONFIG_CMD * cmd);
+
+int wmi_get_btcoex_stats_cmd(struct wmi_t * wmip);
+
+int wmi_SGI_cmd(struct wmi_t *wmip, u32 sgiMask, u8 sgiPERThreshold);
+
+/*
+ *  This function is used to configure the fix rates mask to the target.
+ */
+int wmi_set_fixrates_cmd(struct wmi_t *wmip, u32 fixRatesMask);
+int wmi_get_ratemask_cmd(struct wmi_t *wmip);
+
+int wmi_set_authmode_cmd(struct wmi_t *wmip, u8 mode);
+
+int wmi_set_reassocmode_cmd(struct wmi_t *wmip, u8 mode);
+
+int wmi_set_qos_supp_cmd(struct wmi_t *wmip,u8 status);
+int wmi_set_wmm_cmd(struct wmi_t *wmip, WMI_WMM_STATUS status);
+int wmi_set_wmm_txop(struct wmi_t *wmip, WMI_TXOP_CFG txEnable);
+int wmi_set_country(struct wmi_t *wmip, u8 *countryCode);
+
+int wmi_get_keepalive_configured(struct wmi_t *wmip);
+u8 wmi_get_keepalive_cmd(struct wmi_t *wmip);
+int wmi_set_keepalive_cmd(struct wmi_t *wmip, u8 keepaliveInterval);
+
+int wmi_set_appie_cmd(struct wmi_t *wmip, u8 mgmtFrmType,
+                           u8 ieLen,u8 *ieInfo);
+
+int wmi_set_halparam_cmd(struct wmi_t *wmip, u8 *cmd, u16 dataLen);
+
+s32 wmi_get_rate(s8 rateindex);
+
+int wmi_set_ip_cmd(struct wmi_t *wmip, WMI_SET_IP_CMD *cmd);
+
+/*Wake on Wireless WMI commands*/
+int wmi_set_host_sleep_mode_cmd(struct wmi_t *wmip, WMI_SET_HOST_SLEEP_MODE_CMD *cmd);
+int wmi_set_wow_mode_cmd(struct wmi_t *wmip, WMI_SET_WOW_MODE_CMD *cmd);
+int wmi_get_wow_list_cmd(struct wmi_t *wmip, WMI_GET_WOW_LIST_CMD *cmd);
+int wmi_add_wow_pattern_cmd(struct wmi_t *wmip,
+                                 WMI_ADD_WOW_PATTERN_CMD *cmd, u8 *pattern, u8 *mask, u8 pattern_size);
+int wmi_del_wow_pattern_cmd(struct wmi_t *wmip,
+                                 WMI_DEL_WOW_PATTERN_CMD *cmd);
+int wmi_set_wsc_status_cmd(struct wmi_t *wmip, u32 status);
+
+int
+wmi_set_params_cmd(struct wmi_t *wmip, u32 opcode, u32 length, char *buffer);
+
+int
+wmi_set_mcast_filter_cmd(struct wmi_t *wmip, u8 dot1, u8 dot2, u8 dot3, u8 dot4);
+
+int
+wmi_del_mcast_filter_cmd(struct wmi_t *wmip, u8 dot1, u8 dot2, u8 dot3, u8 dot4);
+
+int
+wmi_mcast_filter_cmd(struct wmi_t *wmip, u8 enable);
+
+bss_t *
+wmi_find_Ssidnode (struct wmi_t *wmip, u8 *pSsid,
+                   u32 ssidLength, bool bIsWPA2, bool bMatchSSID);
+
+
+void
+wmi_node_return (struct wmi_t *wmip, bss_t *bss);
+
+void
+wmi_set_nodeage(struct wmi_t *wmip, u32 nodeAge);
+
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+int wmi_prof_cfg_cmd(struct wmi_t *wmip, u32 period, u32 nbins);
+int wmi_prof_addr_set_cmd(struct wmi_t *wmip, u32 addr);
+int wmi_prof_start_cmd(struct wmi_t *wmip);
+int wmi_prof_stop_cmd(struct wmi_t *wmip);
+int wmi_prof_count_get_cmd(struct wmi_t *wmip);
+#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
+#ifdef OS_ROAM_MANAGEMENT
+void wmi_scan_indication (struct wmi_t *wmip);
+#endif
+
+int
+wmi_set_target_event_report_cmd(struct wmi_t *wmip, WMI_SET_TARGET_EVENT_REPORT_CMD* cmd);
+
+bss_t   *wmi_rm_current_bss (struct wmi_t *wmip, u8 *id);
+int wmi_add_current_bss (struct wmi_t *wmip, u8 *id, bss_t *bss);
+
+
+/*
+ * AP mode
+ */
+int
+wmi_ap_profile_commit(struct wmi_t *wmip, WMI_CONNECT_CMD *p);
+
+int
+wmi_ap_set_hidden_ssid(struct wmi_t *wmip, u8 hidden_ssid);
+
+int
+wmi_ap_set_num_sta(struct wmi_t *wmip, u8 num_sta);
+
+int
+wmi_ap_set_acl_policy(struct wmi_t *wmip, u8 policy);
+
+int
+wmi_ap_acl_mac_list(struct wmi_t *wmip, WMI_AP_ACL_MAC_CMD *a);
+
+u8 acl_add_del_mac(WMI_AP_ACL *a, WMI_AP_ACL_MAC_CMD *acl);
+
+int
+wmi_ap_set_mlme(struct wmi_t *wmip, u8 cmd, u8 *mac, u16 reason);
+
+int
+wmi_set_pvb_cmd(struct wmi_t *wmip, u16 aid, bool flag);
+
+int
+wmi_ap_conn_inact_time(struct wmi_t *wmip, u32 period);
+
+int
+wmi_ap_bgscan_time(struct wmi_t *wmip, u32 period, u32 dwell);
+
+int
+wmi_ap_set_dtim(struct wmi_t *wmip, u8 dtim);
+
+int
+wmi_ap_set_rateset(struct wmi_t *wmip, u8 rateset);
+
+int
+wmi_set_ht_cap_cmd(struct wmi_t *wmip, WMI_SET_HT_CAP_CMD *cmd);
+
+int
+wmi_set_ht_op_cmd(struct wmi_t *wmip, u8 sta_chan_width);
+
+int
+wmi_send_hci_cmd(struct wmi_t *wmip, u8 *buf, u16 sz);
+
+int
+wmi_set_tx_select_rates_cmd(struct wmi_t *wmip, u32 *pMaskArray);
+
+int
+wmi_setup_aggr_cmd(struct wmi_t *wmip, u8 tid);
+
+int
+wmi_delete_aggr_cmd(struct wmi_t *wmip, u8 tid, bool uplink);
+
+int
+wmi_allow_aggr_cmd(struct wmi_t *wmip, u16 tx_tidmask, u16 rx_tidmask);
+
+int
+wmi_set_rx_frame_format_cmd(struct wmi_t *wmip, u8 rxMetaVersion, bool rxDot11Hdr, bool defragOnHost);
+
+int
+wmi_set_thin_mode_cmd(struct wmi_t *wmip, bool bThinMode);
+
+int
+wmi_set_wlan_conn_precedence_cmd(struct wmi_t *wmip, BT_WLAN_CONN_PRECEDENCE precedence);
+
+int
+wmi_set_pmk_cmd(struct wmi_t *wmip, u8 *pmk);
+
+int
+wmi_set_excess_tx_retry_thres_cmd(struct wmi_t *wmip, WMI_SET_EXCESS_TX_RETRY_THRES_CMD *cmd);
+
+u16 wmi_ieee2freq (int chan);
+
+u32 wmi_freq2ieee (u16 freq);
+
+bss_t *
+wmi_find_matching_Ssidnode (struct wmi_t *wmip, u8 *pSsid,
+                   u32 ssidLength,
+                   u32 dot11AuthMode, u32 authMode,
+                   u32 pairwiseCryptoType, u32 grpwiseCryptoTyp);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMI_API_H_ */
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kconfig.c b/drivers/staging/ath6kl/miscdrv/ar3kconfig.c
new file mode 100644
index 00000000000..e0ea2183019
--- /dev/null
+++ b/drivers/staging/ath6kl/miscdrv/ar3kconfig.c
@@ -0,0 +1,565 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// AR3K configuration implementation
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_osapi.h"
+#define ATH_MODULE_NAME misc
+#include "a_debug.h"
+#include "common_drv.h"
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+#include "export_hci_transport.h"
+#else
+#include "hci_transport_api.h"
+#endif
+#include "ar3kconfig.h"
+#include "tlpm.h"
+
+#define BAUD_CHANGE_COMMAND_STATUS_OFFSET   5
+#define HCI_EVENT_RESP_TIMEOUTMS            3000
+#define HCI_CMD_OPCODE_BYTE_LOW_OFFSET      0
+#define HCI_CMD_OPCODE_BYTE_HI_OFFSET       1
+#define HCI_EVENT_OPCODE_BYTE_LOW           3
+#define HCI_EVENT_OPCODE_BYTE_HI            4
+#define HCI_CMD_COMPLETE_EVENT_CODE         0xE
+#define HCI_MAX_EVT_RECV_LENGTH             257
+#define EXIT_MIN_BOOT_COMMAND_STATUS_OFFSET  5
+
+int AthPSInitialize(struct ar3k_config_info *hdev);
+
+static int SendHCICommand(struct ar3k_config_info *pConfig,
+                               u8 *pBuffer,
+                               int              Length)
+{
+    struct htc_packet  *pPacket = NULL;
+    int    status = 0;
+       
+    do {   
+        
+        pPacket = (struct htc_packet *)A_MALLOC(sizeof(struct htc_packet));     
+        if (NULL == pPacket) {
+            status = A_NO_MEMORY;
+            break;    
+        }       
+        
+        A_MEMZERO(pPacket,sizeof(struct htc_packet));      
+        SET_HTC_PACKET_INFO_TX(pPacket,
+                               NULL,
+                               pBuffer, 
+                               Length,
+                               HCI_COMMAND_TYPE, 
+                               AR6K_CONTROL_PKT_TAG);
+        
+            /* issue synchronously */                                      
+        status = HCI_TransportSendPkt(pConfig->pHCIDev,pPacket,true);
+        
+    } while (false);
+   
+    if (pPacket != NULL) {
+        kfree(pPacket);
+    }
+        
+    return status;
+}
+
+static int RecvHCIEvent(struct ar3k_config_info *pConfig,
+                             u8 *pBuffer,
+                             int              *pLength)
+{
+    int    status = 0;
+    struct htc_packet  *pRecvPacket = NULL;
+    
+    do {
+                 
+        pRecvPacket = (struct htc_packet *)A_MALLOC(sizeof(struct htc_packet));
+        if (NULL == pRecvPacket) {
+            status = A_NO_MEMORY;
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to alloc HTC struct \n"));
+            break;    
+        }     
+        
+        A_MEMZERO(pRecvPacket,sizeof(struct htc_packet)); 
+         
+        SET_HTC_PACKET_INFO_RX_REFILL(pRecvPacket,NULL,pBuffer,*pLength,HCI_EVENT_TYPE);
+        
+        status = HCI_TransportRecvHCIEventSync(pConfig->pHCIDev,
+                                               pRecvPacket,
+                                               HCI_EVENT_RESP_TIMEOUTMS);
+        if (status) {
+            break;    
+        }
+
+        *pLength = pRecvPacket->ActualLength;
+        
+    } while (false);
+       
+    if (pRecvPacket != NULL) {
+        kfree(pRecvPacket);    
+    }
+    
+    return status;
+} 
+    
+int SendHCICommandWaitCommandComplete(struct ar3k_config_info *pConfig,
+                                           u8 *pHCICommand,
+                                           int              CmdLength,
+                                           u8 **ppEventBuffer,
+                                           u8 **ppBufferToFree)
+{
+    int    status = 0;
+    u8 *pBuffer = NULL;
+    u8 *pTemp;
+    int         length;
+    bool      commandComplete = false;
+    u8 opCodeBytes[2];
+                               
+    do {
+        
+        length = max(HCI_MAX_EVT_RECV_LENGTH,CmdLength);
+        length += pConfig->pHCIProps->HeadRoom + pConfig->pHCIProps->TailRoom;
+        length += pConfig->pHCIProps->IOBlockPad;
+                                     
+        pBuffer = (u8 *)A_MALLOC(length);
+        if (NULL == pBuffer) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR3K Config: Failed to allocate bt buffer \n"));
+            status = A_NO_MEMORY;
+            break;    
+        }
+        
+            /* get the opcodes to check the command complete event */
+        opCodeBytes[0] = pHCICommand[HCI_CMD_OPCODE_BYTE_LOW_OFFSET];
+        opCodeBytes[1] = pHCICommand[HCI_CMD_OPCODE_BYTE_HI_OFFSET];
+        
+            /* copy HCI command */
+        memcpy(pBuffer + pConfig->pHCIProps->HeadRoom,pHCICommand,CmdLength);         
+            /* send command */
+        status = SendHCICommand(pConfig,
+                                pBuffer + pConfig->pHCIProps->HeadRoom,
+                                CmdLength);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR3K Config: Failed to send HCI Command (%d) \n", status));
+            AR_DEBUG_PRINTBUF(pHCICommand,CmdLength,"HCI Bridge Failed HCI Command");
+            break;    
+        }   
+        
+            /* reuse buffer to capture command complete event */
+        A_MEMZERO(pBuffer,length);
+        status = RecvHCIEvent(pConfig,pBuffer,&length);        
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR3K Config: HCI event recv failed \n"));
+            AR_DEBUG_PRINTBUF(pHCICommand,CmdLength,"HCI Bridge Failed HCI Command");
+            break;    
+        }
+        
+        pTemp = pBuffer + pConfig->pHCIProps->HeadRoom;        
+        if (pTemp[0] == HCI_CMD_COMPLETE_EVENT_CODE) {
+            if ((pTemp[HCI_EVENT_OPCODE_BYTE_LOW] == opCodeBytes[0]) &&
+                (pTemp[HCI_EVENT_OPCODE_BYTE_HI] == opCodeBytes[1])) {
+                commandComplete = true;
+            }
+        }
+        
+        if (!commandComplete) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR3K Config: Unexpected HCI event : %d \n",pTemp[0]));
+            AR_DEBUG_PRINTBUF(pTemp,pTemp[1],"Unexpected HCI event");
+            status = A_ECOMM;
+            break;    
+        }       
+        
+        if (ppEventBuffer != NULL) {
+                /* caller wants to look at the event */
+            *ppEventBuffer = pTemp;
+            if (ppBufferToFree == NULL) {
+                status = A_EINVAL;
+                break;        
+            }
+                /* caller must free the buffer */
+            *ppBufferToFree = pBuffer;
+            pBuffer = NULL;            
+        }
+        
+    } while (false);
+
+    if (pBuffer != NULL) {
+        kfree(pBuffer);    
+    }
+    
+    return status;    
+}
+
+static int AR3KConfigureHCIBaud(struct ar3k_config_info *pConfig)
+{
+    int    status = 0;
+    u8 hciBaudChangeCommand[] =  {0x0c,0xfc,0x2,0,0};
+    u16 baudVal;
+    u8 *pEvent = NULL;
+    u8 *pBufferToFree = NULL;
+    
+    do {
+        
+        if (pConfig->Flags & AR3K_CONFIG_FLAG_SET_AR3K_BAUD) {
+            baudVal = (u16)(pConfig->AR3KBaudRate / 100);
+            hciBaudChangeCommand[3] = (u8)baudVal;
+            hciBaudChangeCommand[4] = (u8)(baudVal >> 8);
+            
+            status = SendHCICommandWaitCommandComplete(pConfig,
+                                                       hciBaudChangeCommand,
+                                                       sizeof(hciBaudChangeCommand),
+                                                       &pEvent,
+                                                       &pBufferToFree);          
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR3K Config: Baud rate change failed! \n"));  
+                break;    
+            }
+            
+            if (pEvent[BAUD_CHANGE_COMMAND_STATUS_OFFSET] != 0) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    ("AR3K Config: Baud change command event status failed: %d \n", 
+                                pEvent[BAUD_CHANGE_COMMAND_STATUS_OFFSET]));
+                status = A_ECOMM; 
+                break;           
+            } 
+            
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+                    ("AR3K Config: Baud Changed to %d \n",pConfig->AR3KBaudRate));  
+        }
+        
+        if (pConfig->Flags & AR3K_CONFIG_FLAG_AR3K_BAUD_CHANGE_DELAY) {
+                /* some versions of AR3K do not switch baud immediately, up to 300MS */
+            A_MDELAY(325);
+        }
+        
+        if (pConfig->Flags & AR3K_CONFIG_FLAG_SET_AR6K_SCALE_STEP) {
+            /* Tell target to change UART baud rate for AR6K */
+            status = HCI_TransportSetBaudRate(pConfig->pHCIDev, pConfig->AR3KBaudRate);
+
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                    ("AR3K Config: failed to set scale and step values: %d \n", status));
+                break;    
+            }
+    
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,
+                    ("AR3K Config: Baud changed to %d for AR6K\n", pConfig->AR3KBaudRate));            
+        }
+                
+    } while (false);
+                        
+    if (pBufferToFree != NULL) {
+        kfree(pBufferToFree);    
+    }
+        
+    return status;
+}
+
+static int AR3KExitMinBoot(struct ar3k_config_info *pConfig)
+{
+    int  status;
+    char exitMinBootCmd[] = {0x25,0xFC,0x0c,0x03,0x00,0x00,0x00,0x00,0x00,0x00,
+                                  0x00,0x00,0x00,0x00,0x00};
+    u8 *pEvent = NULL;
+    u8 *pBufferToFree = NULL;
+    
+    status = SendHCICommandWaitCommandComplete(pConfig,
+                                               exitMinBootCmd,
+                                               sizeof(exitMinBootCmd),
+                                               &pEvent,
+                                               &pBufferToFree);
+    
+    if (!status) {
+        if (pEvent[EXIT_MIN_BOOT_COMMAND_STATUS_OFFSET] != 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                ("AR3K Config: MinBoot exit command event status failed: %d \n", 
+                            pEvent[EXIT_MIN_BOOT_COMMAND_STATUS_OFFSET]));
+            status = A_ECOMM;            
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, 
+                                ("AR3K Config: MinBoot Exit Command Complete (Success) \n"));
+            A_MDELAY(1);
+        }
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR3K Config: MinBoot Exit Failed! \n"));    
+    }
+    
+    if (pBufferToFree != NULL) {
+        kfree(pBufferToFree);    
+    }
+    
+    return status;                                              
+}
+                                 
+static int AR3KConfigureSendHCIReset(struct ar3k_config_info *pConfig)
+{
+    int status = 0;
+    u8 hciResetCommand[] = {0x03,0x0c,0x0};
+    u8 *pEvent = NULL;
+    u8 *pBufferToFree = NULL;
+
+    status = SendHCICommandWaitCommandComplete( pConfig,
+                                                hciResetCommand,
+                                                sizeof(hciResetCommand),
+                                                &pEvent,
+                                                &pBufferToFree );
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR3K Config: HCI reset failed! \n"));
+    }
+
+    if (pBufferToFree != NULL) {
+        kfree(pBufferToFree);
+    }
+
+    return status;
+}
+
+static int AR3KEnableTLPM(struct ar3k_config_info *pConfig)
+{
+    int  status;
+    /* AR3K vendor specific command for Host Wakeup Config */
+    char hostWakeupConfig[] = {0x31,0xFC,0x18,
+                                    0x02,0x00,0x00,0x00,
+                                    0x01,0x00,0x00,0x00,
+                                    TLPM_DEFAULT_IDLE_TIMEOUT_LSB,TLPM_DEFAULT_IDLE_TIMEOUT_MSB,0x00,0x00,    //idle timeout in ms
+                                    0x00,0x00,0x00,0x00,
+                                    TLPM_DEFAULT_WAKEUP_TIMEOUT_MS,0x00,0x00,0x00,    //wakeup timeout in ms
+                                    0x00,0x00,0x00,0x00};
+    /* AR3K vendor specific command for Target Wakeup Config */
+    char targetWakeupConfig[] = {0x31,0xFC,0x18,
+                                      0x04,0x00,0x00,0x00,
+                                      0x01,0x00,0x00,0x00,
+                                      TLPM_DEFAULT_IDLE_TIMEOUT_LSB,TLPM_DEFAULT_IDLE_TIMEOUT_MSB,0x00,0x00,  //idle timeout in ms
+                                      0x00,0x00,0x00,0x00,
+                                      TLPM_DEFAULT_WAKEUP_TIMEOUT_MS,0x00,0x00,0x00,  //wakeup timeout in ms
+                                      0x00,0x00,0x00,0x00};
+    /* AR3K vendor specific command for Host Wakeup Enable */
+    char hostWakeupEnable[] = {0x31,0xFC,0x4,
+                                    0x01,0x00,0x00,0x00};
+    /* AR3K vendor specific command for Target Wakeup Enable */
+    char targetWakeupEnable[] = {0x31,0xFC,0x4,
+                                      0x06,0x00,0x00,0x00};
+    /* AR3K vendor specific command for Sleep Enable */
+    char sleepEnable[] = {0x4,0xFC,0x1,
+                               0x1};
+    u8 *pEvent = NULL;
+    u8 *pBufferToFree = NULL;
+    
+    if (0 != pConfig->IdleTimeout) {
+        u8 idle_lsb = pConfig->IdleTimeout & 0xFF;
+        u8 idle_msb = (pConfig->IdleTimeout & 0xFF00) >> 8;
+        hostWakeupConfig[11] = targetWakeupConfig[11] = idle_lsb;
+        hostWakeupConfig[12] = targetWakeupConfig[12] = idle_msb;
+    }
+
+    if (0 != pConfig->WakeupTimeout) {
+        hostWakeupConfig[19] = targetWakeupConfig[19] = (pConfig->WakeupTimeout & 0xFF);
+    }
+
+    status = SendHCICommandWaitCommandComplete(pConfig,
+                                               hostWakeupConfig,
+                                               sizeof(hostWakeupConfig),
+                                               &pEvent,
+                                               &pBufferToFree);
+    if (pBufferToFree != NULL) {
+        kfree(pBufferToFree);    
+    }
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HostWakeup Config Failed! \n"));    
+        return status;
+    }
+    
+    pEvent = NULL;
+    pBufferToFree = NULL;
+    status = SendHCICommandWaitCommandComplete(pConfig,
+                                               targetWakeupConfig,
+                                               sizeof(targetWakeupConfig),
+                                               &pEvent,
+                                               &pBufferToFree);
+    if (pBufferToFree != NULL) {
+        kfree(pBufferToFree);    
+    }
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Target Wakeup Config Failed! \n"));    
+        return status;
+    }
+
+    pEvent = NULL;
+    pBufferToFree = NULL;
+    status = SendHCICommandWaitCommandComplete(pConfig,
+                                               hostWakeupEnable,
+                                               sizeof(hostWakeupEnable),
+                                               &pEvent,
+                                               &pBufferToFree);
+    if (pBufferToFree != NULL) {
+        kfree(pBufferToFree);    
+    }
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HostWakeup Enable Failed! \n"));    
+        return status;
+    }
+
+    pEvent = NULL;
+    pBufferToFree = NULL;
+    status = SendHCICommandWaitCommandComplete(pConfig,
+                                               targetWakeupEnable,
+                                               sizeof(targetWakeupEnable),
+                                               &pEvent,
+                                               &pBufferToFree);
+    if (pBufferToFree != NULL) {
+        kfree(pBufferToFree);    
+    }
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Target Wakeup Enable Failed! \n"));    
+        return status;
+    }
+
+    pEvent = NULL;
+    pBufferToFree = NULL;
+    status = SendHCICommandWaitCommandComplete(pConfig,
+                                               sleepEnable,
+                                               sizeof(sleepEnable),
+                                               &pEvent,
+                                               &pBufferToFree);
+    if (pBufferToFree != NULL) {
+        kfree(pBufferToFree);    
+    }
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Sleep Enable Failed! \n"));    
+    }
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR3K Config: Enable TLPM Completed (status = %d) \n",status));
+
+    return status;                                              
+}
+
+int AR3KConfigure(struct ar3k_config_info *pConfig)
+{
+    int        status = 0;
+        
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR3K Config: Configuring AR3K ...\n"));
+                                
+    do {
+        
+        if ((pConfig->pHCIDev == NULL) || (pConfig->pHCIProps == NULL) || (pConfig->pHIFDevice == NULL)) {
+            status = A_EINVAL;
+            break;    
+        }
+        
+            /* disable asynchronous recv while we issue commands and receive events synchronously */
+        status = HCI_TransportEnableDisableAsyncRecv(pConfig->pHCIDev,false);
+        if (status) {
+            break;    
+        }
+      
+        if (pConfig->Flags & AR3K_CONFIG_FLAG_FORCE_MINBOOT_EXIT) {
+            status =  AR3KExitMinBoot(pConfig);   
+            if (status) {
+                break;    
+            }    
+        }
+        
+       
+        /* Load patching and PST file if available*/
+        if (0 != AthPSInitialize(pConfig)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Patch Download Failed!\n"));
+        }
+
+        /* Send HCI reset to make PS tags take effect*/
+        AR3KConfigureSendHCIReset(pConfig);
+
+        if (pConfig->Flags & 
+                (AR3K_CONFIG_FLAG_SET_AR3K_BAUD | AR3K_CONFIG_FLAG_SET_AR6K_SCALE_STEP)) {
+            status = AR3KConfigureHCIBaud(pConfig);      
+            if (status) {
+                break;    
+            }
+        }     
+
+
+
+        if (pConfig->PwrMgmtEnabled) {
+            /* the delay is required after the previous HCI reset before further
+             * HCI commands can be issued
+             */
+            A_MDELAY(200);
+            AR3KEnableTLPM(pConfig);
+        }
+               
+           /* re-enable asynchronous recv */
+        status = HCI_TransportEnableDisableAsyncRecv(pConfig->pHCIDev,true);
+        if (status) {
+            break;    
+        }     
+    
+    
+    } while (false);
+    
+  
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR3K Config: Configuration Complete (status = %d) \n",status));
+    
+    return status;
+}
+
+int AR3KConfigureExit(void *config)
+{
+    int        status = 0;
+    struct ar3k_config_info *pConfig = (struct ar3k_config_info *)config;
+        
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR3K Config: Cleaning up AR3K ...\n"));
+                                
+    do {
+        
+        if ((pConfig->pHCIDev == NULL) || (pConfig->pHCIProps == NULL) || (pConfig->pHIFDevice == NULL)) {
+            status = A_EINVAL;
+            break;    
+        }
+        
+            /* disable asynchronous recv while we issue commands and receive events synchronously */
+        status = HCI_TransportEnableDisableAsyncRecv(pConfig->pHCIDev,false);
+        if (status) {
+            break;    
+        }
+      
+        if (pConfig->Flags & 
+                (AR3K_CONFIG_FLAG_SET_AR3K_BAUD | AR3K_CONFIG_FLAG_SET_AR6K_SCALE_STEP)) {
+            status = AR3KConfigureHCIBaud(pConfig);      
+            if (status) {
+                break;    
+            }
+        }
+
+           /* re-enable asynchronous recv */
+        status = HCI_TransportEnableDisableAsyncRecv(pConfig->pHCIDev,true);
+        if (status) {
+            break;    
+        }     
+    
+    
+    } while (false);
+    
+  
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR3K Config: Cleanup Complete (status = %d) \n",status));
+    
+    return status;
+}
+
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
new file mode 100644
index 00000000000..282ceac597b
--- /dev/null
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
@@ -0,0 +1,572 @@
+/*
+ * Copyright (c) 2004-2010 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ * This file implements the Atheros PS and patch downloaded for HCI UART Transport driver.
+ * This file can be used for HCI SDIO transport implementation for AR6002 with HCI_TRANSPORT_SDIO
+ * defined.
+ *
+ *
+ * ar3kcpsconfig.c
+ *
+ *
+ *
+ * The software source and binaries included in this development package are
+ * licensed, not sold. You, or your company, received the package under one
+ * or more license agreements. The rights granted to you are specifically
+ * listed in these license agreement(s). All other rights remain with Atheros
+ * Communications, Inc., its subsidiaries, or the respective owner including
+ * those listed on the included copyright notices..  Distribution of any
+ * portion of this package must be in strict compliance with the license
+ * agreement(s) terms.
+ *
+ *
+ *
+ */
+
+
+
+#include "ar3kpsconfig.h"
+#ifndef HCI_TRANSPORT_SDIO
+#include "hci_ath.h"
+#include "hci_uart.h"
+#endif /* #ifndef HCI_TRANSPORT_SDIO */
+
+#define MAX_FW_PATH_LEN             50
+#define MAX_BDADDR_FORMAT_LENGTH    30
+
+/*
+ *  Structure used to send HCI packet, hci packet length and device info 
+ *  together as parameter to PSThread.
+ */
+typedef struct {
+
+    struct ps_cmd_packet *HciCmdList;
+    u32 num_packets;
+    struct ar3k_config_info *dev;
+}HciCommandListParam;
+
+int SendHCICommandWaitCommandComplete(struct ar3k_config_info *pConfig,
+                                           u8 *pHCICommand,
+                                           int              CmdLength,
+                                           u8 **ppEventBuffer,
+                                           u8 **ppBufferToFree);
+
+u32 Rom_Version;
+u32 Build_Version;
+extern bool BDADDR;
+
+int getDeviceType(struct ar3k_config_info *pConfig, u32 *code);
+int ReadVersionInfo(struct ar3k_config_info *pConfig);
+#ifndef HCI_TRANSPORT_SDIO
+
+DECLARE_WAIT_QUEUE_HEAD(PsCompleteEvent);
+DECLARE_WAIT_QUEUE_HEAD(HciEvent);
+u8 *HciEventpacket;
+rwlock_t syncLock;
+wait_queue_t Eventwait;
+
+int PSHciWritepacket(struct hci_dev*,u8* Data, u32 len);
+extern char *bdaddr;
+#endif /* HCI_TRANSPORT_SDIO */
+
+int write_bdaddr(struct ar3k_config_info *pConfig,u8 *bdaddr,int type);
+
+int PSSendOps(void *arg);
+
+#ifdef BT_PS_DEBUG
+void Hci_log(u8 * log_string,u8 *data,u32 len)
+{
+    int i;
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s : ",log_string));
+    for (i = 0; i < len; i++) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("0x%02x ", data[i]));
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("\n...................................\n"));
+}
+#else
+#define Hci_log(string,data,len)
+#endif /* BT_PS_DEBUG */
+
+
+
+
+int AthPSInitialize(struct ar3k_config_info *hdev)
+{
+    int status = 0;
+    if(hdev == NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid Device handle received\n"));
+        return A_ERROR;
+    }
+
+#ifndef HCI_TRANSPORT_SDIO
+    DECLARE_WAITQUEUE(wait, current);
+#endif /* HCI_TRANSPORT_SDIO */
+    
+
+#ifdef HCI_TRANSPORT_SDIO
+    status = PSSendOps((void*)hdev);
+#else
+    if(InitPSState(hdev) == -1) {
+        return A_ERROR;
+    }
+    allow_signal(SIGKILL);
+    add_wait_queue(&PsCompleteEvent,&wait);
+    set_current_state(TASK_INTERRUPTIBLE);
+    if(!kernel_thread(PSSendOps,(void*)hdev,CLONE_FS|CLONE_FILES|CLONE_SIGHAND|SIGCHLD)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Kthread Failed\n"));
+        remove_wait_queue(&PsCompleteEvent,&wait);
+        return A_ERROR;
+    }
+    wait_event_interruptible(PsCompleteEvent,(PSTagMode == false));
+    set_current_state(TASK_RUNNING);
+    remove_wait_queue(&PsCompleteEvent,&wait);
+
+#endif /* HCI_TRANSPORT_SDIO */
+
+
+    return status;
+    
+}
+
+int PSSendOps(void *arg) 
+{
+    int i;
+    int status = 0;
+    struct ps_cmd_packet *HciCmdList; /* List storing the commands */
+    const struct firmware* firmware;
+    u32 numCmds;
+    u8 *event;
+    u8 *bufferToFree;
+    struct hci_dev *device;
+    u8 *buffer;
+    u32 len;
+    u32 DevType;
+    u8 *PsFileName;
+    u8 *patchFileName;
+    u8 *path = NULL;
+    u8 *config_path = NULL;
+    u8 config_bdaddr[MAX_BDADDR_FORMAT_LENGTH];
+    struct ar3k_config_info *hdev = (struct ar3k_config_info*)arg;
+    struct device *firmwareDev = NULL;
+    status = 0;
+    HciCmdList = NULL;
+#ifdef HCI_TRANSPORT_SDIO
+    device = hdev->pBtStackHCIDev; 
+    firmwareDev = device->parent;
+#else 
+    device = hdev;
+    firmwareDev = &device->dev;
+    AthEnableSyncCommandOp(true);
+#endif /* HCI_TRANSPORT_SDIO */
+    /* First verify if the controller is an FPGA or ASIC, so depending on the device type the PS file to be written will be different.
+     */
+
+    path =(u8 *)A_MALLOC(MAX_FW_PATH_LEN);
+    if(path == NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Malloc failed to allocate %d bytes for path\n", MAX_FW_PATH_LEN));
+        goto complete;
+    }
+    config_path = (u8 *) A_MALLOC(MAX_FW_PATH_LEN);
+    if(config_path == NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Malloc failed to allocate %d bytes for config_path\n", MAX_FW_PATH_LEN));
+        goto complete;
+    }
+
+    if(A_ERROR == getDeviceType(hdev,&DevType)) {
+        status = 1;
+        goto complete;
+    }
+    if(A_ERROR == ReadVersionInfo(hdev)) {
+        status = 1;
+        goto complete;
+    }
+
+    patchFileName = PATCH_FILE;
+    snprintf(path, MAX_FW_PATH_LEN, "%s/%xcoex/",CONFIG_PATH,Rom_Version);
+    if(DevType){
+        if(DevType == 0xdeadc0de){
+                PsFileName =  PS_ASIC_FILE;
+            } else{
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" FPGA Test Image : %x %x  \n",Rom_Version,Build_Version));
+                if((Rom_Version == 0x99999999) && (Build_Version == 1)){
+                        
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("FPGA Test Image : Skipping Patch File load\n"));
+                        patchFileName = NULL;
+                }
+                PsFileName =  PS_FPGA_FILE;
+            }
+    }
+    else{
+            PsFileName =  PS_ASIC_FILE;
+    }
+
+    snprintf(config_path, MAX_FW_PATH_LEN, "%s%s",path,PsFileName);
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%x: FPGA/ASIC PS File Name %s\n", DevType,config_path));
+    /* Read the PS file to a dynamically allocated buffer */
+    if(A_REQUEST_FIRMWARE(&firmware,config_path,firmwareDev) < 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: firmware file open error\n", __FUNCTION__ ));
+        status = 1;
+        goto complete;
+
+    }
+    if(NULL == firmware || firmware->size == 0) {
+        status = 1;
+        goto complete;
+    }
+    buffer = (u8 *)A_MALLOC(firmware->size);
+    if(buffer != NULL) {
+    /* Copy the read file to a local Dynamic buffer */
+        memcpy(buffer,firmware->data,firmware->size);
+        len = firmware->size;
+        A_RELEASE_FIRMWARE(firmware);
+        /* Parse the PS buffer to a global variable */
+        status = AthDoParsePS(buffer,len);
+        kfree(buffer);
+    } else {
+        A_RELEASE_FIRMWARE(firmware);
+    }
+
+
+    /* Read the patch file to a dynamically allocated buffer */
+        if(patchFileName != NULL)
+                snprintf(config_path,
+                         MAX_FW_PATH_LEN, "%s%s",path,patchFileName);
+        else {
+                status = 0;
+        }
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Patch File Name %s\n", config_path));
+    if((patchFileName == NULL) || (A_REQUEST_FIRMWARE(&firmware,config_path,firmwareDev) < 0)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: firmware file open error\n", __FUNCTION__ ));
+        /* 
+         *  It is not necessary that Patch file be available, continue with PS Operations if.
+         *  failed.
+         */
+        status = 0;
+
+    } else {
+        if(NULL == firmware || firmware->size == 0) {
+            status = 0;
+        } else {
+            buffer = (u8 *)A_MALLOC(firmware->size);
+            if(buffer != NULL) {
+                /* Copy the read file to a local Dynamic buffer */
+                memcpy(buffer,firmware->data,firmware->size);
+                len = firmware->size;
+                A_RELEASE_FIRMWARE(firmware);
+                /* parse and store the Patch file contents to a global variables */
+                status = AthDoParsePatch(buffer,len);
+                kfree(buffer);
+            } else {
+                A_RELEASE_FIRMWARE(firmware);
+            }
+        }
+    }
+
+    /* Create an HCI command list from the parsed PS and patch information */
+    AthCreateCommandList(&HciCmdList,&numCmds);
+
+    /* Form the parameter for PSSendOps() API */
+ 
+
+    /*
+     * First Send the CRC packet, 
+     * We have to continue with the PS operations only if the CRC packet has been replied with 
+     * a Command complete event with status Error.
+     */
+
+    if(SendHCICommandWaitCommandComplete
+    (hdev,
+    HciCmdList[0].Hcipacket,
+    HciCmdList[0].packetLen,
+    &event,
+    &bufferToFree) == 0) {
+        if(ReadPSEvent(event) == 0) { /* Exit if the status is success */
+            if(bufferToFree != NULL) {
+                kfree(bufferToFree);
+                }
+        
+#ifndef HCI_TRANSPORT_SDIO
+                        if(bdaddr && bdaddr[0] !='\0') {
+                                write_bdaddr(hdev,bdaddr,BDADDR_TYPE_STRING);
+                        }
+#endif 
+               status = 1;
+               goto complete;
+        }
+        if(bufferToFree != NULL) {
+               kfree(bufferToFree);
+        }
+    } else {
+        status = 0;
+        goto complete;
+    }
+ 
+    for(i = 1; i <numCmds; i++) {
+    
+        if(SendHCICommandWaitCommandComplete
+        (hdev,
+        HciCmdList[i].Hcipacket,
+        HciCmdList[i].packetLen,
+        &event,
+        &bufferToFree) == 0) {
+            if(ReadPSEvent(event) != 0) { /* Exit if the status is success */
+                if(bufferToFree != NULL) {
+                    kfree(bufferToFree);
+                    }
+                   status = 1;
+                    goto complete;
+            }
+            if(bufferToFree != NULL) {
+                   kfree(bufferToFree);
+            }
+        } else {
+            status = 0;
+            goto complete;
+        }
+    }
+#ifdef HCI_TRANSPORT_SDIO
+        if(BDADDR == false)
+                if(hdev->bdaddr[0] !=0x00 ||
+                   hdev->bdaddr[1] !=0x00 ||
+                   hdev->bdaddr[2] !=0x00 ||
+                   hdev->bdaddr[3] !=0x00 ||
+                   hdev->bdaddr[4] !=0x00 ||
+                   hdev->bdaddr[5] !=0x00)
+                        write_bdaddr(hdev,hdev->bdaddr,BDADDR_TYPE_HEX);
+
+#ifndef HCI_TRANSPORT_SDIO
+
+        if(bdaddr && bdaddr[0] != '\0') {
+                write_bdaddr(hdev,bdaddr,BDADDR_TYPE_STRING);
+        } else
+#endif /* HCI_TRANSPORT_SDIO */
+    /* Write BDADDR Read from OTP here */
+
+
+
+#endif
+
+        {
+                 /* Read Contents of BDADDR file if user has not provided any option */
+        snprintf(config_path,MAX_FW_PATH_LEN, "%s%s",path,BDADDR_FILE);
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Patch File Name %s\n", config_path));
+        if(A_REQUEST_FIRMWARE(&firmware,config_path,firmwareDev) < 0) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: firmware file open error\n", __FUNCTION__ ));
+                status = 1;
+                goto complete;
+        }
+        if(NULL == firmware || firmware->size == 0) {
+                status = 1;
+                goto complete;
+        }
+        len = min_t(size_t, firmware->size, MAX_BDADDR_FORMAT_LENGTH - 1);
+        memcpy(config_bdaddr, firmware->data, len);
+        config_bdaddr[len] = '\0';
+        write_bdaddr(hdev,config_bdaddr,BDADDR_TYPE_STRING);
+        A_RELEASE_FIRMWARE(firmware);
+        }
+complete:
+#ifndef HCI_TRANSPORT_SDIO
+    AthEnableSyncCommandOp(false);
+    PSTagMode = false;
+    wake_up_interruptible(&PsCompleteEvent);
+#endif /* HCI_TRANSPORT_SDIO */
+    if(NULL != HciCmdList) {
+        AthFreeCommandList(&HciCmdList,numCmds);
+    }
+    if(path) {
+        kfree(path);
+    }
+    if(config_path) {
+        kfree(config_path);
+    }
+    return status;
+}
+#ifndef HCI_TRANSPORT_SDIO
+/*
+ *  This API is used to send the HCI command to controller and return
+ *  with a HCI Command Complete event.
+ *  For HCI SDIO transport, this will be internally defined. 
+ */
+int SendHCICommandWaitCommandComplete(struct ar3k_config_info *pConfig,
+                                           u8 *pHCICommand,
+                                           int              CmdLength,
+                                           u8 **ppEventBuffer,
+                                           u8 **ppBufferToFree)
+{
+    if(CmdLength == 0) {
+        return A_ERROR;
+    }
+    Hci_log("COM Write -->",pHCICommand,CmdLength);
+    PSAcked = false;
+    if(PSHciWritepacket(pConfig,pHCICommand,CmdLength) == 0) {
+        /* If the controller is not available, return Error */
+        return A_ERROR;
+    }
+    //add_timer(&psCmdTimer);
+    wait_event_interruptible(HciEvent,(PSAcked == true));
+    if(NULL != HciEventpacket) {
+        *ppEventBuffer = HciEventpacket;
+        *ppBufferToFree = HciEventpacket;
+    } else {
+        /* Did not get an event from controller. return error */
+        *ppBufferToFree = NULL;
+        return A_ERROR;
+    }
+
+    return 0;
+}
+#endif /* HCI_TRANSPORT_SDIO */
+
+int ReadPSEvent(u8* Data){
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" PS Event %x %x %x\n",Data[4],Data[5],Data[3]));
+                                
+    if(Data[4] == 0xFC && Data[5] == 0x00)
+    {
+         switch(Data[3]){
+             case 0x0B:
+                     return 0;
+                 break;
+                 case 0x0C:
+                    /* Change Baudrate */
+                        return 0;
+                 break;  
+                 case 0x04:
+                     return 0;
+                 break;  
+                case 0x1E:
+                        Rom_Version = Data[9];
+                        Rom_Version = ((Rom_Version << 8) |Data[8]);
+                        Rom_Version = ((Rom_Version << 8) |Data[7]);
+                        Rom_Version = ((Rom_Version << 8) |Data[6]);
+
+                        Build_Version = Data[13];
+                        Build_Version = ((Build_Version << 8) |Data[12]);
+                        Build_Version = ((Build_Version << 8) |Data[11]);
+                        Build_Version = ((Build_Version << 8) |Data[10]);
+                        return 0;
+                break;
+
+        
+                }
+    }                       
+        
+    return A_ERROR;           
+}
+int str2ba(unsigned char *str_bdaddr,unsigned char *bdaddr)
+{
+        unsigned char bdbyte[3];
+        unsigned char *str_byte = str_bdaddr;
+        int i,j;
+        unsigned char colon_present = 0;
+
+        if(NULL != strstr(str_bdaddr,":")) {
+                colon_present = 1;
+        }
+
+
+        bdbyte[2] = '\0';
+
+        for( i = 0,j = 5; i < 6; i++, j--) {
+                bdbyte[0] = str_byte[0];
+                bdbyte[1] = str_byte[1];
+                bdaddr[j] = A_STRTOL(bdbyte,NULL,16);
+                if(colon_present == 1) {
+                        str_byte+=3;
+                } else {
+                        str_byte+=2;
+                }
+        }
+        return 0; 
+}
+
+int write_bdaddr(struct ar3k_config_info *pConfig,u8 *bdaddr,int type)
+{
+        u8 bdaddr_cmd[] = { 0x0B, 0xFC, 0x0A, 0x01, 0x01, 
+                                                        0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+    u8 *event;
+    u8 *bufferToFree = NULL;
+    int result = A_ERROR;
+        int inc,outc;
+
+        if (type == BDADDR_TYPE_STRING)
+                str2ba(bdaddr,&bdaddr_cmd[7]);
+        else {
+                /* Bdaddr has to be sent as LAP first */
+                for(inc = 5 ,outc = 7; inc >=0; inc--, outc++)
+                        bdaddr_cmd[outc] = bdaddr[inc];
+        }
+
+    if(0 == SendHCICommandWaitCommandComplete(pConfig,bdaddr_cmd,
+                                                                                                sizeof(bdaddr_cmd),
+                                                                                                &event,&bufferToFree)) {
+
+        if(event[4] == 0xFC && event[5] == 0x00){
+               if(event[3] == 0x0B){
+                result = 0;
+            }
+        }
+
+    }
+    if(bufferToFree != NULL) {
+        kfree(bufferToFree);
+   }
+    return result;
+
+}
+int ReadVersionInfo(struct ar3k_config_info *pConfig)
+{
+    u8 hciCommand[] =  {0x1E,0xfc,0x00};
+    u8 *event;
+    u8 *bufferToFree = NULL;
+    int result = A_ERROR;
+    if(0 == SendHCICommandWaitCommandComplete(pConfig,hciCommand,sizeof(hciCommand),&event,&bufferToFree)) {
+        result = ReadPSEvent(event);
+
+    }
+    if(bufferToFree != NULL) {
+        kfree(bufferToFree);
+   }
+    return result;
+}
+int getDeviceType(struct ar3k_config_info *pConfig, u32 *code)
+{
+    u8 hciCommand[] =  {0x05,0xfc,0x05,0x00,0x00,0x00,0x00,0x04};
+    u8 *event;
+    u8 *bufferToFree = NULL;
+    u32 reg;
+    int result = A_ERROR;
+    *code = 0;
+    hciCommand[3] = (u8)(FPGA_REGISTER & 0xFF);
+    hciCommand[4] = (u8)((FPGA_REGISTER >> 8) & 0xFF);
+    hciCommand[5] = (u8)((FPGA_REGISTER >> 16) & 0xFF);
+    hciCommand[6] = (u8)((FPGA_REGISTER >> 24) & 0xFF);
+    if(0 == SendHCICommandWaitCommandComplete(pConfig,hciCommand,sizeof(hciCommand),&event,&bufferToFree)) {
+
+        if(event[4] == 0xFC && event[5] == 0x00){
+               switch(event[3]){
+                case 0x05:
+                reg = event[9];
+                reg = ((reg << 8) |event[8]);
+                reg = ((reg << 8) |event[7]);
+                reg = ((reg << 8) |event[6]);
+                *code = reg;
+                result = 0;
+
+                break;
+                case 0x06:
+                    //Sleep(500);
+                break;
+            }
+        }
+
+    }
+    if(bufferToFree != NULL) {
+        kfree(bufferToFree);
+   }
+    return result;
+}
+
+
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.h b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.h
new file mode 100644
index 00000000000..d4435130780
--- /dev/null
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2004-2010 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ * This file defines the symbols exported by Atheros PS and patch download module.
+ * define the constant HCI_TRANSPORT_SDIO if the module is being used for HCI SDIO transport.
+ * defined.
+ *
+ *
+ * ar3kcpsconfig.h
+ *
+ *
+ *
+ * The software source and binaries included in this development package are
+ * licensed, not sold. You, or your company, received the package under one
+ * or more license agreements. The rights granted to you are specifically
+ * listed in these license agreement(s). All other rights remain with Atheros
+ * Communications, Inc., its subsidiaries, or the respective owner including
+ * those listed on the included copyright notices..  Distribution of any
+ * portion of this package must be in strict compliance with the license
+ * agreement(s) terms.
+ *
+ *
+ *
+ */
+
+
+
+#ifndef __AR3KPSCONFIG_H
+#define __AR3KPSCONFIG_H
+
+/* 
+ * Define the flag HCI_TRANSPORT_SDIO and undefine HCI_TRANSPORT_UART if the transport being used is SDIO.
+ */
+#undef HCI_TRANSPORT_UART
+
+#include <linux/fs.h>
+#include <linux/errno.h>
+#include <linux/signal.h>
+
+
+#include <linux/ioctl.h>
+#include <linux/firmware.h>
+
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#include "ar3kpsparser.h"
+
+#define FPGA_REGISTER   0x4FFC
+#define BDADDR_TYPE_STRING      0
+#define BDADDR_TYPE_HEX         1
+#define CONFIG_PATH       "ar3k"
+
+#define PS_ASIC_FILE      "PS_ASIC.pst"
+#define PS_FPGA_FILE      "PS_FPGA.pst"
+
+#define PATCH_FILE      "RamPatch.txt"
+#define BDADDR_FILE "ar3kbdaddr.pst"
+
+#define ROM_VER_AR3001_3_1_0    30000
+#define ROM_VER_AR3001_3_1_1    30101   
+
+
+#ifndef HCI_TRANSPORT_SDIO
+#define struct ar3k_config_info        struct hci_dev
+extern wait_queue_head_t HciEvent;
+extern wait_queue_t Eventwait;
+extern u8 *HciEventpacket;
+#endif /* #ifndef HCI_TRANSPORT_SDIO */
+
+int AthPSInitialize(struct ar3k_config_info *hdev);
+int ReadPSEvent(u8* Data);
+#endif /* __AR3KPSCONFIG_H */
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
new file mode 100644
index 00000000000..b99a11a9dd6
--- /dev/null
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
@@ -0,0 +1,969 @@
+/*
+ * Copyright (c) 2004-2010 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ * This file implements the Atheros PS and patch parser.
+ * It implements APIs to parse data buffer with patch and PS information and convert it to HCI commands.
+ *
+ *
+ *
+ * ar3kpsparser.c
+ *
+ *
+ *
+ * The software source and binaries included in this development package are
+ * licensed, not sold. You, or your company, received the package under one
+ * or more license agreements. The rights granted to you are specifically
+ * listed in these license agreement(s). All other rights remain with Atheros
+ * Communications, Inc., its subsidiaries, or the respective owner including
+ * those listed on the included copyright notices..  Distribution of any
+ * portion of this package must be in strict compliance with the license
+ * agreement(s) terms.
+ *
+ *
+ *
+ */
+
+
+#include "ar3kpsparser.h"
+
+#include <linux/ctype.h>
+#include <linux/kernel.h>
+
+#define BD_ADDR_SIZE            6
+#define WRITE_PATCH             8
+#define ENABLE_PATCH            11
+#define PS_RESET                2
+#define PS_WRITE                1
+#define PS_VERIFY_CRC           9
+#define CHANGE_BDADDR           15
+
+#define HCI_COMMAND_HEADER      7
+
+#define HCI_EVENT_SIZE          7
+
+#define WRITE_PATCH_COMMAND_STATUS_OFFSET 5
+
+#define PS_RAM_SIZE     2048
+
+#define RAM_PS_REGION           (1<<0)
+#define RAM_PATCH_REGION        (1<<1)
+#define RAMPS_MAX_PS_DATA_PER_TAG         20000
+#define MAX_RADIO_CFG_TABLE_SIZE  244
+#define RAMPS_MAX_PS_TAGS_PER_FILE        50
+
+#define PS_MAX_LEN                        500 
+#define LINE_SIZE_MAX                     (PS_MAX_LEN *2) 
+
+/* Constant values used by parser */
+#define BYTES_OF_PS_DATA_PER_LINE         16
+#define RAMPS_MAX_PS_DATA_PER_TAG         20000
+
+
+/* Number pf PS/Patch entries in an HCI packet */
+#define MAX_BYTE_LENGTH                   244
+
+#define SKIP_BLANKS(str) while (*str == ' ') str++
+
+enum MinBootFileFormatE
+{
+   MB_FILEFORMAT_RADIOTBL,
+   MB_FILEFORMAT_PATCH,
+   MB_FILEFORMAT_COEXCONFIG
+};
+
+enum RamPsSection
+{
+   RAM_PS_SECTION,
+   RAM_PATCH_SECTION,
+   RAM_DYN_MEM_SECTION
+};
+
+enum eType {
+   eHex,
+   edecimal
+};
+
+
+typedef struct tPsTagEntry
+{
+   u32 TagId;
+   u32 TagLen;
+   u8 *TagData;
+} tPsTagEntry, *tpPsTagEntry;
+
+typedef struct tRamPatch
+{
+   u16 Len;
+   u8 *Data;
+} tRamPatch, *ptRamPatch;
+
+
+
+struct st_ps_data_format {
+   enum eType   eDataType;
+   bool    bIsArray;
+};
+
+struct st_read_status {
+    unsigned uTagID;
+    unsigned uSection;
+    unsigned uLineCount;
+    unsigned uCharCount;
+    unsigned uByteCount;
+};
+
+
+/* Stores the number of PS Tags */
+static u32 Tag_Count = 0;
+
+/* Stores the number of patch commands */
+static u32 Patch_Count = 0;
+static u32 Total_tag_lenght = 0;
+bool BDADDR = false;
+u32 StartTagId;
+
+tPsTagEntry PsTagEntry[RAMPS_MAX_PS_TAGS_PER_FILE];
+tRamPatch   RamPatch[MAX_NUM_PATCH_ENTRY];
+
+
+int AthParseFilesUnified(u8 *srcbuffer,u32 srclen, int FileFormat);
+char AthReadChar(u8 *buffer, u32 len,u32 *pos);
+char *AthGetLine(char *buffer, int maxlen, u8 *srcbuffer,u32 len,u32 *pos);
+static int AthPSCreateHCICommand(u8 Opcode, u32 Param1,struct ps_cmd_packet *PSPatchPacket,u32 *index);
+
+/* Function to reads the next character from the input buffer */
+char AthReadChar(u8 *buffer, u32 len,u32 *pos)
+{
+    char Ch;
+    if(buffer == NULL || *pos >=len )
+    {
+        return '\0';
+    } else {
+        Ch = buffer[*pos];
+        (*pos)++;
+        return Ch;
+    }
+}
+/* PS parser helper function */
+unsigned int uGetInputDataFormat(char *pCharLine, struct st_ps_data_format *pstFormat)
+{
+    if(pCharLine[0] != '[') {
+        pstFormat->eDataType = eHex;
+        pstFormat->bIsArray = true;
+        return 0;
+    }
+    switch(pCharLine[1]) {
+        case 'H':
+        case 'h':
+        if(pCharLine[2]==':') {
+            if((pCharLine[3]== 'a') || (pCharLine[3]== 'A')) {
+                if(pCharLine[4] == ']') {
+                    pstFormat->eDataType = eHex;
+                    pstFormat->bIsArray = true;
+                    pCharLine += 5;
+                    return 0;
+                }
+                else {
+                       AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format\n")); //[H:A
+                    return 1;
+                }
+            }
+            if((pCharLine[3]== 'S') || (pCharLine[3]== 's')) {
+                if(pCharLine[4] == ']') {
+                    pstFormat->eDataType = eHex;
+                    pstFormat->bIsArray = false;
+                    pCharLine += 5;
+                    return 0;
+                }
+                else {
+                       AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format\n")); //[H:A
+                    return 1;
+                }
+            }
+            else if(pCharLine[3] == ']') {         //[H:]
+                pstFormat->eDataType = eHex;
+                pstFormat->bIsArray = true;
+                pCharLine += 4;
+                return 0;
+            }
+            else {                            //[H:
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format\n"));
+                return 1;                    
+            }
+        }
+        else if(pCharLine[2]==']') {    //[H]
+            pstFormat->eDataType = eHex;
+            pstFormat->bIsArray = true;
+            pCharLine += 3;
+            return 0;
+        }
+        else {                      //[H
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format\n"));
+            return 1;            
+        }
+        break;
+
+        case 'A':
+        case 'a':
+        if(pCharLine[2]==':') {
+            if((pCharLine[3]== 'h') || (pCharLine[3]== 'H')) {
+                if(pCharLine[4] == ']') {
+                    pstFormat->eDataType = eHex;
+                    pstFormat->bIsArray = true;
+                    pCharLine += 5;
+                    return 0;
+                }
+                else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format 1\n")); //[A:H
+                    return 1;
+                }
+             }
+            else if(pCharLine[3]== ']') {         //[A:]
+                pstFormat->eDataType = eHex;
+                pstFormat->bIsArray = true;
+                pCharLine += 4;
+                return 0;
+            }
+            else {                            //[A:
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format 2\n"));
+                return 1;                    
+            }
+        }
+        else if(pCharLine[2]==']') {    //[H]
+            pstFormat->eDataType = eHex;
+            pstFormat->bIsArray = true;
+            pCharLine += 3;
+            return 0;
+        }
+        else {                      //[H
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format 3\n"));
+            return 1;            
+        }
+        break;
+
+        case 'S':
+        case 's':
+        if(pCharLine[2]==':') {
+            if((pCharLine[3]== 'h') || (pCharLine[3]== 'H')) {
+                if(pCharLine[4] == ']') {
+                    pstFormat->eDataType = eHex;
+                    pstFormat->bIsArray = true;
+                    pCharLine += 5;
+                    return 0;
+                }
+                else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format 5\n")); //[A:H
+                    return 1;
+                }
+             }
+            else if(pCharLine[3]== ']') {         //[A:]
+                pstFormat->eDataType = eHex;
+                pstFormat->bIsArray = true;
+                pCharLine += 4;
+                return 0;
+            }
+            else {                            //[A:
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format 6\n"));
+                return 1;                    
+            }
+        }
+        else if(pCharLine[2]==']') {    //[H]
+            pstFormat->eDataType = eHex;
+            pstFormat->bIsArray = true;
+            pCharLine += 3;
+            return 0;
+        }
+        else {                      //[H
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format 7\n"));
+            return 1;            
+        }
+        break;
+    
+        default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Illegal Data format 8\n"));
+        return 1;
+    }
+}
+
+unsigned int uReadDataInSection(char *pCharLine, struct st_ps_data_format stPS_DataFormat)
+{
+    char *pTokenPtr = pCharLine;
+
+    if(pTokenPtr[0] == '[') {
+        while(pTokenPtr[0] != ']' && pTokenPtr[0] != '\0') {
+            pTokenPtr++;
+        }
+        if(pTokenPtr[0] == '\0') {
+            return (0x0FFF);
+        }
+        pTokenPtr++;
+            
+
+    }
+    if(stPS_DataFormat.eDataType == eHex) {
+        if(stPS_DataFormat.bIsArray == true) {
+            //Not implemented
+            return (0x0FFF);
+        }
+        else {
+            return (A_STRTOL(pTokenPtr, NULL, 16));
+        }
+    }
+    else {
+        //Not implemented
+        return (0x0FFF);
+    }
+}
+int AthParseFilesUnified(u8 *srcbuffer,u32 srclen, int FileFormat)
+{
+   char *Buffer;
+   char *pCharLine;
+   u8 TagCount;
+   u16 ByteCount;
+   u8 ParseSection=RAM_PS_SECTION;
+   u32 pos;
+
+
+
+   int uReadCount;
+   struct st_ps_data_format stPS_DataFormat;
+   struct st_read_status   stReadStatus = {0, 0, 0,0};
+   pos = 0;
+   Buffer = NULL;
+
+   if (srcbuffer == NULL || srclen == 0)
+   {
+      AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Could not open .\n"));
+      return A_ERROR;
+   }
+   TagCount = 0;
+   ByteCount = 0;
+   Buffer = A_MALLOC(LINE_SIZE_MAX + 1);
+   if(NULL == Buffer) {
+       return A_ERROR;
+   }
+   if (FileFormat == MB_FILEFORMAT_PATCH)
+   {
+      int LineRead = 0;
+      while((pCharLine = AthGetLine(Buffer, LINE_SIZE_MAX, srcbuffer,srclen,&pos)) != NULL)
+      {
+
+         SKIP_BLANKS(pCharLine);
+
+         // Comment line or empty line
+         if ((pCharLine[0] == '/') && (pCharLine[1] == '/'))
+         {
+            continue;
+         }
+         
+         if ((pCharLine[0] == '#')) { 
+             if (stReadStatus.uSection != 0)
+             {
+                 AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("error\n"));
+                 if(Buffer != NULL) {
+                     kfree(Buffer);
+                 }
+                 return A_ERROR;
+             }
+             else {
+                 stReadStatus.uSection = 1;
+                 continue;
+             }
+         }
+         if ((pCharLine[0] == '/') && (pCharLine[1] == '*'))
+         {
+            pCharLine+=2;
+            SKIP_BLANKS(pCharLine);
+
+            if(!strncmp(pCharLine,"PA",2)||!strncmp(pCharLine,"Pa",2)||!strncmp(pCharLine,"pa",2))
+                ParseSection=RAM_PATCH_SECTION;
+
+            if(!strncmp(pCharLine,"DY",2)||!strncmp(pCharLine,"Dy",2)||!strncmp(pCharLine,"dy",2))
+                ParseSection=RAM_DYN_MEM_SECTION;
+
+            if(!strncmp(pCharLine,"PS",2)||!strncmp(pCharLine,"Ps",2)||!strncmp(pCharLine,"ps",2))
+                ParseSection=RAM_PS_SECTION;
+
+            LineRead = 0;
+            stReadStatus.uSection = 0;
+
+            continue;
+    }
+         
+         switch(ParseSection)
+         {
+             case RAM_PS_SECTION:
+             {
+                 if (stReadStatus.uSection == 1)  //TagID
+                 {
+                    SKIP_BLANKS(pCharLine);
+                    if(uGetInputDataFormat(pCharLine, &stPS_DataFormat)) {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("uGetInputDataFormat fail\n"));
+                     if(Buffer != NULL) {
+                             kfree(Buffer);
+                     }
+                        return A_ERROR;
+                    }    
+                    //pCharLine +=5;
+                    PsTagEntry[TagCount].TagId = uReadDataInSection(pCharLine, stPS_DataFormat);                            
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" TAG ID %d \n",PsTagEntry[TagCount].TagId));
+
+                    //AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("tag # %x\n", PsTagEntry[TagCount].TagId);
+                    if (TagCount == 0)
+                    {
+                       StartTagId = PsTagEntry[TagCount].TagId;
+                    }
+                    stReadStatus.uSection = 2;
+                 }
+                 else if (stReadStatus.uSection == 2) //TagLength
+                 {
+            
+                    if(uGetInputDataFormat(pCharLine, &stPS_DataFormat)) {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("uGetInputDataFormat fail \n"));
+                     if(Buffer != NULL) {
+                             kfree(Buffer);
+                     }
+                        return A_ERROR;
+                    }
+                    //pCharLine +=5;
+                    ByteCount = uReadDataInSection(pCharLine, stPS_DataFormat);
+
+                    //AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("tag length %x\n", ByteCount));
+                    if (ByteCount > LINE_SIZE_MAX/2)
+                    {
+                     if(Buffer != NULL) {
+                             kfree(Buffer);
+                     }
+                       return A_ERROR;
+                    }
+                    PsTagEntry[TagCount].TagLen = ByteCount;
+                    PsTagEntry[TagCount].TagData = (u8 *)A_MALLOC(ByteCount);
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" TAG Length %d  Tag Index %d \n",PsTagEntry[TagCount].TagLen,TagCount));
+                    stReadStatus.uSection = 3;
+                    stReadStatus.uLineCount = 0;
+                 }
+                 else if( stReadStatus.uSection == 3) {  //Data
+
+                    if(stReadStatus.uLineCount == 0) {
+                        if(uGetInputDataFormat(pCharLine,&stPS_DataFormat)) {
+                            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("uGetInputDataFormat Fail\n"));
+                            if(Buffer != NULL) {
+                                 kfree(Buffer);
+                         }
+                            return A_ERROR;
+                        }
+                        //pCharLine +=5;
+                    }
+           SKIP_BLANKS(pCharLine);
+                    stReadStatus.uCharCount = 0;
+            if(pCharLine[stReadStatus.uCharCount] == '[') {
+            while(pCharLine[stReadStatus.uCharCount] != ']' && pCharLine[stReadStatus.uCharCount] != '\0' ) {
+                            stReadStatus.uCharCount++;
+            }
+            if(pCharLine[stReadStatus.uCharCount] == ']' ) {
+                            stReadStatus.uCharCount++;
+            } else {
+                            stReadStatus.uCharCount = 0;
+            }
+            }
+                    uReadCount = (ByteCount > BYTES_OF_PS_DATA_PER_LINE)? BYTES_OF_PS_DATA_PER_LINE: ByteCount;
+                    //AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" "));
+                    if((stPS_DataFormat.eDataType == eHex) && stPS_DataFormat.bIsArray == true) {
+                       while(uReadCount > 0) {
+                           PsTagEntry[TagCount].TagData[stReadStatus.uByteCount] =
+                                                     (u8)(hex_to_bin(pCharLine[stReadStatus.uCharCount]) << 4)
+                                                     | (u8)(hex_to_bin(pCharLine[stReadStatus.uCharCount + 1]));
+
+                           PsTagEntry[TagCount].TagData[stReadStatus.uByteCount+1] =
+                                                     (u8)(hex_to_bin(pCharLine[stReadStatus.uCharCount + 3]) << 4)
+                                                     | (u8)(hex_to_bin(pCharLine[stReadStatus.uCharCount + 4]));
+
+                           stReadStatus.uCharCount += 6; // read two bytes, plus a space;
+                           stReadStatus.uByteCount += 2;
+                           uReadCount -= 2;
+                       }
+                       if(ByteCount > BYTES_OF_PS_DATA_PER_LINE) {
+                              ByteCount -= BYTES_OF_PS_DATA_PER_LINE;
+                       }
+                       else {
+                          ByteCount = 0;
+                       }
+                    }
+                    else {
+                        //to be implemented
+                    }
+
+                    stReadStatus.uLineCount++;
+                    
+                    if(ByteCount == 0) {
+                        stReadStatus.uSection = 0;
+                        stReadStatus.uCharCount = 0;
+                        stReadStatus.uLineCount = 0;
+                        stReadStatus.uByteCount = 0;
+                    }
+                    else { 
+                        stReadStatus.uCharCount = 0;
+                    }
+
+                    if((stReadStatus.uSection == 0)&&(++TagCount == RAMPS_MAX_PS_TAGS_PER_FILE))
+                    {
+                       AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("\n Buffer over flow PS File too big!!!"));
+                       if(Buffer != NULL) {
+                           kfree(Buffer);
+                       }
+                       return A_ERROR;
+                       //Sleep (3000);
+                       //exit(1);
+                    }
+        
+                 }
+             }
+
+             break;
+             default:
+             {
+                   if(Buffer != NULL) {
+                       kfree(Buffer);
+                   }
+                   return A_ERROR;
+             }
+             break;
+         }
+         LineRead++;
+      }
+      Tag_Count = TagCount;
+      AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Number of Tags %d\n", Tag_Count));
+   }
+
+
+   if (TagCount > RAMPS_MAX_PS_TAGS_PER_FILE)
+   {
+
+      if(Buffer != NULL) {
+           kfree(Buffer);
+      }
+      return A_ERROR;
+   }
+
+   if(Buffer != NULL) {
+        kfree(Buffer);
+   }
+   return 0;
+
+}
+
+
+
+/********************/
+
+
+int GetNextTwoChar(u8 *srcbuffer,u32 len, u32 *pos, char *buffer)
+{
+    unsigned char ch;
+
+    ch = AthReadChar(srcbuffer,len,pos);
+    if(ch != '\0' && isxdigit(ch)) {
+        buffer[0] =  ch;
+    } else 
+    {
+        return A_ERROR;
+    }
+    ch = AthReadChar(srcbuffer,len,pos);
+    if(ch != '\0' && isxdigit(ch)) {
+        buffer[1] =  ch;
+    } else 
+    {
+        return A_ERROR;
+    }
+    return 0;
+}
+
+int AthDoParsePatch(u8 *patchbuffer, u32 patchlen)
+{
+
+    char Byte[3];
+    char Line[MAX_BYTE_LENGTH + 1];
+    int    ByteCount,ByteCount_Org;
+    int count;
+    int i,j,k;
+    int data;
+    u32 filepos;
+    Byte[2] = '\0';
+    j = 0;
+    filepos = 0;
+    Patch_Count = 0;
+
+    while(NULL != AthGetLine(Line,MAX_BYTE_LENGTH,patchbuffer,patchlen,&filepos)) {
+        if(strlen(Line) <= 1 || !isxdigit(Line[0])) {
+            continue;
+        } else {
+            break;
+        }
+    }
+    ByteCount = A_STRTOL(Line, NULL, 16);
+    ByteCount_Org = ByteCount;
+
+    while(ByteCount > MAX_BYTE_LENGTH){
+
+        /* Handle case when the number of patch buffer is more than the 20K */
+        if(MAX_NUM_PATCH_ENTRY == Patch_Count) {
+            for(i = 0; i < Patch_Count; i++) {
+                kfree(RamPatch[i].Data);
+            }
+            return A_ERROR;
+        }
+        RamPatch[Patch_Count].Len= MAX_BYTE_LENGTH;
+        RamPatch[Patch_Count].Data = (u8 *)A_MALLOC(MAX_BYTE_LENGTH);
+        Patch_Count ++;
+
+
+        ByteCount= ByteCount - MAX_BYTE_LENGTH;
+    }
+
+    RamPatch[Patch_Count].Len= (ByteCount & 0xFF);
+    if(ByteCount != 0) {
+        RamPatch[Patch_Count].Data = (u8 *)A_MALLOC(ByteCount);
+        Patch_Count ++;
+    }
+    count = 0;
+    while(ByteCount_Org > MAX_BYTE_LENGTH){
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" Index [%d]\n",j));
+        for (i = 0,k=0; i < MAX_BYTE_LENGTH*2; i += 2,k++,count +=2) {
+            if(GetNextTwoChar(patchbuffer,patchlen,&filepos,Byte) == A_ERROR) {
+                return A_ERROR;
+            }
+            data = A_STRTOUL(&Byte[0], NULL, 16);
+            RamPatch[j].Data[k] = (data & 0xFF);
+
+
+        }
+        j++;
+        ByteCount_Org = ByteCount_Org - MAX_BYTE_LENGTH;
+    }
+    if(j == 0){
+        j++;
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" Index [%d]\n",j));
+    for (k=0; k < ByteCount_Org; i += 2,k++,count+=2) {
+        if(GetNextTwoChar(patchbuffer,patchlen,&filepos,Byte) == A_ERROR) {
+            return A_ERROR;
+        }
+        data = A_STRTOUL(Byte, NULL, 16);
+        RamPatch[j].Data[k] = (data & 0xFF);
+
+
+    }
+    return 0;
+}
+
+
+/********************/
+int AthDoParsePS(u8 *srcbuffer, u32 srclen)
+{
+    int status;
+    int i;
+    bool BDADDR_Present = false;
+
+    Tag_Count = 0;
+
+    Total_tag_lenght = 0;
+    BDADDR = false;
+
+
+    status = A_ERROR;
+
+    if(NULL != srcbuffer && srclen != 0)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("File Open Operation Successful\n"));
+
+        status = AthParseFilesUnified(srcbuffer,srclen,MB_FILEFORMAT_PATCH); 
+    }
+    
+
+
+        if(Tag_Count == 0){
+                Total_tag_lenght = 10;
+
+        }
+        else{
+                for(i=0; i<Tag_Count; i++){
+                        if(PsTagEntry[i].TagId == 1){
+                                BDADDR_Present = true;
+                                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BD ADDR is present in Patch File \r\n"));
+
+                        }
+                        if(PsTagEntry[i].TagLen % 2 == 1){
+                                Total_tag_lenght = Total_tag_lenght + PsTagEntry[i].TagLen + 1;
+                        }
+                        else{
+                                Total_tag_lenght = Total_tag_lenght + PsTagEntry[i].TagLen;
+                        }
+
+                }
+        }
+
+        if(Tag_Count > 0 && !BDADDR_Present){
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BD ADDR is not present adding 10 extra bytes \r\n"));
+                Total_tag_lenght=Total_tag_lenght + 10;
+        }
+        Total_tag_lenght = Total_tag_lenght+ 10 + (Tag_Count*4);
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("** Total Length %d\n",Total_tag_lenght));
+
+
+    return status;
+}
+char *AthGetLine(char *buffer, int maxlen, u8 *srcbuffer,u32 len,u32 *pos)
+{
+
+    int count;
+    static short flag;
+    char CharRead;
+    count = 0;
+    flag = A_ERROR;
+
+    do
+    {
+        CharRead = AthReadChar(srcbuffer,len,pos);
+        if( CharRead == '\0' ) {
+            buffer[count+1] = '\0';
+            if(count == 0) {
+                return NULL;
+            }
+            else {
+                return buffer;
+            }
+        }
+
+        if(CharRead == 13) {
+        } else if(CharRead == 10) {
+            buffer[count] ='\0';  
+            flag = A_ERROR;
+            return buffer;
+        }else {
+            buffer[count++] = CharRead;
+        }
+
+    }
+    while(count < maxlen-1 && CharRead != '\0');
+    buffer[count] = '\0';
+
+    return buffer;
+}
+
+static void LoadHeader(u8 *HCI_PS_Command,u8 opcode,int length,int index){
+
+        HCI_PS_Command[0]= 0x0B;
+        HCI_PS_Command[1]= 0xFC;
+        HCI_PS_Command[2]= length + 4;
+        HCI_PS_Command[3]= opcode;
+        HCI_PS_Command[4]= (index & 0xFF);
+        HCI_PS_Command[5]= ((index>>8) & 0xFF);
+        HCI_PS_Command[6]= length;
+}
+
+/////////////////////////
+//
+int AthCreateCommandList(struct ps_cmd_packet **HciPacketList, u32 *numPackets)
+{
+
+    u8 count;
+    u32 NumcmdEntry = 0;
+
+    u32 Crc = 0;
+    *numPackets = 0;
+
+
+    if(Patch_Count > 0)
+            Crc |= RAM_PATCH_REGION;
+    if(Tag_Count > 0)
+            Crc |= RAM_PS_REGION;
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("PS Thread Started CRC %x Patch Count %d  Tag Count %d \n",Crc,Patch_Count,Tag_Count));
+    
+    if(Patch_Count || Tag_Count ){
+    NumcmdEntry+=(2 + Patch_Count + Tag_Count); /* CRC Packet + PS Reset Packet  + Patch List + PS List*/
+        if(Patch_Count > 0) {
+            NumcmdEntry++; /* Patch Enable Command */
+        }
+           AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Num Cmd Entries %d Size  %d  \r\n",NumcmdEntry,(u32)sizeof(struct ps_cmd_packet) * NumcmdEntry));
+        (*HciPacketList) = A_MALLOC(sizeof(struct ps_cmd_packet) * NumcmdEntry);
+    if(NULL == *HciPacketList) {
+               AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("memory allocation failed  \r\n"));
+        }
+        AthPSCreateHCICommand(PS_VERIFY_CRC,Crc,*HciPacketList,numPackets);
+        if(Patch_Count > 0){
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("*** Write Patch**** \r\n"));
+                AthPSCreateHCICommand(WRITE_PATCH,Patch_Count,*HciPacketList,numPackets);
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("*** Enable Patch**** \r\n"));
+                AthPSCreateHCICommand(ENABLE_PATCH,0,*HciPacketList,numPackets);
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("*** PS Reset**** %d[0x%x] \r\n",PS_RAM_SIZE,PS_RAM_SIZE));
+                AthPSCreateHCICommand(PS_RESET,PS_RAM_SIZE,*HciPacketList,numPackets);
+        if(Tag_Count > 0){
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("*** PS Write**** \r\n"));
+                AthPSCreateHCICommand(PS_WRITE,Tag_Count,*HciPacketList,numPackets);
+        }    
+    }
+    if(!BDADDR){
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BD ADDR not present \r\n"));
+    
+    }
+    for(count = 0; count < Patch_Count; count++) {
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Freeing Patch Buffer %d \r\n",count));
+        kfree(RamPatch[count].Data);
+    }
+
+    for(count = 0; count < Tag_Count; count++) {
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Freeing PS Buffer %d \r\n",count));
+        kfree(PsTagEntry[count].TagData);
+    }
+
+/* 
+ *  SDIO Transport uses synchronous mode of data transfer 
+ *  So, AthPSOperations() call returns only after receiving the 
+ *  command complete event.
+ */
+    return *numPackets;
+}
+
+
+////////////////////////
+
+/////////////
+static int AthPSCreateHCICommand(u8 Opcode, u32 Param1,struct ps_cmd_packet *PSPatchPacket,u32 *index)
+{
+    u8 *HCI_PS_Command;
+    u32 Length;
+    int i,j;
+    
+    switch(Opcode)
+    {
+    case WRITE_PATCH:
+
+
+         for(i=0;i< Param1;i++){
+
+             HCI_PS_Command = (u8 *) A_MALLOC(RamPatch[i].Len+HCI_COMMAND_HEADER);
+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Allocated Buffer Size %d\n",RamPatch[i].Len+HCI_COMMAND_HEADER));
+                 if(HCI_PS_Command == NULL){
+                     AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("MALLOC Failed\r\n"));
+                         return A_ERROR;
+                 }
+                 memset (HCI_PS_Command, 0, RamPatch[i].Len+HCI_COMMAND_HEADER);
+                 LoadHeader(HCI_PS_Command,Opcode,RamPatch[i].Len,i);
+                 for(j=0;j<RamPatch[i].Len;j++){
+                        HCI_PS_Command[HCI_COMMAND_HEADER+j]=RamPatch[i].Data[j];
+                 }
+                 PSPatchPacket[*index].Hcipacket = HCI_PS_Command;
+                 PSPatchPacket[*index].packetLen = RamPatch[i].Len+HCI_COMMAND_HEADER;
+                 (*index)++;
+
+          
+         }
+
+    break;
+
+    case ENABLE_PATCH:
+
+
+         Length = 0;
+         i= 0;
+         HCI_PS_Command = (u8 *) A_MALLOC(Length+HCI_COMMAND_HEADER);
+         if(HCI_PS_Command == NULL){
+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("MALLOC Failed\r\n"));
+            return A_ERROR;
+         }
+
+         memset (HCI_PS_Command, 0, Length+HCI_COMMAND_HEADER);
+         LoadHeader(HCI_PS_Command,Opcode,Length,i);
+         PSPatchPacket[*index].Hcipacket = HCI_PS_Command;
+         PSPatchPacket[*index].packetLen = Length+HCI_COMMAND_HEADER;
+         (*index)++;
+
+    break;
+
+    case PS_RESET:
+                        Length = 0x06;
+                        i=0;
+                        HCI_PS_Command = (u8 *) A_MALLOC(Length+HCI_COMMAND_HEADER);
+                        if(HCI_PS_Command == NULL){
+                                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("MALLOC Failed\r\n"));
+                                return A_ERROR;
+                        }
+                        memset (HCI_PS_Command, 0, Length+HCI_COMMAND_HEADER);
+                        LoadHeader(HCI_PS_Command,Opcode,Length,i);
+                        HCI_PS_Command[7]= 0x00;
+                        HCI_PS_Command[Length+HCI_COMMAND_HEADER -2]= (Param1 & 0xFF);
+                        HCI_PS_Command[Length+HCI_COMMAND_HEADER -1]= ((Param1 >>  8) & 0xFF);
+                 PSPatchPacket[*index].Hcipacket = HCI_PS_Command;
+                 PSPatchPacket[*index].packetLen = Length+HCI_COMMAND_HEADER;
+                 (*index)++;
+
+    break;
+
+    case PS_WRITE:
+                       for(i=0;i< Param1;i++){
+                                if(PsTagEntry[i].TagId ==1)
+                                        BDADDR = true;
+
+                                HCI_PS_Command = (u8 *) A_MALLOC(PsTagEntry[i].TagLen+HCI_COMMAND_HEADER);
+                                if(HCI_PS_Command == NULL){
+                                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("MALLOC Failed\r\n"));
+                                        return A_ERROR;
+                                }
+
+                                memset (HCI_PS_Command, 0, PsTagEntry[i].TagLen+HCI_COMMAND_HEADER);
+                                LoadHeader(HCI_PS_Command,Opcode,PsTagEntry[i].TagLen,PsTagEntry[i].TagId);
+
+                                for(j=0;j<PsTagEntry[i].TagLen;j++){
+                                        HCI_PS_Command[HCI_COMMAND_HEADER+j]=PsTagEntry[i].TagData[j];
+                                }
+
+                     PSPatchPacket[*index].Hcipacket = HCI_PS_Command;
+                     PSPatchPacket[*index].packetLen = PsTagEntry[i].TagLen+HCI_COMMAND_HEADER;
+                     (*index)++;
+
+                        }
+
+    break;
+
+
+    case PS_VERIFY_CRC:
+                        Length = 0x0;
+
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("VALUE of CRC:%d At index %d\r\n",Param1,*index));
+
+                        HCI_PS_Command = (u8 *) A_MALLOC(Length+HCI_COMMAND_HEADER);
+                        if(HCI_PS_Command == NULL){
+                                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("MALLOC Failed\r\n"));
+                                return A_ERROR;
+                        }
+                        memset (HCI_PS_Command, 0, Length+HCI_COMMAND_HEADER);
+                        LoadHeader(HCI_PS_Command,Opcode,Length,Param1);
+
+                 PSPatchPacket[*index].Hcipacket = HCI_PS_Command;
+                 PSPatchPacket[*index].packetLen = Length+HCI_COMMAND_HEADER;
+                 (*index)++;
+
+    break;
+
+    case CHANGE_BDADDR:
+    break;
+    }
+    return 0;
+}
+int AthFreeCommandList(struct ps_cmd_packet **HciPacketList, u32 numPackets)
+{
+    int i;
+    if(*HciPacketList == NULL) {
+        return A_ERROR;
+    }
+    for(i = 0; i < numPackets;i++) {
+        kfree((*HciPacketList)[i].Hcipacket);
+    }  
+    kfree(*HciPacketList);
+    return 0;
+}
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.h b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.h
new file mode 100644
index 00000000000..4e0f2f713a4
--- /dev/null
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.h
@@ -0,0 +1,113 @@
+//------------------------------------------------------------------------------
+//
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//
+// This file is the include file for Atheros PS and patch parser.
+// It implements APIs to parse data buffer with patch and PS information and convert it to HCI commands.
+//
+
+#ifndef __AR3KPSPARSER_H
+#define __AR3KPSPARSER_H
+
+
+
+
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include "athdefs.h"
+#ifdef HCI_TRANSPORT_SDIO
+#include "a_config.h"
+#include "a_osapi.h"
+#define ATH_MODULE_NAME misc
+#include "a_debug.h"
+#include "common_drv.h"
+#include "hci_transport_api.h"
+#include "ar3kconfig.h"
+#else
+#ifndef A_PRINTF
+#define A_PRINTF(args...)     printk(KERN_ALERT args)
+#endif /* A_PRINTF */
+#include "debug_linux.h"
+
+/* Helper data type declaration */
+
+#define ATH_DEBUG_ERR          (1 << 0)
+#define ATH_DEBUG_WARN         (1 << 1)
+#define ATH_DEBUG_INFO         (1 << 2)
+
+
+
+#define false   0
+#define true    1
+
+#ifndef A_MALLOC
+#define A_MALLOC(size)  kmalloc((size),GFP_KERNEL)
+#endif /* A_MALLOC */
+#endif /* HCI_TRANSPORT_UART */
+
+/* String manipulation APIs */
+#ifndef A_STRTOUL
+#define A_STRTOUL               simple_strtoul
+#endif  /* A_STRTOL */
+
+#ifndef A_STRTOL 
+#define A_STRTOL                simple_strtol
+#endif /* A_STRTOL */
+
+
+/* The maximum number of bytes possible in a patch entry */
+#define MAX_PATCH_SIZE                    20000
+
+/* Maximum HCI packets that will be formed from the Patch file */
+#define MAX_NUM_PATCH_ENTRY               (MAX_PATCH_SIZE/MAX_BYTE_LENGTH) + 1
+
+
+
+
+
+
+
+struct ps_cmd_packet
+{
+    u8 *Hcipacket;
+    int packetLen;
+};
+
+/* Parses a Patch information buffer and store it in global structure */
+int AthDoParsePatch(u8 *, u32 );
+
+/* parses a PS information buffer and stores it in a global structure */
+int AthDoParsePS(u8 *, u32 );
+
+/* 
+ *  Uses the output of Both AthDoParsePS and AthDoParsePatch APIs to form HCI command array with
+ *  all the PS and patch commands.
+ *  The list will have the below mentioned commands in order.
+ *  CRC command packet
+ *  Download patch command(s)
+ *  Enable patch Command
+ *  PS Reset Command
+ *  PS Tag Command(s)
+ *
+ */  
+int AthCreateCommandList(struct ps_cmd_packet **, u32 *);
+
+/* Cleanup the dynamically allicated HCI command list */
+int AthFreeCommandList(struct ps_cmd_packet **HciPacketList, u32 numPackets);
+#endif /* __AR3KPSPARSER_H */
diff --git a/drivers/staging/ath6kl/miscdrv/common_drv.c b/drivers/staging/ath6kl/miscdrv/common_drv.c
new file mode 100644
index 00000000000..1ce539aa019
--- /dev/null
+++ b/drivers/staging/ath6kl/miscdrv/common_drv.c
@@ -0,0 +1,910 @@
+//------------------------------------------------------------------------------
+// <copyright file="common_drv.c" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include "a_config.h"
+#include "athdefs.h"
+
+#include "hw/mbox_host_reg.h"
+#include "gpio_reg.h"
+#include "hw/rtc_reg.h"
+#include "hw/mbox_reg.h"
+#include "hw/apb_map.h"
+
+#include "a_osapi.h"
+#include "targaddrs.h"
+#include "hif.h"
+#include "htc_api.h"
+#include "wmi.h"
+#include "bmi.h"
+#include "bmi_msg.h"
+#include "common_drv.h"
+#define ATH_MODULE_NAME misc
+#include "a_debug.h"
+#include "ar6000_diag.h"
+
+static ATH_DEBUG_MODULE_DBG_INFO *g_pModuleInfoHead = NULL;
+static A_MUTEX_T                 g_ModuleListLock;
+static bool                    g_ModuleDebugInit = false;
+
+#ifdef ATH_DEBUG_MODULE
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(misc,
+                                 "misc",
+                                 "Common and misc APIs",
+                                 ATH_DEBUG_MASK_DEFAULTS,
+                                 0,
+                                 NULL);
+
+#endif
+
+#define HOST_INTEREST_ITEM_ADDRESS(target, item) \
+        ((((target) == TARGET_TYPE_AR6002) ? AR6002_HOST_INTEREST_ITEM_ADDRESS(item) : \
+         (((target) == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0)))
+
+
+#define AR6001_LOCAL_COUNT_ADDRESS 0x0c014080
+#define AR6002_LOCAL_COUNT_ADDRESS 0x00018080
+#define AR6003_LOCAL_COUNT_ADDRESS 0x00018080
+#define CPU_DBG_SEL_ADDRESS                      0x00000483
+#define CPU_DBG_ADDRESS                          0x00000484
+
+static u8 custDataAR6002[AR6002_CUST_DATA_SIZE];
+static u8 custDataAR6003[AR6003_CUST_DATA_SIZE];
+
+/* Compile the 4BYTE version of the window register setup routine,
+ * This mitigates host interconnect issues with non-4byte aligned bus requests, some
+ * interconnects use bus adapters that impose strict limitations.
+ * Since diag window access is not intended for performance critical operations, the 4byte mode should
+ * be satisfactory even though it generates 4X the bus activity. */
+
+#ifdef USE_4BYTE_REGISTER_ACCESS
+
+    /* set the window address register (using 4-byte register access ). */
+int ar6000_SetAddressWindowRegister(struct hif_device *hifDevice, u32 RegisterAddr, u32 Address)
+{
+    int status;
+    u8 addrValue[4];
+    s32 i;
+
+        /* write bytes 1,2,3 of the register to set the upper address bytes, the LSB is written
+         * last to initiate the access cycle */
+
+    for (i = 1; i <= 3; i++) {
+            /* fill the buffer with the address byte value we want to hit 4 times*/
+        addrValue[0] = ((u8 *)&Address)[i];
+        addrValue[1] = addrValue[0];
+        addrValue[2] = addrValue[0];
+        addrValue[3] = addrValue[0];
+
+            /* hit each byte of the register address with a 4-byte write operation to the same address,
+             * this is a harmless operation */
+        status = HIFReadWrite(hifDevice,
+                              RegisterAddr+i,
+                              addrValue,
+                              4,
+                              HIF_WR_SYNC_BYTE_FIX,
+                              NULL);
+        if (status) {
+            break;
+        }
+    }
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write initial bytes of 0x%x to window reg: 0x%X \n",
+            Address, RegisterAddr));
+        return status;
+    }
+
+        /* write the address register again, this time write the whole 4-byte value.
+         * The effect here is that the LSB write causes the cycle to start, the extra
+         * 3 byte write to bytes 1,2,3 has no effect since we are writing the same values again */
+    status = HIFReadWrite(hifDevice,
+                          RegisterAddr,
+                          (u8 *)(&Address),
+                          4,
+                          HIF_WR_SYNC_BYTE_INC,
+                          NULL);
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to window reg: 0x%X \n",
+            Address, RegisterAddr));
+        return status;
+    }
+
+    return 0;
+
+
+
+}
+
+
+#else
+
+    /* set the window address register */
+int ar6000_SetAddressWindowRegister(struct hif_device *hifDevice, u32 RegisterAddr, u32 Address)
+{
+    int status;
+
+        /* write bytes 1,2,3 of the register to set the upper address bytes, the LSB is written
+         * last to initiate the access cycle */
+    status = HIFReadWrite(hifDevice,
+                          RegisterAddr+1,  /* write upper 3 bytes */
+                          ((u8 *)(&Address))+1,
+                          sizeof(u32)-1,
+                          HIF_WR_SYNC_BYTE_INC,
+                          NULL);
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write initial bytes of 0x%x to window reg: 0x%X \n",
+             RegisterAddr, Address));
+        return status;
+    }
+
+        /* write the LSB of the register, this initiates the operation */
+    status = HIFReadWrite(hifDevice,
+                          RegisterAddr,
+                          (u8 *)(&Address),
+                          sizeof(u8),
+                          HIF_WR_SYNC_BYTE_INC,
+                          NULL);
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to window reg: 0x%X \n",
+            RegisterAddr, Address));
+        return status;
+    }
+
+    return 0;
+}
+
+#endif
+
+/*
+ * Read from the AR6000 through its diagnostic window.
+ * No cooperation from the Target is required for this.
+ */
+int
+ar6000_ReadRegDiag(struct hif_device *hifDevice, u32 *address, u32 *data)
+{
+    int status;
+
+        /* set window register to start read cycle */
+    status = ar6000_SetAddressWindowRegister(hifDevice,
+                                             WINDOW_READ_ADDR_ADDRESS,
+                                             *address);
+
+    if (status) {
+        return status;
+    }
+
+        /* read the data */
+    status = HIFReadWrite(hifDevice,
+                          WINDOW_DATA_ADDRESS,
+                          (u8 *)data,
+                          sizeof(u32),
+                          HIF_RD_SYNC_BYTE_INC,
+                          NULL);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot read from WINDOW_DATA_ADDRESS\n"));
+        return status;
+    }
+
+    return status;
+}
+
+
+/*
+ * Write to the AR6000 through its diagnostic window.
+ * No cooperation from the Target is required for this.
+ */
+int
+ar6000_WriteRegDiag(struct hif_device *hifDevice, u32 *address, u32 *data)
+{
+    int status;
+
+        /* set write data */
+    status = HIFReadWrite(hifDevice,
+                          WINDOW_DATA_ADDRESS,
+                          (u8 *)data,
+                          sizeof(u32),
+                          HIF_WR_SYNC_BYTE_INC,
+                          NULL);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to WINDOW_DATA_ADDRESS\n", *data));
+        return status;
+    }
+
+        /* set window register, which starts the write cycle */
+    return ar6000_SetAddressWindowRegister(hifDevice,
+                                           WINDOW_WRITE_ADDR_ADDRESS,
+                                           *address);
+    }
+
+int
+ar6000_ReadDataDiag(struct hif_device *hifDevice, u32 address,
+                    u8 *data, u32 length)
+{
+    u32 count;
+    int status = 0;
+
+    for (count = 0; count < length; count += 4, address += 4) {
+        if ((status = ar6000_ReadRegDiag(hifDevice, &address,
+                                         (u32 *)&data[count])) != 0)
+        {
+            break;
+        }
+    }
+
+    return status;
+}
+
+int
+ar6000_WriteDataDiag(struct hif_device *hifDevice, u32 address,
+                    u8 *data, u32 length)
+{
+    u32 count;
+    int status = 0;
+
+    for (count = 0; count < length; count += 4, address += 4) {
+        if ((status = ar6000_WriteRegDiag(hifDevice, &address,
+                                         (u32 *)&data[count])) != 0)
+        {
+            break;
+        }
+    }
+
+    return status;
+}
+
+int
+ar6k_ReadTargetRegister(struct hif_device *hifDevice, int regsel, u32 *regval)
+{
+    int status;
+    u8 vals[4];
+    u8 register_selection[4];
+
+    register_selection[0] = register_selection[1] = register_selection[2] = register_selection[3] = (regsel & 0xff);
+    status = HIFReadWrite(hifDevice,
+                          CPU_DBG_SEL_ADDRESS,
+                          register_selection,
+                          4,
+                          HIF_WR_SYNC_BYTE_FIX,
+                          NULL);
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write CPU_DBG_SEL (%d)\n", regsel));
+        return status;
+    }
+
+    status = HIFReadWrite(hifDevice,
+                          CPU_DBG_ADDRESS,
+                          (u8 *)vals,
+                          sizeof(vals),
+                          HIF_RD_SYNC_BYTE_INC,
+                          NULL);
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot read from CPU_DBG_ADDRESS\n"));
+        return status;
+    }
+
+    *regval = vals[0]<<0 | vals[1]<<8 | vals[2]<<16 | vals[3]<<24;
+
+    return status;
+}
+
+void
+ar6k_FetchTargetRegs(struct hif_device *hifDevice, u32 *targregs)
+{
+    int i;
+    u32 val;
+
+    for (i=0; i<AR6003_FETCH_TARG_REGS_COUNT; i++) {
+        val=0xffffffff;
+        (void)ar6k_ReadTargetRegister(hifDevice, i, &val);
+        targregs[i] = val;
+    }
+}
+
+#if 0
+static int
+_do_write_diag(struct hif_device *hifDevice, u32 addr, u32 value)
+{
+    int status;
+
+    status = ar6000_WriteRegDiag(hifDevice, &addr, &value);
+    if (status)
+    {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot force Target to execute ROM!\n"));
+    }
+
+    return status;
+}
+#endif
+
+
+/*
+ * Delay up to wait_msecs millisecs to allow Target to enter BMI phase,
+ * which is a good sign that it's alive and well.  This is used after
+ * explicitly forcing the Target to reset.
+ *
+ * The wait_msecs time should be sufficiently long to cover any reasonable
+ * boot-time delay.  For instance, AR6001 firmware allow one second for a
+ * low frequency crystal to settle before it calibrates the refclk frequency.
+ *
+ * TBD: Might want to add special handling for AR6K_OPTION_BMI_DISABLE.
+ */
+#if 0
+static int
+_delay_until_target_alive(struct hif_device *hifDevice, s32 wait_msecs, u32 TargetType)
+{
+    s32 actual_wait;
+    s32 i;
+    u32 address;
+
+    actual_wait = 0;
+
+    /* Hardcode the address of LOCAL_COUNT_ADDRESS based on the target type */
+    if (TargetType == TARGET_TYPE_AR6002) {
+       address = AR6002_LOCAL_COUNT_ADDRESS;
+    } else if (TargetType == TARGET_TYPE_AR6003) {
+       address = AR6003_LOCAL_COUNT_ADDRESS;
+    } else {
+       A_ASSERT(0);
+    }
+    address += 0x10;
+    for (i=0; actual_wait < wait_msecs; i++) {
+        u32 data;
+
+        A_MDELAY(100);
+        actual_wait += 100;
+
+        data = 0;
+        if (ar6000_ReadRegDiag(hifDevice, &address, &data) != 0) {
+            return A_ERROR;
+        }
+
+        if (data != 0) {
+            /* No need to wait longer -- we have a BMI credit */
+            return 0;
+        }
+    }
+    return A_ERROR; /* timed out */
+}
+#endif
+
+#define AR6001_RESET_CONTROL_ADDRESS 0x0C000000
+#define AR6002_RESET_CONTROL_ADDRESS 0x00004000
+#define AR6003_RESET_CONTROL_ADDRESS 0x00004000
+/* reset device */
+int ar6000_reset_device(struct hif_device *hifDevice, u32 TargetType, bool waitForCompletion, bool coldReset)
+{
+    int status = 0;
+    u32 address;
+    u32 data;
+
+    do {
+// Workaround BEGIN
+        // address = RESET_CONTROL_ADDRESS;
+        
+        if (coldReset) {
+            data = RESET_CONTROL_COLD_RST_MASK;
+        }
+        else {
+            data = RESET_CONTROL_MBOX_RST_MASK;
+        }
+
+          /* Hardcode the address of RESET_CONTROL_ADDRESS based on the target type */
+        if (TargetType == TARGET_TYPE_AR6002) {
+            address = AR6002_RESET_CONTROL_ADDRESS;
+        } else if (TargetType == TARGET_TYPE_AR6003) {
+            address = AR6003_RESET_CONTROL_ADDRESS;
+        } else {
+            A_ASSERT(0);
+        }
+
+
+        status = ar6000_WriteRegDiag(hifDevice, &address, &data);
+
+        if (status) {
+            break;
+        }
+
+        if (!waitForCompletion) {
+            break;
+        }
+
+#if 0
+        /* Up to 2 second delay to allow things to settle down */
+        (void)_delay_until_target_alive(hifDevice, 2000, TargetType);
+
+        /*
+         * Read back the RESET CAUSE register to ensure that the cold reset
+         * went through.
+         */
+
+        // address = RESET_CAUSE_ADDRESS;
+        /* Hardcode the address of RESET_CAUSE_ADDRESS based on the target type */
+        if (TargetType == TARGET_TYPE_AR6002) {
+            address = 0x000040C0;
+        } else if (TargetType == TARGET_TYPE_AR6003) {
+            address = 0x000040C0;
+        } else {
+            A_ASSERT(0);
+        }
+
+        data = 0;
+        status = ar6000_ReadRegDiag(hifDevice, &address, &data);
+
+        if (status) {
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Reset Cause readback: 0x%X \n",data));
+        data &= RESET_CAUSE_LAST_MASK;
+        if (data != 2) {
+            AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Unable to cold reset the target \n"));
+        }
+#endif
+// Workaroud END
+
+    } while (false);
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Failed to reset target \n"));
+    }
+
+    return 0;
+}
+
+/* This should be called in BMI phase after firmware is downloaded */
+void
+ar6000_copy_cust_data_from_target(struct hif_device *hifDevice, u32 TargetType)
+{
+    u32 eepHeaderAddr;
+    u8 AR6003CustDataShadow[AR6003_CUST_DATA_SIZE+4];
+    s32 i;
+
+    if (BMIReadMemory(hifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(TargetType, hi_board_data),
+            (u8 *)&eepHeaderAddr,
+            4)!= 0)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMIReadMemory for reading board data address failed \n"));
+        return;
+    }
+
+    if (TargetType == TARGET_TYPE_AR6003) {
+        eepHeaderAddr += 36;  /* AR6003 customer data section offset is 37 */
+
+        for (i=0; i<AR6003_CUST_DATA_SIZE+4; i+=4){
+            if (BMIReadSOCRegister(hifDevice, eepHeaderAddr, (u32 *)&AR6003CustDataShadow[i])!= 0) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMIReadSOCRegister () failed \n"));
+                return ;
+            }  
+            eepHeaderAddr +=4;
+        }
+
+        memcpy(custDataAR6003, AR6003CustDataShadow+1, AR6003_CUST_DATA_SIZE);
+    }
+
+    if (TargetType == TARGET_TYPE_AR6002) {
+        eepHeaderAddr += 64;  /* AR6002 customer data sectioin offset is 64 */
+
+        for (i=0; i<AR6002_CUST_DATA_SIZE; i+=4){
+            if (BMIReadSOCRegister(hifDevice, eepHeaderAddr, (u32 *)&custDataAR6002[i])!= 0) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMIReadSOCRegister () failed \n"));
+                return ;
+            }  
+            eepHeaderAddr +=4;
+        }
+    }
+
+    return;
+}
+
+/* This is the function to call when need to use the cust data */
+u8 *ar6000_get_cust_data_buffer(u32 TargetType)
+{
+    if (TargetType == TARGET_TYPE_AR6003)
+        return custDataAR6003;
+
+    if (TargetType == TARGET_TYPE_AR6002)
+        return custDataAR6002;
+
+    return NULL;
+}
+
+#define REG_DUMP_COUNT_AR6001   38  /* WORDs, derived from AR600x_regdump.h */
+#define REG_DUMP_COUNT_AR6002   60
+#define REG_DUMP_COUNT_AR6003   60
+#define REGISTER_DUMP_LEN_MAX   60
+#if REG_DUMP_COUNT_AR6001 > REGISTER_DUMP_LEN_MAX
+#error "REG_DUMP_COUNT_AR6001 too large"
+#endif
+#if REG_DUMP_COUNT_AR6002 > REGISTER_DUMP_LEN_MAX
+#error "REG_DUMP_COUNT_AR6002 too large"
+#endif
+#if REG_DUMP_COUNT_AR6003 > REGISTER_DUMP_LEN_MAX
+#error "REG_DUMP_COUNT_AR6003 too large"
+#endif
+
+
+void ar6000_dump_target_assert_info(struct hif_device *hifDevice, u32 TargetType)
+{
+    u32 address;
+    u32 regDumpArea = 0;
+    int status;
+    u32 regDumpValues[REGISTER_DUMP_LEN_MAX];
+    u32 regDumpCount = 0;
+    u32 i;
+
+    do {
+
+            /* the reg dump pointer is copied to the host interest area */
+        address = HOST_INTEREST_ITEM_ADDRESS(TargetType, hi_failure_state);
+        address = TARG_VTOP(TargetType, address);
+
+        if (TargetType == TARGET_TYPE_AR6002) {
+            regDumpCount = REG_DUMP_COUNT_AR6002;
+        } else  if (TargetType == TARGET_TYPE_AR6003) {
+            regDumpCount = REG_DUMP_COUNT_AR6003;
+        } else {
+            A_ASSERT(0);
+        }
+
+            /* read RAM location through diagnostic window */
+        status = ar6000_ReadRegDiag(hifDevice, &address, &regDumpArea);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Failed to get ptr to register dump area \n"));
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Location of register dump data: 0x%X \n",regDumpArea));
+
+        if (regDumpArea == 0) {
+                /* no reg dump */
+            break;
+        }
+
+        regDumpArea = TARG_VTOP(TargetType, regDumpArea);
+
+            /* fetch register dump data */
+        status = ar6000_ReadDataDiag(hifDevice,
+                                     regDumpArea,
+                                     (u8 *)&regDumpValues[0],
+                                     regDumpCount * (sizeof(u32)));
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Failed to get register dump \n"));
+            break;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Register Dump: \n"));
+
+        for (i = 0; i < regDumpCount; i++) {
+            //ATHR_DISPLAY_MSG (_T(" %d :  0x%8.8X \n"), i, regDumpValues[i]);
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" %d :  0x%8.8X \n",i, regDumpValues[i]));
+
+#ifdef UNDER_CE
+        /*
+         * For Every logPrintf() Open the File so that in case of Crashes
+         * We will have until the Last Message Flushed on to the File
+         * So use logPrintf Sparingly..!!
+         */
+        tgtassertPrintf (ATH_DEBUG_TRC," %d:  0x%8.8X \n",i, regDumpValues[i]);
+#endif
+        }
+
+    } while (false);
+
+}
+
+/* set HTC/Mbox operational parameters, this can only be called when the target is in the
+ * BMI phase */
+int ar6000_set_htc_params(struct hif_device *hifDevice,
+                               u32 TargetType,
+                               u32 MboxIsrYieldValue,
+                               u8 HtcControlBuffers)
+{
+    int status;
+    u32 blocksizes[HTC_MAILBOX_NUM_MAX];
+
+    do {
+            /* get the block sizes */
+        status = HIFConfigureDevice(hifDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
+                                    blocksizes, sizeof(blocksizes));
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_LOG_ERR,("Failed to get block size info from HIF layer...\n"));
+            break;
+        }
+            /* note: we actually get the block size for mailbox 1, for SDIO the block
+             * size on mailbox 0 is artificially set to 1 */
+            /* must be a power of 2 */
+        A_ASSERT((blocksizes[1] & (blocksizes[1] - 1)) == 0);
+
+        if (HtcControlBuffers != 0) {
+                /* set override for number of control buffers to use */
+            blocksizes[1] |=  ((u32)HtcControlBuffers) << 16;
+        }
+
+            /* set the host interest area for the block size */
+        status = BMIWriteMemory(hifDevice,
+                                HOST_INTEREST_ITEM_ADDRESS(TargetType, hi_mbox_io_block_sz),
+                                (u8 *)&blocksizes[1],
+                                4);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_LOG_ERR,("BMIWriteMemory for IO block size failed \n"));
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_LOG_INF,("Block Size Set: %d (target address:0x%X)\n",
+                blocksizes[1], HOST_INTEREST_ITEM_ADDRESS(TargetType, hi_mbox_io_block_sz)));
+
+        if (MboxIsrYieldValue != 0) {
+                /* set the host interest area for the mbox ISR yield limit */
+            status = BMIWriteMemory(hifDevice,
+                                    HOST_INTEREST_ITEM_ADDRESS(TargetType, hi_mbox_isr_yield_limit),
+                                    (u8 *)&MboxIsrYieldValue,
+                                    4);
+
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_LOG_ERR,("BMIWriteMemory for yield limit failed \n"));
+                break;
+            }
+        }
+
+    } while (false);
+
+    return status;
+}
+
+void DebugDumpBytes(u8 *buffer, u16 length, char *pDescription)
+{
+    char stream[60];
+    char byteOffsetStr[10];
+    u32 i;
+    u16 offset, count, byteOffset;
+
+    A_PRINTF("<---------Dumping %d Bytes : %s ------>\n", length, pDescription);
+
+    count = 0;
+    offset = 0;
+    byteOffset = 0;
+    for(i = 0; i < length; i++) {
+        A_SPRINTF(stream + offset, "%2.2X ", buffer[i]);
+        count ++;
+        offset += 3;
+
+        if(count == 16) {
+            count = 0;
+            offset = 0;
+            A_SPRINTF(byteOffsetStr,"%4.4X",byteOffset);
+            A_PRINTF("[%s]: %s\n", byteOffsetStr, stream);
+            A_MEMZERO(stream, 60);
+            byteOffset += 16;
+        }
+    }
+
+    if(offset != 0) {
+        A_SPRINTF(byteOffsetStr,"%4.4X",byteOffset);
+        A_PRINTF("[%s]: %s\n", byteOffsetStr, stream);
+    }
+
+    A_PRINTF("<------------------------------------------------->\n");
+}
+
+void a_dump_module_debug_info(ATH_DEBUG_MODULE_DBG_INFO *pInfo)
+{
+    int                         i;
+    struct ath_debug_mask_description *pDesc;
+
+    if (pInfo == NULL) {
+        return;
+    }
+
+    pDesc = pInfo->pMaskDescriptions;
+
+    A_PRINTF("========================================================\n\n");
+    A_PRINTF("Module Debug Info => Name   : %s    \n", pInfo->ModuleName);
+    A_PRINTF("                  => Descr. : %s \n", pInfo->ModuleDescription);
+    A_PRINTF("\n  Current mask    => 0x%8.8X \n", pInfo->CurrentMask);
+    A_PRINTF("\n  Avail. Debug Masks :\n\n");
+
+    for (i = 0; i < pInfo->MaxDescriptions; i++,pDesc++) {
+        A_PRINTF("                  => 0x%8.8X -- %s \n", pDesc->Mask, pDesc->Description);
+    }
+
+    if (0 == i) {
+        A_PRINTF("                  => * none defined * \n");
+    }
+
+    A_PRINTF("\n  Standard Debug Masks :\n\n");
+        /* print standard masks */
+    A_PRINTF("                  => 0x%8.8X -- Errors \n", ATH_DEBUG_ERR);
+    A_PRINTF("                  => 0x%8.8X -- Warnings \n", ATH_DEBUG_WARN);
+    A_PRINTF("                  => 0x%8.8X -- Informational \n", ATH_DEBUG_INFO);
+    A_PRINTF("                  => 0x%8.8X -- Tracing \n", ATH_DEBUG_TRC);
+    A_PRINTF("\n========================================================\n");
+
+}
+
+
+static ATH_DEBUG_MODULE_DBG_INFO *FindModule(char *module_name)
+{
+    ATH_DEBUG_MODULE_DBG_INFO *pInfo = g_pModuleInfoHead;
+
+    if (!g_ModuleDebugInit) {
+        return NULL;
+    }
+
+    while (pInfo != NULL) {
+            /* TODO: need to use something other than strlen */
+        if (memcmp(pInfo->ModuleName,module_name,strlen(module_name)) == 0) {
+            break;
+        }
+        pInfo = pInfo->pNext;
+    }
+
+    return pInfo;
+}
+
+
+void a_register_module_debug_info(ATH_DEBUG_MODULE_DBG_INFO *pInfo)
+{
+    if (!g_ModuleDebugInit) {
+        return;
+    }
+
+    A_MUTEX_LOCK(&g_ModuleListLock);
+
+    if (!(pInfo->Flags & ATH_DEBUG_INFO_FLAGS_REGISTERED)) {
+        if (g_pModuleInfoHead == NULL) {
+            g_pModuleInfoHead = pInfo;
+        } else {
+           pInfo->pNext = g_pModuleInfoHead;
+           g_pModuleInfoHead = pInfo;
+        }
+        pInfo->Flags |= ATH_DEBUG_INFO_FLAGS_REGISTERED;
+    }
+
+    A_MUTEX_UNLOCK(&g_ModuleListLock);
+}
+
+void a_dump_module_debug_info_by_name(char *module_name)
+{
+    ATH_DEBUG_MODULE_DBG_INFO *pInfo = g_pModuleInfoHead;
+
+    if (!g_ModuleDebugInit) {
+        return;
+    }
+
+    if (memcmp(module_name,"all",3) == 0) {
+            /* dump all */
+        while (pInfo != NULL) {
+            a_dump_module_debug_info(pInfo);
+            pInfo = pInfo->pNext;
+        }
+        return;
+    }
+
+    pInfo = FindModule(module_name);
+
+    if (pInfo != NULL) {
+         a_dump_module_debug_info(pInfo);
+    }
+
+}
+
+int a_get_module_mask(char *module_name, u32 *pMask)
+{
+    ATH_DEBUG_MODULE_DBG_INFO *pInfo = FindModule(module_name);
+
+    if (NULL == pInfo) {
+        return A_ERROR;
+    }
+
+    *pMask = pInfo->CurrentMask;
+    return 0;
+}
+
+int a_set_module_mask(char *module_name, u32 Mask)
+{
+    ATH_DEBUG_MODULE_DBG_INFO *pInfo = FindModule(module_name);
+
+    if (NULL == pInfo) {
+        return A_ERROR;
+    }
+
+    pInfo->CurrentMask = Mask;
+    A_PRINTF("Module %s,  new mask: 0x%8.8X \n",module_name,pInfo->CurrentMask);
+    return 0;
+}
+
+
+void a_module_debug_support_init(void)
+{
+    if (g_ModuleDebugInit) {
+        return;
+    }
+    A_MUTEX_INIT(&g_ModuleListLock);
+    g_pModuleInfoHead = NULL;
+    g_ModuleDebugInit = true;
+    A_REGISTER_MODULE_DEBUG_INFO(misc);
+}
+
+void a_module_debug_support_cleanup(void)
+{
+    ATH_DEBUG_MODULE_DBG_INFO *pInfo = g_pModuleInfoHead;
+    ATH_DEBUG_MODULE_DBG_INFO *pCur;
+
+    if (!g_ModuleDebugInit) {
+        return;
+    }
+
+    g_ModuleDebugInit = false;
+
+    A_MUTEX_LOCK(&g_ModuleListLock);
+
+    while (pInfo != NULL) {
+        pCur = pInfo;
+        pInfo = pInfo->pNext;
+        pCur->pNext = NULL;
+            /* clear registered flag */
+        pCur->Flags &= ~ATH_DEBUG_INFO_FLAGS_REGISTERED;
+    }
+
+    A_MUTEX_UNLOCK(&g_ModuleListLock);
+
+    A_MUTEX_DELETE(&g_ModuleListLock);
+    g_pModuleInfoHead = NULL;
+}
+
+    /* can only be called during bmi init stage */
+int ar6000_set_hci_bridge_flags(struct hif_device *hifDevice,
+                                     u32 TargetType,
+                                     u32 Flags)
+{
+    int status = 0;
+
+    do {
+
+        if (TargetType != TARGET_TYPE_AR6003) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("Target Type:%d, does not support HCI bridging! \n",
+                TargetType));
+            break;
+        }
+
+            /* set hci bridge flags */
+        status = BMIWriteMemory(hifDevice,
+                                HOST_INTEREST_ITEM_ADDRESS(TargetType, hi_hci_bridge_flags),
+                                (u8 *)&Flags,
+                                4);
+
+
+    } while (false);
+
+    return status;
+}
+
diff --git a/drivers/staging/ath6kl/miscdrv/credit_dist.c b/drivers/staging/ath6kl/miscdrv/credit_dist.c
new file mode 100644
index 00000000000..c777e98a756
--- /dev/null
+++ b/drivers/staging/ath6kl/miscdrv/credit_dist.c
@@ -0,0 +1,417 @@
+//------------------------------------------------------------------------------
+// <copyright file="credit_dist.c" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_osapi.h"
+#define ATH_MODULE_NAME misc
+#include "a_debug.h"
+#include "htc_api.h"
+#include "common_drv.h"
+
+/********* CREDIT DISTRIBUTION FUNCTIONS ******************************************/
+
+#define NO_VO_SERVICE 1 /* currently WMI only uses 3 data streams, so we leave VO service inactive */
+#define CONFIG_GIVE_LOW_PRIORITY_STREAMS_MIN_CREDITS 1
+
+#ifdef NO_VO_SERVICE
+#define DATA_SVCS_USED 3
+#else
+#define DATA_SVCS_USED 4
+#endif
+
+static void RedistributeCredits(struct common_credit_state_info *pCredInfo,
+                                struct htc_endpoint_credit_dist *pEPDistList);
+
+static void SeekCredits(struct common_credit_state_info *pCredInfo,
+                        struct htc_endpoint_credit_dist *pEPDistList);
+
+/* reduce an ep's credits back to a set limit */
+static INLINE void ReduceCredits(struct common_credit_state_info *pCredInfo,
+                                struct htc_endpoint_credit_dist  *pEpDist,
+                                int                       Limit)
+{
+    int credits;
+
+        /* set the new limit */
+    pEpDist->TxCreditsAssigned = Limit;
+
+    if (pEpDist->TxCredits <= Limit) {
+        return;
+    }
+
+        /* figure out how much to take away */
+    credits = pEpDist->TxCredits - Limit;
+        /* take them away */
+    pEpDist->TxCredits -= credits;
+    pCredInfo->CurrentFreeCredits += credits;
+}
+
+/* give an endpoint some credits from the free credit pool */
+#define GiveCredits(pCredInfo,pEpDist,credits)      \
+{                                                   \
+    (pEpDist)->TxCredits += (credits);              \
+    (pEpDist)->TxCreditsAssigned += (credits);      \
+    (pCredInfo)->CurrentFreeCredits -= (credits);   \
+}
+
+
+/* default credit init callback.
+ * This function is called in the context of HTCStart() to setup initial (application-specific)
+ * credit distributions */
+static void ar6000_credit_init(void                     *Context,
+                               struct htc_endpoint_credit_dist *pEPList,
+                               int                      TotalCredits)
+{
+    struct htc_endpoint_credit_dist *pCurEpDist;
+    int                      count;
+    struct common_credit_state_info *pCredInfo = (struct common_credit_state_info *)Context;
+
+    pCredInfo->CurrentFreeCredits = TotalCredits;
+    pCredInfo->TotalAvailableCredits = TotalCredits;
+
+    pCurEpDist = pEPList;
+
+        /* run through the list and initialize */
+    while (pCurEpDist != NULL) {
+
+            /* set minimums for each endpoint */
+        pCurEpDist->TxCreditsMin = pCurEpDist->TxCreditsPerMaxMsg;
+
+#ifdef CONFIG_GIVE_LOW_PRIORITY_STREAMS_MIN_CREDITS
+ 
+      if (TotalCredits > 4)
+      {
+          if ((pCurEpDist->ServiceID == WMI_DATA_BK_SVC)  || (pCurEpDist->ServiceID == WMI_DATA_BE_SVC)){
+                    /* assign at least min credits to lower than VO priority services */
+                GiveCredits(pCredInfo,pCurEpDist,pCurEpDist->TxCreditsMin);
+                    /* force active */
+                SET_EP_ACTIVE(pCurEpDist);
+          }
+      }
+ 
+#endif
+
+        if (pCurEpDist->ServiceID == WMI_CONTROL_SVC) {
+                /* give control service some credits */
+            GiveCredits(pCredInfo,pCurEpDist,pCurEpDist->TxCreditsMin);
+                /* control service is always marked active, it never goes inactive EVER */
+            SET_EP_ACTIVE(pCurEpDist);
+        } else if (pCurEpDist->ServiceID == WMI_DATA_BK_SVC) {
+                /* this is the lowest priority data endpoint, save this off for easy access */
+            pCredInfo->pLowestPriEpDist = pCurEpDist;
+        }
+
+        /* Streams have to be created (explicit | implicit)for all kinds
+         * of traffic. BE endpoints are also inactive in the beginning.
+         * When BE traffic starts it creates implicit streams that
+         * redistributes credits.
+         */
+
+        /* note, all other endpoints have minimums set but are initially given NO credits.
+         * Credits will be distributed as traffic activity demands */
+        pCurEpDist = pCurEpDist->pNext;
+    }
+
+    if (pCredInfo->CurrentFreeCredits <= 0) {
+        AR_DEBUG_PRINTF(ATH_LOG_INF, ("Not enough credits (%d) to do credit distributions \n", TotalCredits));
+        A_ASSERT(false);
+        return;
+    }
+
+        /* reset list */
+    pCurEpDist = pEPList;
+        /* now run through the list and set max operating credit limits for everyone */
+    while (pCurEpDist != NULL) {
+        if (pCurEpDist->ServiceID == WMI_CONTROL_SVC) {
+                /* control service max is just 1 max message */
+            pCurEpDist->TxCreditsNorm = pCurEpDist->TxCreditsPerMaxMsg;
+        } else {
+                /* for the remaining data endpoints, we assume that each TxCreditsPerMaxMsg are
+                 * the same.
+                 * We use a simple calculation here, we take the remaining credits and
+                 * determine how many max messages this can cover and then set each endpoint's
+                 * normal value equal to 3/4 this amount.
+                 * */
+            count = (pCredInfo->CurrentFreeCredits/pCurEpDist->TxCreditsPerMaxMsg) * pCurEpDist->TxCreditsPerMaxMsg;
+            count = (count * 3) >> 2;
+            count = max(count,pCurEpDist->TxCreditsPerMaxMsg);
+                /* set normal */
+            pCurEpDist->TxCreditsNorm = count;
+
+        }
+        pCurEpDist = pCurEpDist->pNext;
+    }
+
+}
+
+
+/* default credit distribution callback
+ * This callback is invoked whenever endpoints require credit distributions.
+ * A lock is held while this function is invoked, this function shall NOT block.
+ * The pEPDistList is a list of distribution structures in prioritized order as
+ * defined by the call to the HTCSetCreditDistribution() api.
+ *
+ */
+static void ar6000_credit_distribute(void                     *Context,
+                                     struct htc_endpoint_credit_dist *pEPDistList,
+                                     HTC_CREDIT_DIST_REASON   Reason)
+{
+    struct htc_endpoint_credit_dist *pCurEpDist;
+    struct common_credit_state_info *pCredInfo = (struct common_credit_state_info *)Context;
+
+    switch (Reason) {
+        case HTC_CREDIT_DIST_SEND_COMPLETE :
+            pCurEpDist = pEPDistList;
+                /* we are given the start of the endpoint distribution list.
+                 * There may be one or more endpoints to service.
+                 * Run through the list and distribute credits */
+            while (pCurEpDist != NULL) {
+
+                if (pCurEpDist->TxCreditsToDist > 0) {
+                        /* return the credits back to the endpoint */
+                    pCurEpDist->TxCredits += pCurEpDist->TxCreditsToDist;
+                        /* always zero out when we are done */
+                    pCurEpDist->TxCreditsToDist = 0;
+
+                    if (pCurEpDist->TxCredits > pCurEpDist->TxCreditsAssigned) {
+                            /* reduce to the assigned limit, previous credit reductions
+                             * could have caused the limit to change */
+                        ReduceCredits(pCredInfo, pCurEpDist, pCurEpDist->TxCreditsAssigned);
+                    }
+
+                    if (pCurEpDist->TxCredits > pCurEpDist->TxCreditsNorm) {
+                            /* oversubscribed endpoints need to reduce back to normal */
+                        ReduceCredits(pCredInfo, pCurEpDist, pCurEpDist->TxCreditsNorm);
+                    }
+                
+                    if (!IS_EP_ACTIVE(pCurEpDist)) {
+                            /* endpoint is inactive, now check for messages waiting for credits */
+                        if (pCurEpDist->TxQueueDepth == 0) {
+                                /* EP is inactive and there are no pending messages, 
+                                 * reduce credits back to zero to recover credits */
+                            ReduceCredits(pCredInfo, pCurEpDist, 0);
+                        }
+                    }
+                }
+
+                pCurEpDist = pCurEpDist->pNext;
+            }
+
+            break;
+
+        case HTC_CREDIT_DIST_ACTIVITY_CHANGE :
+            RedistributeCredits(pCredInfo,pEPDistList);
+            break;
+        case HTC_CREDIT_DIST_SEEK_CREDITS :
+            SeekCredits(pCredInfo,pEPDistList);
+            break;
+        case HTC_DUMP_CREDIT_STATE :
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Credit Distribution, total : %d, free : %d\n",
+                                                                        pCredInfo->TotalAvailableCredits, pCredInfo->CurrentFreeCredits));
+            break;
+        default:
+            break;
+
+    }
+
+        /* sanity checks done after each distribution action */
+    A_ASSERT(pCredInfo->CurrentFreeCredits <= pCredInfo->TotalAvailableCredits);
+    A_ASSERT(pCredInfo->CurrentFreeCredits >= 0);
+
+}
+
+/* redistribute credits based on activity change */
+static void RedistributeCredits(struct common_credit_state_info *pCredInfo,
+                                struct htc_endpoint_credit_dist *pEPDistList)
+{
+    struct htc_endpoint_credit_dist *pCurEpDist = pEPDistList;
+
+        /* walk through the list and remove credits from inactive endpoints */
+    while (pCurEpDist != NULL) {
+
+#ifdef CONFIG_GIVE_LOW_PRIORITY_STREAMS_MIN_CREDITS
+
+        if ((pCurEpDist->ServiceID == WMI_DATA_BK_SVC)  || (pCurEpDist->ServiceID == WMI_DATA_BE_SVC)) {
+              /* force low priority streams to always be active to retain their minimum credit distribution */
+             SET_EP_ACTIVE(pCurEpDist);
+        }
+#endif
+
+        if (pCurEpDist->ServiceID != WMI_CONTROL_SVC) {
+            if (!IS_EP_ACTIVE(pCurEpDist)) {
+                if (pCurEpDist->TxQueueDepth == 0) {
+                        /* EP is inactive and there are no pending messages, reduce credits back to zero */
+                    ReduceCredits(pCredInfo, pCurEpDist, 0);
+                } else {
+                        /* we cannot zero the credits assigned to this EP, but to keep
+                         * the credits available for these leftover packets, reduce to
+                         * a minimum */
+                    ReduceCredits(pCredInfo, pCurEpDist, pCurEpDist->TxCreditsMin);
+                }
+            }
+        }
+
+        /* NOTE in the active case, we do not need to do anything further,
+         * when an EP goes active and needs credits, HTC will call into
+         * our distribution function using a reason code of HTC_CREDIT_DIST_SEEK_CREDITS  */
+
+        pCurEpDist = pCurEpDist->pNext;
+    }
+
+}
+
+/* HTC has an endpoint that needs credits, pEPDist is the endpoint in question */
+static void SeekCredits(struct common_credit_state_info *pCredInfo,
+                        struct htc_endpoint_credit_dist *pEPDist)
+{
+    struct htc_endpoint_credit_dist *pCurEpDist;
+    int                      credits = 0;
+    int                      need;
+
+    do {
+
+        if (pEPDist->ServiceID == WMI_CONTROL_SVC) {
+                /* we never oversubscribe on the control service, this is not
+                 * a high performance path and the target never holds onto control
+                 * credits for too long */
+            break;
+        }
+
+#ifdef CONFIG_GIVE_LOW_PRIORITY_STREAMS_MIN_CREDITS
+        if (pEPDist->ServiceID == WMI_DATA_VI_SVC) {
+            if ((pEPDist->TxCreditsAssigned >= pEPDist->TxCreditsNorm)) {
+                 /* limit VI service from oversubscribing */
+                 break;
+            }
+        }
+ 
+        if (pEPDist->ServiceID == WMI_DATA_VO_SVC) {
+            if ((pEPDist->TxCreditsAssigned >= pEPDist->TxCreditsNorm)) {
+                 /* limit VO service from oversubscribing */
+                break;
+            }
+        }
+#else
+        if (pEPDist->ServiceID == WMI_DATA_VI_SVC) {
+            if ((pEPDist->TxCreditsAssigned >= pEPDist->TxCreditsNorm) ||
+                (pCredInfo->CurrentFreeCredits <= pEPDist->TxCreditsPerMaxMsg)) {
+                 /* limit VI service from oversubscribing */
+                 /* at least one free credit will not be used by VI */
+                 break;
+            }
+        }
+ 
+        if (pEPDist->ServiceID == WMI_DATA_VO_SVC) {
+            if ((pEPDist->TxCreditsAssigned >= pEPDist->TxCreditsNorm) ||
+                (pCredInfo->CurrentFreeCredits <= pEPDist->TxCreditsPerMaxMsg)) {
+                 /* limit VO service from oversubscribing */
+                 /* at least one free credit will not be used by VO */
+                break;
+            }
+        }
+#endif
+
+        /* for all other services, we follow a simple algorithm of
+         * 1. checking the free pool for credits
+         * 2. checking lower priority endpoints for credits to take */
+
+            /* give what we can */
+        credits = min(pCredInfo->CurrentFreeCredits,pEPDist->TxCreditsSeek);
+
+        if (credits >= pEPDist->TxCreditsSeek) {
+                /* we found some to fulfill the seek request */
+            break;
+        }
+
+        /* we don't have enough in the free pool, try taking away from lower priority services
+         *
+         * The rule for taking away credits:
+         *   1. Only take from lower priority endpoints
+         *   2. Only take what is allocated above the minimum (never starve an endpoint completely)
+         *   3. Only take what you need.
+         *
+         * */
+
+            /* starting at the lowest priority */
+        pCurEpDist = pCredInfo->pLowestPriEpDist;
+
+            /* work backwards until we hit the endpoint again */
+        while (pCurEpDist != pEPDist) {
+                /* calculate how many we need so far */
+            need = pEPDist->TxCreditsSeek - pCredInfo->CurrentFreeCredits;
+
+            if ((pCurEpDist->TxCreditsAssigned - need) >= pCurEpDist->TxCreditsMin) {
+                    /* the current one has been allocated more than it's minimum and it
+                     * has enough credits assigned above it's minimum to fulfill our need
+                     * try to take away just enough to fulfill our need */
+                ReduceCredits(pCredInfo,
+                              pCurEpDist,
+                              pCurEpDist->TxCreditsAssigned - need);
+
+                if (pCredInfo->CurrentFreeCredits >= pEPDist->TxCreditsSeek) {
+                        /* we have enough */
+                    break;
+                }
+            }
+
+            pCurEpDist = pCurEpDist->pPrev;
+        }
+
+            /* return what we can get */
+        credits = min(pCredInfo->CurrentFreeCredits,pEPDist->TxCreditsSeek);
+
+    } while (false);
+
+        /* did we find some credits? */
+    if (credits) {
+            /* give what we can */
+        GiveCredits(pCredInfo, pEPDist, credits);
+    }
+
+}
+
+/* initialize and setup credit distribution */
+int ar6000_setup_credit_dist(HTC_HANDLE HTCHandle, struct common_credit_state_info *pCredInfo)
+{
+    HTC_SERVICE_ID servicepriority[5];
+
+    A_MEMZERO(pCredInfo,sizeof(struct common_credit_state_info));
+
+    servicepriority[0] = WMI_CONTROL_SVC;  /* highest */
+    servicepriority[1] = WMI_DATA_VO_SVC;
+    servicepriority[2] = WMI_DATA_VI_SVC;
+    servicepriority[3] = WMI_DATA_BE_SVC;
+    servicepriority[4] = WMI_DATA_BK_SVC; /* lowest */
+
+        /* set callbacks and priority list */
+    HTCSetCreditDistribution(HTCHandle,
+                             pCredInfo,
+                             ar6000_credit_distribute,
+                             ar6000_credit_init,
+                             servicepriority,
+                             5);
+
+    return 0;
+}
+
diff --git a/drivers/staging/ath6kl/miscdrv/miscdrv.h b/drivers/staging/ath6kl/miscdrv/miscdrv.h
new file mode 100644
index 00000000000..41be5670db4
--- /dev/null
+++ b/drivers/staging/ath6kl/miscdrv/miscdrv.h
@@ -0,0 +1,42 @@
+//------------------------------------------------------------------------------
+// <copyright file="miscdrv.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _MISCDRV_H
+#define _MISCDRV_H
+
+
+#define HOST_INTEREST_ITEM_ADDRESS(target, item)    \
+   AR6002_HOST_INTEREST_ITEM_ADDRESS(item)
+
+u32 ar6kRev2Array[][128]   = {
+                                    {0xFFFF, 0xFFFF},      // No Patches
+                               };
+
+#define CFG_REV2_ITEMS                0     // no patches so far
+#define AR6K_RESET_ADDR               0x4000
+#define AR6K_RESET_VAL                0x100
+
+#define EEPROM_SZ                     768
+#define EEPROM_WAIT_LIMIT             4
+
+#endif
+
diff --git a/drivers/staging/ath6kl/os/linux/ar6000_drv.c b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
new file mode 100644
index 00000000000..32ee39ad00d
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
@@ -0,0 +1,6267 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+/*
+ * This driver is a pseudo ethernet driver to access the Atheros AR6000
+ * WLAN Device
+ */
+
+#include "ar6000_drv.h"
+#include "cfg80211.h"
+#include "htc.h"
+#include "wmi_filter_linux.h"
+#include "epping_test.h"
+#include "wlan_config.h"
+#include "ar3kconfig.h"
+#include "ar6k_pal.h"
+#include "AR6002/addrs.h"
+
+
+/* LINUX_HACK_FUDGE_FACTOR -- this is used to provide a workaround for linux behavior.  When
+ *  the meta data was added to the header it was found that linux did not correctly provide
+ *  enough headroom.  However when more headroom was requested beyond what was truly needed
+ *  Linux gave the requested headroom. Therefore to get the necessary headroom from Linux
+ *  the driver requests more than is needed by the amount = LINUX_HACK_FUDGE_FACTOR */
+#define LINUX_HACK_FUDGE_FACTOR 16
+#define BDATA_BDADDR_OFFSET     28
+
+u8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+u8 null_mac[] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+
+#ifdef DEBUG
+
+#define  ATH_DEBUG_DBG_LOG       ATH_DEBUG_MAKE_MODULE_MASK(0)
+#define  ATH_DEBUG_WLAN_CONNECT  ATH_DEBUG_MAKE_MODULE_MASK(1)
+#define  ATH_DEBUG_WLAN_SCAN     ATH_DEBUG_MAKE_MODULE_MASK(2)
+#define  ATH_DEBUG_WLAN_TX       ATH_DEBUG_MAKE_MODULE_MASK(3)
+#define  ATH_DEBUG_WLAN_RX       ATH_DEBUG_MAKE_MODULE_MASK(4)
+#define  ATH_DEBUG_HTC_RAW       ATH_DEBUG_MAKE_MODULE_MASK(5)
+#define  ATH_DEBUG_HCI_BRIDGE    ATH_DEBUG_MAKE_MODULE_MASK(6)
+
+static struct ath_debug_mask_description driver_debug_desc[] = {
+    { ATH_DEBUG_DBG_LOG      , "Target Debug Logs"},
+    { ATH_DEBUG_WLAN_CONNECT , "WLAN connect"},
+    { ATH_DEBUG_WLAN_SCAN    , "WLAN scan"},
+    { ATH_DEBUG_WLAN_TX      , "WLAN Tx"},
+    { ATH_DEBUG_WLAN_RX      , "WLAN Rx"},
+    { ATH_DEBUG_HTC_RAW      , "HTC Raw IF tracing"},
+    { ATH_DEBUG_HCI_BRIDGE   , "HCI Bridge Setup"},
+    { ATH_DEBUG_HCI_RECV     , "HCI Recv tracing"},
+    { ATH_DEBUG_HCI_DUMP     , "HCI Packet dumps"},
+};
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(driver,
+                                 "driver",
+                                 "Linux Driver Interface",
+                                 ATH_DEBUG_MASK_DEFAULTS | ATH_DEBUG_WLAN_SCAN |
+                                 ATH_DEBUG_HCI_BRIDGE,
+                                 ATH_DEBUG_DESCRIPTION_COUNT(driver_debug_desc),
+                                 driver_debug_desc);
+
+#endif
+
+
+#define IS_MAC_NULL(mac) (mac[0]==0 && mac[1]==0 && mac[2]==0 && mac[3]==0 && mac[4]==0 && mac[5]==0)
+#define IS_MAC_BCAST(mac) (*mac==0xff)
+
+#define DESCRIPTION "Driver to access the Atheros AR600x Device, version " __stringify(__VER_MAJOR_) "." __stringify(__VER_MINOR_) "." __stringify(__VER_PATCH_) "." __stringify(__BUILD_NUMBER_)
+
+MODULE_AUTHOR("Atheros Communications, Inc.");
+MODULE_DESCRIPTION(DESCRIPTION);
+MODULE_LICENSE("Dual BSD/GPL");
+
+#ifndef REORG_APTC_HEURISTICS
+#undef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+#endif /* REORG_APTC_HEURISTICS */
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+#define APTC_TRAFFIC_SAMPLING_INTERVAL     100  /* msec */
+#define APTC_UPPER_THROUGHPUT_THRESHOLD    3000 /* Kbps */
+#define APTC_LOWER_THROUGHPUT_THRESHOLD    2000 /* Kbps */
+
+typedef struct aptc_traffic_record {
+    bool timerScheduled;
+    struct timeval samplingTS;
+    unsigned long bytesReceived;
+    unsigned long bytesTransmitted;
+} APTC_TRAFFIC_RECORD;
+
+A_TIMER aptcTimer;
+APTC_TRAFFIC_RECORD aptcTR;
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+// callbacks registered by HCI transport driver
+struct hci_transport_callbacks ar6kHciTransCallbacks = { NULL };
+#endif
+
+unsigned int processDot11Hdr = 0;
+
+char ifname[IFNAMSIZ] = {0,};
+
+int wlaninitmode = WLAN_INIT_MODE_DEFAULT;
+static bool bypasswmi;
+unsigned int debuglevel = 0;
+int tspecCompliance = ATHEROS_COMPLIANCE;
+unsigned int busspeedlow = 0;
+unsigned int onebitmode = 0;
+unsigned int skipflash = 0;
+unsigned int wmitimeout = 2;
+unsigned int wlanNodeCaching = 1;
+unsigned int enableuartprint = ENABLEUARTPRINT_DEFAULT;
+unsigned int logWmiRawMsgs = 0;
+unsigned int enabletimerwar = 0;
+unsigned int num_device = 1;
+unsigned int regscanmode;
+unsigned int fwmode = 1;
+unsigned int mbox_yield_limit = 99;
+unsigned int enablerssicompensation = 0;
+int reduce_credit_dribble = 1 + HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF;
+int allow_trace_signal = 0;
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+unsigned int testmode =0;
+#endif
+
+unsigned int irqprocmode = HIF_DEVICE_IRQ_SYNC_ONLY;//HIF_DEVICE_IRQ_ASYNC_SYNC;
+unsigned int panic_on_assert = 1;
+unsigned int nohifscattersupport = NOHIFSCATTERSUPPORT_DEFAULT;
+
+unsigned int setuphci = SETUPHCI_DEFAULT;
+unsigned int loghci = 0;
+unsigned int setupbtdev = SETUPBTDEV_DEFAULT;
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+unsigned int ar3khcibaud = AR3KHCIBAUD_DEFAULT;
+unsigned int hciuartscale = HCIUARTSCALE_DEFAULT;
+unsigned int hciuartstep = HCIUARTSTEP_DEFAULT;
+#endif
+unsigned int csumOffload=0;
+unsigned int csumOffloadTest=0;
+unsigned int eppingtest=0;
+unsigned int mac_addr_method;
+unsigned int firmware_bridge;
+
+module_param_string(ifname, ifname, sizeof(ifname), 0644);
+module_param(wlaninitmode, int, 0644);
+module_param(bypasswmi, bool, 0644);
+module_param(debuglevel, uint, 0644);
+module_param(tspecCompliance, int, 0644);
+module_param(onebitmode, uint, 0644);
+module_param(busspeedlow, uint, 0644);
+module_param(skipflash, uint, 0644);
+module_param(wmitimeout, uint, 0644);
+module_param(wlanNodeCaching, uint, 0644);
+module_param(logWmiRawMsgs, uint, 0644);
+module_param(enableuartprint, uint, 0644);
+module_param(enabletimerwar, uint, 0644);
+module_param(fwmode, uint, 0644);
+module_param(mbox_yield_limit, uint, 0644);
+module_param(reduce_credit_dribble, int, 0644);
+module_param(allow_trace_signal, int, 0644);
+module_param(enablerssicompensation, uint, 0644);
+module_param(processDot11Hdr, uint, 0644);
+module_param(csumOffload, uint, 0644);
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+module_param(testmode, uint, 0644);
+#endif
+module_param(irqprocmode, uint, 0644);
+module_param(nohifscattersupport, uint, 0644);
+module_param(panic_on_assert, uint, 0644);
+module_param(setuphci, uint, 0644);
+module_param(loghci, uint, 0644);
+module_param(setupbtdev, uint, 0644);
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+module_param(ar3khcibaud, uint, 0644);
+module_param(hciuartscale, uint, 0644);
+module_param(hciuartstep, uint, 0644);
+#endif
+module_param(eppingtest, uint, 0644);
+
+/* in 2.6.10 and later this is now a pointer to a uint */
+unsigned int _mboxnum = HTC_MAILBOX_NUM_MAX;
+#define mboxnum &_mboxnum
+
+#ifdef DEBUG
+u32 g_dbg_flags = DBG_DEFAULTS;
+unsigned int debugflags = 0;
+int debugdriver = 0;
+unsigned int debughtc = 0;
+unsigned int debugbmi = 0;
+unsigned int debughif = 0;
+unsigned int txcreditsavailable[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int txcreditsconsumed[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int txcreditintrenable[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int txcreditintrenableaggregate[HTC_MAILBOX_NUM_MAX] = {0};
+module_param(debugflags, uint, 0644);
+module_param(debugdriver, int, 0644);
+module_param(debughtc, uint, 0644);
+module_param(debugbmi, uint, 0644);
+module_param(debughif, uint, 0644);
+module_param_array(txcreditsavailable, uint, mboxnum, 0644);
+module_param_array(txcreditsconsumed, uint, mboxnum, 0644);
+module_param_array(txcreditintrenable, uint, mboxnum, 0644);
+module_param_array(txcreditintrenableaggregate, uint, mboxnum, 0644);
+
+#endif /* DEBUG */
+
+unsigned int resetok = 1;
+unsigned int tx_attempt[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int tx_post[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int tx_complete[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int hifBusRequestNumMax = 40;
+unsigned int war23838_disabled = 0;
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+unsigned int enableAPTCHeuristics = 1;
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+module_param_array(tx_attempt, uint, mboxnum, 0644);
+module_param_array(tx_post, uint, mboxnum, 0644);
+module_param_array(tx_complete, uint, mboxnum, 0644);
+module_param(hifBusRequestNumMax, uint, 0644);
+module_param(war23838_disabled, uint, 0644);
+module_param(resetok, uint, 0644);
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+module_param(enableAPTCHeuristics, uint, 0644);
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+#ifdef BLOCK_TX_PATH_FLAG
+int blocktx = 0;
+module_param(blocktx, int, 0644);
+#endif /* BLOCK_TX_PATH_FLAG */
+
+typedef struct user_rssi_compensation_t {
+    u16 customerID;
+    union {
+    u16 a_enable;
+    u16 bg_enable;
+    u16 enable;
+    };
+    s16 bg_param_a;
+    s16 bg_param_b;
+    s16 a_param_a;
+    s16 a_param_b;
+    u32 reserved;
+} USER_RSSI_CPENSATION;
+
+static USER_RSSI_CPENSATION rssi_compensation_param;
+
+static s16 rssi_compensation_table[96];
+
+int reconnect_flag = 0;
+static ar6k_pal_config_t ar6k_pal_config_g;
+
+/* Function declarations */
+static int ar6000_init_module(void);
+static void ar6000_cleanup_module(void);
+
+int ar6000_init(struct net_device *dev);
+static int ar6000_open(struct net_device *dev);
+static int ar6000_close(struct net_device *dev);
+static void ar6000_init_control_info(struct ar6_softc *ar);
+static int ar6000_data_tx(struct sk_buff *skb, struct net_device *dev);
+
+void ar6000_destroy(struct net_device *dev, unsigned int unregister);
+static void ar6000_detect_error(unsigned long ptr);
+static void     ar6000_set_multicast_list(struct net_device *dev);
+static struct net_device_stats *ar6000_get_stats(struct net_device *dev);
+
+static void disconnect_timer_handler(unsigned long ptr);
+
+void read_rssi_compensation_param(struct ar6_softc *ar);
+
+/*
+ * HTC service connection handlers
+ */
+static int ar6000_avail_ev(void *context, void *hif_handle);
+
+static int ar6000_unavail_ev(void *context, void *hif_handle);
+
+int ar6000_configure_target(struct ar6_softc *ar);
+
+static void ar6000_target_failure(void *Instance, int Status);
+
+static void ar6000_rx(void *Context, struct htc_packet *pPacket);
+
+static void ar6000_rx_refill(void *Context,HTC_ENDPOINT_ID Endpoint);
+
+static void ar6000_tx_complete(void *Context, struct htc_packet_queue *pPackets);
+
+static HTC_SEND_FULL_ACTION ar6000_tx_queue_full(void *Context, struct htc_packet *pPacket);
+
+static void ar6000_alloc_netbufs(A_NETBUF_QUEUE_T *q, u16 num);
+static void ar6000_deliver_frames_to_nw_stack(void * dev, void *osbuf);
+//static void ar6000_deliver_frames_to_bt_stack(void * dev, void *osbuf);
+
+static struct htc_packet *ar6000_alloc_amsdu_rxbuf(void *Context, HTC_ENDPOINT_ID Endpoint, int Length);
+
+static void ar6000_refill_amsdu_rxbufs(struct ar6_softc *ar, int Count);
+
+static void ar6000_cleanup_amsdu_rxbufs(struct ar6_softc *ar);
+
+static ssize_t
+ar6000_sysfs_bmi_read(struct file *fp, struct kobject *kobj,
+                      struct bin_attribute *bin_attr,
+                      char *buf, loff_t pos, size_t count);
+
+static ssize_t
+ar6000_sysfs_bmi_write(struct file *fp, struct kobject *kobj,
+                       struct bin_attribute *bin_attr,
+                       char *buf, loff_t pos, size_t count);
+
+static int
+ar6000_sysfs_bmi_init(struct ar6_softc *ar);
+
+void  ar6k_cleanup_hci_pal(struct ar6_softc *ar);
+
+static void
+ar6000_sysfs_bmi_deinit(struct ar6_softc *ar);
+
+int
+ar6000_sysfs_bmi_get_config(struct ar6_softc *ar, u32 mode);
+
+/*
+ * Static variables
+ */
+
+struct net_device *ar6000_devices[MAX_AR6000];
+static int is_netdev_registered;
+DECLARE_WAIT_QUEUE_HEAD(arEvent);
+static void ar6000_cookie_init(struct ar6_softc *ar);
+static void ar6000_cookie_cleanup(struct ar6_softc *ar);
+static void ar6000_free_cookie(struct ar6_softc *ar, struct ar_cookie * cookie);
+static struct ar_cookie *ar6000_alloc_cookie(struct ar6_softc *ar);
+
+static int ar6000_reinstall_keys(struct ar6_softc *ar,u8 key_op_ctrl);
+
+#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+struct net_device *arApNetDev;
+#endif /* CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
+
+static struct ar_cookie s_ar_cookie_mem[MAX_COOKIE_NUM];
+
+#define HOST_INTEREST_ITEM_ADDRESS(ar, item) \
+        (((ar)->arTargetType == TARGET_TYPE_AR6002) ? AR6002_HOST_INTEREST_ITEM_ADDRESS(item) : \
+        (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0))
+
+
+static struct net_device_ops ar6000_netdev_ops = {
+    .ndo_init               = NULL,
+    .ndo_open               = ar6000_open,
+    .ndo_stop               = ar6000_close,
+    .ndo_get_stats          = ar6000_get_stats,
+    .ndo_start_xmit         = ar6000_data_tx,
+    .ndo_set_multicast_list = ar6000_set_multicast_list,
+};
+
+/* Debug log support */
+
+/*
+ * Flag to govern whether the debug logs should be parsed in the kernel
+ * or reported to the application.
+ */
+#define REPORT_DEBUG_LOGS_TO_APP
+
+int
+ar6000_set_host_app_area(struct ar6_softc *ar)
+{
+    u32 address, data;
+    struct host_app_area_s host_app_area;
+
+    /* Fetch the address of the host_app_area_s instance in the host interest area */
+    address = TARG_VTOP(ar->arTargetType, HOST_INTEREST_ITEM_ADDRESS(ar, hi_app_host_interest));
+    if (ar6000_ReadRegDiag(ar->arHifDevice, &address, &data) != 0) {
+        return A_ERROR;
+    }
+    address = TARG_VTOP(ar->arTargetType, data);
+    host_app_area.wmi_protocol_ver = WMI_PROTOCOL_VERSION;
+    if (ar6000_WriteDataDiag(ar->arHifDevice, address,
+                             (u8 *)&host_app_area,
+                             sizeof(struct host_app_area_s)) != 0)
+    {
+        return A_ERROR;
+    }
+
+    return 0;
+}
+
+u32 dbglog_get_debug_hdr_ptr(struct ar6_softc *ar)
+{
+    u32 param;
+    u32 address;
+    int status;
+
+    address = TARG_VTOP(ar->arTargetType, HOST_INTEREST_ITEM_ADDRESS(ar, hi_dbglog_hdr));
+    if ((status = ar6000_ReadDataDiag(ar->arHifDevice, address,
+                                      (u8 *)&param, 4)) != 0)
+    {
+        param = 0;
+    }
+
+    return param;
+}
+
+/*
+ * The dbglog module has been initialized. Its ok to access the relevant
+ * data stuctures over the diagnostic window.
+ */
+void
+ar6000_dbglog_init_done(struct ar6_softc *ar)
+{
+    ar->dbglog_init_done = true;
+}
+
+u32 dbglog_get_debug_fragment(s8 *datap, u32 len, u32 limit)
+{
+    s32 *buffer;
+    u32 count;
+    u32 numargs;
+    u32 length;
+    u32 fraglen;
+
+    count = fraglen = 0;
+    buffer = (s32 *)datap;
+    length = (limit >> 2);
+
+    if (len <= limit) {
+        fraglen = len;
+    } else {
+        while (count < length) {
+            numargs = DBGLOG_GET_NUMARGS(buffer[count]);
+            fraglen = (count << 2);
+            count += numargs + 1;
+        }
+    }
+
+    return fraglen;
+}
+
+void
+dbglog_parse_debug_logs(s8 *datap, u32 len)
+{
+    s32 *buffer;
+    u32 count;
+    u32 timestamp;
+    u32 debugid;
+    u32 moduleid;
+    u32 numargs;
+    u32 length;
+
+    count = 0;
+    buffer = (s32 *)datap;
+    length = (len >> 2);
+    while (count < length) {
+        debugid = DBGLOG_GET_DBGID(buffer[count]);
+        moduleid = DBGLOG_GET_MODULEID(buffer[count]);
+        numargs = DBGLOG_GET_NUMARGS(buffer[count]);
+        timestamp = DBGLOG_GET_TIMESTAMP(buffer[count]);
+        switch (numargs) {
+            case 0:
+            AR_DEBUG_PRINTF(ATH_DEBUG_DBG_LOG,("%d %d (%d)\n", moduleid, debugid, timestamp));
+            break;
+
+            case 1:
+            AR_DEBUG_PRINTF(ATH_DEBUG_DBG_LOG,("%d %d (%d): 0x%x\n", moduleid, debugid,
+                            timestamp, buffer[count+1]));
+            break;
+
+            case 2:
+            AR_DEBUG_PRINTF(ATH_DEBUG_DBG_LOG,("%d %d (%d): 0x%x, 0x%x\n", moduleid, debugid,
+                            timestamp, buffer[count+1], buffer[count+2]));
+            break;
+
+            default:
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid args: %d\n", numargs));
+        }
+        count += numargs + 1;
+    }
+}
+
+int
+ar6000_dbglog_get_debug_logs(struct ar6_softc *ar)
+{
+    u32 data[8]; /* Should be able to accommodate struct dbglog_buf_s */
+    u32 address;
+    u32 length;
+    u32 dropped;
+    u32 firstbuf;
+    u32 debug_hdr_ptr;
+
+    if (!ar->dbglog_init_done) return A_ERROR;
+
+
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    if (ar->dbgLogFetchInProgress) {
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        return A_EBUSY;
+    }
+
+        /* block out others */
+    ar->dbgLogFetchInProgress = true;
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    debug_hdr_ptr = dbglog_get_debug_hdr_ptr(ar);
+    printk("debug_hdr_ptr: 0x%x\n", debug_hdr_ptr);
+
+    /* Get the contents of the ring buffer */
+    if (debug_hdr_ptr) {
+        address = TARG_VTOP(ar->arTargetType, debug_hdr_ptr);
+        length = 4 /* sizeof(dbuf) */ + 4 /* sizeof(dropped) */;
+        A_MEMZERO(data, sizeof(data));
+        ar6000_ReadDataDiag(ar->arHifDevice, address, (u8 *)data, length);
+        address = TARG_VTOP(ar->arTargetType, data[0] /* dbuf */);
+        firstbuf = address;
+        dropped = data[1]; /* dropped */
+        length = 4 /* sizeof(next) */ + 4 /* sizeof(buffer) */ + 4 /* sizeof(bufsize) */ + 4 /* sizeof(length) */ + 4 /* sizeof(count) */ + 4 /* sizeof(free) */;
+        A_MEMZERO(data, sizeof(data));
+        ar6000_ReadDataDiag(ar->arHifDevice, address, (u8 *)&data, length);
+
+        do {
+            address = TARG_VTOP(ar->arTargetType, data[1] /* buffer*/);
+            length = data[3]; /* length */
+            if ((length) && (length <= data[2] /* bufsize*/)) {
+                /* Rewind the index if it is about to overrun the buffer */
+                if (ar->log_cnt > (DBGLOG_HOST_LOG_BUFFER_SIZE - length)) {
+                    ar->log_cnt = 0;
+                }
+                if(0 != ar6000_ReadDataDiag(ar->arHifDevice, address,
+                                    (u8 *)&ar->log_buffer[ar->log_cnt], length))
+                {
+                    break;
+                }
+                ar6000_dbglog_event(ar, dropped, (s8 *)&ar->log_buffer[ar->log_cnt], length);
+                ar->log_cnt += length;
+            } else {
+                AR_DEBUG_PRINTF(ATH_DEBUG_DBG_LOG,("Length: %d (Total size: %d)\n",
+                                data[3], data[2]));
+            }
+
+            address = TARG_VTOP(ar->arTargetType, data[0] /* next */);
+            length = 4 /* sizeof(next) */ + 4 /* sizeof(buffer) */ + 4 /* sizeof(bufsize) */ + 4 /* sizeof(length) */ + 4 /* sizeof(count) */ + 4 /* sizeof(free) */;
+            A_MEMZERO(data, sizeof(data));
+            if(0 != ar6000_ReadDataDiag(ar->arHifDevice, address,
+                                (u8 *)&data, length))
+            {
+                break;
+            }
+
+        } while (address != firstbuf);
+    }
+
+    ar->dbgLogFetchInProgress = false;
+
+    return 0;
+}
+
+void
+ar6000_dbglog_event(struct ar6_softc *ar, u32 dropped,
+                    s8 *buffer, u32 length)
+{
+#ifdef REPORT_DEBUG_LOGS_TO_APP
+    #define MAX_WIRELESS_EVENT_SIZE 252
+    /*
+     * Break it up into chunks of MAX_WIRELESS_EVENT_SIZE bytes of messages.
+     * There seems to be a limitation on the length of message that could be
+     * transmitted to the user app via this mechanism.
+     */
+    u32 send, sent;
+
+    sent = 0;
+    send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
+                                     MAX_WIRELESS_EVENT_SIZE);
+    while (send) {
+        sent += send;
+        send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
+                                         MAX_WIRELESS_EVENT_SIZE);
+    }
+#else
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Dropped logs: 0x%x\nDebug info length: %d\n",
+                    dropped, length));
+
+    /* Interpret the debug logs */
+    dbglog_parse_debug_logs((s8 *)buffer, length);
+#endif /* REPORT_DEBUG_LOGS_TO_APP */
+}
+
+
+static int __init
+ar6000_init_module(void)
+{
+    static int probed = 0;
+    int r;
+    OSDRV_CALLBACKS osdrvCallbacks;
+
+    a_module_debug_support_init();
+
+#ifdef DEBUG
+        /* check for debug mask overrides */
+    if (debughtc != 0) {
+        ATH_DEBUG_SET_DEBUG_MASK(htc,debughtc);
+    }
+    if (debugbmi != 0) {
+        ATH_DEBUG_SET_DEBUG_MASK(bmi,debugbmi);
+    }
+    if (debughif != 0) {
+        ATH_DEBUG_SET_DEBUG_MASK(hif,debughif);
+    }
+    if (debugdriver != 0) {
+        ATH_DEBUG_SET_DEBUG_MASK(driver,debugdriver);
+    }
+
+#endif
+
+    A_REGISTER_MODULE_DEBUG_INFO(driver);
+
+    A_MEMZERO(&osdrvCallbacks,sizeof(osdrvCallbacks));
+    osdrvCallbacks.deviceInsertedHandler = ar6000_avail_ev;
+    osdrvCallbacks.deviceRemovedHandler = ar6000_unavail_ev;
+#ifdef CONFIG_PM
+    osdrvCallbacks.deviceSuspendHandler = ar6000_suspend_ev;
+    osdrvCallbacks.deviceResumeHandler = ar6000_resume_ev;
+    osdrvCallbacks.devicePowerChangeHandler = ar6000_power_change_ev;
+#endif
+
+#ifdef DEBUG
+    /* Set the debug flags if specified at load time */
+    if(debugflags != 0)
+    {
+        g_dbg_flags = debugflags;
+    }
+#endif
+
+    if (probed) {
+        return -ENODEV;
+    }
+    probed++;
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+    memset(&aptcTR, 0, sizeof(APTC_TRAFFIC_RECORD));
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+    r = HIFInit(&osdrvCallbacks);
+    if (r)
+        return r;
+
+    return 0;
+}
+
+static void __exit
+ar6000_cleanup_module(void)
+{
+    int i = 0;
+    struct net_device *ar6000_netdev;
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+    /* Delete the Adaptive Power Control timer */
+    if (timer_pending(&aptcTimer)) {
+        del_timer_sync(&aptcTimer);
+    }
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+    for (i=0; i < MAX_AR6000; i++) {
+        if (ar6000_devices[i] != NULL) {
+            ar6000_netdev = ar6000_devices[i];
+            ar6000_devices[i] = NULL;
+            ar6000_destroy(ar6000_netdev, 1);
+        }
+    }
+
+    HIFShutDownDevice(NULL);
+
+    a_module_debug_support_cleanup();
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ar6000_cleanup: success\n"));
+}
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+void
+aptcTimerHandler(unsigned long arg)
+{
+    u32 numbytes;
+    u32 throughput;
+    struct ar6_softc *ar;
+    int status;
+
+    ar = (struct ar6_softc *)arg;
+    A_ASSERT(ar != NULL);
+    A_ASSERT(!timer_pending(&aptcTimer));
+
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    /* Get the number of bytes transferred */
+    numbytes = aptcTR.bytesTransmitted + aptcTR.bytesReceived;
+    aptcTR.bytesTransmitted = aptcTR.bytesReceived = 0;
+
+    /* Calculate and decide based on throughput thresholds */
+    throughput = ((numbytes * 8)/APTC_TRAFFIC_SAMPLING_INTERVAL); /* Kbps */
+    if (throughput < APTC_LOWER_THROUGHPUT_THRESHOLD) {
+        /* Enable Sleep and delete the timer */
+        A_ASSERT(ar->arWmiReady == true);
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        status = wmi_powermode_cmd(ar->arWmi, REC_POWER);
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        A_ASSERT(status == 0);
+        aptcTR.timerScheduled = false;
+    } else {
+        A_TIMEOUT_MS(&aptcTimer, APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
+    }
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+}
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+static void
+ar6000_alloc_netbufs(A_NETBUF_QUEUE_T *q, u16 num)
+{
+    void * osbuf;
+
+    while(num) {
+        if((osbuf = A_NETBUF_ALLOC(AR6000_BUFFER_SIZE))) {
+            A_NETBUF_ENQUEUE(q, osbuf);
+        } else {
+            break;
+        }
+        num--;
+    }
+
+    if(num) {
+        A_PRINTF("%s(), allocation of netbuf failed", __func__);
+    }
+}
+
+static struct bin_attribute bmi_attr = {
+    .attr = {.name = "bmi", .mode = 0600},
+    .read = ar6000_sysfs_bmi_read,
+    .write = ar6000_sysfs_bmi_write,
+};
+
+static ssize_t
+ar6000_sysfs_bmi_read(struct file *fp, struct kobject *kobj,
+                      struct bin_attribute *bin_attr,
+                      char *buf, loff_t pos, size_t count)
+{
+    int index;
+    struct ar6_softc *ar;
+    struct hif_device_os_device_info   *osDevInfo;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Read %d bytes\n", (u32)count));
+    for (index=0; index < MAX_AR6000; index++) {
+        ar = (struct ar6_softc *)ar6k_priv(ar6000_devices[index]);
+        osDevInfo = &ar->osDevInfo;
+        if (kobj == (&(((struct device *)osDevInfo->pOSDevice)->kobj))) {
+            break;
+        }
+    }
+
+    if (index == MAX_AR6000) return 0;
+
+    if ((BMIRawRead(ar->arHifDevice, (u8*)buf, count, true)) != 0) {
+        return 0;
+    }
+
+    return count;
+}
+
+static ssize_t
+ar6000_sysfs_bmi_write(struct file *fp, struct kobject *kobj,
+                       struct bin_attribute *bin_attr,
+                       char *buf, loff_t pos, size_t count)
+{
+    int index;
+    struct ar6_softc *ar;
+    struct hif_device_os_device_info   *osDevInfo;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Write %d bytes\n", (u32)count));
+    for (index=0; index < MAX_AR6000; index++) {
+        ar = (struct ar6_softc *)ar6k_priv(ar6000_devices[index]);
+        osDevInfo = &ar->osDevInfo;
+        if (kobj == (&(((struct device *)osDevInfo->pOSDevice)->kobj))) {
+            break;
+        }
+    }
+
+    if (index == MAX_AR6000) return 0;
+
+    if ((BMIRawWrite(ar->arHifDevice, (u8*)buf, count)) != 0) {
+        return 0;
+    }
+
+    return count;
+}
+
+static int
+ar6000_sysfs_bmi_init(struct ar6_softc *ar)
+{
+    int status;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Creating sysfs entry\n"));
+    A_MEMZERO(&ar->osDevInfo, sizeof(struct hif_device_os_device_info));
+
+    /* Get the underlying OS device */
+    status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_GET_OS_DEVICE,
+                                &ar->osDevInfo,
+                                sizeof(struct hif_device_os_device_info));
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI: Failed to get OS device info from HIF\n"));
+        return A_ERROR;
+    }
+
+    /* Create a bmi entry in the sysfs filesystem */
+    if ((sysfs_create_bin_file(&(((struct device *)ar->osDevInfo.pOSDevice)->kobj), &bmi_attr)) < 0)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMI: Failed to create entry for bmi in sysfs filesystem\n"));
+        return A_ERROR;
+    }
+
+    return 0;
+}
+
+static void
+ar6000_sysfs_bmi_deinit(struct ar6_softc *ar)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Deleting sysfs entry\n"));
+
+    sysfs_remove_bin_file(&(((struct device *)ar->osDevInfo.pOSDevice)->kobj), &bmi_attr);
+}
+
+#define bmifn(fn) do { \
+    if ((fn) < 0) { \
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI operation failed: %d\n", __LINE__)); \
+        return A_ERROR; \
+    } \
+} while(0)
+
+#ifdef SOFTMAC_FILE_USED
+#define AR6002_MAC_ADDRESS_OFFSET     0x0A
+#define AR6003_MAC_ADDRESS_OFFSET     0x16
+static
+void calculate_crc(u32 TargetType, u8 *eeprom_data)
+{
+    u16 *ptr_crc;
+    u16 *ptr16_eeprom;
+    u16 checksum;
+    u32 i;
+    u32 eeprom_size;
+
+    if (TargetType == TARGET_TYPE_AR6001)
+    {
+        eeprom_size = 512;
+        ptr_crc = (u16 *)eeprom_data;
+    }
+    else if (TargetType == TARGET_TYPE_AR6003)
+    {
+        eeprom_size = 1024;
+        ptr_crc = (u16 *)((u8 *)eeprom_data + 0x04);
+    }
+    else
+    {
+        eeprom_size = 768;
+        ptr_crc = (u16 *)((u8 *)eeprom_data + 0x04);
+    }
+
+
+    // Clear the crc
+    *ptr_crc = 0;
+
+    // Recalculate new CRC
+    checksum = 0;
+    ptr16_eeprom = (u16 *)eeprom_data;
+    for (i = 0;i < eeprom_size; i += 2)
+    {
+        checksum = checksum ^ (*ptr16_eeprom);
+        ptr16_eeprom++;
+    }
+    checksum = 0xFFFF ^ checksum;
+    *ptr_crc = checksum;
+}
+
+static void 
+ar6000_softmac_update(struct ar6_softc *ar, u8 *eeprom_data, size_t size)
+{
+    const char *source = "random generated";
+    const struct firmware *softmac_entry;
+    u8 *ptr_mac;
+    switch (ar->arTargetType) {
+    case TARGET_TYPE_AR6002:
+        ptr_mac = (u8 *)((u8 *)eeprom_data + AR6002_MAC_ADDRESS_OFFSET);
+        break;
+    case TARGET_TYPE_AR6003:
+        ptr_mac = (u8 *)((u8 *)eeprom_data + AR6003_MAC_ADDRESS_OFFSET);
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Invalid Target Type\n"));
+        return;
+    }
+        printk(KERN_DEBUG "MAC from EEPROM %pM\n", ptr_mac);
+
+    /* create a random MAC in case we cannot read file from system */
+    ptr_mac[0] = 0;
+    ptr_mac[1] = 0x03;
+    ptr_mac[2] = 0x7F;
+    ptr_mac[3] = random32() & 0xff; 
+    ptr_mac[4] = random32() & 0xff; 
+    ptr_mac[5] = random32() & 0xff; 
+    if ((A_REQUEST_FIRMWARE(&softmac_entry, "softmac", ((struct device *)ar->osDevInfo.pOSDevice))) == 0)
+    {
+        char *macbuf = A_MALLOC_NOWAIT(softmac_entry->size+1);
+        if (macbuf) {            
+            unsigned int softmac[6];
+            memcpy(macbuf, softmac_entry->data, softmac_entry->size);
+            macbuf[softmac_entry->size] = '\0';
+            if (sscanf(macbuf, "%02x:%02x:%02x:%02x:%02x:%02x", 
+                        &softmac[0], &softmac[1], &softmac[2],
+                        &softmac[3], &softmac[4], &softmac[5])==6) {
+                int i;
+                for (i=0; i<6; ++i) {
+                    ptr_mac[i] = softmac[i] & 0xff;
+                }
+                source = "softmac file";
+            }
+            kfree(macbuf);
+        }
+        A_RELEASE_FIRMWARE(softmac_entry);
+    }
+        printk(KERN_DEBUG "MAC from %s %pM\n", source, ptr_mac);
+   calculate_crc(ar->arTargetType, eeprom_data);
+}
+#endif /* SOFTMAC_FILE_USED */
+
+static int
+ar6000_transfer_bin_file(struct ar6_softc *ar, AR6K_BIN_FILE file, u32 address, bool compressed)
+{
+    int status;
+    const char *filename;
+    const struct firmware *fw_entry;
+    u32 fw_entry_size;
+    u8 **buf;
+    size_t *buf_len;
+
+    switch (file) {
+        case AR6K_OTP_FILE:
+                buf = &ar->fw_otp;
+                buf_len = &ar->fw_otp_len;
+            if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                filename = AR6003_REV1_OTP_FILE;
+            } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                filename = AR6003_REV2_OTP_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_OTP_FILE;
+            } else {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+                return A_ERROR;
+            }
+            break;
+
+        case AR6K_FIRMWARE_FILE:
+                buf = &ar->fw;
+                buf_len = &ar->fw_len;
+            if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                filename = AR6003_REV1_FIRMWARE_FILE;
+            } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                filename = AR6003_REV2_FIRMWARE_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_FIRMWARE_FILE;
+            } else {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+                return A_ERROR;
+            }
+            
+            if (eppingtest) {
+                bypasswmi = true;
+                if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                    filename = AR6003_REV1_EPPING_FIRMWARE_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                    filename = AR6003_REV2_EPPING_FIRMWARE_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_EPPING_FIRMWARE_FILE;
+                } else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("eppingtest : unsupported firmware revision: %d\n", 
+                        ar->arVersion.target_ver));
+                    return A_ERROR;
+                }
+                compressed = false;
+            }
+            
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+            if(testmode) {
+                if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                    filename = AR6003_REV1_TCMD_FIRMWARE_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                    filename = AR6003_REV2_TCMD_FIRMWARE_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_TCMD_FIRMWARE_FILE;
+                } else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+                    return A_ERROR;
+                }
+                compressed = false;
+            }
+#endif 
+#ifdef HTC_RAW_INTERFACE
+            if (!eppingtest && bypasswmi) {
+                if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                    filename = AR6003_REV1_ART_FIRMWARE_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                    filename = AR6003_REV2_ART_FIRMWARE_FILE;
+                } else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+                    return A_ERROR;
+                }
+                compressed = false;
+            }
+#endif 
+            break;
+
+        case AR6K_PATCH_FILE:
+                buf = &ar->fw_patch;
+                buf_len = &ar->fw_patch_len;
+            if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                filename = AR6003_REV1_PATCH_FILE;
+            } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                filename = AR6003_REV2_PATCH_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_PATCH_FILE;
+            } else {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+                return A_ERROR;
+            }
+            break;
+
+        case AR6K_BOARD_DATA_FILE:
+                buf = &ar->fw_data;
+                buf_len = &ar->fw_data_len;
+            if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                filename = AR6003_REV1_BOARD_DATA_FILE;
+            } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                filename = AR6003_REV2_BOARD_DATA_FILE;
+                } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                        filename = AR6003_REV3_BOARD_DATA_FILE;
+            } else {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+                return A_ERROR;
+            }
+            break;
+
+        default:
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown file type: %d\n", file));
+            return A_ERROR;
+    }
+
+    if (*buf == NULL) {
+            if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
+                    return A_ENOENT;
+            }
+
+            *buf = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+            *buf_len = fw_entry->size;
+            A_RELEASE_FIRMWARE(fw_entry);
+    }
+
+#ifdef SOFTMAC_FILE_USED
+    if (file==AR6K_BOARD_DATA_FILE && *buf_len) {
+        ar6000_softmac_update(ar, *buf, *buf_len);
+    }
+#endif 
+
+
+    fw_entry_size = *buf_len;
+
+    /* Load extended board data for AR6003 */
+    if ((file==AR6K_BOARD_DATA_FILE) && *buf) {
+        u32 board_ext_address;
+        u32 board_ext_data_size;
+        u32 board_data_size;
+
+        board_ext_data_size = (((ar)->arTargetType == TARGET_TYPE_AR6002) ? AR6002_BOARD_EXT_DATA_SZ : \
+                               (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_BOARD_EXT_DATA_SZ : 0));
+
+        board_data_size = (((ar)->arTargetType == TARGET_TYPE_AR6002) ? AR6002_BOARD_DATA_SZ : \
+                          (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_BOARD_DATA_SZ : 0));
+        
+        /* Determine where in Target RAM to write Board Data */
+        bmifn(BMIReadMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_ext_data), (u8 *)&board_ext_address, 4));
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("Board extended Data download address: 0x%x\n", board_ext_address));
+
+        /* check whether the target has allocated memory for extended board data and file contains extended board data */
+        if ((board_ext_address) && (*buf_len == (board_data_size + board_ext_data_size))) {
+            u32 param;
+
+            status = BMIWriteMemory(ar->arHifDevice, board_ext_address, (u8 *)(*buf + board_data_size), board_ext_data_size);
+
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI operation failed: %d\n", __LINE__));
+                return A_ERROR;
+            }
+
+            /* Record the fact that extended board Data IS initialized */
+            param = (board_ext_data_size << 16) | 1;
+            bmifn(BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_ext_data_config),
+                                       (unsigned char *)&param, 4));
+        }
+        fw_entry_size = board_data_size;
+    }
+
+    if (compressed) {
+        status = BMIFastDownload(ar->arHifDevice, address, *buf, fw_entry_size);
+    } else {
+        status = BMIWriteMemory(ar->arHifDevice, address, *buf, fw_entry_size);
+    }
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI operation failed: %d\n", __LINE__));
+        return A_ERROR;
+    }
+
+    return 0;
+}
+
+int
+ar6000_update_bdaddr(struct ar6_softc *ar)
+{
+
+        if (setupbtdev != 0) {
+            u32 address;
+
+           if (BMIReadMemory(ar->arHifDevice,
+                HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_data), (u8 *)&address, 4) != 0)
+           {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for hi_board_data failed\n"));
+                return A_ERROR;
+           }
+
+           if (BMIReadMemory(ar->arHifDevice, address + BDATA_BDADDR_OFFSET, (u8 *)ar->bdaddr, 6) != 0)
+           {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for BD address failed\n"));
+                return A_ERROR;
+           }
+           AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BDADDR 0x%x:0x%x:0x%x:0x%x:0x%x:0x%x\n", ar->bdaddr[0],
+                                                                ar->bdaddr[1], ar->bdaddr[2], ar->bdaddr[3],
+                                                                ar->bdaddr[4], ar->bdaddr[5]));
+        }
+
+return 0;
+}
+
+int
+ar6000_sysfs_bmi_get_config(struct ar6_softc *ar, u32 mode)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Requesting device specific configuration\n"));
+
+    if (mode == WLAN_INIT_MODE_UDEV) {
+        char version[16];
+        const struct firmware *fw_entry;
+
+        /* Get config using udev through a script in user space */
+        sprintf(version, "%2.2x", ar->arVersion.target_ver);
+        if ((A_REQUEST_FIRMWARE(&fw_entry, version, ((struct device *)ar->osDevInfo.pOSDevice))) != 0)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI: Failure to get configuration for target version: %s\n", version));
+            return A_ERROR;
+        }
+
+        A_RELEASE_FIRMWARE(fw_entry);
+    } else {
+        /* The config is contained within the driver itself */
+        int status;
+        u32 param, options, sleep, address;
+
+        /* Temporarily disable system sleep */
+        address = MBOX_BASE_ADDRESS + LOCAL_SCRATCH_ADDRESS;
+        bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+        options = param;
+        param |= AR6K_OPTION_SLEEP_DISABLE;
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+        address = RTC_BASE_ADDRESS + SYSTEM_SLEEP_ADDRESS;
+        bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+        sleep = param;
+        param |= WLAN_SYSTEM_SLEEP_DISABLE_SET(1);
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("old options: %d, old sleep: %d\n", options, sleep));
+
+        if (ar->arTargetType == TARGET_TYPE_AR6003) {
+            /* Program analog PLL register */
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, ANALOG_INTF_BASE_ADDRESS + 0x284, 0xF9104001));
+            /* Run at 80/88MHz by default */
+            param = CPU_CLOCK_STANDARD_SET(1);
+        } else {
+            /* Run at 40/44MHz by default */
+            param = CPU_CLOCK_STANDARD_SET(0);
+        }
+        address = RTC_BASE_ADDRESS + CPU_CLOCK_ADDRESS;
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+        param = 0;
+        if (ar->arTargetType == TARGET_TYPE_AR6002) {
+            bmifn(BMIReadMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_ext_clk_detected), (u8 *)&param, 4));
+        }
+
+        /* LPO_CAL.ENABLE = 1 if no external clk is detected */
+        if (param != 1) {
+            address = RTC_BASE_ADDRESS + LPO_CAL_ADDRESS;
+            param = LPO_CAL_ENABLE_SET(1);
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+        }
+
+        /* Venus2.0: Lower SDIO pad drive strength,
+         * temporary WAR to avoid SDIO CRC error */
+        if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("AR6K: Temporary WAR to avoid SDIO CRC error\n"));
+            param = 0x20;
+            address = GPIO_BASE_ADDRESS + GPIO_PIN10_ADDRESS;
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+            address = GPIO_BASE_ADDRESS + GPIO_PIN11_ADDRESS;
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+            address = GPIO_BASE_ADDRESS + GPIO_PIN12_ADDRESS;
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+            address = GPIO_BASE_ADDRESS + GPIO_PIN13_ADDRESS;
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+        }
+
+#ifdef FORCE_INTERNAL_CLOCK
+        /* Ignore external clock, if any, and force use of internal clock */
+        if (ar->arTargetType == TARGET_TYPE_AR6003) {
+            /* hi_ext_clk_detected = 0 */
+            param = 0;
+            bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_ext_clk_detected), (u8 *)&param, 4));
+
+            /* CLOCK_CONTROL &= ~LF_CLK32 */
+            address = RTC_BASE_ADDRESS + CLOCK_CONTROL_ADDRESS;
+            bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+            param &= (~CLOCK_CONTROL_LF_CLK32_SET(1));
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+        }
+#endif /* FORCE_INTERNAL_CLOCK */
+
+        /* Transfer Board Data from Target EEPROM to Target RAM */
+        if (ar->arTargetType == TARGET_TYPE_AR6003) {
+            /* Determine where in Target RAM to write Board Data */
+            bmifn(BMIReadMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_data), (u8 *)&address, 4));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("Board Data download address: 0x%x\n", address));
+
+            /* Write EEPROM data to Target RAM */
+            if ((ar6000_transfer_bin_file(ar, AR6K_BOARD_DATA_FILE, address, false)) != 0) {
+                return A_ERROR;
+            }
+
+            /* Record the fact that Board Data IS initialized */
+            param = 1;
+            bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_data_initialized), (u8 *)&param, 4));
+
+            /* Transfer One time Programmable data */
+            AR6K_APP_LOAD_ADDRESS(address, ar->arVersion.target_ver);
+            if (ar->arVersion.target_ver == AR6003_REV3_VERSION)
+                  address = 0x1234;
+            status = ar6000_transfer_bin_file(ar, AR6K_OTP_FILE, address, true);
+            if (status == 0) {
+                /* Execute the OTP code */
+                param = 0;
+                AR6K_APP_START_OVERRIDE_ADDRESS(address, ar->arVersion.target_ver);
+                bmifn(BMIExecute(ar->arHifDevice, address, &param));
+            } else if (status != A_ENOENT) {
+                return A_ERROR;
+            } 
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Programming of board data for chip %d not supported\n", ar->arTargetType));
+            return A_ERROR;
+        }
+
+        /* Download Target firmware */
+        AR6K_APP_LOAD_ADDRESS(address, ar->arVersion.target_ver);
+        if (ar->arVersion.target_ver == AR6003_REV3_VERSION)
+                address = 0x1234;
+        if ((ar6000_transfer_bin_file(ar, AR6K_FIRMWARE_FILE, address, true)) != 0) {
+            return A_ERROR;
+        }
+
+        /* Set starting address for firmware */
+        AR6K_APP_START_OVERRIDE_ADDRESS(address, ar->arVersion.target_ver);
+        bmifn(BMISetAppStart(ar->arHifDevice, address));
+
+        if(ar->arTargetType == TARGET_TYPE_AR6003) {
+                AR6K_DATASET_PATCH_ADDRESS(address, ar->arVersion.target_ver);
+                if ((ar6000_transfer_bin_file(ar, AR6K_PATCH_FILE,
+                                              address, false)) != 0)
+                        return A_ERROR;
+                param = address;
+                bmifn(BMIWriteMemory(ar->arHifDevice,
+                HOST_INTEREST_ITEM_ADDRESS(ar, hi_dset_list_head),
+                                           (unsigned char *)&param, 4));
+        }
+
+        /* Restore system sleep */
+        address = RTC_BASE_ADDRESS + SYSTEM_SLEEP_ADDRESS;
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, sleep));
+
+        address = MBOX_BASE_ADDRESS + LOCAL_SCRATCH_ADDRESS;
+        param = options | 0x20;
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+        if (ar->arTargetType == TARGET_TYPE_AR6003) {
+            /* Configure GPIO AR6003 UART */
+#ifndef CONFIG_AR600x_DEBUG_UART_TX_PIN
+#define CONFIG_AR600x_DEBUG_UART_TX_PIN 8
+#endif
+            param = CONFIG_AR600x_DEBUG_UART_TX_PIN;
+            bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_dbg_uart_txpin), (u8 *)&param, 4));
+
+#if (CONFIG_AR600x_DEBUG_UART_TX_PIN == 23)
+            {
+                address = GPIO_BASE_ADDRESS + CLOCK_GPIO_ADDRESS;
+                bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+                param |= CLOCK_GPIO_BT_CLK_OUT_EN_SET(1);
+                bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+            }
+#endif
+
+            /* Configure GPIO for BT Reset */
+#ifdef ATH6KL_CONFIG_GPIO_BT_RESET
+#define CONFIG_AR600x_BT_RESET_PIN      0x16
+            param = CONFIG_AR600x_BT_RESET_PIN;
+            bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_hci_uart_support_pins), (u8 *)&param, 4));
+#endif /* ATH6KL_CONFIG_GPIO_BT_RESET */
+
+            /* Configure UART flow control polarity */
+#ifndef CONFIG_ATH6KL_BT_UART_FC_POLARITY
+#define CONFIG_ATH6KL_BT_UART_FC_POLARITY 0
+#endif
+
+#if (CONFIG_ATH6KL_BT_UART_FC_POLARITY == 1)
+            if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                param = ((CONFIG_ATH6KL_BT_UART_FC_POLARITY << 1) & 0x2);
+                bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_hci_uart_pwr_mgmt_params), (u8 *)&param, 4));
+            }
+#endif /* CONFIG_ATH6KL_BT_UART_FC_POLARITY */
+        }
+
+#ifdef HTC_RAW_INTERFACE
+        if (!eppingtest && bypasswmi) {
+            /* Don't run BMIDone for ART mode and force resetok=0 */
+            resetok = 0;
+            msleep(1000);
+        }
+#endif /* HTC_RAW_INTERFACE */
+    }
+
+    return 0;
+}
+
+int
+ar6000_configure_target(struct ar6_softc *ar)
+{
+    u32 param;
+    if (enableuartprint) {
+        param = 1;
+        if (BMIWriteMemory(ar->arHifDevice,
+                           HOST_INTEREST_ITEM_ADDRESS(ar, hi_serial_enable),
+                           (u8 *)&param,
+                           4)!= 0)
+        {
+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for enableuartprint failed \n"));
+             return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Serial console prints enabled\n"));
+    }
+
+    /* Tell target which HTC version it is used*/
+    param = HTC_PROTOCOL_VERSION;
+    if (BMIWriteMemory(ar->arHifDevice,
+                       HOST_INTEREST_ITEM_ADDRESS(ar, hi_app_host_interest),
+                       (u8 *)&param,
+                       4)!= 0)
+    {
+         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for htc version failed \n"));
+         return A_ERROR;
+    }
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+    if(testmode) {
+        ar->arTargetMode = AR6000_TCMD_MODE;
+    }else {
+        ar->arTargetMode = AR6000_WLAN_MODE;
+    }
+#endif
+    if (enabletimerwar) {
+        u32 param;
+
+        if (BMIReadMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
+            (u8 *)&param,
+            4)!= 0)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for enabletimerwar failed \n"));
+            return A_ERROR;
+        }
+
+        param |= HI_OPTION_TIMER_WAR;
+
+        if (BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
+            (u8 *)&param,
+            4) != 0)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for enabletimerwar failed \n"));
+            return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Timer WAR enabled\n"));
+    }
+
+    /* set the firmware mode to STA/IBSS/AP */
+    {
+        u32 param;
+
+        if (BMIReadMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
+            (u8 *)&param,
+            4)!= 0)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for setting fwmode failed \n"));
+            return A_ERROR;
+        }
+
+        param |= (num_device << HI_OPTION_NUM_DEV_SHIFT);
+        param |= (fwmode << HI_OPTION_FW_MODE_SHIFT);
+        param |= (mac_addr_method << HI_OPTION_MAC_ADDR_METHOD_SHIFT);
+        param |= (firmware_bridge << HI_OPTION_FW_BRIDGE_SHIFT);
+
+
+        if (BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
+            (u8 *)&param,
+            4) != 0)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for setting fwmode failed \n"));
+            return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Firmware mode set\n"));
+    }
+
+#ifdef ATH6KL_DISABLE_TARGET_DBGLOGS
+    {
+        u32 param;
+
+        if (BMIReadMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
+            (u8 *)&param,
+            4)!= 0)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for disabling debug logs failed\n"));
+            return A_ERROR;
+        }
+
+        param |= HI_OPTION_DISABLE_DBGLOG;
+
+        if (BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
+            (u8 *)&param,
+            4) != 0)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for HI_OPTION_DISABLE_DBGLOG\n"));
+            return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Firmware mode set\n"));
+    }
+#endif /* ATH6KL_DISABLE_TARGET_DBGLOGS */
+
+    /* 
+     * Hardcode the address use for the extended board data 
+     * Ideally this should be pre-allocate by the OS at boot time
+     * But since it is a new feature and board data is loaded 
+     * at init time, we have to workaround this from host.
+     * It is difficult to patch the firmware boot code,
+     * but possible in theory.
+     */
+
+        if (ar->arTargetType == TARGET_TYPE_AR6003) {
+                u32 ramReservedSz;
+                if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                        param = AR6003_REV2_BOARD_EXT_DATA_ADDRESS;
+                        ramReservedSz =  AR6003_REV2_RAM_RESERVE_SIZE;
+                } else {
+                        param = AR6003_REV3_BOARD_EXT_DATA_ADDRESS;
+                        ramReservedSz =  AR6003_REV3_RAM_RESERVE_SIZE;
+                }
+                if (BMIWriteMemory(ar->arHifDevice,
+                        HOST_INTEREST_ITEM_ADDRESS(ar, hi_board_ext_data),
+                                                   (u8 *)&param, 4) != 0) {
+                                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                                                ("BMIWriteMemory for "
+                                                 "hi_board_ext_data failed\n"));
+                                return A_ERROR;
+                }
+                if (BMIWriteMemory(ar->arHifDevice,
+                                   HOST_INTEREST_ITEM_ADDRESS(ar,
+                                   hi_end_RAM_reserve_sz),
+                                   (u8 *)&ramReservedSz, 4) != 0) {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR ,
+                                        ("BMIWriteMemory for "
+                                         "hi_end_RAM_reserve_sz failed\n"));
+                        return A_ERROR;
+                }
+        }
+
+        /* since BMIInit is called in the driver layer, we have to set the block
+         * size here for the target */
+
+    if (ar6000_set_htc_params(ar->arHifDevice, ar->arTargetType,
+                              mbox_yield_limit, 0)) {
+                                /* use default number of control buffers */
+        return A_ERROR;
+    }
+
+    if (setupbtdev != 0) {
+        if (ar6000_set_hci_bridge_flags(ar->arHifDevice,
+                                        ar->arTargetType,
+                                        setupbtdev)) {
+            return A_ERROR;
+        }
+    }
+    return 0;
+}
+
+static void
+init_netdev(struct net_device *dev, char *name)
+{
+    dev->netdev_ops = &ar6000_netdev_ops;
+    dev->watchdog_timeo = AR6000_TX_TIMEOUT;
+
+   /*
+    * We need the OS to provide us with more headroom in order to
+    * perform dix to 802.3, WMI header encap, and the HTC header
+    */
+    if (processDot11Hdr) {
+        dev->hard_header_len = sizeof(struct ieee80211_qosframe) + sizeof(ATH_LLC_SNAP_HDR) + sizeof(WMI_DATA_HDR) + HTC_HEADER_LEN + WMI_MAX_TX_META_SZ + LINUX_HACK_FUDGE_FACTOR;
+    } else {
+        dev->hard_header_len = ETH_HLEN + sizeof(ATH_LLC_SNAP_HDR) +
+            sizeof(WMI_DATA_HDR) + HTC_HEADER_LEN + WMI_MAX_TX_META_SZ + LINUX_HACK_FUDGE_FACTOR;
+    }
+
+    if (name[0])
+    {
+        strcpy(dev->name, name);
+    }
+
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+    if(csumOffload){
+        dev->features |= NETIF_F_IP_CSUM; /*advertise kernel capability to do TCP/UDP CSUM offload for IPV4*/
+    }
+#endif
+
+    return;
+}
+
+static int __ath6kl_init_netdev(struct net_device *dev)
+{
+        int r;
+
+        rtnl_lock();
+        r = ar6000_init(dev);
+        rtnl_unlock();
+
+        if (r) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: ar6000_init\n"));
+                return r;
+        }
+
+        return 0;
+}
+
+#ifdef HTC_RAW_INTERFACE
+static int ath6kl_init_netdev_wmi(struct net_device *dev)
+{
+        if (!eppingtest && bypasswmi)
+                return 0;
+
+        return __ath6kl_init_netdev(dev);
+}
+#else
+static int ath6kl_init_netdev_wmi(struct net_device *dev)
+{
+        return __ath6kl_init_netdev(dev);
+}
+#endif
+
+static int ath6kl_init_netdev(struct ar6_softc *ar)
+{
+        int r;
+
+        r = ar6000_sysfs_bmi_get_config(ar, wlaninitmode);
+        if (r) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                                ("ar6000_avail: "
+                                 "ar6000_sysfs_bmi_get_config failed\n"));
+                return r;
+        }
+
+        return ath6kl_init_netdev_wmi(ar->arNetDev);
+}
+
+/*
+ * HTC Event handlers
+ */
+static int
+ar6000_avail_ev(void *context, void *hif_handle)
+{
+    int i;
+    struct net_device *dev;
+    void *ar_netif;
+    struct ar6_softc *ar;
+    int device_index = 0;
+    struct htc_init_info  htcInfo;
+    struct wireless_dev *wdev;
+    int r = 0;
+    struct hif_device_os_device_info osDevInfo;
+
+    memset(&osDevInfo, 0, sizeof(osDevInfo));
+    if (HIFConfigureDevice(hif_handle, HIF_DEVICE_GET_OS_DEVICE,
+        &osDevInfo, sizeof(osDevInfo))) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: Failed to get OS device instance\n", __func__));
+        return A_ERROR;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ar6000_available\n"));
+
+    for (i=0; i < MAX_AR6000; i++) {
+        if (ar6000_devices[i] == NULL) {
+            break;
+        }
+    }
+
+    if (i == MAX_AR6000) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_available: max devices reached\n"));
+        return A_ERROR;
+    }
+
+    /* Save this. It gives a bit better readability especially since */
+    /* we use another local "i" variable below.                      */
+    device_index = i;
+
+    wdev = ar6k_cfg80211_init(osDevInfo.pOSDevice);
+    if (IS_ERR(wdev)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: ar6k_cfg80211_init failed\n", __func__));
+        return A_ERROR;
+    }
+    ar_netif = wdev_priv(wdev);
+
+    if (ar_netif == NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Can't allocate ar6k priv memory\n", __func__));
+        return A_ERROR;
+    }
+
+    A_MEMZERO(ar_netif, sizeof(struct ar6_softc));
+    ar = (struct ar6_softc *)ar_netif;
+
+    ar->wdev = wdev;
+    wdev->iftype = NL80211_IFTYPE_STATION;
+
+    dev = alloc_netdev_mq(0, "wlan%d", ether_setup, 1);
+    if (!dev) {
+        printk(KERN_CRIT "AR6K: no memory for network device instance\n");
+        ar6k_cfg80211_deinit(ar);
+        return A_ERROR;
+    }
+
+    dev->ieee80211_ptr = wdev;
+    SET_NETDEV_DEV(dev, wiphy_dev(wdev->wiphy));
+    wdev->netdev = dev;
+    ar->arNetworkType = INFRA_NETWORK;
+    ar->smeState = SME_DISCONNECTED;
+    ar->arAutoAuthStage = AUTH_IDLE;
+
+    init_netdev(dev, ifname);
+
+
+    ar->arNetDev             = dev;
+    ar->arHifDevice          = hif_handle;
+    ar->arWlanState          = WLAN_ENABLED;
+    ar->arDeviceIndex        = device_index;
+
+    ar->arWlanPowerState     = WLAN_POWER_STATE_ON;
+    ar->arWlanOff            = false;   /* We are in ON state */
+#ifdef CONFIG_PM
+    ar->arWowState           = WLAN_WOW_STATE_NONE;
+    ar->arBTOff              = true;   /* BT chip assumed to be OFF */
+    ar->arBTSharing          = WLAN_CONFIG_BT_SHARING; 
+    ar->arWlanOffConfig      = WLAN_CONFIG_WLAN_OFF;
+    ar->arSuspendConfig      = WLAN_CONFIG_PM_SUSPEND;
+    ar->arWow2Config         = WLAN_CONFIG_PM_WOW2;
+#endif /* CONFIG_PM */
+
+    A_INIT_TIMER(&ar->arHBChallengeResp.timer, ar6000_detect_error, dev);
+    ar->arHBChallengeResp.seqNum = 0;
+    ar->arHBChallengeResp.outstanding = false;
+    ar->arHBChallengeResp.missCnt = 0;
+    ar->arHBChallengeResp.frequency = AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT;
+    ar->arHBChallengeResp.missThres = AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT;
+
+    ar6000_init_control_info(ar);
+    init_waitqueue_head(&arEvent);
+    sema_init(&ar->arSem, 1);
+    ar->bIsDestroyProgress = false;
+
+    INIT_HTC_PACKET_QUEUE(&ar->amsdu_rx_buffer_queue);
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+    A_INIT_TIMER(&aptcTimer, aptcTimerHandler, ar);
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+    A_INIT_TIMER(&ar->disconnect_timer, disconnect_timer_handler, dev);
+
+    BMIInit();
+
+    ar6000_sysfs_bmi_init(ar);
+
+    {
+        struct bmi_target_info targ_info;
+
+        r = BMIGetTargetInfo(ar->arHifDevice, &targ_info);
+        if (r)
+            goto avail_ev_failed;
+
+        ar->arVersion.target_ver = targ_info.target_ver;
+        ar->arTargetType = targ_info.target_type;
+        wdev->wiphy->hw_version = targ_info.target_ver;
+    }
+
+    r = ar6000_configure_target(ar);
+    if (r)
+            goto avail_ev_failed;
+
+    A_MEMZERO(&htcInfo,sizeof(htcInfo));
+    htcInfo.pContext = ar;
+    htcInfo.TargetFailure = ar6000_target_failure;
+
+    ar->arHtcTarget = HTCCreate(ar->arHifDevice,&htcInfo);
+
+    if (!ar->arHtcTarget) {
+        r = -ENOMEM;
+        goto avail_ev_failed;
+    }
+
+    spin_lock_init(&ar->arLock);
+
+#ifdef WAPI_ENABLE
+    ar->arWapiEnable = 0;
+#endif
+
+
+    if(csumOffload){
+        /*if external frame work is also needed, change and use an extended rxMetaVerion*/
+        ar->rxMetaVersion=WMI_META_VERSION_2;
+    }
+
+    ar->aggr_cntxt = aggr_init(ar6000_alloc_netbufs);
+    if (!ar->aggr_cntxt) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() Failed to initialize aggr.\n", __func__));
+            r = -ENOMEM;
+            goto avail_ev_failed;
+    }
+
+    aggr_register_rx_dispatcher(ar->aggr_cntxt, (void *)dev, ar6000_deliver_frames_to_nw_stack);
+
+    HIFClaimDevice(ar->arHifDevice, ar);
+
+    /* We only register the device in the global list if we succeed. */
+    /* If the device is in the global list, it will be destroyed     */
+    /* when the module is unloaded.                                  */
+    ar6000_devices[device_index] = dev;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("BMI enabled: %d\n", wlaninitmode));
+    if ((wlaninitmode == WLAN_INIT_MODE_UDEV) ||
+        (wlaninitmode == WLAN_INIT_MODE_DRV)) {
+        r = ath6kl_init_netdev(ar);
+        if (r)
+            goto avail_ev_failed;
+    }
+
+    /* This runs the init function if registered */
+    r = register_netdev(dev);
+    if (r) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: register_netdev failed\n"));
+        ar6000_destroy(dev, 0);
+        return r;
+    }
+
+        is_netdev_registered = 1;
+
+#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+    arApNetDev = NULL;
+#endif /* CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ar6000_avail: name=%s hifdevice=0x%lx, dev=0x%lx (%d), ar=0x%lx\n",
+                    dev->name, (unsigned long)ar->arHifDevice, (unsigned long)dev, device_index,
+                    (unsigned long)ar));
+
+avail_ev_failed :
+    if (r)
+        ar6000_sysfs_bmi_deinit(ar);  
+
+    return r;
+}
+
+static void ar6000_target_failure(void *Instance, int Status)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)Instance;
+    WMI_TARGET_ERROR_REPORT_EVENT errEvent;
+    static bool sip = false;
+
+    if (Status != 0) {
+
+        printk(KERN_ERR "ar6000_target_failure: target asserted \n");
+
+        if (timer_pending(&ar->arHBChallengeResp.timer)) {
+            A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
+        }
+
+        /* try dumping target assertion information (if any) */
+        ar6000_dump_target_assert_info(ar->arHifDevice,ar->arTargetType);
+
+        /*
+         * Fetch the logs from the target via the diagnostic
+         * window.
+         */
+        ar6000_dbglog_get_debug_logs(ar);
+
+        /* Report the error only once */
+        if (!sip) {
+            sip = true;
+            errEvent.errorVal = WMI_TARGET_COM_ERR |
+                                WMI_TARGET_FATAL_ERR;
+        }
+    }
+}
+
+static int
+ar6000_unavail_ev(void *context, void *hif_handle)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)context;
+        /* NULL out it's entry in the global list */
+    ar6000_devices[ar->arDeviceIndex] = NULL;
+    ar6000_destroy(ar->arNetDev, 1);
+
+    return 0;
+}
+
+void
+ar6000_restart_endpoint(struct net_device *dev)
+{
+    int status = 0;
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
+
+    BMIInit();
+    do {
+        if ( (status=ar6000_configure_target(ar))!= 0)
+            break;
+        if ( (status=ar6000_sysfs_bmi_get_config(ar, wlaninitmode)) != 0)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: ar6000_sysfs_bmi_get_config failed\n"));
+            break;
+        }
+        rtnl_lock();
+        status = (ar6000_init(dev)==0) ? 0 : A_ERROR;
+        rtnl_unlock();
+
+        if (status) {
+            break;
+        }
+        if (ar->arSsidLen && ar->arWlanState == WLAN_ENABLED) {
+            ar6000_connect_to_ap(ar);
+        }  
+    } while (0);
+
+    if (status== 0) {
+        return;
+    }
+
+    ar6000_devices[ar->arDeviceIndex] = NULL;
+    ar6000_destroy(ar->arNetDev, 1);
+}
+
+void
+ar6000_stop_endpoint(struct net_device *dev, bool keepprofile, bool getdbglogs)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
+
+    /* Stop the transmit queues */
+    netif_stop_queue(dev);
+
+    /* Disable the target and the interrupts associated with it */
+    if (ar->arWmiReady == true)
+    {
+        if (!bypasswmi)
+        {
+            bool disconnectIssued;
+ 
+            disconnectIssued = (ar->arConnected) || (ar->arConnectPending);
+            ar6000_disconnect(ar);
+            if (!keepprofile) {
+                ar6000_init_profile_info(ar);
+            }
+
+            A_UNTIMEOUT(&ar->disconnect_timer);
+
+            if (getdbglogs) {
+                ar6000_dbglog_get_debug_logs(ar);
+            }
+
+            ar->arWmiReady  = false;
+            wmi_shutdown(ar->arWmi);
+            ar->arWmiEnabled = false;
+            ar->arWmi = NULL;
+            /* 
+             * After wmi_shudown all WMI events will be dropped.
+             * We need to cleanup the buffers allocated in AP mode
+             * and give disconnect notification to stack, which usually
+             * happens in the disconnect_event. 
+             * Simulate the disconnect_event by calling the function directly.
+             * Sometimes disconnect_event will be received when the debug logs 
+             * are collected.
+             */
+            if (disconnectIssued) {
+                if(ar->arNetworkType & AP_NETWORK) {
+                    ar6000_disconnect_event(ar, DISCONNECT_CMD, bcast_mac, 0, NULL, 0);
+                } else {
+                    ar6000_disconnect_event(ar, DISCONNECT_CMD, ar->arBssid, 0, NULL, 0);
+                }
+            }
+            ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
+            ar->user_key_ctrl      = 0;
+        }
+
+         AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s(): WMI stopped\n", __func__));
+    }
+    else
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s(): WMI not ready 0x%lx 0x%lx\n",
+            __func__, (unsigned long) ar, (unsigned long) ar->arWmi));
+
+        /* Shut down WMI if we have started it */
+        if(ar->arWmiEnabled == true)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s(): Shut down WMI\n", __func__));
+            wmi_shutdown(ar->arWmi);
+            ar->arWmiEnabled = false;
+            ar->arWmi = NULL;
+        }
+    }
+
+    if (ar->arHtcTarget != NULL) {
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        if (NULL != ar6kHciTransCallbacks.cleanupTransport) {
+            ar6kHciTransCallbacks.cleanupTransport(NULL);
+        }
+#else
+        // FIXME: workaround to reset BT's UART baud rate to default
+        if (NULL != ar->exitCallback) {
+            struct ar3k_config_info ar3kconfig;
+            int status;
+
+            A_MEMZERO(&ar3kconfig,sizeof(ar3kconfig));
+            ar6000_set_default_ar3kconfig(ar, (void *)&ar3kconfig);
+            status = ar->exitCallback(&ar3kconfig);
+            if (0 != status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to reset AR3K baud rate! \n"));
+            }
+        }
+        // END workaround
+        if (setuphci)
+                ar6000_cleanup_hci(ar);
+#endif
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" Shutting down HTC .... \n"));
+        /* stop HTC */
+        HTCStop(ar->arHtcTarget);
+    }
+
+    if (resetok) {
+        /* try to reset the device if we can
+         * The driver may have been configure NOT to reset the target during
+         * a debug session */
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" Attempting to reset target on instance destroy.... \n"));
+        if (ar->arHifDevice != NULL) {
+            bool coldReset = (ar->arTargetType == TARGET_TYPE_AR6003) ? true: false;
+            ar6000_reset_device(ar->arHifDevice, ar->arTargetType, true, coldReset);
+        }
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" Host does not want target reset. \n"));
+    }
+       /* Done with cookies */
+    ar6000_cookie_cleanup(ar);
+
+    /* cleanup any allocated AMSDU buffers */
+    ar6000_cleanup_amsdu_rxbufs(ar);
+}
+/*
+ * We need to differentiate between the surprise and planned removal of the
+ * device because of the following consideration:
+ * - In case of surprise removal, the hcd already frees up the pending
+ *   for the device and hence there is no need to unregister the function
+ *   driver inorder to get these requests. For planned removal, the function
+ *   driver has to explicitly unregister itself to have the hcd return all the
+ *   pending requests before the data structures for the devices are freed up.
+ *   Note that as per the current implementation, the function driver will
+ *   end up releasing all the devices since there is no API to selectively
+ *   release a particular device.
+ * - Certain commands issued to the target can be skipped for surprise
+ *   removal since they will anyway not go through.
+ */
+void
+ar6000_destroy(struct net_device *dev, unsigned int unregister)
+{
+    struct ar6_softc *ar;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("+ar6000_destroy \n"));
+    
+    if((dev == NULL) || ((ar = ar6k_priv(dev)) == NULL))
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s(): Failed to get device structure.\n", __func__));
+        return;
+    }
+
+    ar->bIsDestroyProgress = true;
+
+    if (down_interruptible(&ar->arSem)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s(): down_interruptible failed \n", __func__));
+        return;
+    }
+
+    if (ar->arWlanPowerState != WLAN_POWER_STATE_CUT_PWR) {
+        /* only stop endpoint if we are not stop it in suspend_ev */
+        ar6000_stop_endpoint(dev, false, true);
+    }
+
+    ar->arWlanState = WLAN_DISABLED;
+    if (ar->arHtcTarget != NULL) {
+        /* destroy HTC */
+        HTCDestroy(ar->arHtcTarget);
+    }
+    if (ar->arHifDevice != NULL) {
+        /*release the device so we do not get called back on remove incase we
+         * we're explicity destroyed by module unload */
+        HIFReleaseDevice(ar->arHifDevice);
+        HIFShutDownDevice(ar->arHifDevice);
+    }
+    aggr_module_destroy(ar->aggr_cntxt);
+
+       /* Done with cookies */
+    ar6000_cookie_cleanup(ar);
+
+        /* cleanup any allocated AMSDU buffers */
+    ar6000_cleanup_amsdu_rxbufs(ar);
+
+    ar6000_sysfs_bmi_deinit(ar);
+
+    /* Cleanup BMI */
+    BMICleanup();
+
+    /* Clear the tx counters */
+    memset(tx_attempt, 0, sizeof(tx_attempt));
+    memset(tx_post, 0, sizeof(tx_post));
+    memset(tx_complete, 0, sizeof(tx_complete));
+
+#ifdef HTC_RAW_INTERFACE
+    if (ar->arRawHtc) {
+        kfree(ar->arRawHtc);
+        ar->arRawHtc = NULL;
+    }
+#endif 
+    /* Free up the device data structure */
+    if (unregister && is_netdev_registered) {           
+        unregister_netdev(dev);
+        is_netdev_registered = 0;
+    }
+    free_netdev(dev);
+
+    ar6k_cfg80211_deinit(ar);
+
+#ifdef CONFIG_AP_VIRTUL_ADAPTER_SUPPORT
+    ar6000_remove_ap_interface();
+#endif /*CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
+
+    kfree(ar->fw_otp);
+    kfree(ar->fw);
+    kfree(ar->fw_patch);
+    kfree(ar->fw_data);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("-ar6000_destroy \n"));
+}
+
+static void disconnect_timer_handler(unsigned long ptr)
+{
+    struct net_device *dev = (struct net_device *)ptr;
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
+
+    A_UNTIMEOUT(&ar->disconnect_timer);
+
+    ar6000_init_profile_info(ar);
+    ar6000_disconnect(ar);
+}
+
+static void ar6000_detect_error(unsigned long ptr)
+{
+    struct net_device *dev = (struct net_device *)ptr;
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
+    WMI_TARGET_ERROR_REPORT_EVENT errEvent;
+
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    if (ar->arHBChallengeResp.outstanding) {
+        ar->arHBChallengeResp.missCnt++;
+    } else {
+        ar->arHBChallengeResp.missCnt = 0;
+    }
+
+    if (ar->arHBChallengeResp.missCnt > ar->arHBChallengeResp.missThres) {
+        /* Send Error Detect event to the application layer and do not reschedule the error detection module timer */
+        ar->arHBChallengeResp.missCnt = 0;
+        ar->arHBChallengeResp.seqNum = 0;
+        errEvent.errorVal = WMI_TARGET_COM_ERR | WMI_TARGET_FATAL_ERR;
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        return;
+    }
+
+    /* Generate the sequence number for the next challenge */
+    ar->arHBChallengeResp.seqNum++;
+    ar->arHBChallengeResp.outstanding = true;
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    /* Send the challenge on the control channel */
+    if (wmi_get_challenge_resp_cmd(ar->arWmi, ar->arHBChallengeResp.seqNum, DRV_HB_CHALLENGE) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to send heart beat challenge\n"));
+    }
+
+
+    /* Reschedule the timer for the next challenge */
+    A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
+}
+
+void ar6000_init_profile_info(struct ar6_softc *ar)
+{
+    ar->arSsidLen            = 0;
+    A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
+
+    switch(fwmode) {
+        case HI_OPTION_FW_MODE_IBSS:
+            ar->arNetworkType = ar->arNextMode = ADHOC_NETWORK;
+            break;
+        case HI_OPTION_FW_MODE_BSS_STA:
+            ar->arNetworkType = ar->arNextMode = INFRA_NETWORK;
+            break;
+        case HI_OPTION_FW_MODE_AP:
+            ar->arNetworkType = ar->arNextMode = AP_NETWORK;
+            break;
+    }
+
+    ar->arDot11AuthMode      = OPEN_AUTH;
+    ar->arAuthMode           = NONE_AUTH;
+    ar->arPairwiseCrypto     = NONE_CRYPT;
+    ar->arPairwiseCryptoLen  = 0;
+    ar->arGroupCrypto        = NONE_CRYPT;
+    ar->arGroupCryptoLen     = 0;
+    A_MEMZERO(ar->arWepKeyList, sizeof(ar->arWepKeyList));
+    A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
+    A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
+    ar->arBssChannel = 0;
+}
+
+static void
+ar6000_init_control_info(struct ar6_softc *ar)
+{
+    ar->arWmiEnabled         = false;
+    ar6000_init_profile_info(ar);
+    ar->arDefTxKeyIndex      = 0;
+    A_MEMZERO(ar->arWepKeyList, sizeof(ar->arWepKeyList));
+    ar->arChannelHint        = 0;
+    ar->arListenIntervalT    = A_DEFAULT_LISTEN_INTERVAL;
+    ar->arListenIntervalB    = 0;
+    ar->arVersion.host_ver   = AR6K_SW_VERSION;
+    ar->arRssi               = 0;
+    ar->arTxPwr              = 0;
+    ar->arTxPwrSet           = false;
+    ar->arSkipScan           = 0;
+    ar->arBeaconInterval     = 0;
+    ar->arBitRate            = 0;
+    ar->arMaxRetries         = 0;
+    ar->arWmmEnabled         = true;
+    ar->intra_bss            = 1;
+    ar->scan_triggered       = 0;
+    A_MEMZERO(&ar->scParams, sizeof(ar->scParams));
+    ar->scParams.shortScanRatio = WMI_SHORTSCANRATIO_DEFAULT;
+    ar->scParams.scanCtrlFlags = DEFAULT_SCAN_CTRL_FLAGS;
+
+    /* Initialize the AP mode state info */
+    {
+        u8 ctr;
+        A_MEMZERO((u8 *)ar->sta_list, AP_MAX_NUM_STA * sizeof(sta_t));
+
+        /* init the Mutexes */
+        A_MUTEX_INIT(&ar->mcastpsqLock);
+
+        /* Init the PS queues */
+        for (ctr=0; ctr < AP_MAX_NUM_STA ; ctr++) {
+            A_MUTEX_INIT(&ar->sta_list[ctr].psqLock);
+            A_NETBUF_QUEUE_INIT(&ar->sta_list[ctr].psq);
+        }
+
+        ar->ap_profile_flag = 0;
+        A_NETBUF_QUEUE_INIT(&ar->mcastpsq);
+
+        memcpy(ar->ap_country_code, DEF_AP_COUNTRY_CODE, 3);
+        ar->ap_wmode = DEF_AP_WMODE_G;
+        ar->ap_dtim_period = DEF_AP_DTIM;
+        ar->ap_beacon_interval = DEF_BEACON_INTERVAL;
+    }
+}
+
+static int
+ar6000_open(struct net_device *dev)
+{
+    unsigned long  flags;
+    struct ar6_softc    *ar = (struct ar6_softc *)ar6k_priv(dev);
+
+    spin_lock_irqsave(&ar->arLock, flags);
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        ar->arWlanState = WLAN_ENABLED;
+    }
+
+    if( ar->arConnected || bypasswmi) {
+        netif_carrier_on(dev);
+        /* Wake up the queues */
+        netif_wake_queue(dev);
+    }
+    else
+        netif_carrier_off(dev);
+
+    spin_unlock_irqrestore(&ar->arLock, flags);
+    return 0;
+}
+
+static int
+ar6000_close(struct net_device *dev)
+{
+    struct ar6_softc    *ar = (struct ar6_softc *)ar6k_priv(dev);
+    netif_stop_queue(dev);
+
+    ar6000_disconnect(ar);
+
+    if(ar->arWmiReady == true) {
+        if (wmi_scanparams_cmd(ar->arWmi, 0xFFFF, 0,
+                               0, 0, 0, 0, 0, 0, 0, 0) != 0) {
+            return -EIO;
+        }
+        ar->arWlanState = WLAN_DISABLED;
+    }
+        ar6k_cfg80211_scanComplete_event(ar, A_ECANCELED);
+
+    return 0;
+}
+
+/* connect to a service */
+static int ar6000_connectservice(struct ar6_softc               *ar,
+                                      struct htc_service_connect_req  *pConnect,
+                                      char *pDesc)
+{
+    int                 status;
+    struct htc_service_connect_resp response;
+
+    do {
+
+        A_MEMZERO(&response,sizeof(response));
+
+        status = HTCConnectService(ar->arHtcTarget,
+                                   pConnect,
+                                   &response);
+
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" Failed to connect to %s service status:%d \n",
+                              pDesc, status));
+            break;
+        }
+        switch (pConnect->ServiceID) {
+            case WMI_CONTROL_SVC :
+                if (ar->arWmiEnabled) {
+                        /* set control endpoint for WMI use */
+                    wmi_set_control_ep(ar->arWmi, response.Endpoint);
+                }
+                    /* save EP for fast lookup */
+                ar->arControlEp = response.Endpoint;
+                break;
+            case WMI_DATA_BE_SVC :
+                arSetAc2EndpointIDMap(ar, WMM_AC_BE, response.Endpoint);
+                break;
+            case WMI_DATA_BK_SVC :
+                arSetAc2EndpointIDMap(ar, WMM_AC_BK, response.Endpoint);
+                break;
+            case WMI_DATA_VI_SVC :
+                arSetAc2EndpointIDMap(ar, WMM_AC_VI, response.Endpoint);
+                 break;
+           case WMI_DATA_VO_SVC :
+                arSetAc2EndpointIDMap(ar, WMM_AC_VO, response.Endpoint);
+                break;
+           default:
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ServiceID not mapped %d\n", pConnect->ServiceID));
+                status = A_EINVAL;
+            break;
+        }
+
+    } while (false);
+
+    return status;
+}
+
+void ar6000_TxDataCleanup(struct ar6_softc *ar)
+{
+        /* flush all the data (non-control) streams
+         * we only flush packets that are tagged as data, we leave any control packets that
+         * were in the TX queues alone */
+    HTCFlushEndpoint(ar->arHtcTarget,
+                     arAc2EndpointID(ar, WMM_AC_BE),
+                     AR6K_DATA_PKT_TAG);
+    HTCFlushEndpoint(ar->arHtcTarget,
+                     arAc2EndpointID(ar, WMM_AC_BK),
+                     AR6K_DATA_PKT_TAG);
+    HTCFlushEndpoint(ar->arHtcTarget,
+                     arAc2EndpointID(ar, WMM_AC_VI),
+                     AR6K_DATA_PKT_TAG);
+    HTCFlushEndpoint(ar->arHtcTarget,
+                     arAc2EndpointID(ar, WMM_AC_VO),
+                     AR6K_DATA_PKT_TAG);
+}
+
+HTC_ENDPOINT_ID
+ar6000_ac2_endpoint_id ( void * devt, u8 ac)
+{
+    struct ar6_softc *ar = (struct ar6_softc *) devt;
+    return(arAc2EndpointID(ar, ac));
+}
+
+u8 ar6000_endpoint_id2_ac(void * devt, HTC_ENDPOINT_ID ep )
+{
+    struct ar6_softc *ar = (struct ar6_softc *) devt;
+    return(arEndpoint2Ac(ar, ep ));
+}
+
+#if defined(CONFIG_ATH6KL_ENABLE_COEXISTENCE)
+static int ath6kl_config_btcoex_params(struct ar6_softc *ar)
+{
+        int r;
+        WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD sbcb_cmd;
+        WMI_SET_BTCOEX_FE_ANT_CMD sbfa_cmd;
+
+        /* Configure the type of BT collocated with WLAN */
+        memset(&sbcb_cmd, 0, sizeof(WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD));
+        sbcb_cmd.btcoexCoLocatedBTdev = ATH6KL_BT_DEV;
+
+        r = wmi_set_btcoex_colocated_bt_dev_cmd(ar->arWmi, &sbcb_cmd);
+
+        if (r) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                                ("Unable to set collocated BT type\n"));
+                return r;
+        }
+
+        /* Configure the type of BT collocated with WLAN */
+        memset(&sbfa_cmd, 0, sizeof(WMI_SET_BTCOEX_FE_ANT_CMD));
+
+        sbfa_cmd.btcoexFeAntType = ATH6KL_BT_ANTENNA;
+
+        r = wmi_set_btcoex_fe_ant_cmd(ar->arWmi, &sbfa_cmd);
+        if (r) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                                ("Unable to set fornt end antenna configuration\n"));
+                return r;
+        }
+
+        return 0;
+}
+#else
+static int ath6kl_config_btcoex_params(struct ar6_softc *ar)
+{
+        return 0;
+}
+#endif /* CONFIG_ATH6KL_ENABLE_COEXISTENCE */
+
+/*
+ * This function applies WLAN specific configuration defined in wlan_config.h
+ */
+int ar6000_target_config_wlan_params(struct ar6_softc *ar)
+{
+    int status = 0;
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+    if (ar->arTargetMode != AR6000_WLAN_MODE) {
+        return 0;
+    }
+#endif /* CONFIG_HOST_TCMD_SUPPORT */
+
+    /* 
+     * configure the device for rx dot11 header rules 0,0 are the default values
+     * therefore this command can be skipped if the inputs are 0,FALSE,FALSE.Required
+     * if checksum offload is needed. Set RxMetaVersion to 2
+     */
+    if ((wmi_set_rx_frame_format_cmd(ar->arWmi,ar->rxMetaVersion, processDot11Hdr, processDot11Hdr)) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set the rx frame format.\n"));
+        status = A_ERROR;
+    }
+
+    status = ath6kl_config_btcoex_params(ar);
+    if (status)
+        return status;
+
+#if WLAN_CONFIG_IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN
+    if ((wmi_pmparams_cmd(ar->arWmi, 0, 1, 0, 0, 1, IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN)) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set power save fail event policy\n"));
+        status = A_ERROR;
+    }
+#endif
+
+#if WLAN_CONFIG_DONOT_IGNORE_BARKER_IN_ERP
+    if ((wmi_set_lpreamble_cmd(ar->arWmi, 0, WMI_DONOT_IGNORE_BARKER_IN_ERP)) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set barker preamble policy\n"));
+        status = A_ERROR;
+    }
+#endif
+
+    if ((wmi_set_keepalive_cmd(ar->arWmi, WLAN_CONFIG_KEEP_ALIVE_INTERVAL)) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set keep alive interval\n"));
+        status = A_ERROR;
+    }
+
+#if WLAN_CONFIG_DISABLE_11N
+    {
+        WMI_SET_HT_CAP_CMD htCap;
+
+        memset(&htCap, 0, sizeof(WMI_SET_HT_CAP_CMD));
+        htCap.band = 0;
+        if ((wmi_set_ht_cap_cmd(ar->arWmi, &htCap)) != 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set ht capabilities \n"));
+            status = A_ERROR;
+        }
+
+        htCap.band = 1;
+        if ((wmi_set_ht_cap_cmd(ar->arWmi, &htCap)) != 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set ht capabilities \n"));
+            status = A_ERROR;
+        }
+    }
+#endif /* WLAN_CONFIG_DISABLE_11N */
+
+#ifdef ATH6K_CONFIG_OTA_MODE
+    if ((wmi_powermode_cmd(ar->arWmi, MAX_PERF_POWER)) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set power mode \n"));
+        status = A_ERROR;
+    }
+#endif
+
+    if ((wmi_disctimeout_cmd(ar->arWmi, WLAN_CONFIG_DISCONNECT_TIMEOUT)) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set disconnect timeout \n"));
+        status = A_ERROR;
+    }
+
+#if WLAN_CONFIG_DISABLE_TX_BURSTING  
+    if ((wmi_set_wmm_txop(ar->arWmi, WMI_TXOP_DISABLED)) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set txop bursting \n"));
+        status = A_ERROR;
+    }
+#endif 
+
+    return status;
+}
+
+/* This function does one time initialization for the lifetime of the device */
+int ar6000_init(struct net_device *dev)
+{
+    struct ar6_softc *ar;
+    int    status;
+    s32 timeleft;
+    s16 i;
+    int         ret = 0;
+
+    if((ar = ar6k_priv(dev)) == NULL)
+    {
+        return -EIO;
+    }
+
+    if (wlaninitmode == WLAN_INIT_MODE_USR || wlaninitmode == WLAN_INIT_MODE_DRV) {
+    
+        ar6000_update_bdaddr(ar);
+
+        if (enablerssicompensation) {
+            ar6000_copy_cust_data_from_target(ar->arHifDevice, ar->arTargetType);
+            read_rssi_compensation_param(ar);
+            for (i=-95; i<=0; i++) {
+                rssi_compensation_table[0-i] = rssi_compensation_calc(ar,i);
+            }
+        }
+    }
+
+    dev_hold(dev);
+    rtnl_unlock();
+
+    /* Do we need to finish the BMI phase */
+    if ((wlaninitmode == WLAN_INIT_MODE_USR || wlaninitmode == WLAN_INIT_MODE_DRV) && 
+        (BMIDone(ar->arHifDevice) != 0))
+    {
+        ret = -EIO;
+        goto ar6000_init_done;
+    }
+
+    if (!bypasswmi)
+    {
+#if 0 /* TBDXXX */
+        if (ar->arVersion.host_ver != ar->arVersion.target_ver) {
+            A_PRINTF("WARNING: Host version 0x%x does not match Target "
+                    " version 0x%x!\n",
+                    ar->arVersion.host_ver, ar->arVersion.target_ver);
+        }
+#endif
+
+        /* Indicate that WMI is enabled (although not ready yet) */
+        ar->arWmiEnabled = true;
+        if ((ar->arWmi = wmi_init((void *) ar)) == NULL)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() Failed to initialize WMI.\n", __func__));
+            ret = -EIO;
+            goto ar6000_init_done;
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() Got WMI @ 0x%lx.\n", __func__,
+            (unsigned long) ar->arWmi));
+    }
+
+    do {
+        struct htc_service_connect_req connect;
+
+            /* the reason we have to wait for the target here is that the driver layer
+             * has to init BMI in order to set the host block size,
+             */
+        status = HTCWaitTarget(ar->arHtcTarget);
+
+        if (status) {
+            break;
+        }
+
+        A_MEMZERO(&connect,sizeof(connect));
+            /* meta data is unused for now */
+        connect.pMetaData = NULL;
+        connect.MetaDataLength = 0;
+            /* these fields are the same for all service endpoints */
+        connect.EpCallbacks.pContext = ar;
+        connect.EpCallbacks.EpTxCompleteMultiple = ar6000_tx_complete;
+        connect.EpCallbacks.EpRecv = ar6000_rx;
+        connect.EpCallbacks.EpRecvRefill = ar6000_rx_refill;
+        connect.EpCallbacks.EpSendFull = ar6000_tx_queue_full;
+            /* set the max queue depth so that our ar6000_tx_queue_full handler gets called.
+             * Linux has the peculiarity of not providing flow control between the
+             * NIC and the network stack. There is no API to indicate that a TX packet
+             * was sent which could provide some back pressure to the network stack.
+             * Under linux you would have to wait till the network stack consumed all sk_buffs
+             * before any back-flow kicked in. Which isn't very friendly.
+             * So we have to manage this ourselves */
+        connect.MaxSendQueueDepth = MAX_DEFAULT_SEND_QUEUE_DEPTH;
+        connect.EpCallbacks.RecvRefillWaterMark = AR6000_MAX_RX_BUFFERS / 4; /* set to 25 % */
+        if (0 == connect.EpCallbacks.RecvRefillWaterMark) {
+            connect.EpCallbacks.RecvRefillWaterMark++;
+        }
+            /* connect to control service */
+        connect.ServiceID = WMI_CONTROL_SVC;
+        status = ar6000_connectservice(ar,
+                                       &connect,
+                                       "WMI CONTROL");
+        if (status) {
+            break;
+        }
+
+        connect.LocalConnectionFlags |= HTC_LOCAL_CONN_FLAGS_ENABLE_SEND_BUNDLE_PADDING;
+            /* limit the HTC message size on the send path, although we can receive A-MSDU frames of
+             * 4K, we will only send ethernet-sized (802.3) frames on the send path. */
+        connect.MaxSendMsgSize = WMI_MAX_TX_DATA_FRAME_LENGTH;
+
+            /* to reduce the amount of committed memory for larger A_MSDU frames, use the recv-alloc threshold
+             * mechanism for larger packets */
+        connect.EpCallbacks.RecvAllocThreshold = AR6000_BUFFER_SIZE;
+        connect.EpCallbacks.EpRecvAllocThresh = ar6000_alloc_amsdu_rxbuf;
+
+            /* for the remaining data services set the connection flag to reduce dribbling,
+             * if configured to do so */
+        if (reduce_credit_dribble) {
+            connect.ConnectionFlags |= HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE;
+            /* the credit dribble trigger threshold is (reduce_credit_dribble - 1) for a value
+             * of 0-3 */
+            connect.ConnectionFlags &= ~HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
+            connect.ConnectionFlags |=
+                        ((u16)reduce_credit_dribble - 1) & HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
+        }
+            /* connect to best-effort service */
+        connect.ServiceID = WMI_DATA_BE_SVC;
+
+        status = ar6000_connectservice(ar,
+                                       &connect,
+                                       "WMI DATA BE");
+        if (status) {
+            break;
+        }
+
+            /* connect to back-ground
+             * map this to WMI LOW_PRI */
+        connect.ServiceID = WMI_DATA_BK_SVC;
+        status = ar6000_connectservice(ar,
+                                       &connect,
+                                       "WMI DATA BK");
+        if (status) {
+            break;
+        }
+
+            /* connect to Video service, map this to
+             * to HI PRI */
+        connect.ServiceID = WMI_DATA_VI_SVC;
+        status = ar6000_connectservice(ar,
+                                       &connect,
+                                       "WMI DATA VI");
+        if (status) {
+            break;
+        }
+
+            /* connect to VO service, this is currently not
+             * mapped to a WMI priority stream due to historical reasons.
+             * WMI originally defined 3 priorities over 3 mailboxes
+             * We can change this when WMI is reworked so that priorities are not
+             * dependent on mailboxes */
+        connect.ServiceID = WMI_DATA_VO_SVC;
+        status = ar6000_connectservice(ar,
+                                       &connect,
+                                       "WMI DATA VO");
+        if (status) {
+            break;
+        }
+
+        A_ASSERT(arAc2EndpointID(ar,WMM_AC_BE) != 0);
+        A_ASSERT(arAc2EndpointID(ar,WMM_AC_BK) != 0);
+        A_ASSERT(arAc2EndpointID(ar,WMM_AC_VI) != 0);
+        A_ASSERT(arAc2EndpointID(ar,WMM_AC_VO) != 0);
+
+            /* setup access class priority mappings */
+        ar->arAcStreamPriMap[WMM_AC_BK] = 0; /* lowest  */
+        ar->arAcStreamPriMap[WMM_AC_BE] = 1; /*         */
+        ar->arAcStreamPriMap[WMM_AC_VI] = 2; /*         */
+        ar->arAcStreamPriMap[WMM_AC_VO] = 3; /* highest */
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        if (setuphci && (NULL != ar6kHciTransCallbacks.setupTransport)) {
+            struct hci_transport_misc_handles hciHandles;
+
+            hciHandles.netDevice = ar->arNetDev;
+            hciHandles.hifDevice = ar->arHifDevice;
+            hciHandles.htcHandle = ar->arHtcTarget;
+            status = (int)(ar6kHciTransCallbacks.setupTransport(&hciHandles));
+        }
+#else
+        if (setuphci) {
+                /* setup HCI */
+            status = ar6000_setup_hci(ar);
+        }
+#endif
+
+    } while (false);
+
+    if (status) {
+        ret = -EIO;
+        goto ar6000_init_done;
+    }
+
+        if (regscanmode) {
+                u32 param;
+
+                if (BMIReadMemory(ar->arHifDevice,
+                                  HOST_INTEREST_ITEM_ADDRESS(ar,
+                                                             hi_option_flag),
+                                                             (u8 *)&param,
+                                                             4) != 0) {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                                        ("BMIReadMemory forsetting "
+                                         "regscanmode failed\n"));
+                        return A_ERROR;
+                }
+
+                if (regscanmode == 1)
+                        param |= HI_OPTION_SKIP_REG_SCAN;
+                else if (regscanmode == 2)
+                        param |= HI_OPTION_INIT_REG_SCAN;
+
+                if (BMIWriteMemory(ar->arHifDevice,
+                                   HOST_INTEREST_ITEM_ADDRESS(ar,
+                                                              hi_option_flag),
+                                                              (u8 *)&param,
+                                                              4) != 0) {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                                        ("BMIWriteMemory forsetting "
+                                        "regscanmode failed\n"));
+                        return A_ERROR;
+                }
+                AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("Regulatory scan mode set\n"));
+        }
+
+    /*
+     * give our connected endpoints some buffers
+     */
+
+    ar6000_rx_refill(ar, ar->arControlEp);
+    ar6000_rx_refill(ar, arAc2EndpointID(ar,WMM_AC_BE));
+
+    /*
+     * We will post the receive buffers only for SPE or endpoint ping testing so we are
+     * making it conditional on the 'bypasswmi' flag.
+     */
+    if (bypasswmi) {
+        ar6000_rx_refill(ar,arAc2EndpointID(ar,WMM_AC_BK));
+        ar6000_rx_refill(ar,arAc2EndpointID(ar,WMM_AC_VI));
+        ar6000_rx_refill(ar,arAc2EndpointID(ar,WMM_AC_VO));
+    }
+
+    /* allocate some buffers that handle larger AMSDU frames */
+    ar6000_refill_amsdu_rxbufs(ar,AR6000_MAX_AMSDU_RX_BUFFERS);
+
+        /* setup credit distribution */
+    ar6000_setup_credit_dist(ar->arHtcTarget, &ar->arCreditStateInfo);
+
+    /* Since cookies are used for HTC transports, they should be */
+    /* initialized prior to enabling HTC.                        */
+    ar6000_cookie_init(ar);
+
+    /* start HTC */
+    status = HTCStart(ar->arHtcTarget);
+
+    if (status) {
+        if (ar->arWmiEnabled == true) {
+            wmi_shutdown(ar->arWmi);
+            ar->arWmiEnabled = false;
+            ar->arWmi = NULL;
+        }
+        ar6000_cookie_cleanup(ar);
+        ret = -EIO;
+        goto ar6000_init_done;
+    }
+
+    if (!bypasswmi) {
+        /* Wait for Wmi event to be ready */
+        timeleft = wait_event_interruptible_timeout(arEvent,
+            (ar->arWmiReady == true), wmitimeout * HZ);
+
+        if (ar->arVersion.abi_ver != AR6K_ABI_VERSION) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ABI Version mismatch: Host(0x%x), Target(0x%x)\n", AR6K_ABI_VERSION, ar->arVersion.abi_ver));
+#ifndef ATH6K_SKIP_ABI_VERSION_CHECK
+            ret = -EIO;
+            goto ar6000_init_done;
+#endif /* ATH6K_SKIP_ABI_VERSION_CHECK */
+        }
+
+        if(!timeleft || signal_pending(current))
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("WMI is not ready or wait was interrupted\n"));
+            ret = -EIO;
+            goto ar6000_init_done;
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() WMI is ready\n", __func__));
+
+        /* Communicate the wmi protocol verision to the target */
+        if ((ar6000_set_host_app_area(ar)) != 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set the host app area\n"));
+        }
+        ar6000_target_config_wlan_params(ar);
+    }
+
+    ar->arNumDataEndPts = 1;
+
+    if (bypasswmi) {
+            /* for tests like endpoint ping, the MAC address needs to be non-zero otherwise
+             * the data path through a raw socket is disabled */
+        dev->dev_addr[0] = 0x00;
+        dev->dev_addr[1] = 0x01;
+        dev->dev_addr[2] = 0x02;
+        dev->dev_addr[3] = 0xAA;
+        dev->dev_addr[4] = 0xBB;
+        dev->dev_addr[5] = 0xCC;
+    }
+
+ar6000_init_done:
+    rtnl_lock();
+    dev_put(dev);
+
+    return ret;
+}
+
+
+void
+ar6000_bitrate_rx(void *devt, s32 rateKbps)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)devt;
+
+    ar->arBitRate = rateKbps;
+    wake_up(&arEvent);
+}
+
+void
+ar6000_ratemask_rx(void *devt, u32 ratemask)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)devt;
+
+    ar->arRateMask = ratemask;
+    wake_up(&arEvent);
+}
+
+void
+ar6000_txPwr_rx(void *devt, u8 txPwr)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)devt;
+
+    ar->arTxPwr = txPwr;
+    wake_up(&arEvent);
+}
+
+
+void
+ar6000_channelList_rx(void *devt, s8 numChan, u16 *chanList)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)devt;
+
+    memcpy(ar->arChannelList, chanList, numChan * sizeof (u16));
+    ar->arNumChannels = numChan;
+
+    wake_up(&arEvent);
+}
+
+u8 ar6000_ibss_map_epid(struct sk_buff *skb, struct net_device *dev, u32 *mapNo)
+{
+    struct ar6_softc      *ar = (struct ar6_softc *)ar6k_priv(dev);
+    u8 *datap;
+    ATH_MAC_HDR     *macHdr;
+    u32 i, eptMap;
+
+    (*mapNo) = 0;
+    datap = A_NETBUF_DATA(skb);
+    macHdr = (ATH_MAC_HDR *)(datap + sizeof(WMI_DATA_HDR));
+    if (IEEE80211_IS_MULTICAST(macHdr->dstMac)) {
+        return ENDPOINT_2;
+    }
+
+    eptMap = -1;
+    for (i = 0; i < ar->arNodeNum; i ++) {
+        if (IEEE80211_ADDR_EQ(macHdr->dstMac, ar->arNodeMap[i].macAddress)) {
+            (*mapNo) = i + 1;
+            ar->arNodeMap[i].txPending ++;
+            return ar->arNodeMap[i].epId;
+        }
+
+        if ((eptMap == -1) && !ar->arNodeMap[i].txPending) {
+            eptMap = i;
+        }
+    }
+
+    if (eptMap == -1) {
+        eptMap = ar->arNodeNum;
+        ar->arNodeNum ++;
+        A_ASSERT(ar->arNodeNum <= MAX_NODE_NUM);
+    }
+
+    memcpy(ar->arNodeMap[eptMap].macAddress, macHdr->dstMac, IEEE80211_ADDR_LEN);
+
+    for (i = ENDPOINT_2; i <= ENDPOINT_5; i ++) {
+        if (!ar->arTxPending[i]) {
+            ar->arNodeMap[eptMap].epId = i;
+            break;
+        }
+        // No free endpoint is available, start redistribution on the inuse endpoints.
+        if (i == ENDPOINT_5) {
+            ar->arNodeMap[eptMap].epId = ar->arNexEpId;
+            ar->arNexEpId ++;
+            if (ar->arNexEpId > ENDPOINT_5) {
+                ar->arNexEpId = ENDPOINT_2;
+            }
+        }
+    }
+
+    (*mapNo) = eptMap + 1;
+    ar->arNodeMap[eptMap].txPending ++;
+
+    return ar->arNodeMap[eptMap].epId;
+}
+
+#ifdef DEBUG
+static void ar6000_dump_skb(struct sk_buff *skb)
+{
+   u_char *ch;
+   for (ch = A_NETBUF_DATA(skb);
+        (unsigned long)ch < ((unsigned long)A_NETBUF_DATA(skb) +
+        A_NETBUF_LEN(skb)); ch++)
+    {
+         AR_DEBUG_PRINTF(ATH_DEBUG_WARN,("%2.2x ", *ch));
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_WARN,("\n"));
+}
+#endif
+
+#ifdef HTC_TEST_SEND_PKTS
+static void DoHTCSendPktsTest(struct ar6_softc *ar, int MapNo, HTC_ENDPOINT_ID eid, struct sk_buff *skb);
+#endif
+
+static int
+ar6000_data_tx(struct sk_buff *skb, struct net_device *dev)
+{
+#define AC_NOT_MAPPED   99
+    struct ar6_softc        *ar = (struct ar6_softc *)ar6k_priv(dev);
+    u8 ac = AC_NOT_MAPPED;
+    HTC_ENDPOINT_ID    eid = ENDPOINT_UNUSED;
+    u32 mapNo = 0;
+    int               len;
+    struct ar_cookie *cookie;
+    bool            checkAdHocPsMapping = false,bMoreData = false;
+    HTC_TX_TAG        htc_tag = AR6K_DATA_PKT_TAG;
+    u8 dot11Hdr = processDot11Hdr;
+#ifdef CONFIG_PM
+    if (ar->arWowState != WLAN_WOW_STATE_NONE) {
+        A_NETBUF_FREE(skb);
+        return 0;
+    }
+#endif /* CONFIG_PM */
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("ar6000_data_tx start - skb=0x%lx, data=0x%lx, len=0x%x\n",
+                     (unsigned long)skb, (unsigned long)A_NETBUF_DATA(skb),
+                     A_NETBUF_LEN(skb)));
+
+    /* If target is not associated */
+    if( (!ar->arConnected && !bypasswmi)
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+     /* TCMD doesn't support any data, free the buf and return */
+    || (ar->arTargetMode == AR6000_TCMD_MODE)
+#endif
+                                            ) {
+        A_NETBUF_FREE(skb);
+        return 0;
+    }
+
+    do {
+
+        if (ar->arWmiReady == false && bypasswmi == 0) {
+            break;
+        }
+
+#ifdef BLOCK_TX_PATH_FLAG
+        if (blocktx) {
+            break;
+        }
+#endif /* BLOCK_TX_PATH_FLAG */
+
+        /* AP mode Power save processing */
+        /* If the dst STA is in sleep state, queue the pkt in its PS queue */
+
+        if (ar->arNetworkType == AP_NETWORK) {
+            ATH_MAC_HDR *datap = (ATH_MAC_HDR *)A_NETBUF_DATA(skb);
+            sta_t *conn = NULL;
+
+            /* If the dstMac is a Multicast address & atleast one of the
+             * associated STA is in PS mode, then queue the pkt to the
+             * mcastq
+             */
+            if (IEEE80211_IS_MULTICAST(datap->dstMac)) {
+                u8 ctr=0;
+                bool qMcast=false;
+
+
+                for (ctr=0; ctr<AP_MAX_NUM_STA; ctr++) {
+                    if (STA_IS_PWR_SLEEP((&ar->sta_list[ctr]))) {
+                        qMcast = true;
+                    }
+                }
+                if(qMcast) {
+
+                    /* If this transmit is not because of a Dtim Expiry q it */
+                    if (ar->DTIMExpired == false) {
+                        bool isMcastqEmpty = false;
+
+                        A_MUTEX_LOCK(&ar->mcastpsqLock);
+                        isMcastqEmpty = A_NETBUF_QUEUE_EMPTY(&ar->mcastpsq);
+                        A_NETBUF_ENQUEUE(&ar->mcastpsq, skb);
+                        A_MUTEX_UNLOCK(&ar->mcastpsqLock);
+
+                        /* If this is the first Mcast pkt getting queued
+                         * indicate to the target to set the BitmapControl LSB
+                         * of the TIM IE.
+                         */
+                        if (isMcastqEmpty) {
+                             wmi_set_pvb_cmd(ar->arWmi, MCAST_AID, 1);
+                        }
+                        return 0;
+                    } else {
+                     /* This transmit is because of Dtim expiry. Determine if
+                      * MoreData bit has to be set.
+                      */
+                         A_MUTEX_LOCK(&ar->mcastpsqLock);
+                         if(!A_NETBUF_QUEUE_EMPTY(&ar->mcastpsq)) {
+                             bMoreData = true;
+                         }
+                         A_MUTEX_UNLOCK(&ar->mcastpsqLock);
+                    }
+                }
+            } else {
+                conn = ieee80211_find_conn(ar, datap->dstMac);
+                if (conn) {
+                    if (STA_IS_PWR_SLEEP(conn)) {
+                        /* If this transmit is not because of a PsPoll q it*/
+                        if (!STA_IS_PS_POLLED(conn)) {
+                            bool isPsqEmpty = false;
+                            /* Queue the frames if the STA is sleeping */
+                            A_MUTEX_LOCK(&conn->psqLock);
+                            isPsqEmpty = A_NETBUF_QUEUE_EMPTY(&conn->psq);
+                            A_NETBUF_ENQUEUE(&conn->psq, skb);
+                            A_MUTEX_UNLOCK(&conn->psqLock);
+
+                            /* If this is the first pkt getting queued
+                             * for this STA, update the PVB for this STA
+                             */
+                            if (isPsqEmpty) {
+                                wmi_set_pvb_cmd(ar->arWmi, conn->aid, 1);
+                            }
+
+                            return 0;
+                         } else {
+                         /* This tx is because of a PsPoll. Determine if
+                          * MoreData bit has to be set
+                          */
+                             A_MUTEX_LOCK(&conn->psqLock);
+                             if (!A_NETBUF_QUEUE_EMPTY(&conn->psq)) {
+                                 bMoreData = true;
+                             }
+                             A_MUTEX_UNLOCK(&conn->psqLock);
+                         }
+                    }
+                } else {
+
+                    /* non existent STA. drop the frame */
+                    A_NETBUF_FREE(skb);
+                    return 0;
+                }
+            }
+        }
+
+        if (ar->arWmiEnabled) {
+        u8 csumStart=0;
+        u8 csumDest=0;
+        u8 csum=skb->ip_summed;
+        if(csumOffload && (csum==CHECKSUM_PARTIAL)){
+            csumStart = (skb->head + skb->csum_start - skb_network_header(skb) +
+                         sizeof(ATH_LLC_SNAP_HDR));
+            csumDest=skb->csum_offset+csumStart;
+        }
+            if (A_NETBUF_HEADROOM(skb) < dev->hard_header_len - LINUX_HACK_FUDGE_FACTOR) {
+                struct sk_buff  *newbuf;
+
+                /*
+                 * We really should have gotten enough headroom but sometimes
+                 * we still get packets with not enough headroom.  Copy the packet.
+                 */
+                len = A_NETBUF_LEN(skb);
+                newbuf = A_NETBUF_ALLOC(len);
+                if (newbuf == NULL) {
+                    break;
+                }
+                A_NETBUF_PUT(newbuf, len);
+                memcpy(A_NETBUF_DATA(newbuf), A_NETBUF_DATA(skb), len);
+                A_NETBUF_FREE(skb);
+                skb = newbuf;
+                /* fall through and assemble header */
+            }
+
+            if (dot11Hdr) {
+                if (wmi_dot11_hdr_add(ar->arWmi,skb,ar->arNetworkType) != 0) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_data_tx-wmi_dot11_hdr_add failed\n"));
+                    break;
+                }
+            } else {
+                if (wmi_dix_2_dot3(ar->arWmi, skb) != 0) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_data_tx - wmi_dix_2_dot3 failed\n"));
+                    break;
+                }
+            }
+            if(csumOffload && (csum ==CHECKSUM_PARTIAL)){
+                WMI_TX_META_V2  metaV2;
+                metaV2.csumStart =csumStart;
+                metaV2.csumDest = csumDest;
+                metaV2.csumFlags = 0x1;/*instruct target to calculate checksum*/
+                if (wmi_data_hdr_add(ar->arWmi, skb, DATA_MSGTYPE, bMoreData, dot11Hdr,
+                                        WMI_META_VERSION_2,&metaV2) != 0) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_data_tx - wmi_data_hdr_add failed\n"));
+                    break;
+                }
+
+            }
+            else
+            {
+                if (wmi_data_hdr_add(ar->arWmi, skb, DATA_MSGTYPE, bMoreData, dot11Hdr,0,NULL) != 0) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_data_tx - wmi_data_hdr_add failed\n"));
+                    break;
+                }
+            }
+
+
+            if ((ar->arNetworkType == ADHOC_NETWORK) &&
+                ar->arIbssPsEnable && ar->arConnected) {
+                    /* flag to check adhoc mapping once we take the lock below: */
+                checkAdHocPsMapping = true;
+
+            } else {
+                    /* get the stream mapping */
+                ac  =  wmi_implicit_create_pstream(ar->arWmi, skb, 0, ar->arWmmEnabled);
+            }
+
+        } else {
+            EPPING_HEADER    *eppingHdr;
+
+            eppingHdr = A_NETBUF_DATA(skb);
+
+            if (IS_EPPING_PACKET(eppingHdr)) {
+                    /* the stream ID is mapped to an access class */
+                ac = eppingHdr->StreamNo_h;
+                    /* some EPPING packets cannot be dropped no matter what access class it was
+                     * sent on.  We can change the packet tag to guarantee it will not get dropped */
+                if (IS_EPING_PACKET_NO_DROP(eppingHdr)) {
+                    htc_tag = AR6K_CONTROL_PKT_TAG;
+                }
+
+                if (ac == HCI_TRANSPORT_STREAM_NUM) {
+                        /* pass this to HCI */
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+                    if (!hci_test_send(ar,skb)) {
+                        return 0;
+                    }
+#endif
+                        /* set AC to discard this skb */
+                    ac = AC_NOT_MAPPED;
+                } else {
+                    /* a quirk of linux, the payload of the frame is 32-bit aligned and thus the addition
+                     * of the HTC header will mis-align the start of the HTC frame, so we add some
+                     * padding which will be stripped off in the target */
+                    if (EPPING_ALIGNMENT_PAD > 0) {
+                        A_NETBUF_PUSH(skb, EPPING_ALIGNMENT_PAD);
+                    }
+                }
+
+            } else {
+                    /* not a ping packet, drop it */
+                ac = AC_NOT_MAPPED;
+            }
+        }
+
+    } while (false);
+
+        /* did we succeed ? */
+    if ((ac == AC_NOT_MAPPED) && !checkAdHocPsMapping) {
+            /* cleanup and exit */
+        A_NETBUF_FREE(skb);
+        AR6000_STAT_INC(ar, tx_dropped);
+        AR6000_STAT_INC(ar, tx_aborted_errors);
+        return 0;
+    }
+
+    cookie = NULL;
+
+        /* take the lock to protect driver data */
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    do {
+
+        if (checkAdHocPsMapping) {
+            eid = ar6000_ibss_map_epid(skb, dev, &mapNo);
+        }else {
+            eid = arAc2EndpointID (ar, ac);
+        }
+            /* validate that the endpoint is connected */
+        if (eid == 0 || eid == ENDPOINT_UNUSED ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" eid %d is NOT mapped!\n", eid));
+            break;
+        }
+            /* allocate resource for this packet */
+        cookie = ar6000_alloc_cookie(ar);
+
+        if (cookie != NULL) {
+                /* update counts while the lock is held */
+            ar->arTxPending[eid]++;
+            ar->arTotalTxDataPending++;
+        }
+
+    } while (false);
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    if (cookie != NULL) {
+        cookie->arc_bp[0] = (unsigned long)skb;
+        cookie->arc_bp[1] = mapNo;
+        SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
+                               cookie,
+                               A_NETBUF_DATA(skb),
+                               A_NETBUF_LEN(skb),
+                               eid,
+                               htc_tag);
+
+#ifdef DEBUG
+        if (debugdriver >= 3) {
+            ar6000_dump_skb(skb);
+        }
+#endif
+#ifdef HTC_TEST_SEND_PKTS
+        DoHTCSendPktsTest(ar,mapNo,eid,skb);
+#endif
+            /* HTC interface is asynchronous, if this fails, cleanup will happen in
+             * the ar6000_tx_complete callback */
+        HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
+    } else {
+            /* no packet to send, cleanup */
+        A_NETBUF_FREE(skb);
+        AR6000_STAT_INC(ar, tx_dropped);
+        AR6000_STAT_INC(ar, tx_aborted_errors);
+    }
+
+    return 0;
+}
+
+int
+ar6000_acl_data_tx(struct sk_buff *skb, struct net_device *dev)
+{
+    struct ar6_softc        *ar = (struct ar6_softc *)ar6k_priv(dev);
+    struct ar_cookie *cookie;
+    HTC_ENDPOINT_ID    eid = ENDPOINT_UNUSED;
+
+    cookie = NULL;
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+        /* For now we send ACL on BE endpoint: We can also have a dedicated EP */
+        eid = arAc2EndpointID (ar, 0);
+        /* allocate resource for this packet */
+        cookie = ar6000_alloc_cookie(ar);
+
+        if (cookie != NULL) {
+            /* update counts while the lock is held */
+            ar->arTxPending[eid]++;
+            ar->arTotalTxDataPending++;
+        }
+
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+        if (cookie != NULL) {
+            cookie->arc_bp[0] = (unsigned long)skb;
+            cookie->arc_bp[1] = 0;
+            SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
+                            cookie,
+                            A_NETBUF_DATA(skb),
+                            A_NETBUF_LEN(skb),
+                            eid,
+                            AR6K_DATA_PKT_TAG);
+
+            /* HTC interface is asynchronous, if this fails, cleanup will happen in
+             * the ar6000_tx_complete callback */
+            HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
+        } else {
+            /* no packet to send, cleanup */
+            A_NETBUF_FREE(skb);
+            AR6000_STAT_INC(ar, tx_dropped);
+            AR6000_STAT_INC(ar, tx_aborted_errors);
+        }
+    return 0;
+}
+
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+static void
+tvsub(register struct timeval *out, register struct timeval *in)
+{
+    if((out->tv_usec -= in->tv_usec) < 0) {
+        out->tv_sec--;
+        out->tv_usec += 1000000;
+    }
+    out->tv_sec -= in->tv_sec;
+}
+
+void
+applyAPTCHeuristics(struct ar6_softc *ar)
+{
+    u32 duration;
+    u32 numbytes;
+    u32 throughput;
+    struct timeval ts;
+    int status;
+
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    if ((enableAPTCHeuristics) && (!aptcTR.timerScheduled)) {
+        do_gettimeofday(&ts);
+        tvsub(&ts, &aptcTR.samplingTS);
+        duration = ts.tv_sec * 1000 + ts.tv_usec / 1000; /* ms */
+        numbytes = aptcTR.bytesTransmitted + aptcTR.bytesReceived;
+
+        if (duration > APTC_TRAFFIC_SAMPLING_INTERVAL) {
+            /* Initialize the time stamp and byte count */
+            aptcTR.bytesTransmitted = aptcTR.bytesReceived = 0;
+            do_gettimeofday(&aptcTR.samplingTS);
+
+            /* Calculate and decide based on throughput thresholds */
+            throughput = ((numbytes * 8) / duration);
+            if (throughput > APTC_UPPER_THROUGHPUT_THRESHOLD) {
+                /* Disable Sleep and schedule a timer */
+                A_ASSERT(ar->arWmiReady == true);
+                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+                status = wmi_powermode_cmd(ar->arWmi, MAX_PERF_POWER);
+                AR6000_SPIN_LOCK(&ar->arLock, 0);
+                A_TIMEOUT_MS(&aptcTimer, APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
+                aptcTR.timerScheduled = true;
+            }
+        }
+    }
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+}
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+static HTC_SEND_FULL_ACTION ar6000_tx_queue_full(void *Context, struct htc_packet *pPacket)
+{
+    struct ar6_softc     *ar = (struct ar6_softc *)Context;
+    HTC_SEND_FULL_ACTION    action = HTC_SEND_FULL_KEEP;
+    bool                  stopNet = false;
+    HTC_ENDPOINT_ID         Endpoint = HTC_GET_ENDPOINT_FROM_PKT(pPacket);
+
+    do {
+
+        if (bypasswmi) {
+            int accessClass;
+
+            if (HTC_GET_TAG_FROM_PKT(pPacket) == AR6K_CONTROL_PKT_TAG) {
+                    /* don't drop special control packets */
+                break;
+            }
+
+            accessClass = arEndpoint2Ac(ar,Endpoint);
+                /* for endpoint ping testing drop Best Effort and Background */
+            if ((accessClass == WMM_AC_BE) || (accessClass == WMM_AC_BK)) {
+                action = HTC_SEND_FULL_DROP;
+                stopNet = false;
+            } else {
+                    /* keep but stop the netqueues */
+                stopNet = true;
+            }
+            break;
+        }
+
+        if (Endpoint == ar->arControlEp) {
+                /* under normal WMI if this is getting full, then something is running rampant
+                 * the host should not be exhausting the WMI queue with too many commands
+                 * the only exception to this is during testing using endpointping */
+            AR6000_SPIN_LOCK(&ar->arLock, 0);
+                /* set flag to handle subsequent messages */
+            ar->arWMIControlEpFull = true;
+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("WMI Control Endpoint is FULL!!! \n"));
+                /* no need to stop the network */
+            stopNet = false;
+            break;
+        }
+
+        /* if we get here, we are dealing with data endpoints getting full */
+
+        if (HTC_GET_TAG_FROM_PKT(pPacket) == AR6K_CONTROL_PKT_TAG) {
+            /* don't drop control packets issued on ANY data endpoint */
+            break;
+        }
+
+        if (ar->arNetworkType == ADHOC_NETWORK) {
+            /* in adhoc mode, we cannot differentiate traffic priorities so there is no need to
+             * continue, however we should stop the network */
+            stopNet = true;
+            break;
+        }
+        /* the last MAX_HI_COOKIE_NUM "batch" of cookies are reserved for the highest
+         * active stream */
+        if (ar->arAcStreamPriMap[arEndpoint2Ac(ar,Endpoint)] < ar->arHiAcStreamActivePri &&
+            ar->arCookieCount <= MAX_HI_COOKIE_NUM) {
+                /* this stream's priority is less than the highest active priority, we
+                 * give preference to the highest priority stream by directing
+                 * HTC to drop the packet that overflowed */
+            action = HTC_SEND_FULL_DROP;
+                /* since we are dropping packets, no need to stop the network */
+            stopNet = false;
+            break;
+        }
+
+    } while (false);
+
+    if (stopNet) {
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        ar->arNetQueueStopped = true;
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        /* one of the data endpoints queues is getting full..need to stop network stack
+         * the queue will resume in ar6000_tx_complete() */
+        netif_stop_queue(ar->arNetDev);
+    }
+
+    return action;
+}
+
+
+static void
+ar6000_tx_complete(void *Context, struct htc_packet_queue *pPacketQueue)
+{
+    struct ar6_softc     *ar = (struct ar6_softc *)Context;
+    u32 mapNo = 0;
+    int        status;
+    struct ar_cookie * ar_cookie;
+    HTC_ENDPOINT_ID   eid;
+    bool          wakeEvent = false;
+    struct sk_buff_head  skb_queue;
+    struct htc_packet      *pPacket;
+    struct sk_buff  *pktSkb;
+    bool          flushing = false;
+
+    skb_queue_head_init(&skb_queue);
+
+        /* lock the driver as we update internal state */
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+        /* reap completed packets */
+    while (!HTC_QUEUE_EMPTY(pPacketQueue)) {
+
+        pPacket = HTC_PACKET_DEQUEUE(pPacketQueue);
+
+        ar_cookie = (struct ar_cookie *)pPacket->pPktContext;
+        A_ASSERT(ar_cookie);
+
+        status = pPacket->Status;
+        pktSkb = (struct sk_buff *)ar_cookie->arc_bp[0];
+        eid = pPacket->Endpoint;
+        mapNo = ar_cookie->arc_bp[1];
+
+        A_ASSERT(pktSkb);
+        A_ASSERT(pPacket->pBuffer == A_NETBUF_DATA(pktSkb));
+
+            /* add this to the list, use faster non-lock API */
+        __skb_queue_tail(&skb_queue,pktSkb);
+
+        if (!status) {
+            A_ASSERT(pPacket->ActualLength == A_NETBUF_LEN(pktSkb));
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("ar6000_tx_complete skb=0x%lx data=0x%lx len=0x%x eid=%d ",
+                         (unsigned long)pktSkb, (unsigned long)pPacket->pBuffer,
+                         pPacket->ActualLength,
+                         eid));
+
+        ar->arTxPending[eid]--;
+
+        if ((eid  != ar->arControlEp) || bypasswmi) {
+            ar->arTotalTxDataPending--;
+        }
+
+        if (eid == ar->arControlEp)
+        {
+            if (ar->arWMIControlEpFull) {
+                    /* since this packet completed, the WMI EP is no longer full */
+                ar->arWMIControlEpFull = false;
+            }
+
+            if (ar->arTxPending[eid] == 0) {
+                wakeEvent = true;
+            }
+        }
+
+        if (status) {
+            if (status == A_ECANCELED) {
+                    /* a packet was flushed  */
+                flushing = true;
+            }
+            AR6000_STAT_INC(ar, tx_errors);
+            if (status != A_NO_RESOURCE) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() -TX ERROR, status: 0x%x\n", __func__,
+                            status));
+            }
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("OK\n"));
+            flushing = false;
+            AR6000_STAT_INC(ar, tx_packets);
+            ar->arNetStats.tx_bytes += A_NETBUF_LEN(pktSkb);
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+            aptcTR.bytesTransmitted += a_netbuf_to_len(pktSkb);
+            applyAPTCHeuristics(ar);
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+        }
+
+        // TODO this needs to be looked at
+        if ((ar->arNetworkType == ADHOC_NETWORK) && ar->arIbssPsEnable
+            && (eid != ar->arControlEp) && mapNo)
+        {
+            mapNo --;
+            ar->arNodeMap[mapNo].txPending --;
+
+            if (!ar->arNodeMap[mapNo].txPending && (mapNo == (ar->arNodeNum - 1))) {
+                u32 i;
+                for (i = ar->arNodeNum; i > 0; i --) {
+                    if (!ar->arNodeMap[i - 1].txPending) {
+                        A_MEMZERO(&ar->arNodeMap[i - 1], sizeof(struct ar_node_mapping));
+                        ar->arNodeNum --;
+                    } else {
+                        break;
+                    }
+                }
+            }
+        }
+
+        ar6000_free_cookie(ar, ar_cookie);
+
+        if (ar->arNetQueueStopped) {
+            ar->arNetQueueStopped = false;
+        }
+    }
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    /* lock is released, we can freely call other kernel APIs */
+
+        /* free all skbs in our local list */
+    while (!skb_queue_empty(&skb_queue)) {
+            /* use non-lock version */
+        pktSkb = __skb_dequeue(&skb_queue);
+        A_NETBUF_FREE(pktSkb);
+    }
+
+    if ((ar->arConnected == true) || bypasswmi) {
+        if (!flushing) {
+                /* don't wake the queue if we are flushing, other wise it will just
+                 * keep queueing packets, which will keep failing */
+            netif_wake_queue(ar->arNetDev);
+        }
+    }
+
+    if (wakeEvent) {
+        wake_up(&arEvent);
+    }
+
+}
+
+sta_t *
+ieee80211_find_conn(struct ar6_softc *ar, u8 *node_addr)
+{
+    sta_t *conn = NULL;
+    u8 i, max_conn;
+
+    switch(ar->arNetworkType) {
+        case AP_NETWORK:
+            max_conn = AP_MAX_NUM_STA;
+            break;
+        default:
+            max_conn=0;
+            break;
+    }
+
+    for (i = 0; i < max_conn; i++) {
+        if (IEEE80211_ADDR_EQ(node_addr, ar->sta_list[i].mac)) {
+            conn = &ar->sta_list[i];
+            break;
+        }
+    }
+
+    return conn;
+}
+
+sta_t *ieee80211_find_conn_for_aid(struct ar6_softc *ar, u8 aid)
+{
+    sta_t *conn = NULL;
+    u8 ctr;
+
+    for (ctr = 0; ctr < AP_MAX_NUM_STA; ctr++) {
+        if (ar->sta_list[ctr].aid == aid) {
+            conn = &ar->sta_list[ctr];
+            break;
+        }
+    }
+    return conn;
+}
+
+/*
+ * Receive event handler.  This is called by HTC when a packet is received
+ */
+int pktcount;
+static void
+ar6000_rx(void *Context, struct htc_packet *pPacket)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)Context;
+    struct sk_buff *skb = (struct sk_buff *)pPacket->pPktContext;
+    int minHdrLen;
+    u8 containsDot11Hdr = 0;
+    int        status = pPacket->Status;
+    HTC_ENDPOINT_ID   ept = pPacket->Endpoint;
+
+    A_ASSERT((status) ||
+             (pPacket->pBuffer == (A_NETBUF_DATA(skb) + HTC_HEADER_LEN)));
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_RX,("ar6000_rx ar=0x%lx eid=%d, skb=0x%lx, data=0x%lx, len=0x%x status:%d",
+                    (unsigned long)ar, ept, (unsigned long)skb, (unsigned long)pPacket->pBuffer,
+                    pPacket->ActualLength, status));
+    if (status) {
+        if (status != A_ECANCELED) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("RX ERR (%d) \n",status));
+        }
+    }
+
+        /* take lock to protect buffer counts
+         * and adaptive power throughput state */
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    if (!status) {
+        AR6000_STAT_INC(ar, rx_packets);
+        ar->arNetStats.rx_bytes += pPacket->ActualLength;
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+        aptcTR.bytesReceived += a_netbuf_to_len(skb);
+        applyAPTCHeuristics(ar);
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+        A_NETBUF_PUT(skb, pPacket->ActualLength +  HTC_HEADER_LEN);
+        A_NETBUF_PULL(skb, HTC_HEADER_LEN);
+
+#ifdef DEBUG
+        if (debugdriver >= 2) {
+            ar6000_dump_skb(skb);
+        }
+#endif /* DEBUG */
+    }
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    skb->dev = ar->arNetDev;
+    if (status) {
+        AR6000_STAT_INC(ar, rx_errors);
+        A_NETBUF_FREE(skb);
+    } else if (ar->arWmiEnabled == true) {
+        if (ept == ar->arControlEp) {
+           /*
+            * this is a wmi control msg
+            */
+#ifdef CONFIG_PM 
+            ar6000_check_wow_status(ar, skb, true);
+#endif /* CONFIG_PM */
+            wmi_control_rx(ar->arWmi, skb);
+        } else {
+                WMI_DATA_HDR *dhdr = (WMI_DATA_HDR *)A_NETBUF_DATA(skb);
+                bool is_amsdu;
+                u8 tid;
+
+                /*
+                 * This check can be removed if after a while we do not
+                 * see the warning. For now we leave it to ensure
+                 * we drop these frames accordingly in case the
+                 * target generates them for some reason. These
+                 * were used for an internal PAL but that's not
+                 * used or supported anymore. These frames should
+                 * not come up from the target.
+                 */
+                if (WARN_ON(WMI_DATA_HDR_GET_DATA_TYPE(dhdr) ==
+                            WMI_DATA_HDR_DATA_TYPE_ACL)) {
+                        AR6000_STAT_INC(ar, rx_errors);
+                        A_NETBUF_FREE(skb);
+                        return;
+                }
+
+#ifdef CONFIG_PM 
+                ar6000_check_wow_status(ar, NULL, false);
+#endif /* CONFIG_PM */
+                /*
+                 * this is a wmi data packet
+                 */
+                 // NWF
+
+                if (processDot11Hdr) {
+                    minHdrLen = sizeof(WMI_DATA_HDR) + sizeof(struct ieee80211_frame) + sizeof(ATH_LLC_SNAP_HDR);
+                } else {
+                    minHdrLen = sizeof (WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) +
+                          sizeof(ATH_LLC_SNAP_HDR);
+                }
+
+                /* In the case of AP mode we may receive NULL data frames
+                 * that do not have LLC hdr. They are 16 bytes in size.
+                 * Allow these frames in the AP mode.
+                 * ACL data frames don't follow ethernet frame bounds for
+                 * min length
+                 */
+                if (ar->arNetworkType != AP_NETWORK &&
+                    ((pPacket->ActualLength < minHdrLen) ||
+                    (pPacket->ActualLength > AR6000_MAX_RX_MESSAGE_SIZE)))
+                {
+                    /*
+                     * packet is too short or too long
+                     */
+                    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("TOO SHORT or TOO LONG\n"));
+                    AR6000_STAT_INC(ar, rx_errors);
+                    AR6000_STAT_INC(ar, rx_length_errors);
+                    A_NETBUF_FREE(skb);
+                } else {
+                    u16 seq_no;
+                    u8 meta_type;
+
+#if 0
+                    /* Access RSSI values here */
+                    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("RSSI %d\n",
+                        ((WMI_DATA_HDR *) A_NETBUF_DATA(skb))->rssi));
+#endif
+                    /* Get the Power save state of the STA */
+                    if (ar->arNetworkType == AP_NETWORK) {
+                        sta_t *conn = NULL;
+                        u8 psState=0,prevPsState;
+                        ATH_MAC_HDR *datap=NULL;
+                        u16 offset;
+
+                        meta_type = WMI_DATA_HDR_GET_META(dhdr);
+
+                        psState = (((WMI_DATA_HDR *)A_NETBUF_DATA(skb))->info
+                                     >> WMI_DATA_HDR_PS_SHIFT) & WMI_DATA_HDR_PS_MASK;
+
+                        offset = sizeof(WMI_DATA_HDR);
+
+                        switch (meta_type) {
+                            case 0:
+                                break;
+                            case WMI_META_VERSION_1:
+                                offset += sizeof(WMI_RX_META_V1);
+                                break;
+                            case WMI_META_VERSION_2:
+                                offset += sizeof(WMI_RX_META_V2);
+                                break;
+                            default:
+                                break;
+                        }
+
+                        datap = (ATH_MAC_HDR *)(A_NETBUF_DATA(skb)+offset);
+                        conn = ieee80211_find_conn(ar, datap->srcMac);
+
+                        if (conn) {
+                            /* if there is a change in PS state of the STA,
+                             * take appropriate steps.
+                             * 1. If Sleep-->Awake, flush the psq for the STA
+                             *    Clear the PVB for the STA.
+                             * 2. If Awake-->Sleep, Starting queueing frames
+                             * the STA.
+                             */
+                            prevPsState = STA_IS_PWR_SLEEP(conn);
+                            if (psState) {
+                                STA_SET_PWR_SLEEP(conn);
+                            } else {
+                                STA_CLR_PWR_SLEEP(conn);
+                            }
+
+                            if (prevPsState ^ STA_IS_PWR_SLEEP(conn)) {
+
+                                if (!STA_IS_PWR_SLEEP(conn)) {
+
+                                    A_MUTEX_LOCK(&conn->psqLock);
+                                    while (!A_NETBUF_QUEUE_EMPTY(&conn->psq)) {
+                                        struct sk_buff *skb=NULL;
+
+                                        skb = A_NETBUF_DEQUEUE(&conn->psq);
+                                        A_MUTEX_UNLOCK(&conn->psqLock);
+                                        ar6000_data_tx(skb,ar->arNetDev);
+                                        A_MUTEX_LOCK(&conn->psqLock);
+                                    }
+                                    A_MUTEX_UNLOCK(&conn->psqLock);
+                                    /* Clear the PVB for this STA */
+                                    wmi_set_pvb_cmd(ar->arWmi, conn->aid, 0);
+                                }
+                            }
+                        } else {
+                            /* This frame is from a STA that is not associated*/
+                            A_ASSERT(false);
+                        }
+
+                        /* Drop NULL data frames here */
+                        if((pPacket->ActualLength < minHdrLen) ||
+                                (pPacket->ActualLength > AR6000_MAX_RX_MESSAGE_SIZE)) {
+                            A_NETBUF_FREE(skb);
+                            goto rx_done;
+                        }
+                    }
+
+                    is_amsdu = WMI_DATA_HDR_IS_AMSDU(dhdr) ? true : false;
+                    tid = WMI_DATA_HDR_GET_UP(dhdr);
+                    seq_no = WMI_DATA_HDR_GET_SEQNO(dhdr);
+                    meta_type = WMI_DATA_HDR_GET_META(dhdr);
+                    containsDot11Hdr = WMI_DATA_HDR_GET_DOT11(dhdr);
+
+                    wmi_data_hdr_remove(ar->arWmi, skb);
+
+                    switch (meta_type) {
+                        case WMI_META_VERSION_1:
+                            {
+                                WMI_RX_META_V1 *pMeta = (WMI_RX_META_V1 *)A_NETBUF_DATA(skb);
+                                A_PRINTF("META %d %d %d %d %x\n", pMeta->status, pMeta->rix, pMeta->rssi, pMeta->channel, pMeta->flags);
+                                A_NETBUF_PULL((void*)skb, sizeof(WMI_RX_META_V1));
+                                break;
+                            }
+                        case WMI_META_VERSION_2:
+                            {
+                                WMI_RX_META_V2 *pMeta = (WMI_RX_META_V2 *)A_NETBUF_DATA(skb);
+                                if(pMeta->csumFlags & 0x1){
+                                    skb->ip_summed=CHECKSUM_COMPLETE;
+                                    skb->csum=(pMeta->csum);
+                                }
+                                A_NETBUF_PULL((void*)skb, sizeof(WMI_RX_META_V2));
+                                break;
+                            }
+                        default:
+                            break;
+                    }
+
+                    A_ASSERT(status == 0);
+
+                    /* NWF: print the 802.11 hdr bytes */
+                    if(containsDot11Hdr) {
+                        status = wmi_dot11_hdr_remove(ar->arWmi,skb);
+                    } else if(!is_amsdu) {
+                        status = wmi_dot3_2_dix(skb);
+                    }
+
+                    if (status) {
+                        /* Drop frames that could not be processed (lack of memory, etc.) */
+                        A_NETBUF_FREE(skb);
+                        goto rx_done;
+                    }
+
+                    if ((ar->arNetDev->flags & IFF_UP) == IFF_UP) {
+                        if (ar->arNetworkType == AP_NETWORK) {
+                            struct sk_buff *skb1 = NULL;
+                            ATH_MAC_HDR *datap;
+
+                            datap = (ATH_MAC_HDR *)A_NETBUF_DATA(skb);
+                            if (IEEE80211_IS_MULTICAST(datap->dstMac)) {
+                                /* Bcast/Mcast frames should be sent to the OS
+                                 * stack as well as on the air.
+                                 */
+                                skb1 = skb_copy(skb,GFP_ATOMIC);
+                            } else {
+                                /* Search for a connected STA with dstMac as
+                                 * the Mac address. If found send the frame to
+                                 * it on the air else send the frame up the
+                                 * stack
+                                 */
+                                sta_t *conn = NULL;
+                                conn = ieee80211_find_conn(ar, datap->dstMac);
+
+                                if (conn && ar->intra_bss) {
+                                    skb1 = skb;
+                                    skb = NULL;
+                                } else if(conn && !ar->intra_bss) {
+                                    A_NETBUF_FREE(skb);
+                                    skb = NULL;
+                                }
+                            }
+                            if (skb1) {
+                                ar6000_data_tx(skb1, ar->arNetDev);
+                            }
+                        }
+                    }
+                    aggr_process_recv_frm(ar->aggr_cntxt, tid, seq_no, is_amsdu, (void **)&skb);
+                    ar6000_deliver_frames_to_nw_stack((void *) ar->arNetDev, (void *)skb);
+                }
+            }
+    } else {
+        if (EPPING_ALIGNMENT_PAD > 0) {
+            A_NETBUF_PULL(skb, EPPING_ALIGNMENT_PAD);
+        }
+        ar6000_deliver_frames_to_nw_stack((void *)ar->arNetDev, (void *)skb);
+    }
+
+rx_done:
+
+    return;
+}
+
+static void
+ar6000_deliver_frames_to_nw_stack(void *dev, void *osbuf)
+{
+    struct sk_buff *skb = (struct sk_buff *)osbuf;
+
+    if(skb) {
+        skb->dev = dev;
+        if ((skb->dev->flags & IFF_UP) == IFF_UP) {
+#ifdef CONFIG_PM 
+            ar6000_check_wow_status((struct ar6_softc *)ar6k_priv(dev), skb, false);
+#endif /* CONFIG_PM */
+            skb->protocol = eth_type_trans(skb, skb->dev);
+        /*
+         * If this routine is called on a ISR (Hard IRQ) or DSR (Soft IRQ)
+         * or tasklet use the netif_rx to deliver the packet to the stack
+         * netif_rx will queue the packet onto the receive queue and mark
+         * the softirq thread has a pending action to complete. Kernel will 
+         * schedule the softIrq kernel thread after processing the DSR.
+         *
+         * If this routine is called on a process context, use netif_rx_ni
+         * which will schedle the softIrq kernel thread after queuing the packet.
+         */
+            if (in_interrupt()) {
+                netif_rx(skb);
+            } else {
+                netif_rx_ni(skb);
+            }
+        } else {
+            A_NETBUF_FREE(skb);
+        }
+    }
+}
+
+#if 0
+static void
+ar6000_deliver_frames_to_bt_stack(void *dev, void *osbuf)
+{
+    struct sk_buff *skb = (struct sk_buff *)osbuf;
+
+    if(skb) {
+        skb->dev = dev;
+        if ((skb->dev->flags & IFF_UP) == IFF_UP) {
+            skb->protocol = htons(ETH_P_CONTROL);
+            netif_rx(skb);
+        } else {
+            A_NETBUF_FREE(skb);
+        }
+    }
+}
+#endif
+
+static void
+ar6000_rx_refill(void *Context, HTC_ENDPOINT_ID Endpoint)
+{
+    struct ar6_softc  *ar = (struct ar6_softc *)Context;
+    void        *osBuf;
+    int         RxBuffers;
+    int         buffersToRefill;
+    struct htc_packet  *pPacket;
+    struct htc_packet_queue queue;
+
+    buffersToRefill = (int)AR6000_MAX_RX_BUFFERS -
+                                    HTCGetNumRecvBuffers(ar->arHtcTarget, Endpoint);
+
+    if (buffersToRefill <= 0) {
+            /* fast return, nothing to fill */
+        return;
+    }
+
+    INIT_HTC_PACKET_QUEUE(&queue);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_RX,("ar6000_rx_refill: providing htc with %d buffers at eid=%d\n",
+                    buffersToRefill, Endpoint));
+
+    for (RxBuffers = 0; RxBuffers < buffersToRefill; RxBuffers++) {
+        osBuf = A_NETBUF_ALLOC(AR6000_BUFFER_SIZE);
+        if (NULL == osBuf) {
+            break;
+        }
+            /* the HTC packet wrapper is at the head of the reserved area
+             * in the skb */
+        pPacket = (struct htc_packet *)(A_NETBUF_HEAD(osBuf));
+            /* set re-fill info */
+        SET_HTC_PACKET_INFO_RX_REFILL(pPacket,osBuf,A_NETBUF_DATA(osBuf),AR6000_BUFFER_SIZE,Endpoint);
+            /* add to queue */
+        HTC_PACKET_ENQUEUE(&queue,pPacket);
+    }
+
+    if (!HTC_QUEUE_EMPTY(&queue)) {
+            /* add packets */
+        HTCAddReceivePktMultiple(ar->arHtcTarget, &queue);
+    }
+
+}
+
+  /* clean up our amsdu buffer list */
+static void ar6000_cleanup_amsdu_rxbufs(struct ar6_softc *ar)
+{
+    struct htc_packet  *pPacket;
+    void        *osBuf;
+
+        /* empty AMSDU buffer queue and free OS bufs */
+    while (true) {
+
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        pPacket = HTC_PACKET_DEQUEUE(&ar->amsdu_rx_buffer_queue);
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+        if (NULL == pPacket) {
+            break;
+        }
+
+        osBuf = pPacket->pPktContext;
+        if (NULL == osBuf) {
+            A_ASSERT(false);
+            break;
+        }
+
+        A_NETBUF_FREE(osBuf);
+    }
+
+}
+
+
+    /* refill the amsdu buffer list */
+static void ar6000_refill_amsdu_rxbufs(struct ar6_softc *ar, int Count)
+{
+    struct htc_packet  *pPacket;
+    void        *osBuf;
+
+    while (Count > 0) {
+        osBuf = A_NETBUF_ALLOC(AR6000_AMSDU_BUFFER_SIZE);
+        if (NULL == osBuf) {
+            break;
+        }
+            /* the HTC packet wrapper is at the head of the reserved area
+             * in the skb */
+        pPacket = (struct htc_packet *)(A_NETBUF_HEAD(osBuf));
+            /* set re-fill info */
+        SET_HTC_PACKET_INFO_RX_REFILL(pPacket,osBuf,A_NETBUF_DATA(osBuf),AR6000_AMSDU_BUFFER_SIZE,0);
+
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+            /* put it in the list */
+        HTC_PACKET_ENQUEUE(&ar->amsdu_rx_buffer_queue,pPacket);
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        Count--;
+    }
+
+}
+
+    /* callback to allocate a large receive buffer for a pending packet.  This function is called when
+     * an HTC packet arrives whose length exceeds a threshold value
+     *
+     * We use a pre-allocated list of buffers of maximum AMSDU size (4K).  Under linux it is more optimal to
+     * keep the allocation size the same to optimize cached-slab allocations.
+     *
+     * */
+static struct htc_packet *ar6000_alloc_amsdu_rxbuf(void *Context, HTC_ENDPOINT_ID Endpoint, int Length)
+{
+    struct htc_packet  *pPacket = NULL;
+    struct ar6_softc  *ar = (struct ar6_softc *)Context;
+    int         refillCount = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_RX,("ar6000_alloc_amsdu_rxbuf: eid=%d, Length:%d\n",Endpoint,Length));
+
+    do {
+
+        if (Length <= AR6000_BUFFER_SIZE) {
+                /* shouldn't be getting called on normal sized packets */
+            A_ASSERT(false);
+            break;
+        }
+
+        if (Length > AR6000_AMSDU_BUFFER_SIZE) {
+            A_ASSERT(false);
+            break;
+        }
+
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+            /* allocate a packet from the list */
+        pPacket = HTC_PACKET_DEQUEUE(&ar->amsdu_rx_buffer_queue);
+            /* see if we need to refill again */
+        refillCount = AR6000_MAX_AMSDU_RX_BUFFERS - HTC_PACKET_QUEUE_DEPTH(&ar->amsdu_rx_buffer_queue);
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+        if (NULL == pPacket) {
+            break;
+        }
+            /* set actual endpoint ID */
+        pPacket->Endpoint = Endpoint;
+
+    } while (false);
+
+    if (refillCount >= AR6000_AMSDU_REFILL_THRESHOLD) {
+        ar6000_refill_amsdu_rxbufs(ar,refillCount);
+    }
+
+    return pPacket;
+}
+
+static void     
+ar6000_set_multicast_list(struct net_device *dev)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000: Multicast filter not supported\n"));
+}
+
+static struct net_device_stats *
+ar6000_get_stats(struct net_device *dev)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
+    return &ar->arNetStats;
+}
+
+void
+ar6000_ready_event(void *devt, u8 *datap, u8 phyCap, u32 sw_ver, u32 abi_ver)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)devt;
+    struct net_device *dev = ar->arNetDev;
+
+    memcpy(dev->dev_addr, datap, AR6000_ETH_ADDR_LEN);
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("mac address = %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
+        dev->dev_addr[0], dev->dev_addr[1],
+        dev->dev_addr[2], dev->dev_addr[3],
+        dev->dev_addr[4], dev->dev_addr[5]));
+
+    ar->arPhyCapability = phyCap;
+    ar->arVersion.wlan_ver = sw_ver;
+    ar->arVersion.abi_ver = abi_ver;
+
+    snprintf(ar->wdev->wiphy->fw_version, sizeof(ar->wdev->wiphy->fw_version),
+             "%u:%u:%u:%u",
+             (ar->arVersion.wlan_ver & 0xf0000000) >> 28,
+             (ar->arVersion.wlan_ver & 0x0f000000) >> 24,
+             (ar->arVersion.wlan_ver & 0x00ff0000) >> 16,
+             (ar->arVersion.wlan_ver & 0x0000ffff));
+
+    /* Indicate to the waiting thread that the ready event was received */
+    ar->arWmiReady = true;
+    wake_up(&arEvent);
+}
+
+void ar6000_install_static_wep_keys(struct ar6_softc *ar)
+{
+    u8 index;
+    u8 keyUsage;
+
+    for (index = WMI_MIN_KEY_INDEX; index <= WMI_MAX_KEY_INDEX; index++) {
+        if (ar->arWepKeyList[index].arKeyLen) {
+            keyUsage = GROUP_USAGE;
+            if (index == ar->arDefTxKeyIndex) {
+                keyUsage |= TX_USAGE;
+            }
+            wmi_addKey_cmd(ar->arWmi,
+                           index,
+                           WEP_CRYPT,
+                           keyUsage,
+                           ar->arWepKeyList[index].arKeyLen,
+                           NULL,
+                           ar->arWepKeyList[index].arKey, KEY_OP_INIT_VAL, NULL,
+                           NO_SYNC_WMIFLAG);
+        }
+    }
+}
+
+void
+add_new_sta(struct ar6_softc *ar, u8 *mac, u16 aid, u8 *wpaie,
+            u8 ielen, u8 keymgmt, u8 ucipher, u8 auth)
+{
+    u8 free_slot=aid-1;
+
+        memcpy(ar->sta_list[free_slot].mac, mac, ATH_MAC_LEN);
+        memcpy(ar->sta_list[free_slot].wpa_ie, wpaie, ielen);
+        ar->sta_list[free_slot].aid = aid;
+        ar->sta_list[free_slot].keymgmt = keymgmt;
+        ar->sta_list[free_slot].ucipher = ucipher;
+        ar->sta_list[free_slot].auth = auth;
+        ar->sta_list_index = ar->sta_list_index | (1 << free_slot);
+    ar->arAPStats.sta[free_slot].aid = aid;
+}
+
+void
+ar6000_connect_event(struct ar6_softc *ar, u16 channel, u8 *bssid,
+                     u16 listenInterval, u16 beaconInterval,
+                     NETWORK_TYPE networkType, u8 beaconIeLen,
+                     u8 assocReqLen, u8 assocRespLen,
+                     u8 *assocInfo)
+{
+    union iwreq_data wrqu;
+    int i, beacon_ie_pos, assoc_resp_ie_pos, assoc_req_ie_pos;
+    static const char *tag1 = "ASSOCINFO(ReqIEs=";
+    static const char *tag2 = "ASSOCRESPIE=";
+    static const char *beaconIetag = "BEACONIE=";
+    char buf[WMI_CONTROL_MSG_MAX_LEN * 2 + strlen(tag1) + 1];
+    char *pos;
+    u8 key_op_ctrl;
+    unsigned long flags;
+    struct ieee80211req_key *ik;
+    CRYPTO_TYPE keyType = NONE_CRYPT;
+
+    if(ar->arNetworkType & AP_NETWORK) {
+        struct net_device *dev = ar->arNetDev;
+        if(memcmp(dev->dev_addr, bssid, ATH_MAC_LEN)==0) {
+            ar->arACS = channel;
+            ik = &ar->ap_mode_bkey;
+
+            switch(ar->arAuthMode) {
+            case NONE_AUTH:
+                if(ar->arPairwiseCrypto == WEP_CRYPT) {
+                    ar6000_install_static_wep_keys(ar);
+                }
+#ifdef WAPI_ENABLE
+                else if(ar->arPairwiseCrypto == WAPI_CRYPT) {
+                    ap_set_wapi_key(ar, ik);
+                }
+#endif
+                break;
+            case WPA_PSK_AUTH:
+            case WPA2_PSK_AUTH:
+            case (WPA_PSK_AUTH|WPA2_PSK_AUTH):
+                switch (ik->ik_type) {
+                    case IEEE80211_CIPHER_TKIP:
+                        keyType = TKIP_CRYPT;
+                        break;
+                    case IEEE80211_CIPHER_AES_CCM:
+                        keyType = AES_CRYPT;
+                        break;
+                    default:
+                       goto skip_key;
+                }
+                wmi_addKey_cmd(ar->arWmi, ik->ik_keyix, keyType, GROUP_USAGE,
+                                ik->ik_keylen, (u8 *)&ik->ik_keyrsc,
+                                ik->ik_keydata, KEY_OP_INIT_VAL, ik->ik_macaddr,
+                                SYNC_BOTH_WMIFLAG);
+
+                break;
+            }
+skip_key:
+            ar->arConnected  = true;
+            return;
+        }
+
+        A_PRINTF("NEW STA %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x \n "
+            " AID=%d \n", bssid[0], bssid[1], bssid[2],
+             bssid[3], bssid[4], bssid[5], channel);
+        switch ((listenInterval>>8)&0xFF) {
+            case OPEN_AUTH:
+                A_PRINTF("AUTH: OPEN\n");
+                break;
+            case SHARED_AUTH:
+                A_PRINTF("AUTH: SHARED\n");
+                break;
+            default:
+                A_PRINTF("AUTH: Unknown\n");
+                break;
+        }
+        switch (listenInterval&0xFF) {
+            case WPA_PSK_AUTH:
+                A_PRINTF("KeyMgmt: WPA-PSK\n");
+                break;
+            case WPA2_PSK_AUTH:
+                A_PRINTF("KeyMgmt: WPA2-PSK\n");
+                break;
+            default:
+                A_PRINTF("KeyMgmt: NONE\n");
+                break;
+        }
+        switch (beaconInterval) {
+            case AES_CRYPT:
+                A_PRINTF("Cipher: AES\n");
+                break;
+            case TKIP_CRYPT:
+                A_PRINTF("Cipher: TKIP\n");
+                break;
+            case WEP_CRYPT:
+                A_PRINTF("Cipher: WEP\n");
+                break;
+#ifdef WAPI_ENABLE
+            case WAPI_CRYPT:
+                A_PRINTF("Cipher: WAPI\n");
+                break;
+#endif
+            default:
+                A_PRINTF("Cipher: NONE\n");
+                break;
+        }
+
+        add_new_sta(ar, bssid, channel /*aid*/,
+            assocInfo /* WPA IE */, assocRespLen /* IE len */,
+            listenInterval&0xFF /* Keymgmt */, beaconInterval /* cipher */,
+            (listenInterval>>8)&0xFF /* auth alg */);
+
+        /* Send event to application */
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        memcpy(wrqu.addr.sa_data, bssid, ATH_MAC_LEN);
+        wireless_send_event(ar->arNetDev, IWEVREGISTERED, &wrqu, NULL);
+        /* In case the queue is stopped when we switch modes, this will
+         * wake it up
+         */
+        netif_wake_queue(ar->arNetDev);
+        return;
+    }
+
+    ar6k_cfg80211_connect_event(ar, channel, bssid,
+                                listenInterval, beaconInterval,
+                                networkType, beaconIeLen,
+                                assocReqLen, assocRespLen,
+                                assocInfo);
+
+    memcpy(ar->arBssid, bssid, sizeof(ar->arBssid));
+    ar->arBssChannel = channel;
+
+    A_PRINTF("AR6000 connected event on freq %d ", channel);
+    A_PRINTF("with bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
+            " listenInterval=%d, beaconInterval = %d, beaconIeLen = %d assocReqLen=%d"
+            " assocRespLen =%d\n",
+             bssid[0], bssid[1], bssid[2],
+             bssid[3], bssid[4], bssid[5],
+             listenInterval, beaconInterval,
+             beaconIeLen, assocReqLen, assocRespLen);
+    if (networkType & ADHOC_NETWORK) {
+        if (networkType & ADHOC_CREATOR) {
+            A_PRINTF("Network: Adhoc (Creator)\n");
+        } else {
+            A_PRINTF("Network: Adhoc (Joiner)\n");
+        }
+    } else {
+        A_PRINTF("Network: Infrastructure\n");
+    }
+
+    if ((ar->arNetworkType == INFRA_NETWORK)) {
+        wmi_listeninterval_cmd(ar->arWmi, ar->arListenIntervalT, ar->arListenIntervalB);
+    }
+
+    if (beaconIeLen && (sizeof(buf) > (9 + beaconIeLen * 2))) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nBeaconIEs= "));
+
+        beacon_ie_pos = 0;
+        A_MEMZERO(buf, sizeof(buf));
+        sprintf(buf, "%s", beaconIetag);
+        pos = buf + 9;
+        for (i = beacon_ie_pos; i < beacon_ie_pos + beaconIeLen; i++) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("%2.2x ", assocInfo[i]));
+            sprintf(pos, "%2.2x", assocInfo[i]);
+            pos += 2;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        wrqu.data.length = strlen(buf);
+        wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
+    }
+
+    if (assocRespLen && (sizeof(buf) > (12 + (assocRespLen * 2))))
+    {
+        assoc_resp_ie_pos = beaconIeLen + assocReqLen +
+                            sizeof(u16)  +  /* capinfo*/
+                            sizeof(u16)  +  /* status Code */
+                            sizeof(u16)  ;  /* associd */
+        A_MEMZERO(buf, sizeof(buf));
+        sprintf(buf, "%s", tag2);
+        pos = buf + 12;
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nAssocRespIEs= "));
+        /*
+         * The Association Response Frame w.o. the WLAN header is delivered to
+         * the host, so skip over to the IEs
+         */
+        for (i = assoc_resp_ie_pos; i < assoc_resp_ie_pos + assocRespLen - 6; i++)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("%2.2x ", assocInfo[i]));
+            sprintf(pos, "%2.2x", assocInfo[i]);
+            pos += 2;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        wrqu.data.length = strlen(buf);
+        wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
+    }
+
+    if (assocReqLen && (sizeof(buf) > (17 + (assocReqLen * 2)))) {
+        /*
+         * assoc Request includes capability and listen interval. Skip these.
+         */
+        assoc_req_ie_pos =  beaconIeLen +
+                            sizeof(u16)  +  /* capinfo*/
+                            sizeof(u16);    /* listen interval */
+
+        A_MEMZERO(buf, sizeof(buf));
+        sprintf(buf, "%s", tag1);
+        pos = buf + 17;
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("AssocReqIEs= "));
+        for (i = assoc_req_ie_pos; i < assoc_req_ie_pos + assocReqLen - 4; i++) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("%2.2x ", assocInfo[i]));
+            sprintf(pos, "%2.2x", assocInfo[i]);
+            pos += 2;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        wrqu.data.length = strlen(buf);
+        wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
+    }
+
+    if (ar->user_savedkeys_stat == USER_SAVEDKEYS_STAT_RUN &&
+        ar->user_saved_keys.keyOk == true)
+    {
+        key_op_ctrl = KEY_OP_VALID_MASK & ~KEY_OP_INIT_TSC;
+
+        if (ar->user_key_ctrl & AR6000_USER_SETKEYS_RSC_UNCHANGED) {
+            key_op_ctrl &= ~KEY_OP_INIT_RSC;
+        } else {
+            key_op_ctrl |= KEY_OP_INIT_RSC;
+        }
+        ar6000_reinstall_keys(ar, key_op_ctrl);
+    }
+
+    netif_wake_queue(ar->arNetDev);
+
+    /* Update connect & link status atomically */
+    spin_lock_irqsave(&ar->arLock, flags);
+    ar->arConnected  = true;
+    ar->arConnectPending = false;
+    netif_carrier_on(ar->arNetDev);
+    spin_unlock_irqrestore(&ar->arLock, flags);
+    /* reset the rx aggr state */
+    aggr_reset_state(ar->aggr_cntxt);
+    reconnect_flag = 0;
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    memcpy(wrqu.addr.sa_data, bssid, IEEE80211_ADDR_LEN);
+    wrqu.addr.sa_family = ARPHRD_ETHER;
+    wireless_send_event(ar->arNetDev, SIOCGIWAP, &wrqu, NULL);
+    if ((ar->arNetworkType == ADHOC_NETWORK) && ar->arIbssPsEnable) {
+        A_MEMZERO(ar->arNodeMap, sizeof(ar->arNodeMap));
+        ar->arNodeNum = 0;
+        ar->arNexEpId = ENDPOINT_2;
+    }
+   if (!ar->arUserBssFilter) {
+        wmi_bssfilter_cmd(ar->arWmi, NONE_BSS_FILTER, 0);
+   }
+
+}
+
+void ar6000_set_numdataendpts(struct ar6_softc *ar, u32 num)
+{
+    A_ASSERT(num <= (HTC_MAILBOX_NUM_MAX - 1));
+    ar->arNumDataEndPts = num;
+}
+
+void
+sta_cleanup(struct ar6_softc *ar, u8 i)
+{
+    struct sk_buff *skb;
+
+    /* empty the queued pkts in the PS queue if any */
+    A_MUTEX_LOCK(&ar->sta_list[i].psqLock);
+    while (!A_NETBUF_QUEUE_EMPTY(&ar->sta_list[i].psq)) {
+        skb = A_NETBUF_DEQUEUE(&ar->sta_list[i].psq);
+        A_NETBUF_FREE(skb);
+    }
+    A_MUTEX_UNLOCK(&ar->sta_list[i].psqLock);
+
+    /* Zero out the state fields */
+    A_MEMZERO(&ar->arAPStats.sta[ar->sta_list[i].aid-1], sizeof(WMI_PER_STA_STAT));
+    A_MEMZERO(&ar->sta_list[i].mac, ATH_MAC_LEN);
+    A_MEMZERO(&ar->sta_list[i].wpa_ie, IEEE80211_MAX_IE);
+    ar->sta_list[i].aid = 0;
+    ar->sta_list[i].flags = 0;
+
+    ar->sta_list_index = ar->sta_list_index & ~(1 << i);
+
+}
+
+u8 remove_sta(struct ar6_softc *ar, u8 *mac, u16 reason)
+{
+    u8 i, removed=0;
+
+    if(IS_MAC_NULL(mac)) {
+        return removed;
+    }
+
+    if(IS_MAC_BCAST(mac)) {
+        A_PRINTF("DEL ALL STA\n");
+        for(i=0; i < AP_MAX_NUM_STA; i++) {
+            if(!IS_MAC_NULL(ar->sta_list[i].mac)) {
+                sta_cleanup(ar, i);
+                removed = 1;
+            }
+        }
+    } else {
+        for(i=0; i < AP_MAX_NUM_STA; i++) {
+            if(memcmp(ar->sta_list[i].mac, mac, ATH_MAC_LEN)==0) {
+                A_PRINTF("DEL STA %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
+                " aid=%d REASON=%d\n", mac[0], mac[1], mac[2],
+                 mac[3], mac[4], mac[5], ar->sta_list[i].aid, reason);
+
+                sta_cleanup(ar, i);
+                removed = 1;
+                break;
+            }
+        }
+    }
+    return removed;
+}
+
+void
+ar6000_disconnect_event(struct ar6_softc *ar, u8 reason, u8 *bssid,
+                        u8 assocRespLen, u8 *assocInfo, u16 protocolReasonStatus)
+{
+    u8 i;
+    unsigned long flags;
+    union iwreq_data wrqu;
+
+    if(ar->arNetworkType & AP_NETWORK) {
+        union iwreq_data wrqu;
+        struct sk_buff *skb;
+
+        if(!remove_sta(ar, bssid, protocolReasonStatus)) {
+            return;
+        }
+
+        /* If there are no more associated STAs, empty the mcast PS q */
+        if (ar->sta_list_index == 0) {
+            A_MUTEX_LOCK(&ar->mcastpsqLock);
+            while (!A_NETBUF_QUEUE_EMPTY(&ar->mcastpsq)) {
+                skb = A_NETBUF_DEQUEUE(&ar->mcastpsq);
+                A_NETBUF_FREE(skb);
+            }
+            A_MUTEX_UNLOCK(&ar->mcastpsqLock);
+
+            /* Clear the LSB of the BitMapCtl field of the TIM IE */
+            if (ar->arWmiReady) {
+                wmi_set_pvb_cmd(ar->arWmi, MCAST_AID, 0);
+            }
+        }
+
+        if(!IS_MAC_BCAST(bssid)) {
+            /* Send event to application */
+            A_MEMZERO(&wrqu, sizeof(wrqu));
+            memcpy(wrqu.addr.sa_data, bssid, ATH_MAC_LEN);
+            wireless_send_event(ar->arNetDev, IWEVEXPIRED, &wrqu, NULL);
+        }
+
+        ar->arConnected = false;
+        return;
+    }
+
+    ar6k_cfg80211_disconnect_event(ar, reason, bssid,
+                                   assocRespLen, assocInfo,
+                                   protocolReasonStatus);
+
+    /* Send disconnect event to supplicant */
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.addr.sa_family = ARPHRD_ETHER;
+    wireless_send_event(ar->arNetDev, SIOCGIWAP, &wrqu, NULL);
+
+    /* it is necessary to clear the host-side rx aggregation state */
+    aggr_reset_state(ar->aggr_cntxt);
+
+    A_UNTIMEOUT(&ar->disconnect_timer);
+
+    A_PRINTF("AR6000 disconnected");
+    if (bssid[0] || bssid[1] || bssid[2] || bssid[3] || bssid[4] || bssid[5]) {
+        A_PRINTF(" from %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
+                 bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nDisconnect Reason is %d", reason));
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nProtocol Reason/Status Code is %d", protocolReasonStatus));
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nAssocResp Frame = %s",
+                    assocRespLen ? " " : "NULL"));
+    for (i = 0; i < assocRespLen; i++) {
+        if (!(i % 0x10)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("%2.2x ", assocInfo[i]));
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+    /*
+     * If the event is due to disconnect cmd from the host, only they the target
+     * would stop trying to connect. Under any other condition, target would
+     * keep trying to connect.
+     *
+     */
+    if( reason == DISCONNECT_CMD)
+    {
+        if ((!ar->arUserBssFilter) && (ar->arWmiReady)) {
+            wmi_bssfilter_cmd(ar->arWmi, NONE_BSS_FILTER, 0);
+        }
+    } else {
+        ar->arConnectPending = true;
+        if (((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x11)) ||
+            ((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x0) && (reconnect_flag == 1))) {
+            ar->arConnected = true;
+            return;
+        }
+    }
+
+    if ((reason == NO_NETWORK_AVAIL) && (ar->arWmiReady)) 
+    {
+        bss_t *pWmiSsidnode = NULL;
+
+        /* remove the current associated bssid node */
+        wmi_free_node (ar->arWmi, bssid);
+
+        /*
+         * In case any other same SSID nodes are present
+         * remove it, since those nodes also not available now
+         */
+        do
+        {
+            /*
+             * Find the nodes based on SSID and remove it
+             * NOTE :: This case will not work out for Hidden-SSID
+             */
+            pWmiSsidnode = wmi_find_Ssidnode (ar->arWmi, ar->arSsid, ar->arSsidLen, false, true);
+
+            if (pWmiSsidnode)
+            {
+                wmi_free_node (ar->arWmi, pWmiSsidnode->ni_macaddr);
+            }
+
+        } while (pWmiSsidnode);
+    }
+
+    /* Update connect & link status atomically */
+    spin_lock_irqsave(&ar->arLock, flags);
+    ar->arConnected = false;
+    netif_carrier_off(ar->arNetDev);
+    spin_unlock_irqrestore(&ar->arLock, flags);
+
+    if( (reason != CSERV_DISCONNECT) || (reconnect_flag != 1) ) {
+        reconnect_flag = 0;
+    }
+
+    if (reason != CSERV_DISCONNECT)
+    {
+        ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
+        ar->user_key_ctrl      = 0;
+    }
+
+    netif_stop_queue(ar->arNetDev);
+    A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
+    ar->arBssChannel = 0;
+    ar->arBeaconInterval = 0;
+
+    ar6000_TxDataCleanup(ar);
+}
+
+void
+ar6000_regDomain_event(struct ar6_softc *ar, u32 regCode)
+{
+    A_PRINTF("AR6000 Reg Code = 0x%x\n", regCode);
+    ar->arRegCode = regCode;
+}
+
+void
+ar6000_aggr_rcv_addba_req_evt(struct ar6_softc *ar, WMI_ADDBA_REQ_EVENT *evt)
+{
+    if(evt->status == 0) {
+        aggr_recv_addba_req_evt(ar->aggr_cntxt, evt->tid, evt->st_seq_no, evt->win_sz);
+    }
+}
+
+void
+ar6000_aggr_rcv_addba_resp_evt(struct ar6_softc *ar, WMI_ADDBA_RESP_EVENT *evt)
+{
+    A_PRINTF("ADDBA RESP. tid %d status %d, sz %d\n", evt->tid, evt->status, evt->amsdu_sz);
+    if(evt->status == 0) {
+    }
+}
+
+void
+ar6000_aggr_rcv_delba_req_evt(struct ar6_softc *ar, WMI_DELBA_EVENT *evt)
+{
+    aggr_recv_delba_req_evt(ar->aggr_cntxt, evt->tid);
+}
+
+void register_pal_cb(ar6k_pal_config_t *palConfig_p)
+{
+  ar6k_pal_config_g = *palConfig_p;
+}
+
+void
+ar6000_hci_event_rcv_evt(struct ar6_softc *ar, WMI_HCI_EVENT *cmd)
+{
+    void *osbuf = NULL;
+    s8 i;
+    u8 size, *buf;
+    int ret = 0;
+
+    size = cmd->evt_buf_sz + 4;
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+       ret = A_NO_MEMORY;
+       A_PRINTF("Error in allocating netbuf \n");
+       return;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+    buf = (u8 *)A_NETBUF_DATA(osbuf);
+    /* First 2-bytes carry HCI event/ACL data type
+     * the next 2 are free
+     */
+    *((short *)buf) = WMI_HCI_EVENT_EVENTID;
+    buf += sizeof(int);
+    memcpy(buf, cmd->buf, cmd->evt_buf_sz);
+
+    ar6000_deliver_frames_to_nw_stack(ar->arNetDev, osbuf);
+    if(loghci) {
+        A_PRINTF_LOG("HCI Event From PAL <-- \n");
+        for(i = 0; i < cmd->evt_buf_sz; i++) {
+           A_PRINTF_LOG("0x%02x ", cmd->buf[i]);
+           if((i % 10) == 0) {
+               A_PRINTF_LOG("\n");
+           }
+        }
+        A_PRINTF_LOG("\n");
+        A_PRINTF_LOG("==================================\n");
+    }
+}
+
+void
+ar6000_neighborReport_event(struct ar6_softc *ar, int numAps, WMI_NEIGHBOR_INFO *info)
+{
+#if WIRELESS_EXT >= 18
+    struct iw_pmkid_cand *pmkcand;
+#else /* WIRELESS_EXT >= 18 */
+    static const char *tag = "PRE-AUTH";
+    char buf[128];
+#endif /* WIRELESS_EXT >= 18 */
+
+    union iwreq_data wrqu;
+    int i;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_SCAN,("AR6000 Neighbor Report Event\n"));
+    for (i=0; i < numAps; info++, i++) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_SCAN,("bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
+            info->bssid[0], info->bssid[1], info->bssid[2],
+            info->bssid[3], info->bssid[4], info->bssid[5]));
+        if (info->bssFlags & WMI_PREAUTH_CAPABLE_BSS) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_SCAN,("preauth-cap"));
+        }
+        if (info->bssFlags & WMI_PMKID_VALID_BSS) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_SCAN,(" pmkid-valid\n"));
+            continue;           /* we skip bss if the pmkid is already valid */
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_SCAN,("\n"));
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+#if WIRELESS_EXT >= 18
+        pmkcand = A_MALLOC_NOWAIT(sizeof(struct iw_pmkid_cand));
+        A_MEMZERO(pmkcand, sizeof(struct iw_pmkid_cand));
+        pmkcand->index = i;
+        pmkcand->flags = info->bssFlags;
+        memcpy(pmkcand->bssid.sa_data, info->bssid, ATH_MAC_LEN);
+        wrqu.data.length = sizeof(struct iw_pmkid_cand);
+        wireless_send_event(ar->arNetDev, IWEVPMKIDCAND, &wrqu, (char *)pmkcand);
+        kfree(pmkcand);
+#else /* WIRELESS_EXT >= 18 */
+        snprintf(buf, sizeof(buf), "%s%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x",
+                 tag,
+                 info->bssid[0], info->bssid[1], info->bssid[2],
+                 info->bssid[3], info->bssid[4], info->bssid[5],
+                 i, info->bssFlags);
+        wrqu.data.length = strlen(buf);
+        wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
+#endif /* WIRELESS_EXT >= 18 */
+    }
+}
+
+void
+ar6000_tkip_micerr_event(struct ar6_softc *ar, u8 keyid, bool ismcast)
+{
+    static const char *tag = "MLME-MICHAELMICFAILURE.indication";
+    char buf[128];
+    union iwreq_data wrqu;
+
+    /*
+     * For AP case, keyid will have aid of STA which sent pkt with
+     * MIC error. Use this aid to get MAC & send it to hostapd.
+     */
+    if (ar->arNetworkType == AP_NETWORK) {
+        sta_t *s = ieee80211_find_conn_for_aid(ar, (keyid >> 2));
+        if(!s){
+            A_PRINTF("AP TKIP MIC error received from Invalid aid / STA not found =%d\n", keyid);
+            return;
+        }
+        A_PRINTF("AP TKIP MIC error received from aid=%d\n", keyid);
+        snprintf(buf,sizeof(buf), "%s addr=%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x",
+            tag, s->mac[0],s->mac[1],s->mac[2],s->mac[3],s->mac[4],s->mac[5]);
+    } else {
+
+    ar6k_cfg80211_tkip_micerr_event(ar, keyid, ismcast);
+
+        A_PRINTF("AR6000 TKIP MIC error received for keyid %d %scast\n",
+             keyid & 0x3, ismcast ? "multi": "uni");
+        snprintf(buf, sizeof(buf), "%s(keyid=%d %sicast)", tag, keyid & 0x3,
+             ismcast ? "mult" : "un");
+    }
+
+    memset(&wrqu, 0, sizeof(wrqu));
+    wrqu.data.length = strlen(buf);
+    wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+void
+ar6000_scanComplete_event(struct ar6_softc *ar, int status)
+{
+
+    ar6k_cfg80211_scanComplete_event(ar, status);
+
+    if (!ar->arUserBssFilter) {
+        wmi_bssfilter_cmd(ar->arWmi, NONE_BSS_FILTER, 0);
+    }
+    if (ar->scan_triggered) {
+        if (status== 0) {
+            union iwreq_data wrqu;
+            A_MEMZERO(&wrqu, sizeof(wrqu));
+            wireless_send_event(ar->arNetDev, SIOCGIWSCAN, &wrqu, NULL);
+        }
+        ar->scan_triggered = 0;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_SCAN,( "AR6000 scan complete: %d\n", status));
+}
+
+void
+ar6000_targetStats_event(struct ar6_softc *ar,  u8 *ptr, u32 len)
+{
+    u8 ac;
+
+    if(ar->arNetworkType == AP_NETWORK) {
+        WMI_AP_MODE_STAT *p = (WMI_AP_MODE_STAT *)ptr;
+        WMI_AP_MODE_STAT *ap = &ar->arAPStats;
+
+        if (len < sizeof(*p)) {
+            return;
+        }
+
+        for(ac=0;ac<AP_MAX_NUM_STA;ac++) {
+            ap->sta[ac].tx_bytes   += p->sta[ac].tx_bytes;
+            ap->sta[ac].tx_pkts    += p->sta[ac].tx_pkts;
+            ap->sta[ac].tx_error   += p->sta[ac].tx_error;
+            ap->sta[ac].tx_discard += p->sta[ac].tx_discard;
+            ap->sta[ac].rx_bytes   += p->sta[ac].rx_bytes;
+            ap->sta[ac].rx_pkts    += p->sta[ac].rx_pkts;
+            ap->sta[ac].rx_error   += p->sta[ac].rx_error;
+            ap->sta[ac].rx_discard += p->sta[ac].rx_discard;
+        }
+
+    } else {
+        WMI_TARGET_STATS *pTarget = (WMI_TARGET_STATS *)ptr;
+         TARGET_STATS *pStats = &ar->arTargetStats;
+
+        if (len < sizeof(*pTarget)) {
+            return;
+        }
+
+        // Update the RSSI of the connected bss.
+        if (ar->arConnected) {
+            bss_t *pConnBss = NULL;
+
+            pConnBss = wmi_find_node(ar->arWmi,ar->arBssid);
+            if (pConnBss)
+            {
+                pConnBss->ni_rssi = pTarget->cservStats.cs_aveBeacon_rssi;
+                pConnBss->ni_snr = pTarget->cservStats.cs_aveBeacon_snr;
+                wmi_node_return(ar->arWmi, pConnBss);
+            }
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 updating target stats\n"));
+        pStats->tx_packets          += pTarget->txrxStats.tx_stats.tx_packets;
+        pStats->tx_bytes            += pTarget->txrxStats.tx_stats.tx_bytes;
+        pStats->tx_unicast_pkts     += pTarget->txrxStats.tx_stats.tx_unicast_pkts;
+        pStats->tx_unicast_bytes    += pTarget->txrxStats.tx_stats.tx_unicast_bytes;
+        pStats->tx_multicast_pkts   += pTarget->txrxStats.tx_stats.tx_multicast_pkts;
+        pStats->tx_multicast_bytes  += pTarget->txrxStats.tx_stats.tx_multicast_bytes;
+        pStats->tx_broadcast_pkts   += pTarget->txrxStats.tx_stats.tx_broadcast_pkts;
+        pStats->tx_broadcast_bytes  += pTarget->txrxStats.tx_stats.tx_broadcast_bytes;
+        pStats->tx_rts_success_cnt  += pTarget->txrxStats.tx_stats.tx_rts_success_cnt;
+        for(ac = 0; ac < WMM_NUM_AC; ac++)
+            pStats->tx_packet_per_ac[ac] += pTarget->txrxStats.tx_stats.tx_packet_per_ac[ac];
+        pStats->tx_errors           += pTarget->txrxStats.tx_stats.tx_errors;
+        pStats->tx_failed_cnt       += pTarget->txrxStats.tx_stats.tx_failed_cnt;
+        pStats->tx_retry_cnt        += pTarget->txrxStats.tx_stats.tx_retry_cnt;
+        pStats->tx_mult_retry_cnt   += pTarget->txrxStats.tx_stats.tx_mult_retry_cnt;
+        pStats->tx_rts_fail_cnt     += pTarget->txrxStats.tx_stats.tx_rts_fail_cnt;
+        pStats->tx_unicast_rate      = wmi_get_rate(pTarget->txrxStats.tx_stats.tx_unicast_rate);
+
+        pStats->rx_packets          += pTarget->txrxStats.rx_stats.rx_packets;
+        pStats->rx_bytes            += pTarget->txrxStats.rx_stats.rx_bytes;
+        pStats->rx_unicast_pkts     += pTarget->txrxStats.rx_stats.rx_unicast_pkts;
+        pStats->rx_unicast_bytes    += pTarget->txrxStats.rx_stats.rx_unicast_bytes;
+        pStats->rx_multicast_pkts   += pTarget->txrxStats.rx_stats.rx_multicast_pkts;
+        pStats->rx_multicast_bytes  += pTarget->txrxStats.rx_stats.rx_multicast_bytes;
+        pStats->rx_broadcast_pkts   += pTarget->txrxStats.rx_stats.rx_broadcast_pkts;
+        pStats->rx_broadcast_bytes  += pTarget->txrxStats.rx_stats.rx_broadcast_bytes;
+        pStats->rx_fragment_pkt     += pTarget->txrxStats.rx_stats.rx_fragment_pkt;
+        pStats->rx_errors           += pTarget->txrxStats.rx_stats.rx_errors;
+        pStats->rx_crcerr           += pTarget->txrxStats.rx_stats.rx_crcerr;
+        pStats->rx_key_cache_miss   += pTarget->txrxStats.rx_stats.rx_key_cache_miss;
+        pStats->rx_decrypt_err      += pTarget->txrxStats.rx_stats.rx_decrypt_err;
+        pStats->rx_duplicate_frames += pTarget->txrxStats.rx_stats.rx_duplicate_frames;
+        pStats->rx_unicast_rate      = wmi_get_rate(pTarget->txrxStats.rx_stats.rx_unicast_rate);
+
+
+        pStats->tkip_local_mic_failure
+                                += pTarget->txrxStats.tkipCcmpStats.tkip_local_mic_failure;
+        pStats->tkip_counter_measures_invoked
+                                += pTarget->txrxStats.tkipCcmpStats.tkip_counter_measures_invoked;
+        pStats->tkip_replays        += pTarget->txrxStats.tkipCcmpStats.tkip_replays;
+        pStats->tkip_format_errors  += pTarget->txrxStats.tkipCcmpStats.tkip_format_errors;
+        pStats->ccmp_format_errors  += pTarget->txrxStats.tkipCcmpStats.ccmp_format_errors;
+        pStats->ccmp_replays        += pTarget->txrxStats.tkipCcmpStats.ccmp_replays;
+
+        pStats->power_save_failure_cnt += pTarget->pmStats.power_save_failure_cnt;
+        pStats->noise_floor_calibation = pTarget->noise_floor_calibation;
+
+        pStats->cs_bmiss_cnt        += pTarget->cservStats.cs_bmiss_cnt;
+        pStats->cs_lowRssi_cnt      += pTarget->cservStats.cs_lowRssi_cnt;
+        pStats->cs_connect_cnt      += pTarget->cservStats.cs_connect_cnt;
+        pStats->cs_disconnect_cnt   += pTarget->cservStats.cs_disconnect_cnt;
+        pStats->cs_aveBeacon_snr    = pTarget->cservStats.cs_aveBeacon_snr;
+        pStats->cs_aveBeacon_rssi   = pTarget->cservStats.cs_aveBeacon_rssi;
+
+        if (enablerssicompensation) {
+            pStats->cs_aveBeacon_rssi =
+                    rssi_compensation_calc(ar, pStats->cs_aveBeacon_rssi);
+        }
+        pStats->cs_lastRoam_msec    = pTarget->cservStats.cs_lastRoam_msec;
+        pStats->cs_snr              = pTarget->cservStats.cs_snr;
+        pStats->cs_rssi             = pTarget->cservStats.cs_rssi;
+
+        pStats->lq_val              = pTarget->lqVal;
+
+        pStats->wow_num_pkts_dropped += pTarget->wowStats.wow_num_pkts_dropped;
+        pStats->wow_num_host_pkt_wakeups += pTarget->wowStats.wow_num_host_pkt_wakeups;
+        pStats->wow_num_host_event_wakeups += pTarget->wowStats.wow_num_host_event_wakeups;
+        pStats->wow_num_events_discarded += pTarget->wowStats.wow_num_events_discarded;
+        pStats->arp_received += pTarget->arpStats.arp_received;
+        pStats->arp_matched  += pTarget->arpStats.arp_matched;
+        pStats->arp_replied  += pTarget->arpStats.arp_replied;
+
+        if (ar->statsUpdatePending) {
+            ar->statsUpdatePending = false;
+            wake_up(&arEvent);
+        }
+    }
+}
+
+void
+ar6000_rssiThreshold_event(struct ar6_softc *ar,  WMI_RSSI_THRESHOLD_VAL newThreshold, s16 rssi)
+{
+    USER_RSSI_THOLD userRssiThold;
+
+    rssi = rssi + SIGNAL_QUALITY_NOISE_FLOOR;
+
+    if (enablerssicompensation) {
+        rssi = rssi_compensation_calc(ar, rssi);
+    }
+
+    /* Send an event to the app */
+    userRssiThold.tag = ar->rssi_map[newThreshold].tag;
+    userRssiThold.rssi = rssi;
+    A_PRINTF("rssi Threshold range = %d tag = %d  rssi = %d\n", newThreshold,
+             userRssiThold.tag, userRssiThold.rssi);
+}
+
+
+void
+ar6000_hbChallengeResp_event(struct ar6_softc *ar, u32 cookie, u32 source)
+{
+    if (source != APP_HB_CHALLENGE) {
+        /* This would ignore the replys that come in after their due time */
+        if (cookie == ar->arHBChallengeResp.seqNum) {
+            ar->arHBChallengeResp.outstanding = false;
+        }
+    }
+}
+
+
+void
+ar6000_reportError_event(struct ar6_softc *ar, WMI_TARGET_ERROR_VAL errorVal)
+{
+        static const char * const errString[] = {
+                [WMI_TARGET_PM_ERR_FAIL]    "WMI_TARGET_PM_ERR_FAIL",
+                [WMI_TARGET_KEY_NOT_FOUND]  "WMI_TARGET_KEY_NOT_FOUND",
+                [WMI_TARGET_DECRYPTION_ERR] "WMI_TARGET_DECRYPTION_ERR",
+                [WMI_TARGET_BMISS]          "WMI_TARGET_BMISS",
+                [WMI_PSDISABLE_NODE_JOIN]   "WMI_PSDISABLE_NODE_JOIN"
+        };
+
+    A_PRINTF("AR6000 Error on Target. Error = 0x%x\n", errorVal);
+
+    /* One error is reported at a time, and errorval is a bitmask */
+    if(errorVal & (errorVal - 1))
+       return;
+
+    A_PRINTF("AR6000 Error type = ");
+    switch(errorVal)
+    {
+        case WMI_TARGET_PM_ERR_FAIL:
+        case WMI_TARGET_KEY_NOT_FOUND:
+        case WMI_TARGET_DECRYPTION_ERR:
+        case WMI_TARGET_BMISS:
+        case WMI_PSDISABLE_NODE_JOIN:
+            A_PRINTF("%s\n", errString[errorVal]);
+            break;
+        default:
+            A_PRINTF("INVALID\n");
+            break;
+    }
+
+}
+
+
+void
+ar6000_cac_event(struct ar6_softc *ar, u8 ac, u8 cacIndication,
+                 u8 statusCode, u8 *tspecSuggestion)
+{
+    WMM_TSPEC_IE    *tspecIe;
+
+    /*
+     * This is the TSPEC IE suggestion from AP.
+     * Suggestion provided by AP under some error
+     * cases, could be helpful for the host app.
+     * Check documentation.
+     */
+    tspecIe = (WMM_TSPEC_IE *)tspecSuggestion;
+
+    /*
+     * What do we do, if we get TSPEC rejection? One thought
+     * that comes to mind is implictly delete the pstream...
+     */
+    A_PRINTF("AR6000 CAC notification. "
+                "AC = %d, cacIndication = 0x%x, statusCode = 0x%x\n",
+                 ac, cacIndication, statusCode);
+}
+
+void
+ar6000_channel_change_event(struct ar6_softc *ar, u16 oldChannel,
+                            u16 newChannel)
+{
+    A_PRINTF("Channel Change notification\nOld Channel: %d, New Channel: %d\n",
+             oldChannel, newChannel);
+}
+
+#define AR6000_PRINT_BSSID(_pBss)  do {     \
+        A_PRINTF("%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",\
+                 (_pBss)[0],(_pBss)[1],(_pBss)[2],(_pBss)[3],\
+                 (_pBss)[4],(_pBss)[5]);  \
+} while(0)
+
+void
+ar6000_roam_tbl_event(struct ar6_softc *ar, WMI_TARGET_ROAM_TBL *pTbl)
+{
+    u8 i;
+
+    A_PRINTF("ROAM TABLE NO OF ENTRIES is %d ROAM MODE is %d\n",
+              pTbl->numEntries, pTbl->roamMode);
+    for (i= 0; i < pTbl->numEntries; i++) {
+        A_PRINTF("[%d]bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ", i,
+            pTbl->bssRoamInfo[i].bssid[0], pTbl->bssRoamInfo[i].bssid[1],
+            pTbl->bssRoamInfo[i].bssid[2],
+            pTbl->bssRoamInfo[i].bssid[3],
+            pTbl->bssRoamInfo[i].bssid[4],
+            pTbl->bssRoamInfo[i].bssid[5]);
+        A_PRINTF("RSSI %d RSSIDT %d LAST RSSI %d UTIL %d ROAM_UTIL %d"
+                 " BIAS %d\n",
+            pTbl->bssRoamInfo[i].rssi,
+            pTbl->bssRoamInfo[i].rssidt,
+            pTbl->bssRoamInfo[i].last_rssi,
+            pTbl->bssRoamInfo[i].util,
+            pTbl->bssRoamInfo[i].roam_util,
+            pTbl->bssRoamInfo[i].bias);
+    }
+}
+
+void
+ar6000_wow_list_event(struct ar6_softc *ar, u8 num_filters, WMI_GET_WOW_LIST_REPLY *wow_reply)
+{
+    u8 i,j;
+
+    /*Each event now contains exactly one filter, see bug 26613*/
+    A_PRINTF("WOW pattern %d of %d patterns\n", wow_reply->this_filter_num,                 wow_reply->num_filters);
+    A_PRINTF("wow mode = %s host mode = %s\n",
+            (wow_reply->wow_mode == 0? "disabled":"enabled"),
+            (wow_reply->host_mode == 1 ? "awake":"asleep"));
+
+
+    /*If there are no patterns, the reply will only contain generic
+      WoW information. Pattern information will exist only if there are
+      patterns present. Bug 26716*/
+
+   /* If this event contains pattern information, display it*/
+    if (wow_reply->this_filter_num) {
+        i=0;
+        A_PRINTF("id=%d size=%d offset=%d\n",
+                    wow_reply->wow_filters[i].wow_filter_id,
+                    wow_reply->wow_filters[i].wow_filter_size,
+                    wow_reply->wow_filters[i].wow_filter_offset);
+       A_PRINTF("wow pattern = ");
+       for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
+             A_PRINTF("%2.2x",wow_reply->wow_filters[i].wow_filter_pattern[j]);
+        }
+
+        A_PRINTF("\nwow mask = ");
+        for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
+            A_PRINTF("%2.2x",wow_reply->wow_filters[i].wow_filter_mask[j]);
+        }
+        A_PRINTF("\n");
+    }
+}
+
+/*
+ * Report the Roaming related data collected on the target
+ */
+void
+ar6000_display_roam_time(WMI_TARGET_ROAM_TIME *p)
+{
+    A_PRINTF("Disconnect Data : BSSID: ");
+    AR6000_PRINT_BSSID(p->disassoc_bssid);
+    A_PRINTF(" RSSI %d DISASSOC Time %d NO_TXRX_TIME %d\n",
+             p->disassoc_bss_rssi,p->disassoc_time,
+             p->no_txrx_time);
+    A_PRINTF("Connect Data: BSSID: ");
+    AR6000_PRINT_BSSID(p->assoc_bssid);
+    A_PRINTF(" RSSI %d ASSOC Time %d TXRX_TIME %d\n",
+             p->assoc_bss_rssi,p->assoc_time,
+             p->allow_txrx_time);
+}
+
+void
+ar6000_roam_data_event(struct ar6_softc *ar, WMI_TARGET_ROAM_DATA *p)
+{
+    switch (p->roamDataType) {
+        case ROAM_DATA_TIME:
+            ar6000_display_roam_time(&p->u.roamTime);
+            break;
+        default:
+            break;
+    }
+}
+
+void
+ar6000_bssInfo_event_rx(struct ar6_softc *ar, u8 *datap, int len)
+{
+    struct sk_buff *skb;
+    WMI_BSS_INFO_HDR *bih = (WMI_BSS_INFO_HDR *)datap;
+
+
+    if (!ar->arMgmtFilter) {
+        return;
+    }
+    if (((ar->arMgmtFilter & IEEE80211_FILTER_TYPE_BEACON) &&
+        (bih->frameType != BEACON_FTYPE))  ||
+        ((ar->arMgmtFilter & IEEE80211_FILTER_TYPE_PROBE_RESP) &&
+        (bih->frameType != PROBERESP_FTYPE)))
+    {
+        return;
+    }
+
+    if ((skb = A_NETBUF_ALLOC_RAW(len)) != NULL) {
+
+        A_NETBUF_PUT(skb, len);
+        memcpy(A_NETBUF_DATA(skb), datap, len);
+        skb->dev = ar->arNetDev;
+        memcpy(skb_mac_header(skb), A_NETBUF_DATA(skb), 6);
+        skb->ip_summed = CHECKSUM_NONE;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = __constant_htons(0x0019);
+        netif_rx(skb);
+    }
+}
+
+u32 wmiSendCmdNum;
+
+int
+ar6000_control_tx(void *devt, void *osbuf, HTC_ENDPOINT_ID eid)
+{
+    struct ar6_softc       *ar = (struct ar6_softc *)devt;
+    int         status = 0;
+    struct ar_cookie *cookie = NULL;
+    int i;
+#ifdef CONFIG_PM
+    if (ar->arWowState != WLAN_WOW_STATE_NONE) {
+        A_NETBUF_FREE(osbuf);
+        return A_EACCES;
+    }
+#endif /* CONFIG_PM */
+        /* take lock to protect ar6000_alloc_cookie() */
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    do {
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("ar_contrstatus = ol_tx: skb=0x%lx, len=0x%x eid =%d\n",
+                         (unsigned long)osbuf, A_NETBUF_LEN(osbuf), eid));
+
+        if (ar->arWMIControlEpFull && (eid == ar->arControlEp)) {
+                /* control endpoint is full, don't allocate resources, we
+                 * are just going to drop this packet */
+            cookie = NULL;
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" WMI Control EP full, dropping packet : 0x%lX, len:%d \n",
+                    (unsigned long)osbuf, A_NETBUF_LEN(osbuf)));
+        } else {
+            cookie = ar6000_alloc_cookie(ar);
+        }
+
+        if (cookie == NULL) {
+            status = A_NO_MEMORY;
+            break;
+        }
+
+        if(logWmiRawMsgs) {
+            A_PRINTF("WMI cmd send, msgNo %d :", wmiSendCmdNum);
+            for(i = 0; i < a_netbuf_to_len(osbuf); i++)
+                A_PRINTF("%x ", ((u8 *)a_netbuf_to_data(osbuf))[i]);
+            A_PRINTF("\n");
+        }
+
+        wmiSendCmdNum++;
+
+    } while (false);
+
+    if (cookie != NULL) {
+            /* got a structure to send it out on */
+        ar->arTxPending[eid]++;
+
+        if (eid != ar->arControlEp) {
+            ar->arTotalTxDataPending++;
+        }
+    }
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    if (cookie != NULL) {
+        cookie->arc_bp[0] = (unsigned long)osbuf;
+        cookie->arc_bp[1] = 0;
+        SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
+                               cookie,
+                               A_NETBUF_DATA(osbuf),
+                               A_NETBUF_LEN(osbuf),
+                               eid,
+                               AR6K_CONTROL_PKT_TAG);
+            /* this interface is asynchronous, if there is an error, cleanup will happen in the
+             * TX completion callback */
+        HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
+        status = 0;
+    }
+
+    if (status) {
+        A_NETBUF_FREE(osbuf);
+    }
+    return status;
+}
+
+/* indicate tx activity or inactivity on a WMI stream */
+void ar6000_indicate_tx_activity(void *devt, u8 TrafficClass, bool Active)
+{
+    struct ar6_softc  *ar = (struct ar6_softc *)devt;
+    HTC_ENDPOINT_ID eid ;
+    int i;
+
+    if (ar->arWmiEnabled) {
+        eid = arAc2EndpointID(ar, TrafficClass);
+
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+        ar->arAcStreamActive[TrafficClass] = Active;
+
+        if (Active) {
+            /* when a stream goes active, keep track of the active stream with the highest priority */
+
+            if (ar->arAcStreamPriMap[TrafficClass] > ar->arHiAcStreamActivePri) {
+                    /* set the new highest active priority */
+                ar->arHiAcStreamActivePri = ar->arAcStreamPriMap[TrafficClass];
+            }
+
+        } else {
+            /* when a stream goes inactive, we may have to search for the next active stream
+             * that is the highest priority */
+
+            if (ar->arHiAcStreamActivePri == ar->arAcStreamPriMap[TrafficClass]) {
+
+                /* the highest priority stream just went inactive */
+
+                    /* reset and search for the "next" highest "active" priority stream */
+                ar->arHiAcStreamActivePri = 0;
+                for (i = 0; i < WMM_NUM_AC; i++) {
+                    if (ar->arAcStreamActive[i]) {
+                        if (ar->arAcStreamPriMap[i] > ar->arHiAcStreamActivePri) {
+                            /* set the new highest active priority */
+                            ar->arHiAcStreamActivePri = ar->arAcStreamPriMap[i];
+                        }
+                    }
+                }
+            }
+        }
+
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    } else {
+            /* for mbox ping testing, the traffic class is mapped directly as a stream ID,
+             * see handling of AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE in ioctl.c
+             * convert the stream ID to a endpoint */
+        eid = arAc2EndpointID(ar, TrafficClass);
+    }
+
+        /* notify HTC, this may cause credit distribution changes */
+
+    HTCIndicateActivityChange(ar->arHtcTarget,
+                              eid,
+                              Active);
+
+}
+
+void
+ar6000_btcoex_config_event(struct ar6_softc *ar,  u8 *ptr, u32 len)
+{
+
+    WMI_BTCOEX_CONFIG_EVENT *pBtcoexConfig = (WMI_BTCOEX_CONFIG_EVENT *)ptr;
+    WMI_BTCOEX_CONFIG_EVENT *pArbtcoexConfig =&ar->arBtcoexConfig;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 BTCOEX CONFIG EVENT \n"));
+
+    A_PRINTF("received config event\n");
+    pArbtcoexConfig->btProfileType = pBtcoexConfig->btProfileType;
+    pArbtcoexConfig->linkId = pBtcoexConfig->linkId;
+
+    switch (pBtcoexConfig->btProfileType) {
+        case WMI_BTCOEX_BT_PROFILE_SCO:
+            memcpy(&pArbtcoexConfig->info.scoConfigCmd, &pBtcoexConfig->info.scoConfigCmd,
+                                        sizeof(WMI_SET_BTCOEX_SCO_CONFIG_CMD));
+            break;
+        case WMI_BTCOEX_BT_PROFILE_A2DP:
+            memcpy(&pArbtcoexConfig->info.a2dpConfigCmd, &pBtcoexConfig->info.a2dpConfigCmd,
+                                        sizeof(WMI_SET_BTCOEX_A2DP_CONFIG_CMD));
+            break;
+        case WMI_BTCOEX_BT_PROFILE_ACLCOEX:
+            memcpy(&pArbtcoexConfig->info.aclcoexConfig, &pBtcoexConfig->info.aclcoexConfig,
+                                        sizeof(WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD));
+            break;
+        case WMI_BTCOEX_BT_PROFILE_INQUIRY_PAGE:
+           memcpy(&pArbtcoexConfig->info.btinquiryPageConfigCmd, &pBtcoexConfig->info.btinquiryPageConfigCmd,
+                                        sizeof(WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD));
+            break;
+    }
+    if (ar->statsUpdatePending) {
+         ar->statsUpdatePending = false;
+          wake_up(&arEvent);
+    }
+}
+
+void
+ar6000_btcoex_stats_event(struct ar6_softc *ar,  u8 *ptr, u32 len)
+{
+    WMI_BTCOEX_STATS_EVENT *pBtcoexStats = (WMI_BTCOEX_STATS_EVENT *)ptr;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 BTCOEX CONFIG EVENT \n"));
+
+    memcpy(&ar->arBtcoexStats, pBtcoexStats, sizeof(WMI_BTCOEX_STATS_EVENT));
+
+    if (ar->statsUpdatePending) {
+         ar->statsUpdatePending = false;
+        wake_up(&arEvent);
+    }
+
+}
+module_init(ar6000_init_module);
+module_exit(ar6000_cleanup_module);
+
+/* Init cookie queue */
+static void
+ar6000_cookie_init(struct ar6_softc *ar)
+{
+    u32 i;
+
+    ar->arCookieList = NULL;
+    ar->arCookieCount = 0;
+
+    A_MEMZERO(s_ar_cookie_mem, sizeof(s_ar_cookie_mem));
+
+    for (i = 0; i < MAX_COOKIE_NUM; i++) {
+        ar6000_free_cookie(ar, &s_ar_cookie_mem[i]);
+    }
+}
+
+/* cleanup cookie queue */
+static void
+ar6000_cookie_cleanup(struct ar6_softc *ar)
+{
+    /* It is gone .... */
+    ar->arCookieList = NULL;
+    ar->arCookieCount = 0;
+}
+
+/* Init cookie queue */
+static void
+ar6000_free_cookie(struct ar6_softc *ar, struct ar_cookie * cookie)
+{
+    /* Insert first */
+    A_ASSERT(ar != NULL);
+    A_ASSERT(cookie != NULL);
+
+    cookie->arc_list_next = ar->arCookieList;
+    ar->arCookieList = cookie;
+    ar->arCookieCount++;
+}
+
+/* cleanup cookie queue */
+static struct ar_cookie *
+ar6000_alloc_cookie(struct ar6_softc  *ar)
+{
+    struct ar_cookie   *cookie;
+
+    cookie = ar->arCookieList;
+    if(cookie != NULL)
+    {
+        ar->arCookieList = cookie->arc_list_next;
+        ar->arCookieCount--;
+    }
+
+    return cookie;
+}
+
+void
+ar6000_tx_retry_err_event(void *devt)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Tx retries reach maximum!\n"));
+}
+
+void
+ar6000_snrThresholdEvent_rx(void *devt, WMI_SNR_THRESHOLD_VAL newThreshold, u8 snr)
+{
+    WMI_SNR_THRESHOLD_EVENT event;
+
+    event.range = newThreshold;
+    event.snr = snr;
+}
+
+void
+ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL newThreshold, u8 lq)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("lq threshold range %d, lq %d\n", newThreshold, lq));
+}
+
+
+
+u32 a_copy_to_user(void *to, const void *from, u32 n)
+{
+    return(copy_to_user(to, from, n));
+}
+
+u32 a_copy_from_user(void *to, const void *from, u32 n)
+{
+    return(copy_from_user(to, from, n));
+}
+
+
+int
+ar6000_get_driver_cfg(struct net_device *dev,
+                        u16 cfgParam,
+                        void *result)
+{
+
+    int    ret = 0;
+
+    switch(cfgParam)
+    {
+        case AR6000_DRIVER_CFG_GET_WLANNODECACHING:
+           *((u32 *)result) = wlanNodeCaching;
+           break;
+        case AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS:
+           *((u32 *)result) = logWmiRawMsgs;
+            break;
+        default:
+           ret = EINVAL;
+           break;
+    }
+
+    return ret;
+}
+
+void
+ar6000_keepalive_rx(void *devt, u8 configured)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)devt;
+
+    ar->arKeepaliveConfigured = configured;
+    wake_up(&arEvent);
+}
+
+void
+ar6000_pmkid_list_event(void *devt, u8 numPMKID, WMI_PMKID *pmkidList,
+                        u8 *bssidList)
+{
+    u8 i, j;
+
+    A_PRINTF("Number of Cached PMKIDs is %d\n", numPMKID);
+
+    for (i = 0; i < numPMKID; i++) {
+        A_PRINTF("\nBSSID %d ", i);
+            for (j = 0; j < ATH_MAC_LEN; j++) {
+                A_PRINTF("%2.2x", bssidList[j]);
+            }
+        bssidList += (ATH_MAC_LEN + WMI_PMKID_LEN);
+        A_PRINTF("\nPMKID %d ", i);
+            for (j = 0; j < WMI_PMKID_LEN; j++) {
+                A_PRINTF("%2.2x", pmkidList->pmkid[j]);
+            }
+        pmkidList = (WMI_PMKID *)((u8 *)pmkidList + ATH_MAC_LEN +
+                                  WMI_PMKID_LEN);
+    }
+}
+
+void ar6000_pspoll_event(struct ar6_softc *ar,u8 aid)
+{
+    sta_t *conn=NULL;
+    bool isPsqEmpty = false;
+
+    conn = ieee80211_find_conn_for_aid(ar, aid);
+
+    /* If the PS q for this STA is not empty, dequeue and send a pkt from
+     * the head of the q. Also update the More data bit in the WMI_DATA_HDR
+     * if there are more pkts for this STA in the PS q. If there are no more
+     * pkts for this STA, update the PVB for this STA.
+     */
+    A_MUTEX_LOCK(&conn->psqLock);
+    isPsqEmpty  = A_NETBUF_QUEUE_EMPTY(&conn->psq);
+    A_MUTEX_UNLOCK(&conn->psqLock);
+
+    if (isPsqEmpty) {
+        /* TODO:No buffered pkts for this STA. Send out a NULL data frame */
+    } else {
+        struct sk_buff *skb = NULL;
+
+        A_MUTEX_LOCK(&conn->psqLock);
+        skb = A_NETBUF_DEQUEUE(&conn->psq);
+        A_MUTEX_UNLOCK(&conn->psqLock);
+        /* Set the STA flag to PSPolled, so that the frame will go out */
+        STA_SET_PS_POLLED(conn);
+        ar6000_data_tx(skb, ar->arNetDev);
+        STA_CLR_PS_POLLED(conn);
+
+        /* Clear the PVB for this STA if the queue has become empty */
+        A_MUTEX_LOCK(&conn->psqLock);
+        isPsqEmpty  = A_NETBUF_QUEUE_EMPTY(&conn->psq);
+        A_MUTEX_UNLOCK(&conn->psqLock);
+
+        if (isPsqEmpty) {
+            wmi_set_pvb_cmd(ar->arWmi, conn->aid, 0);
+        }
+    }
+}
+
+void ar6000_dtimexpiry_event(struct ar6_softc *ar)
+{
+    bool isMcastQueued = false;
+    struct sk_buff *skb = NULL;
+
+    /* If there are no associated STAs, ignore the DTIM expiry event.
+     * There can be potential race conditions where the last associated
+     * STA may disconnect & before the host could clear the 'Indicate DTIM'
+     * request to the firmware, the firmware would have just indicated a DTIM
+     * expiry event. The race is between 'clear DTIM expiry cmd' going
+     * from the host to the firmware & the DTIM expiry event happening from
+     * the firmware to the host.
+     */
+    if (ar->sta_list_index == 0) {
+        return;
+    }
+
+    A_MUTEX_LOCK(&ar->mcastpsqLock);
+    isMcastQueued = A_NETBUF_QUEUE_EMPTY(&ar->mcastpsq);
+    A_MUTEX_UNLOCK(&ar->mcastpsqLock);
+
+    A_ASSERT(isMcastQueued == false);
+
+    /* Flush the mcast psq to the target */
+    /* Set the STA flag to DTIMExpired, so that the frame will go out */
+    ar->DTIMExpired = true;
+
+    A_MUTEX_LOCK(&ar->mcastpsqLock);
+    while (!A_NETBUF_QUEUE_EMPTY(&ar->mcastpsq)) {
+        skb = A_NETBUF_DEQUEUE(&ar->mcastpsq);
+        A_MUTEX_UNLOCK(&ar->mcastpsqLock);
+
+        ar6000_data_tx(skb, ar->arNetDev);
+
+        A_MUTEX_LOCK(&ar->mcastpsqLock);
+    }
+    A_MUTEX_UNLOCK(&ar->mcastpsqLock);
+
+    /* Reset the DTIMExpired flag back to 0 */
+    ar->DTIMExpired = false;
+
+    /* Clear the LSB of the BitMapCtl field of the TIM IE */
+    wmi_set_pvb_cmd(ar->arWmi, MCAST_AID, 0);
+}
+
+void
+read_rssi_compensation_param(struct ar6_softc *ar)
+{
+    u8 *cust_data_ptr;
+
+//#define RSSICOMPENSATION_PRINT
+
+#ifdef RSSICOMPENSATION_PRINT
+    s16 i;
+    cust_data_ptr = ar6000_get_cust_data_buffer(ar->arTargetType);
+    for (i=0; i<16; i++) {
+        A_PRINTF("cust_data_%d = %x \n", i, *(u8 *)cust_data_ptr);
+        cust_data_ptr += 1;
+    }
+#endif
+
+    cust_data_ptr = ar6000_get_cust_data_buffer(ar->arTargetType);
+
+    rssi_compensation_param.customerID = *(u16 *)cust_data_ptr & 0xffff;
+    rssi_compensation_param.enable = *(u16 *)(cust_data_ptr+2) & 0xffff;
+    rssi_compensation_param.bg_param_a = *(u16 *)(cust_data_ptr+4) & 0xffff;
+    rssi_compensation_param.bg_param_b = *(u16 *)(cust_data_ptr+6) & 0xffff;
+    rssi_compensation_param.a_param_a = *(u16 *)(cust_data_ptr+8) & 0xffff;
+    rssi_compensation_param.a_param_b = *(u16 *)(cust_data_ptr+10) &0xffff;
+    rssi_compensation_param.reserved = *(u32 *)(cust_data_ptr+12);
+
+#ifdef RSSICOMPENSATION_PRINT
+    A_PRINTF("customerID = 0x%x \n", rssi_compensation_param.customerID);
+    A_PRINTF("enable = 0x%x \n", rssi_compensation_param.enable);
+    A_PRINTF("bg_param_a = 0x%x and %d \n", rssi_compensation_param.bg_param_a, rssi_compensation_param.bg_param_a);
+    A_PRINTF("bg_param_b = 0x%x and %d \n", rssi_compensation_param.bg_param_b, rssi_compensation_param.bg_param_b);
+    A_PRINTF("a_param_a = 0x%x and %d \n", rssi_compensation_param.a_param_a, rssi_compensation_param.a_param_a);
+    A_PRINTF("a_param_b = 0x%x and %d \n", rssi_compensation_param.a_param_b, rssi_compensation_param.a_param_b);
+    A_PRINTF("Last 4 bytes = 0x%x \n", rssi_compensation_param.reserved);
+#endif
+
+    if (rssi_compensation_param.enable != 0x1) {
+        rssi_compensation_param.enable = 0;
+    }
+
+   return;
+}
+
+s32 rssi_compensation_calc_tcmd(u32 freq, s32 rssi, u32 totalPkt)
+{
+
+    if (freq > 5000)
+    {
+        if (rssi_compensation_param.enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11a\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before compensation  = %d, totalPkt = %d\n", rssi,totalPkt));
+            rssi = rssi * rssi_compensation_param.a_param_a + totalPkt * rssi_compensation_param.a_param_b;
+            rssi = (rssi-50) /100;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after compensation = %d\n", rssi));
+        }
+    }
+    else
+    {
+        if (rssi_compensation_param.enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11bg\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before compensation  = %d, totalPkt = %d\n", rssi,totalPkt));
+            rssi = rssi * rssi_compensation_param.bg_param_a + totalPkt * rssi_compensation_param.bg_param_b;
+            rssi = (rssi-50) /100;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after compensation = %d\n", rssi));
+        }
+    }
+
+    return rssi;
+}
+
+s16 rssi_compensation_calc(struct ar6_softc *ar, s16 rssi)
+{
+    if (ar->arBssChannel > 5000)
+    {
+        if (rssi_compensation_param.enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11a\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before compensation  = %d\n", rssi));
+            rssi = rssi * rssi_compensation_param.a_param_a + rssi_compensation_param.a_param_b;
+            rssi = (rssi-50) /100;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after compensation = %d\n", rssi));
+        }
+    }
+    else
+    {
+        if (rssi_compensation_param.enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11bg\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before compensation  = %d\n", rssi));
+            rssi = rssi * rssi_compensation_param.bg_param_a + rssi_compensation_param.bg_param_b;
+            rssi = (rssi-50) /100;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after compensation = %d\n", rssi));
+        }
+    }
+
+    return rssi;
+}
+
+s16 rssi_compensation_reverse_calc(struct ar6_softc *ar, s16 rssi, bool Above)
+{
+    s16 i;
+
+    if (ar->arBssChannel > 5000)
+    {
+        if (rssi_compensation_param.enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11a\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before rev compensation  = %d\n", rssi));
+            rssi = rssi * 100;
+            rssi = (rssi - rssi_compensation_param.a_param_b) / rssi_compensation_param.a_param_a;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after rev compensation = %d\n", rssi));
+        }
+    }
+    else
+    {
+        if (rssi_compensation_param.enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11bg\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before rev compensation  = %d\n", rssi));
+
+            if (Above) {
+                for (i=95; i>=0; i--) {
+                    if (rssi <=  rssi_compensation_table[i]) {
+                        rssi = 0 - i;
+                        break;
+                    }
+                }
+            } else {
+                for (i=0; i<=95; i++) {
+                    if (rssi >=  rssi_compensation_table[i]) {
+                        rssi = 0 - i;
+                        break;
+                    }
+                }
+            }
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after rev compensation = %d\n", rssi));
+        }
+    }
+
+    return rssi;
+}
+
+#ifdef WAPI_ENABLE
+void ap_wapi_rekey_event(struct ar6_softc *ar, u8 type, u8 *mac)
+{
+    union iwreq_data wrqu;
+    char buf[20];
+
+    A_MEMZERO(buf, sizeof(buf));
+
+    strcpy(buf, "WAPI_REKEY");
+    buf[10] = type;
+    memcpy(&buf[11], mac, ATH_MAC_LEN);
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = 10+1+ATH_MAC_LEN;
+    wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
+
+    A_PRINTF("WAPI REKEY - %d - %02x:%02x\n", type, mac[4], mac[5]);
+}
+#endif
+
+static int
+ar6000_reinstall_keys(struct ar6_softc *ar, u8 key_op_ctrl)
+{
+    int status = 0;
+    struct ieee80211req_key *uik = &ar->user_saved_keys.ucast_ik;
+    struct ieee80211req_key *bik = &ar->user_saved_keys.bcast_ik;
+    CRYPTO_TYPE  keyType = ar->user_saved_keys.keyType;
+
+    if (IEEE80211_CIPHER_CCKM_KRK != uik->ik_type) {
+        if (NONE_CRYPT == keyType) {
+            goto _reinstall_keys_out;
+        }
+
+        if (uik->ik_keylen) {
+            status = wmi_addKey_cmd(ar->arWmi, uik->ik_keyix,
+                    ar->user_saved_keys.keyType, PAIRWISE_USAGE,
+                    uik->ik_keylen, (u8 *)&uik->ik_keyrsc,
+                    uik->ik_keydata, key_op_ctrl, uik->ik_macaddr, SYNC_BEFORE_WMIFLAG);
+        }
+
+    } else {
+        status = wmi_add_krk_cmd(ar->arWmi, uik->ik_keydata);
+    }
+
+    if (IEEE80211_CIPHER_CCKM_KRK != bik->ik_type) {
+        if (NONE_CRYPT == keyType) {
+            goto _reinstall_keys_out;
+        }
+
+        if (bik->ik_keylen) {
+            status = wmi_addKey_cmd(ar->arWmi, bik->ik_keyix,
+                    ar->user_saved_keys.keyType, GROUP_USAGE,
+                    bik->ik_keylen, (u8 *)&bik->ik_keyrsc,
+                    bik->ik_keydata, key_op_ctrl, bik->ik_macaddr, NO_SYNC_WMIFLAG);
+        }
+    } else {
+        status = wmi_add_krk_cmd(ar->arWmi, bik->ik_keydata);
+    }
+
+_reinstall_keys_out:
+    ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
+    ar->user_key_ctrl      = 0;
+
+    return status;
+}
+
+
+void
+ar6000_dset_open_req(
+    void *context,
+    u32 id,
+    u32 targHandle,
+    u32 targReplyFn,
+    u32 targReplyArg)
+{
+}
+
+void
+ar6000_dset_close(
+    void *context,
+    u32 access_cookie)
+{
+    return;
+}
+
+void
+ar6000_dset_data_req(
+   void *context,
+   u32 accessCookie,
+   u32 offset,
+   u32 length,
+   u32 targBuf,
+   u32 targReplyFn,
+   u32 targReplyArg)
+{
+}
+
+int
+ar6000_ap_mode_profile_commit(struct ar6_softc *ar)
+{
+    WMI_CONNECT_CMD p;
+    unsigned long  flags;
+
+    /* No change in AP's profile configuration */
+    if(ar->ap_profile_flag==0) {
+        A_PRINTF("COMMIT: No change in profile!!!\n");
+        return -ENODATA;
+    }
+
+    if(!ar->arSsidLen) {
+        A_PRINTF("SSID not set!!!\n");
+        return -ECHRNG;
+    }
+
+    switch(ar->arAuthMode) {
+    case NONE_AUTH:
+        if((ar->arPairwiseCrypto != NONE_CRYPT) &&
+#ifdef WAPI_ENABLE
+           (ar->arPairwiseCrypto != WAPI_CRYPT) &&
+#endif
+           (ar->arPairwiseCrypto != WEP_CRYPT)) {
+            A_PRINTF("Cipher not supported in AP mode Open auth\n");
+            return -EOPNOTSUPP;
+        }
+        break;
+    case WPA_PSK_AUTH:
+    case WPA2_PSK_AUTH:
+    case (WPA_PSK_AUTH|WPA2_PSK_AUTH):
+        break;
+    default:
+        A_PRINTF("This key mgmt type not supported in AP mode\n");
+        return -EOPNOTSUPP;
+    }
+
+    /* Update the arNetworkType */
+    ar->arNetworkType = ar->arNextMode;
+
+    A_MEMZERO(&p,sizeof(p));
+    p.ssidLength = ar->arSsidLen;
+    memcpy(p.ssid,ar->arSsid,p.ssidLength);
+    p.channel = ar->arChannelHint;
+    p.networkType = ar->arNetworkType;
+
+    p.dot11AuthMode = ar->arDot11AuthMode;
+    p.authMode = ar->arAuthMode;
+    p.pairwiseCryptoType = ar->arPairwiseCrypto;
+    p.pairwiseCryptoLen = ar->arPairwiseCryptoLen;
+    p.groupCryptoType = ar->arGroupCrypto;
+    p.groupCryptoLen = ar->arGroupCryptoLen;
+    p.ctrl_flags = ar->arConnectCtrlFlags;
+
+    wmi_ap_profile_commit(ar->arWmi, &p);
+    spin_lock_irqsave(&ar->arLock, flags);
+    ar->arConnected  = true;
+    netif_carrier_on(ar->arNetDev);
+    spin_unlock_irqrestore(&ar->arLock, flags);
+    ar->ap_profile_flag = 0;
+    return 0;
+}
+
+int
+ar6000_connect_to_ap(struct ar6_softc *ar)
+{
+    /* The ssid length check prevents second "essid off" from the user,
+       to be treated as a connect cmd. The second "essid off" is ignored.
+    */
+    if((ar->arWmiReady == true) && (ar->arSsidLen > 0) && ar->arNetworkType!=AP_NETWORK)
+    {
+        int status;
+        if((ADHOC_NETWORK != ar->arNetworkType) &&
+           (NONE_AUTH==ar->arAuthMode)          &&
+           (WEP_CRYPT==ar->arPairwiseCrypto)) {
+                ar6000_install_static_wep_keys(ar);
+        }
+
+        if (!ar->arUserBssFilter) {
+            if (wmi_bssfilter_cmd(ar->arWmi, ALL_BSS_FILTER, 0) != 0) {
+                return -EIO;
+            }
+        }
+#ifdef WAPI_ENABLE
+        if (ar->arWapiEnable)  {
+            ar->arPairwiseCrypto = WAPI_CRYPT;
+            ar->arPairwiseCryptoLen = 0;
+            ar->arGroupCrypto = WAPI_CRYPT;
+            ar->arGroupCryptoLen = 0;
+            ar->arAuthMode = NONE_AUTH;
+            ar->arConnectCtrlFlags |= CONNECT_IGNORE_WPAx_GROUP_CIPHER;
+        }
+#endif
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("Connect called with authmode %d dot11 auth %d"\
+                        " PW crypto %d PW crypto Len %d GRP crypto %d"\
+                        " GRP crypto Len %d\n",
+                        ar->arAuthMode, ar->arDot11AuthMode,
+                        ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
+                        ar->arGroupCrypto, ar->arGroupCryptoLen));
+        reconnect_flag = 0;
+        /* Set the listen interval into 1000TUs or more. This value will be indicated to Ap in the conn.
+           later set it back locally at the STA to 100/1000 TUs depending on the power mode */
+        if ((ar->arNetworkType == INFRA_NETWORK)) {
+            wmi_listeninterval_cmd(ar->arWmi, max(ar->arListenIntervalT, (u16)A_MAX_WOW_LISTEN_INTERVAL), 0);
+        }
+        status = wmi_connect_cmd(ar->arWmi, ar->arNetworkType,
+                                 ar->arDot11AuthMode, ar->arAuthMode,
+                                 ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
+                                 ar->arGroupCrypto,ar->arGroupCryptoLen,
+                                 ar->arSsidLen, ar->arSsid,
+                                 ar->arReqBssid, ar->arChannelHint,
+                                 ar->arConnectCtrlFlags);
+        if (status) {
+            wmi_listeninterval_cmd(ar->arWmi, ar->arListenIntervalT, ar->arListenIntervalB);
+            if (!ar->arUserBssFilter) {
+                wmi_bssfilter_cmd(ar->arWmi, NONE_BSS_FILTER, 0);
+            }
+            return status;
+        }
+
+        if ((!(ar->arConnectCtrlFlags & CONNECT_DO_WPA_OFFLOAD)) &&
+            ((WPA_PSK_AUTH == ar->arAuthMode) || (WPA2_PSK_AUTH == ar->arAuthMode)))
+        {
+            A_TIMEOUT_MS(&ar->disconnect_timer, A_DISCONNECT_TIMER_INTERVAL, 0);
+        }
+
+        ar->arConnectCtrlFlags &= ~CONNECT_DO_WPA_OFFLOAD;
+        
+        ar->arConnectPending = true;
+        return status;    
+    }
+    return A_ERROR;
+}
+
+int
+ar6000_disconnect(struct ar6_softc *ar)
+{
+    if ((ar->arConnected == true) || (ar->arConnectPending == true)) {
+        wmi_disconnect_cmd(ar->arWmi);
+        /* 
+         * Disconnect cmd is issued, clear connectPending.
+         * arConnected will be cleard in disconnect_event notification.
+         */
+        ar->arConnectPending = false;
+    }
+
+    return 0;
+}
+
+int
+ar6000_ap_mode_get_wpa_ie(struct ar6_softc *ar, struct ieee80211req_wpaie *wpaie)
+{
+    sta_t *conn = NULL;
+    conn = ieee80211_find_conn(ar, wpaie->wpa_macaddr);
+
+    A_MEMZERO(wpaie->wpa_ie, IEEE80211_MAX_IE);
+    A_MEMZERO(wpaie->rsn_ie, IEEE80211_MAX_IE);
+
+    if(conn) {
+        memcpy(wpaie->wpa_ie, conn->wpa_ie, IEEE80211_MAX_IE);
+    }
+
+    return 0;
+}
+
+int
+is_iwioctl_allowed(u8 mode, u16 cmd)
+{
+    if(cmd >= SIOCSIWCOMMIT && cmd <= SIOCGIWPOWER) {
+        cmd -= SIOCSIWCOMMIT;
+        if(sioctl_filter[cmd] == 0xFF) return 0;
+        if(sioctl_filter[cmd] & mode) return 0;
+    } else if(cmd >= SIOCIWFIRSTPRIV && cmd <= (SIOCIWFIRSTPRIV+30)) {
+        cmd -= SIOCIWFIRSTPRIV;
+        if(pioctl_filter[cmd] == 0xFF) return 0;
+        if(pioctl_filter[cmd] & mode) return 0;
+    } else {
+        return A_ERROR;
+    }
+    return A_ENOTSUP;
+}
+
+int
+is_xioctl_allowed(u8 mode, int cmd)
+{
+    if(sizeof(xioctl_filter)-1 < cmd) {
+        A_PRINTF("Filter for this cmd=%d not defined\n",cmd);
+        return 0;
+    }
+    if(xioctl_filter[cmd] == 0xFF) return 0;
+    if(xioctl_filter[cmd] & mode) return 0;
+    return A_ERROR;
+}
+
+#ifdef WAPI_ENABLE
+int
+ap_set_wapi_key(struct ar6_softc *ar, void *ikey)
+{
+    struct ieee80211req_key *ik = (struct ieee80211req_key *)ikey;
+    KEY_USAGE   keyUsage = 0;
+    int    status;
+
+    if (memcmp(ik->ik_macaddr, bcast_mac, IEEE80211_ADDR_LEN) == 0) {
+        keyUsage = GROUP_USAGE;
+    } else {
+        keyUsage = PAIRWISE_USAGE;
+    }
+    A_PRINTF("WAPI_KEY: Type:%d ix:%d mac:%02x:%02x len:%d\n",
+        keyUsage, ik->ik_keyix, ik->ik_macaddr[4], ik->ik_macaddr[5],
+        ik->ik_keylen);
+
+    status = wmi_addKey_cmd(ar->arWmi, ik->ik_keyix, WAPI_CRYPT, keyUsage,
+                            ik->ik_keylen, (u8 *)&ik->ik_keyrsc,
+                            ik->ik_keydata, KEY_OP_INIT_VAL, ik->ik_macaddr,
+                            SYNC_BOTH_WMIFLAG);
+
+    if (0 != status) {
+        return -EIO;
+    }
+    return 0;
+}
+#endif
+
+void ar6000_peer_event(
+    void *context,
+    u8 eventCode,
+    u8 *macAddr)
+{
+    u8 pos;
+
+    for (pos=0;pos<6;pos++)
+        printk("%02x: ",*(macAddr+pos));
+    printk("\n");
+}
+
+#ifdef HTC_TEST_SEND_PKTS
+#define HTC_TEST_DUPLICATE 8
+static void DoHTCSendPktsTest(struct ar6_softc *ar, int MapNo, HTC_ENDPOINT_ID eid, struct sk_buff *dupskb)
+{
+    struct ar_cookie *cookie;
+    struct ar_cookie *cookieArray[HTC_TEST_DUPLICATE];
+    struct sk_buff   *new_skb;
+    int    i;
+    int    pkts = 0;
+    struct htc_packet_queue pktQueue;
+    EPPING_HEADER    *eppingHdr;
+
+    eppingHdr = A_NETBUF_DATA(dupskb);
+
+    if (eppingHdr->Cmd_h == EPPING_CMD_NO_ECHO) {
+        /* skip test if this is already a tx perf test */
+        return;
+    }
+
+    for (i = 0; i < HTC_TEST_DUPLICATE; i++,pkts++) {
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        cookie = ar6000_alloc_cookie(ar);
+        if (cookie != NULL) {
+            ar->arTxPending[eid]++;
+            ar->arTotalTxDataPending++;
+        }
+
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+        if (NULL == cookie) {
+            break;
+        }
+
+        new_skb = A_NETBUF_ALLOC(A_NETBUF_LEN(dupskb));
+
+        if (new_skb == NULL) {
+            AR6000_SPIN_LOCK(&ar->arLock, 0);
+            ar6000_free_cookie(ar,cookie);
+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+            break;
+        }
+
+        A_NETBUF_PUT_DATA(new_skb, A_NETBUF_DATA(dupskb), A_NETBUF_LEN(dupskb));
+        cookie->arc_bp[0] = (unsigned long)new_skb;
+        cookie->arc_bp[1] = MapNo;
+        SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
+                               cookie,
+                               A_NETBUF_DATA(new_skb),
+                               A_NETBUF_LEN(new_skb),
+                               eid,
+                               AR6K_DATA_PKT_TAG);
+
+        cookieArray[i] = cookie;
+
+        {
+            EPPING_HEADER *pHdr = (EPPING_HEADER *)A_NETBUF_DATA(new_skb);
+            pHdr->Cmd_h = EPPING_CMD_NO_ECHO;  /* do not echo the packet */
+        }
+    }
+
+    if (pkts == 0) {
+        return;
+    }
+
+    INIT_HTC_PACKET_QUEUE(&pktQueue);
+
+    for (i = 0; i < pkts; i++) {
+        HTC_PACKET_ENQUEUE(&pktQueue,&cookieArray[i]->HtcPkt);
+    }
+
+    HTCSendPktsMultiple(ar->arHtcTarget, &pktQueue);
+
+}
+#endif
+
+#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+/*
+ * Add support for adding and removing a virtual adapter for soft AP.
+ * Some OS requires different adapters names for station and soft AP mode.
+ * To support these requirement, create and destroy a netdevice  instance
+ * when the AP mode is operational. A full fledged support for virual device
+ * is not implemented. Rather a virtual interface is created and is linked
+ * with the existing physical device instance during the operation of the 
+ * AP mode.
+ */
+
+int ar6000_start_ap_interface(struct ar6_softc *ar)
+{
+    struct ar_virtual_interface *arApDev;
+
+    /* Change net_device to point to AP instance */
+    arApDev = (struct ar_virtual_interface *)ar->arApDev;
+    ar->arNetDev = arApDev->arNetDev;
+
+    return 0;
+}
+
+int ar6000_stop_ap_interface(struct ar6_softc *ar)
+{
+    struct ar_virtual_interface *arApDev;
+
+    /* Change net_device to point to sta instance */
+    arApDev = (struct ar_virtual_interface *)ar->arApDev;
+    if (arApDev) {
+        ar->arNetDev = arApDev->arStaNetDev;
+    }
+
+    return 0;
+}
+
+
+int ar6000_create_ap_interface(struct ar6_softc *ar, char *ap_ifname)
+{
+    struct net_device *dev;
+    struct ar_virtual_interface *arApDev;
+
+    dev = alloc_etherdev(sizeof(struct ar_virtual_interface));
+    if (dev == NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_create_ap_interface: can't alloc etherdev\n"));
+        return A_ERROR;
+    } 
+    
+    ether_setup(dev);
+    init_netdev(dev, ap_ifname);
+    dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+
+    if (register_netdev(dev)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_create_ap_interface: register_netdev failed\n"));
+        return A_ERROR;
+    }
+
+    arApDev = netdev_priv(dev);
+    arApDev->arDev = ar;
+    arApDev->arNetDev = dev;
+    arApDev->arStaNetDev = ar->arNetDev;
+
+    ar->arApDev = arApDev;
+    arApNetDev = dev;
+
+    /* Copy the MAC address */
+    memcpy(dev->dev_addr, ar->arNetDev->dev_addr, AR6000_ETH_ADDR_LEN);
+
+    return 0;
+}
+
+int ar6000_add_ap_interface(struct ar6_softc *ar, char *ap_ifname)
+{
+    /* Interface already added, need not proceed further */
+    if (ar->arApDev != NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_add_ap_interface: interface already present \n"));
+        return 0;
+    }
+
+    if (ar6000_create_ap_interface(ar, ap_ifname) != 0) {
+        return A_ERROR;
+    }
+
+    A_PRINTF("Add AP interface %s \n",ap_ifname);
+
+    return ar6000_start_ap_interface(ar);
+}
+
+int ar6000_remove_ap_interface(struct ar6_softc *ar)
+{
+    if (arApNetDev) {
+        ar6000_stop_ap_interface(ar);
+
+        unregister_netdev(arApNetDev);
+        free_netdev(apApNetDev);
+
+        A_PRINTF("Remove AP interface\n");
+    }
+    ar->arApDev = NULL;
+    arApNetDev = NULL;
+
+    
+    return 0;
+}
+#endif /* CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
+
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+EXPORT_SYMBOL(setupbtdev);
+#endif
diff --git a/drivers/staging/ath6kl/os/linux/ar6000_pm.c b/drivers/staging/ath6kl/os/linux/ar6000_pm.c
new file mode 100644
index 00000000000..1e0ace8b6d1
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/ar6000_pm.c
@@ -0,0 +1,626 @@
+/*
+ *
+ * Copyright (c) 2004-2010 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ * 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+ *
+ */
+
+/*
+ * Implementation of system power management
+ */
+
+#include "ar6000_drv.h"
+#include <linux/inetdevice.h>
+#include <linux/platform_device.h>
+#include "wlan_config.h"
+
+#define WOW_ENABLE_MAX_INTERVAL 0
+#define WOW_SET_SCAN_PARAMS     0
+
+extern unsigned int wmitimeout;
+extern wait_queue_head_t arEvent;
+
+#undef ATH_MODULE_NAME
+#define ATH_MODULE_NAME pm
+#define  ATH_DEBUG_PM       ATH_DEBUG_MAKE_MODULE_MASK(0)
+
+#ifdef DEBUG
+static struct ath_debug_mask_description pm_debug_desc[] = {
+    { ATH_DEBUG_PM     , "System power management"},
+};
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(pm,
+                                 "pm",
+                                 "System Power Management",
+                                 ATH_DEBUG_MASK_DEFAULTS | ATH_DEBUG_PM,
+                                 ATH_DEBUG_DESCRIPTION_COUNT(pm_debug_desc),
+                                 pm_debug_desc);
+
+#endif /* DEBUG */
+
+int ar6000_exit_cut_power_state(struct ar6_softc *ar);
+
+#ifdef CONFIG_PM
+static void ar6k_send_asleep_event_to_app(struct ar6_softc *ar, bool asleep)
+{
+    char buf[128];
+    union iwreq_data wrqu;
+
+    snprintf(buf, sizeof(buf), "HOST_ASLEEP=%s", asleep ? "asleep" : "awake");
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = strlen(buf);
+    wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+static void ar6000_wow_resume(struct ar6_softc *ar)
+{
+    if (ar->arWowState!= WLAN_WOW_STATE_NONE) {
+        u16 fg_start_period = (ar->scParams.fg_start_period==0) ? 1 : ar->scParams.fg_start_period;
+        u16 bg_period = (ar->scParams.bg_period==0) ? 60 : ar->scParams.bg_period;
+        WMI_SET_HOST_SLEEP_MODE_CMD hostSleepMode = {true, false};
+        ar->arWowState = WLAN_WOW_STATE_NONE;
+        if (wmi_set_host_sleep_mode_cmd(ar->arWmi, &hostSleepMode)!= 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup restore host awake\n"));
+        }
+#if WOW_SET_SCAN_PARAMS
+        wmi_scanparams_cmd(ar->arWmi, fg_start_period,
+                                   ar->scParams.fg_end_period,
+                                   bg_period,
+                                   ar->scParams.minact_chdwell_time,
+                                   ar->scParams.maxact_chdwell_time,
+                                   ar->scParams.pas_chdwell_time,
+                                   ar->scParams.shortScanRatio,
+                                   ar->scParams.scanCtrlFlags,
+                                   ar->scParams.max_dfsch_act_time,
+                                   ar->scParams.maxact_scan_per_ssid);
+#else
+       (void)fg_start_period;
+       (void)bg_period;
+#endif
+
+
+#if WOW_ENABLE_MAX_INTERVAL /* we don't do it if the power consumption is already good enough. */
+        if (wmi_listeninterval_cmd(ar->arWmi, ar->arListenIntervalT, ar->arListenIntervalB) == 0) {
+        }
+#endif
+        ar6k_send_asleep_event_to_app(ar, false);
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Resume WoW successfully\n"));
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("WoW does not invoked. skip resume"));
+    }
+    ar->arWlanPowerState = WLAN_POWER_STATE_ON;
+}
+
+static void ar6000_wow_suspend(struct ar6_softc *ar)
+{
+#define WOW_LIST_ID 1
+    if (ar->arNetworkType != AP_NETWORK) {
+        /* Setup WoW for unicast & Arp request for our own IP
+        disable background scan. Set listen interval into 1000 TUs
+        Enable keepliave for 110 seconds
+        */
+        struct in_ifaddr **ifap = NULL;
+        struct in_ifaddr *ifa = NULL;
+        struct in_device *in_dev;
+        u8 macMask[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+        int status;
+        WMI_ADD_WOW_PATTERN_CMD addWowCmd = { .filter = { 0 } };
+        WMI_DEL_WOW_PATTERN_CMD delWowCmd;
+        WMI_SET_HOST_SLEEP_MODE_CMD hostSleepMode = {false, true};
+        WMI_SET_WOW_MODE_CMD wowMode = {    .enable_wow = true,
+                                            .hostReqDelay = 500 };/*500 ms delay*/
+
+        if (ar->arWowState!= WLAN_WOW_STATE_NONE) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("System already go into wow mode!\n"));
+            return;
+        }
+
+        ar6000_TxDataCleanup(ar); /* IMPORTANT, otherwise there will be 11mA after listen interval as 1000*/
+
+#if WOW_ENABLE_MAX_INTERVAL /* we don't do it if the power consumption is already good enough. */
+        if (wmi_listeninterval_cmd(ar->arWmi, A_MAX_WOW_LISTEN_INTERVAL, 0) == 0) {
+        }
+#endif
+
+#if WOW_SET_SCAN_PARAMS
+        status = wmi_scanparams_cmd(ar->arWmi, 0xFFFF, 0, 0xFFFF, 0, 0, 0, 0, 0, 0, 0);
+#endif
+        /* clear up our WoW pattern first */
+        delWowCmd.filter_list_id = WOW_LIST_ID;
+        delWowCmd.filter_id = 0;
+        wmi_del_wow_pattern_cmd(ar->arWmi, &delWowCmd);
+
+        /* setup unicast packet pattern for WoW */
+        if (ar->arNetDev->dev_addr[1]) {
+            addWowCmd.filter_list_id = WOW_LIST_ID;
+            addWowCmd.filter_size = 6; /* MAC address */
+            addWowCmd.filter_offset = 0;
+            status = wmi_add_wow_pattern_cmd(ar->arWmi, &addWowCmd, ar->arNetDev->dev_addr, macMask, addWowCmd.filter_size);
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to add WoW pattern\n"));
+            }
+        }
+        /* setup ARP request for our own IP */
+        if ((in_dev = __in_dev_get_rtnl(ar->arNetDev)) != NULL) {
+            for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL; ifap = &ifa->ifa_next) {
+                if (!strcmp(ar->arNetDev->name, ifa->ifa_label)) {
+                    break; /* found */
+                }
+            }
+        }
+        if (ifa && ifa->ifa_local) {
+            WMI_SET_IP_CMD ipCmd;
+            memset(&ipCmd, 0, sizeof(ipCmd));
+            ipCmd.ips[0] = ifa->ifa_local;
+            status = wmi_set_ip_cmd(ar->arWmi, &ipCmd);
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup IP for ARP agent\n"));
+            }
+        }
+
+#ifndef ATH6K_CONFIG_OTA_MODE
+        wmi_powermode_cmd(ar->arWmi, REC_POWER);
+#endif
+
+        status = wmi_set_wow_mode_cmd(ar->arWmi, &wowMode);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to enable wow mode\n"));
+        }
+        ar6k_send_asleep_event_to_app(ar, true);
+
+        status = wmi_set_host_sleep_mode_cmd(ar->arWmi, &hostSleepMode);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to set host asleep\n"));
+        }
+
+        ar->arWowState = WLAN_WOW_STATE_SUSPENDING;
+        if (ar->arTxPending[ar->arControlEp]) {
+            u32 timeleft = wait_event_interruptible_timeout(arEvent,
+            ar->arTxPending[ar->arControlEp] == 0, wmitimeout * HZ);
+            if (!timeleft || signal_pending(current)) {
+               /* what can I do? wow resume at once */
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup WoW. Pending wmi control data %d\n", ar->arTxPending[ar->arControlEp]));
+            }
+        }
+
+        status = hifWaitForPendingRecv(ar->arHifDevice);
+
+        ar->arWowState = WLAN_WOW_STATE_SUSPENDED;
+        ar->arWlanPowerState = WLAN_POWER_STATE_WOW;
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Not allowed to go to WOW at this moment.\n"));
+    }
+}
+
+int ar6000_suspend_ev(void *context)
+{
+    int status = 0;
+    struct ar6_softc *ar = (struct ar6_softc *)context;
+    s16 pmmode = ar->arSuspendConfig;
+wow_not_connected:
+    switch (pmmode) {
+    case WLAN_SUSPEND_WOW:
+        if (ar->arWmiReady && ar->arWlanState==WLAN_ENABLED && ar->arConnected) {
+            ar6000_wow_suspend(ar);
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM,("%s:Suspend for wow mode %d\n", __func__, ar->arWlanPowerState));
+        } else {
+            pmmode = ar->arWow2Config;
+            goto wow_not_connected;
+        }
+        break;
+    case WLAN_SUSPEND_CUT_PWR:
+        /* fall through */
+    case WLAN_SUSPEND_CUT_PWR_IF_BT_OFF:
+        /* fall through */
+    case WLAN_SUSPEND_DEEP_SLEEP:
+        /* fall through */
+    default:
+        status = ar6000_update_wlan_pwr_state(ar, WLAN_DISABLED, true);
+        if (ar->arWlanPowerState==WLAN_POWER_STATE_ON ||
+            ar->arWlanPowerState==WLAN_POWER_STATE_WOW) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Strange suspend state for not wow mode %d", ar->arWlanPowerState));
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM,("%s:Suspend for %d mode pwr %d status %d\n", __func__, pmmode, ar->arWlanPowerState, status));
+        status = (ar->arWlanPowerState == WLAN_POWER_STATE_CUT_PWR) ? 0 : A_EBUSY;
+        break;
+    }
+
+    ar->scan_triggered = 0;
+    return status;
+}
+
+int ar6000_resume_ev(void *context)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)context;
+    u16 powerState = ar->arWlanPowerState;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: enter previous state %d wowState %d\n", __func__, powerState, ar->arWowState));
+    switch (powerState) {
+    case WLAN_POWER_STATE_WOW:
+        ar6000_wow_resume(ar);
+        break;
+    case WLAN_POWER_STATE_CUT_PWR:
+        /* fall through */
+    case WLAN_POWER_STATE_DEEP_SLEEP:
+        ar6000_update_wlan_pwr_state(ar, WLAN_ENABLED, true);
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM,("%s:Resume for %d mode pwr %d\n", __func__, powerState, ar->arWlanPowerState));
+        break;
+    case WLAN_POWER_STATE_ON:
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Strange SDIO bus power mode!!\n"));
+        break;
+    }
+    return 0;
+}
+
+void ar6000_check_wow_status(struct ar6_softc *ar, struct sk_buff *skb, bool isEvent)
+{
+    if (ar->arWowState!=WLAN_WOW_STATE_NONE) {
+        if (ar->arWowState==WLAN_WOW_STATE_SUSPENDING) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM,("\n%s: Received IRQ while we are wow suspending!!!\n\n", __func__));
+            return;
+        }
+        /* Wow resume from irq interrupt */
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: WoW resume from irq thread status %d\n", __func__, ar->arWlanPowerState));
+        ar6000_wow_resume(ar);
+    }
+}
+
+int ar6000_power_change_ev(void *context, u32 config)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)context;
+    int status = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: power change event callback %d \n", __func__, config));
+    switch (config) {
+       case HIF_DEVICE_POWER_UP:
+            ar6000_restart_endpoint(ar->arNetDev);
+            status = 0;
+            break;
+       case HIF_DEVICE_POWER_DOWN:
+       case HIF_DEVICE_POWER_CUT:
+            status = 0;
+            break;
+    }
+    return status;
+}
+
+#endif /* CONFIG_PM */
+
+int
+ar6000_setup_cut_power_state(struct ar6_softc *ar,  AR6000_WLAN_STATE state)
+{
+    int                      status = 0;
+    HIF_DEVICE_POWER_CHANGE_TYPE  config;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: Cut power %d %d \n", __func__,state, ar->arWlanPowerState));
+#ifdef CONFIG_PM
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Wlan OFF %d BT OFf %d \n", ar->arWlanOff, ar->arBTOff));
+#endif
+    do {
+        if (state == WLAN_ENABLED) {
+            /* Not in cut power state.. exit */
+            if (ar->arWlanPowerState != WLAN_POWER_STATE_CUT_PWR) {
+                break;
+            }
+
+            /* Change the state to ON */
+            ar->arWlanPowerState = WLAN_POWER_STATE_ON;
+
+
+            /* Indicate POWER_UP to HIF */
+            config = HIF_DEVICE_POWER_UP;
+            status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_POWER_STATE_CHANGE,
+                                &config,
+                                sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
+
+            if (status == A_PENDING) {
+            } else if (status == 0) {
+                ar6000_restart_endpoint(ar->arNetDev);
+                status = 0;
+            }
+        } else if (state == WLAN_DISABLED) {
+
+
+            /* Already in cut power state.. exit */
+            if (ar->arWlanPowerState == WLAN_POWER_STATE_CUT_PWR) {
+                break;
+            }
+            ar6000_stop_endpoint(ar->arNetDev, true, false);
+
+            config = HIF_DEVICE_POWER_CUT;
+            status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_POWER_STATE_CHANGE,
+                                &config,
+                                sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
+
+            ar->arWlanPowerState = WLAN_POWER_STATE_CUT_PWR;
+        }
+    } while (0);
+
+    return status;
+}
+
+int
+ar6000_setup_deep_sleep_state(struct ar6_softc *ar, AR6000_WLAN_STATE state)
+{
+    int status = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: Deep sleep %d %d \n", __func__,state, ar->arWlanPowerState));
+#ifdef CONFIG_PM
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Wlan OFF %d BT OFf %d \n", ar->arWlanOff, ar->arBTOff));
+#endif
+    do {
+        WMI_SET_HOST_SLEEP_MODE_CMD hostSleepMode;
+
+        if (state == WLAN_ENABLED) {
+            u16 fg_start_period;
+
+            /* Not in deep sleep state.. exit */
+            if (ar->arWlanPowerState != WLAN_POWER_STATE_DEEP_SLEEP) {
+                if (ar->arWlanPowerState != WLAN_POWER_STATE_ON) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Strange state when we resume from deep sleep %d\n", ar->arWlanPowerState));
+                }
+                break;
+            }
+
+            fg_start_period = (ar->scParams.fg_start_period==0) ? 1 : ar->scParams.fg_start_period;
+            hostSleepMode.awake = true;
+            hostSleepMode.asleep = false;
+
+            if ((status=wmi_set_host_sleep_mode_cmd(ar->arWmi, &hostSleepMode)) != 0) {
+                break;
+            }
+
+            /* Change the state to ON */
+            ar->arWlanPowerState = WLAN_POWER_STATE_ON;
+
+                /* Enable foreground scanning */
+                if ((status=wmi_scanparams_cmd(ar->arWmi, fg_start_period,
+                                        ar->scParams.fg_end_period,
+                                        ar->scParams.bg_period,
+                                        ar->scParams.minact_chdwell_time,
+                                        ar->scParams.maxact_chdwell_time,
+                                        ar->scParams.pas_chdwell_time,
+                                        ar->scParams.shortScanRatio,
+                                        ar->scParams.scanCtrlFlags,
+                                        ar->scParams.max_dfsch_act_time,
+                                        ar->scParams.maxact_scan_per_ssid)) != 0)
+                {
+                    break;
+                }
+
+            if (ar->arNetworkType != AP_NETWORK)
+            {
+                if (ar->arSsidLen) {
+                    if (ar6000_connect_to_ap(ar) != 0) {
+                        /* no need to report error if connection failed */
+                        break;
+                    }
+                }
+            }
+        } else if (state == WLAN_DISABLED){
+            WMI_SET_WOW_MODE_CMD wowMode = { .enable_wow = false };
+
+            /* Already in deep sleep state.. exit */
+            if (ar->arWlanPowerState != WLAN_POWER_STATE_ON) {
+                if (ar->arWlanPowerState != WLAN_POWER_STATE_DEEP_SLEEP) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Strange state when we suspend for deep sleep %d\n", ar->arWlanPowerState));
+                }
+                break;
+            }
+
+            if (ar->arNetworkType != AP_NETWORK)
+            {
+                /* Disconnect from the AP and disable foreground scanning */
+                AR6000_SPIN_LOCK(&ar->arLock, 0);
+                if (ar->arConnected == true || ar->arConnectPending == true) {
+                    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+                    wmi_disconnect_cmd(ar->arWmi);
+                } else {
+                    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+                }
+            }
+
+            ar->scan_triggered = 0;
+
+            if ((status=wmi_scanparams_cmd(ar->arWmi, 0xFFFF, 0, 0, 0, 0, 0, 0, 0, 0, 0)) != 0) {
+                break;
+            }
+
+            /* make sure we disable wow for deep sleep */
+            if ((status=wmi_set_wow_mode_cmd(ar->arWmi, &wowMode))!= 0)
+            {
+                break;
+            }
+
+            ar6000_TxDataCleanup(ar);
+#ifndef ATH6K_CONFIG_OTA_MODE
+            wmi_powermode_cmd(ar->arWmi, REC_POWER);
+#endif
+
+            hostSleepMode.awake = false;
+            hostSleepMode.asleep = true;
+            if ((status=wmi_set_host_sleep_mode_cmd(ar->arWmi, &hostSleepMode))!= 0) {
+                break;
+            }
+            if (ar->arTxPending[ar->arControlEp]) {
+                u32 timeleft = wait_event_interruptible_timeout(arEvent,
+                                ar->arTxPending[ar->arControlEp] == 0, wmitimeout * HZ);
+                if (!timeleft || signal_pending(current)) {
+                    status = A_ERROR;
+                    break;
+                }
+            }
+            status = hifWaitForPendingRecv(ar->arHifDevice);
+
+            ar->arWlanPowerState = WLAN_POWER_STATE_DEEP_SLEEP;
+        }
+    } while (0);
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to enter/exit deep sleep %d\n", state));
+    }
+
+    return status;
+}
+
+int
+ar6000_update_wlan_pwr_state(struct ar6_softc *ar, AR6000_WLAN_STATE state, bool pmEvent)
+{
+    int status = 0;
+    u16 powerState, oldPowerState;
+    AR6000_WLAN_STATE oldstate = ar->arWlanState;
+    bool wlanOff = ar->arWlanOff;
+#ifdef CONFIG_PM
+    bool btOff = ar->arBTOff;
+#endif /* CONFIG_PM */
+
+    if ((state!=WLAN_DISABLED && state!=WLAN_ENABLED)) {
+        return A_ERROR;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        return A_EBUSY;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return A_ERROR;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        up(&ar->arSem);
+        return A_EBUSY;
+    }
+
+    ar->arWlanState = wlanOff ? WLAN_DISABLED : state;
+    oldPowerState = ar->arWlanPowerState;
+    if (state == WLAN_ENABLED) {
+        powerState = ar->arWlanPowerState;
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("WLAN PWR set to ENABLE^^\n"));
+        if (!wlanOff) {
+            if (powerState == WLAN_POWER_STATE_DEEP_SLEEP) {
+                status = ar6000_setup_deep_sleep_state(ar, WLAN_ENABLED);
+            } else if (powerState == WLAN_POWER_STATE_CUT_PWR) {
+                status = ar6000_setup_cut_power_state(ar, WLAN_ENABLED);
+            }
+        }
+#ifdef CONFIG_PM
+        else if (pmEvent && wlanOff) {
+            bool allowCutPwr = ((!ar->arBTSharing) || btOff);
+            if ((powerState==WLAN_POWER_STATE_CUT_PWR) && (!allowCutPwr)) {
+                /* Come out of cut power */
+                ar6000_setup_cut_power_state(ar, WLAN_ENABLED);
+                status = ar6000_setup_deep_sleep_state(ar, WLAN_DISABLED);
+            }
+        }
+#endif /* CONFIG_PM */
+    } else if (state == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("WLAN PWR set to DISABLED~\n"));
+        powerState = WLAN_POWER_STATE_DEEP_SLEEP;
+#ifdef CONFIG_PM
+        if (pmEvent) {  /* disable due to suspend */
+            bool suspendCutPwr = (ar->arSuspendConfig == WLAN_SUSPEND_CUT_PWR ||
+                                    (ar->arSuspendConfig == WLAN_SUSPEND_WOW &&
+                                        ar->arWow2Config==WLAN_SUSPEND_CUT_PWR));
+            bool suspendCutIfBtOff = ((ar->arSuspendConfig ==
+                                            WLAN_SUSPEND_CUT_PWR_IF_BT_OFF ||
+                                        (ar->arSuspendConfig == WLAN_SUSPEND_WOW &&
+                                         ar->arWow2Config==WLAN_SUSPEND_CUT_PWR_IF_BT_OFF)) &&
+                                        (!ar->arBTSharing || btOff));
+            if ((suspendCutPwr) ||
+                (suspendCutIfBtOff) ||
+                (ar->arWlanState==WLAN_POWER_STATE_CUT_PWR))
+            {
+                powerState = WLAN_POWER_STATE_CUT_PWR;
+            }
+        } else {
+            if ((wlanOff) &&
+                (ar->arWlanOffConfig == WLAN_OFF_CUT_PWR) &&
+                (!ar->arBTSharing || btOff))
+            {
+                /* For BT clock sharing designs, CUT_POWER depend on BT state */
+                powerState = WLAN_POWER_STATE_CUT_PWR;
+            }
+        }
+#endif /* CONFIG_PM */
+
+        if (powerState == WLAN_POWER_STATE_DEEP_SLEEP) {
+            if (ar->arWlanPowerState == WLAN_POWER_STATE_CUT_PWR) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Load firmware before set to deep sleep\n"));
+                ar6000_setup_cut_power_state(ar, WLAN_ENABLED);
+            }
+            status = ar6000_setup_deep_sleep_state(ar, WLAN_DISABLED);
+        } else if (powerState == WLAN_POWER_STATE_CUT_PWR) {
+            status = ar6000_setup_cut_power_state(ar, WLAN_DISABLED);
+        }
+
+    }
+
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup WLAN state %d\n", ar->arWlanState));
+        ar->arWlanState = oldstate;
+    } else if (status == 0) {
+        WMI_REPORT_SLEEP_STATE_EVENT  wmiSleepEvent, *pSleepEvent = NULL;
+        if ((ar->arWlanPowerState == WLAN_POWER_STATE_ON) && (oldPowerState != WLAN_POWER_STATE_ON)) {
+            wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_AWAKE;
+            pSleepEvent = &wmiSleepEvent;
+        } else if ((ar->arWlanPowerState != WLAN_POWER_STATE_ON) && (oldPowerState == WLAN_POWER_STATE_ON)) {
+            wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_DEEP_SLEEP;
+            pSleepEvent = &wmiSleepEvent;
+        }
+        if (pSleepEvent) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("SENT WLAN Sleep Event %d\n", wmiSleepEvent.sleepState));
+        }
+    }
+    up(&ar->arSem);
+    return status;
+}
+
+int
+ar6000_set_bt_hw_state(struct ar6_softc *ar, u32 enable)
+{
+#ifdef CONFIG_PM
+    bool off = (enable == 0);
+    int status;
+    if (ar->arBTOff == off) {
+        return 0;
+    }
+    ar->arBTOff = off;
+    status = ar6000_update_wlan_pwr_state(ar, ar->arWlanOff ? WLAN_DISABLED : WLAN_ENABLED, false);
+    return status;
+#else
+    return 0;
+#endif
+}
+
+int
+ar6000_set_wlan_state(struct ar6_softc *ar, AR6000_WLAN_STATE state)
+{
+    int status;
+    bool off = (state == WLAN_DISABLED);
+    if (ar->arWlanOff == off) {
+        return 0;
+    }
+    ar->arWlanOff = off;
+    status = ar6000_update_wlan_pwr_state(ar, state, false);
+    return status;
+}
diff --git a/drivers/staging/ath6kl/os/linux/ar6000_raw_if.c b/drivers/staging/ath6kl/os/linux/ar6000_raw_if.c
new file mode 100644
index 00000000000..ae7c1dd96d8
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/ar6000_raw_if.c
@@ -0,0 +1,455 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#include "ar6000_drv.h"
+
+#ifdef HTC_RAW_INTERFACE
+
+static void
+ar6000_htc_raw_read_cb(void *Context, struct htc_packet *pPacket)
+{
+    struct ar6_softc        *ar = (struct ar6_softc *)Context;
+    raw_htc_buffer    *busy;
+    HTC_RAW_STREAM_ID streamID; 
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+
+    busy = (raw_htc_buffer *)pPacket->pPktContext;
+    A_ASSERT(busy != NULL);
+
+    if (pPacket->Status == A_ECANCELED) {
+        /*
+         * HTC provides A_ECANCELED status when it doesn't want to be refilled
+         * (probably due to a shutdown)
+         */
+        return;
+    }
+
+    streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
+    A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
+    
+#ifdef CF
+   if (down_trylock(&arRaw->raw_htc_read_sem[streamID])) {
+#else
+    if (down_interruptible(&arRaw->raw_htc_read_sem[streamID])) {
+#endif /* CF */
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to down the semaphore\n"));
+    }
+
+    A_ASSERT((pPacket->Status != 0) ||
+             (pPacket->pBuffer == (busy->data + HTC_HEADER_LEN)));
+
+    busy->length = pPacket->ActualLength + HTC_HEADER_LEN;
+    busy->currPtr = HTC_HEADER_LEN;
+    arRaw->read_buffer_available[streamID] = true;
+    //AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("raw read cb:  0x%X 0x%X \n", busy->currPtr,busy->length);
+    up(&arRaw->raw_htc_read_sem[streamID]);
+
+    /* Signal the waiting process */
+    AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("Waking up the StreamID(%d) read process\n", streamID));
+    wake_up_interruptible(&arRaw->raw_htc_read_queue[streamID]);
+}
+
+static void
+ar6000_htc_raw_write_cb(void *Context, struct htc_packet *pPacket)
+{
+    struct ar6_softc          *ar = (struct ar6_softc  *)Context;
+    raw_htc_buffer      *free;
+    HTC_RAW_STREAM_ID   streamID;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+    
+    free = (raw_htc_buffer *)pPacket->pPktContext;
+    A_ASSERT(free != NULL);
+
+    if (pPacket->Status == A_ECANCELED) {
+        /*
+         * HTC provides A_ECANCELED status when it doesn't want to be refilled
+         * (probably due to a shutdown)
+         */
+        return;
+    }
+
+    streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
+    A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
+    
+#ifdef CF
+    if (down_trylock(&arRaw->raw_htc_write_sem[streamID])) {
+#else
+    if (down_interruptible(&arRaw->raw_htc_write_sem[streamID])) {
+#endif
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to down the semaphore\n"));
+    }
+
+    A_ASSERT(pPacket->pBuffer == (free->data + HTC_HEADER_LEN));
+
+    free->length = 0;
+    arRaw->write_buffer_available[streamID] = true;
+    up(&arRaw->raw_htc_write_sem[streamID]);
+
+    /* Signal the waiting process */
+    AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("Waking up the StreamID(%d) write process\n", streamID));
+    wake_up_interruptible(&arRaw->raw_htc_write_queue[streamID]);
+}
+
+/* connect to a service */
+static int ar6000_connect_raw_service(struct ar6_softc        *ar,
+                                           HTC_RAW_STREAM_ID StreamID)
+{
+    int                 status;
+    struct htc_service_connect_resp response;
+    u8 streamNo;
+    struct htc_service_connect_req  connect;
+    
+    do {      
+        
+        A_MEMZERO(&connect,sizeof(connect));
+            /* pass the stream ID as meta data to the RAW streams service */
+        streamNo = (u8)StreamID;
+        connect.pMetaData = &streamNo;
+        connect.MetaDataLength = sizeof(u8);
+            /* these fields are the same for all endpoints */
+        connect.EpCallbacks.pContext = ar;
+        connect.EpCallbacks.EpTxComplete = ar6000_htc_raw_write_cb;   
+        connect.EpCallbacks.EpRecv = ar6000_htc_raw_read_cb;   
+            /* simple interface, we don't need these optional callbacks */      
+        connect.EpCallbacks.EpRecvRefill = NULL;
+        connect.EpCallbacks.EpSendFull = NULL;
+        connect.MaxSendQueueDepth = RAW_HTC_WRITE_BUFFERS_NUM;  
+        
+            /* connect to the raw streams service, we may be able to get 1 or more
+             * connections, depending on WHAT is running on the target */
+        connect.ServiceID = HTC_RAW_STREAMS_SVC;
+        
+        A_MEMZERO(&response,sizeof(response));
+        
+            /* try to connect to the raw stream, it is okay if this fails with 
+             * status HTC_SERVICE_NO_MORE_EP */
+        status = HTCConnectService(ar->arHtcTarget, 
+                                   &connect,
+                                   &response);
+        
+        if (status) {
+            if (response.ConnectRespCode == HTC_SERVICE_NO_MORE_EP) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HTC RAW , No more streams allowed \n"));
+                status = 0;
+            }
+            break;    
+        }
+
+            /* set endpoint mapping for the RAW HTC streams */
+        arSetRawStream2EndpointIDMap(ar,StreamID,response.Endpoint);
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("HTC RAW : stream ID: %d, endpoint: %d\n", 
+                        StreamID, arRawStream2EndpointID(ar,StreamID)));
+        
+    } while (false);
+    
+    return status;
+}
+
+int ar6000_htc_raw_open(struct ar6_softc *ar)
+{
+    int status;
+    int streamID, endPt, count2;
+    raw_htc_buffer *buffer;
+    HTC_SERVICE_ID servicepriority;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+    if (!arRaw) {
+        arRaw = ar->arRawHtc = A_MALLOC(sizeof(AR_RAW_HTC_T));
+        if (arRaw) {
+            A_MEMZERO(arRaw, sizeof(AR_RAW_HTC_T));
+        }
+    }
+    A_ASSERT(ar->arHtcTarget != NULL);
+    if (!arRaw) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Faile to allocate memory for HTC RAW interface\n"));
+        return -ENOMEM;
+    }
+    /* wait for target */
+    status = HTCWaitTarget(ar->arHtcTarget);
+        
+    if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HTCWaitTarget failed (%d)\n", status));
+        return -ENODEV;  
+    }
+    
+    for (endPt = 0; endPt < ENDPOINT_MAX; endPt++) {
+        arRaw->arEp2RawMapping[endPt] = HTC_RAW_STREAM_NOT_MAPPED;
+    }
+        
+    for (streamID = HTC_RAW_STREAM_0; streamID < HTC_RAW_STREAM_NUM_MAX; streamID++) {
+        /* Initialize the data structures */
+        sema_init(&arRaw->raw_htc_read_sem[streamID], 1);
+        sema_init(&arRaw->raw_htc_write_sem[streamID], 1);
+        init_waitqueue_head(&arRaw->raw_htc_read_queue[streamID]);
+        init_waitqueue_head(&arRaw->raw_htc_write_queue[streamID]);
+
+            /* try to connect to the raw service */
+        status = ar6000_connect_raw_service(ar,streamID);
+        
+        if (status) {
+            break;    
+        }
+        
+        if (arRawStream2EndpointID(ar,streamID) == 0) {
+            break;    
+        }
+        
+        for (count2 = 0; count2 < RAW_HTC_READ_BUFFERS_NUM; count2 ++) {
+            /* Initialize the receive buffers */
+            buffer = &arRaw->raw_htc_write_buffer[streamID][count2];
+            memset(buffer, 0, sizeof(raw_htc_buffer));
+            buffer = &arRaw->raw_htc_read_buffer[streamID][count2];
+            memset(buffer, 0, sizeof(raw_htc_buffer));
+            
+            SET_HTC_PACKET_INFO_RX_REFILL(&buffer->HTCPacket,
+                                          buffer,
+                                          buffer->data,
+                                          HTC_RAW_BUFFER_SIZE,
+                                          arRawStream2EndpointID(ar,streamID));
+            
+            /* Queue buffers to HTC for receive */
+            if ((status = HTCAddReceivePkt(ar->arHtcTarget, &buffer->HTCPacket)) != 0)
+            {
+                BMIInit();
+                return -EIO;
+            }
+        }
+
+        for (count2 = 0; count2 < RAW_HTC_WRITE_BUFFERS_NUM; count2 ++) {
+            /* Initialize the receive buffers */
+            buffer = &arRaw->raw_htc_write_buffer[streamID][count2];
+            memset(buffer, 0, sizeof(raw_htc_buffer));
+        }
+
+        arRaw->read_buffer_available[streamID] = false;
+        arRaw->write_buffer_available[streamID] = true;
+    }
+    
+    if (status) {
+        return -EIO;    
+    }
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("HTC RAW, number of streams the target supports: %d \n", streamID));
+            
+    servicepriority = HTC_RAW_STREAMS_SVC;  /* only 1 */
+    
+        /* set callbacks and priority list */
+    HTCSetCreditDistribution(ar->arHtcTarget,
+                             ar,
+                             NULL,  /* use default */
+                             NULL,  /* use default */
+                             &servicepriority,
+                             1);
+
+    /* Start the HTC component */
+    if ((status = HTCStart(ar->arHtcTarget)) != 0) {
+        BMIInit();
+        return -EIO;
+    }
+
+    (ar)->arRawIfInit = true;
+    
+    return 0;
+}
+
+int ar6000_htc_raw_close(struct ar6_softc *ar)
+{
+    A_PRINTF("ar6000_htc_raw_close called \n");
+    HTCStop(ar->arHtcTarget);
+    
+        /* reset the device */
+    ar6000_reset_device(ar->arHifDevice, ar->arTargetType, true, false);
+    /* Initialize the BMI component */
+    BMIInit();
+
+    return 0;
+}
+
+raw_htc_buffer *
+get_filled_buffer(struct ar6_softc *ar, HTC_RAW_STREAM_ID StreamID)
+{
+    int count;
+    raw_htc_buffer *busy;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+
+    /* Check for data */
+    for (count = 0; count < RAW_HTC_READ_BUFFERS_NUM; count ++) {
+        busy = &arRaw->raw_htc_read_buffer[StreamID][count];
+        if (busy->length) {
+            break;
+        }
+    }
+    if (busy->length) {
+        arRaw->read_buffer_available[StreamID] = true;
+    } else {
+        arRaw->read_buffer_available[StreamID] = false;
+    }
+
+    return busy;
+}
+
+ssize_t ar6000_htc_raw_read(struct ar6_softc *ar, HTC_RAW_STREAM_ID StreamID, 
+                            char __user *buffer, size_t length)
+{
+    int readPtr;
+    raw_htc_buffer *busy;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+
+    if (arRawStream2EndpointID(ar,StreamID) == 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("StreamID(%d) not connected! \n", StreamID));
+        return -EFAULT;    
+    }
+    
+    if (down_interruptible(&arRaw->raw_htc_read_sem[StreamID])) {
+        return -ERESTARTSYS;
+    }
+
+    busy = get_filled_buffer(ar,StreamID);
+    while (!arRaw->read_buffer_available[StreamID]) {
+        up(&arRaw->raw_htc_read_sem[StreamID]);
+
+        /* Wait for the data */
+        AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("Sleeping StreamID(%d) read process\n", StreamID));
+        if (wait_event_interruptible(arRaw->raw_htc_read_queue[StreamID],
+                                     arRaw->read_buffer_available[StreamID]))
+        {
+            return -EINTR;
+        }
+        if (down_interruptible(&arRaw->raw_htc_read_sem[StreamID])) {
+            return -ERESTARTSYS;
+        }
+        busy = get_filled_buffer(ar,StreamID);
+    }
+
+    /* Read the data */
+    readPtr = busy->currPtr;
+    if (length > busy->length - HTC_HEADER_LEN) {
+        length = busy->length - HTC_HEADER_LEN;
+    }
+    if (copy_to_user(buffer, &busy->data[readPtr], length)) {
+        up(&arRaw->raw_htc_read_sem[StreamID]);
+        return -EFAULT;
+    }
+
+    busy->currPtr += length;
+        
+    if (busy->currPtr == busy->length)
+    {    
+        busy->currPtr = 0;
+        busy->length = 0;        
+        HTC_PACKET_RESET_RX(&busy->HTCPacket);                                          
+        //AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("raw read ioctl:  ep for packet:%d \n", busy->HTCPacket.Endpoint));
+        HTCAddReceivePkt(ar->arHtcTarget, &busy->HTCPacket);
+    }
+    arRaw->read_buffer_available[StreamID] = false;
+    up(&arRaw->raw_htc_read_sem[StreamID]);
+
+    return length;
+}
+
+static raw_htc_buffer *
+get_free_buffer(struct ar6_softc *ar, HTC_ENDPOINT_ID StreamID)
+{
+    int count;
+    raw_htc_buffer *free;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+
+    free = NULL;
+    for (count = 0; count < RAW_HTC_WRITE_BUFFERS_NUM; count ++) {
+        free = &arRaw->raw_htc_write_buffer[StreamID][count];
+        if (free->length == 0) {
+            break;
+        }
+    }
+    if (!free->length) {
+        arRaw->write_buffer_available[StreamID] = true;
+    } else {
+        arRaw->write_buffer_available[StreamID] = false;
+    }
+
+    return free;
+}
+
+ssize_t ar6000_htc_raw_write(struct ar6_softc *ar, HTC_RAW_STREAM_ID StreamID,
+                     char __user *buffer, size_t length)
+{
+    int writePtr;
+    raw_htc_buffer *free;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+    if (arRawStream2EndpointID(ar,StreamID) == 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("StreamID(%d) not connected! \n", StreamID));
+        return -EFAULT;    
+    }
+    
+    if (down_interruptible(&arRaw->raw_htc_write_sem[StreamID])) {
+        return -ERESTARTSYS;
+    }
+
+    /* Search for a free buffer */
+    free = get_free_buffer(ar,StreamID);
+
+    /* Check if there is space to write else wait */
+    while (!arRaw->write_buffer_available[StreamID]) {
+        up(&arRaw->raw_htc_write_sem[StreamID]);
+
+        /* Wait for buffer to become free */
+        AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("Sleeping StreamID(%d) write process\n", StreamID));
+        if (wait_event_interruptible(arRaw->raw_htc_write_queue[StreamID],
+                                     arRaw->write_buffer_available[StreamID]))
+        {
+            return -EINTR;
+        }
+        if (down_interruptible(&arRaw->raw_htc_write_sem[StreamID])) {
+            return -ERESTARTSYS;
+        }
+        free = get_free_buffer(ar,StreamID);
+    }
+
+    /* Send the data */
+    writePtr = HTC_HEADER_LEN;
+    if (length > (HTC_RAW_BUFFER_SIZE - HTC_HEADER_LEN)) {
+        length = HTC_RAW_BUFFER_SIZE - HTC_HEADER_LEN;
+    }
+
+    if (copy_from_user(&free->data[writePtr], buffer, length)) {
+        up(&arRaw->raw_htc_read_sem[StreamID]);
+        return -EFAULT;
+    }
+
+    free->length = length;
+        
+    SET_HTC_PACKET_INFO_TX(&free->HTCPacket,
+                           free,
+                           &free->data[writePtr],
+                           length,
+                           arRawStream2EndpointID(ar,StreamID),
+                           AR6K_DATA_PKT_TAG);
+    
+    HTCSendPkt(ar->arHtcTarget,&free->HTCPacket);
+    
+    arRaw->write_buffer_available[StreamID] = false;
+    up(&arRaw->raw_htc_write_sem[StreamID]);
+
+    return length;
+}
+#endif /* HTC_RAW_INTERFACE */
diff --git a/drivers/staging/ath6kl/os/linux/cfg80211.c b/drivers/staging/ath6kl/os/linux/cfg80211.c
new file mode 100644
index 00000000000..5fdda4aa2fe
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/cfg80211.c
@@ -0,0 +1,1892 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <net/cfg80211.h>
+#include <net/netlink.h>
+
+#include "ar6000_drv.h"
+
+
+extern A_WAITQUEUE_HEAD arEvent;
+extern unsigned int wmitimeout;
+extern int reconnect_flag;
+
+
+#define RATETAB_ENT(_rate, _rateid, _flags) {   \
+    .bitrate    = (_rate),                  \
+    .flags      = (_flags),                 \
+    .hw_value   = (_rateid),                \
+}
+
+#define CHAN2G(_channel, _freq, _flags) {   \
+    .band           = IEEE80211_BAND_2GHZ,  \
+    .hw_value       = (_channel),           \
+    .center_freq    = (_freq),              \
+    .flags          = (_flags),             \
+    .max_antenna_gain   = 0,                \
+    .max_power      = 30,                   \
+}
+
+#define CHAN5G(_channel, _flags) {              \
+    .band           = IEEE80211_BAND_5GHZ,      \
+    .hw_value       = (_channel),               \
+    .center_freq    = 5000 + (5 * (_channel)),  \
+    .flags          = (_flags),                 \
+    .max_antenna_gain   = 0,                    \
+    .max_power      = 30,                       \
+}
+
+static struct
+ieee80211_rate ar6k_rates[] = {
+    RATETAB_ENT(10,  0x1,   0),
+    RATETAB_ENT(20,  0x2,   0),
+    RATETAB_ENT(55,  0x4,   0),
+    RATETAB_ENT(110, 0x8,   0),
+    RATETAB_ENT(60,  0x10,  0),
+    RATETAB_ENT(90,  0x20,  0),
+    RATETAB_ENT(120, 0x40,  0),
+    RATETAB_ENT(180, 0x80,  0),
+    RATETAB_ENT(240, 0x100, 0),
+    RATETAB_ENT(360, 0x200, 0),
+    RATETAB_ENT(480, 0x400, 0),
+    RATETAB_ENT(540, 0x800, 0),
+};
+
+#define ar6k_a_rates     (ar6k_rates + 4)
+#define ar6k_a_rates_size    8
+#define ar6k_g_rates     (ar6k_rates + 0)
+#define ar6k_g_rates_size    12
+
+static struct
+ieee80211_channel ar6k_2ghz_channels[] = {
+    CHAN2G(1, 2412, 0),
+    CHAN2G(2, 2417, 0),
+    CHAN2G(3, 2422, 0),
+    CHAN2G(4, 2427, 0),
+    CHAN2G(5, 2432, 0),
+    CHAN2G(6, 2437, 0),
+    CHAN2G(7, 2442, 0),
+    CHAN2G(8, 2447, 0),
+    CHAN2G(9, 2452, 0),
+    CHAN2G(10, 2457, 0),
+    CHAN2G(11, 2462, 0),
+    CHAN2G(12, 2467, 0),
+    CHAN2G(13, 2472, 0),
+    CHAN2G(14, 2484, 0),
+};
+
+static struct
+ieee80211_channel ar6k_5ghz_a_channels[] = {
+    CHAN5G(34, 0),      CHAN5G(36, 0),
+    CHAN5G(38, 0),      CHAN5G(40, 0),
+    CHAN5G(42, 0),      CHAN5G(44, 0),
+    CHAN5G(46, 0),      CHAN5G(48, 0),
+    CHAN5G(52, 0),      CHAN5G(56, 0),
+    CHAN5G(60, 0),      CHAN5G(64, 0),
+    CHAN5G(100, 0),     CHAN5G(104, 0),
+    CHAN5G(108, 0),     CHAN5G(112, 0),
+    CHAN5G(116, 0),     CHAN5G(120, 0),
+    CHAN5G(124, 0),     CHAN5G(128, 0),
+    CHAN5G(132, 0),     CHAN5G(136, 0),
+    CHAN5G(140, 0),     CHAN5G(149, 0),
+    CHAN5G(153, 0),     CHAN5G(157, 0),
+    CHAN5G(161, 0),     CHAN5G(165, 0),
+    CHAN5G(184, 0),     CHAN5G(188, 0),
+    CHAN5G(192, 0),     CHAN5G(196, 0),
+    CHAN5G(200, 0),     CHAN5G(204, 0),
+    CHAN5G(208, 0),     CHAN5G(212, 0),
+    CHAN5G(216, 0),
+};
+
+static struct
+ieee80211_supported_band ar6k_band_2ghz = {
+    .n_channels = ARRAY_SIZE(ar6k_2ghz_channels),
+    .channels = ar6k_2ghz_channels,
+    .n_bitrates = ar6k_g_rates_size,
+    .bitrates = ar6k_g_rates,
+};
+
+static struct
+ieee80211_supported_band ar6k_band_5ghz = {
+    .n_channels = ARRAY_SIZE(ar6k_5ghz_a_channels),
+    .channels = ar6k_5ghz_a_channels,
+    .n_bitrates = ar6k_a_rates_size,
+    .bitrates = ar6k_a_rates,
+};
+
+static int
+ar6k_set_wpa_version(struct ar6_softc *ar, enum nl80211_wpa_versions wpa_version)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: %u\n", __func__, wpa_version));
+
+    if (!wpa_version) {
+        ar->arAuthMode = NONE_AUTH;
+    } else if (wpa_version & NL80211_WPA_VERSION_1) {
+        ar->arAuthMode = WPA_AUTH;
+    } else if (wpa_version & NL80211_WPA_VERSION_2) {
+        ar->arAuthMode = WPA2_AUTH;
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: %u not spported\n", __func__, wpa_version));
+        return -ENOTSUPP;
+    }
+
+    return 0;
+}
+
+static int
+ar6k_set_auth_type(struct ar6_softc *ar, enum nl80211_auth_type auth_type)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: 0x%x\n", __func__, auth_type));
+
+    switch (auth_type) {
+    case NL80211_AUTHTYPE_OPEN_SYSTEM:
+        ar->arDot11AuthMode = OPEN_AUTH;
+        break;
+    case NL80211_AUTHTYPE_SHARED_KEY:
+        ar->arDot11AuthMode = SHARED_AUTH;
+        break;
+    case NL80211_AUTHTYPE_NETWORK_EAP:
+        ar->arDot11AuthMode = LEAP_AUTH;
+        break;
+
+    case NL80211_AUTHTYPE_AUTOMATIC:
+        ar->arDot11AuthMode = OPEN_AUTH;
+        ar->arAutoAuthStage = AUTH_OPEN_IN_PROGRESS;
+        break;
+
+    default:
+        ar->arDot11AuthMode = OPEN_AUTH;
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: 0x%x not spported\n", __func__, auth_type));
+        return -ENOTSUPP;
+    }
+
+    return 0;
+}
+
+static int
+ar6k_set_cipher(struct ar6_softc *ar, u32 cipher, bool ucast)
+{
+    u8 *ar_cipher = ucast ? &ar->arPairwiseCrypto :
+                                &ar->arGroupCrypto;
+    u8 *ar_cipher_len = ucast ? &ar->arPairwiseCryptoLen :
+                                    &ar->arGroupCryptoLen;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                    ("%s: cipher 0x%x, ucast %u\n", __func__, cipher, ucast));
+
+    switch (cipher) {
+    case 0:
+    case IW_AUTH_CIPHER_NONE:
+        *ar_cipher = NONE_CRYPT;
+        *ar_cipher_len = 0;
+        break;
+    case WLAN_CIPHER_SUITE_WEP40:
+        *ar_cipher = WEP_CRYPT;
+        *ar_cipher_len = 5;
+        break;
+    case WLAN_CIPHER_SUITE_WEP104:
+        *ar_cipher = WEP_CRYPT;
+        *ar_cipher_len = 13;
+        break;
+    case WLAN_CIPHER_SUITE_TKIP:
+        *ar_cipher = TKIP_CRYPT;
+        *ar_cipher_len = 0;
+        break;
+    case WLAN_CIPHER_SUITE_CCMP:
+        *ar_cipher = AES_CRYPT;
+        *ar_cipher_len = 0;
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: cipher 0x%x not supported\n", __func__, cipher));
+        return -ENOTSUPP;
+    }
+
+    return 0;
+}
+
+static void
+ar6k_set_key_mgmt(struct ar6_softc *ar, u32 key_mgmt)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: 0x%x\n", __func__, key_mgmt));
+
+    if (WLAN_AKM_SUITE_PSK == key_mgmt) {
+        if (WPA_AUTH == ar->arAuthMode) {
+            ar->arAuthMode = WPA_PSK_AUTH;
+        } else if (WPA2_AUTH == ar->arAuthMode) {
+            ar->arAuthMode = WPA2_PSK_AUTH;
+        }
+    } else if (WLAN_AKM_SUITE_8021X != key_mgmt) {
+        ar->arAuthMode = NONE_AUTH;
+    }
+}
+
+static int
+ar6k_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+                      struct cfg80211_connect_params *sme)
+{
+    struct ar6_softc *ar = ar6k_priv(dev);
+    int status;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+    ar->smeState = SME_CONNECTING;
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready yet\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->bIsDestroyProgress) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: destroy in progress\n", __func__));
+        return -EBUSY;
+    }
+
+    if(!sme->ssid_len || IEEE80211_MAX_SSID_LEN < sme->ssid_len) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: ssid invalid\n", __func__));
+        return -EINVAL;
+    }
+
+    if(ar->arSkipScan == true &&
+       ((sme->channel && sme->channel->center_freq == 0) ||
+        (sme->bssid && !sme->bssid[0] && !sme->bssid[1] && !sme->bssid[2] &&
+         !sme->bssid[3] && !sme->bssid[4] && !sme->bssid[5])))
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s:SkipScan: channel or bssid invalid\n", __func__));
+        return -EINVAL;
+    }
+
+    if(down_interruptible(&ar->arSem)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, couldn't get access\n", __func__));
+        return -ERESTARTSYS;
+    }
+
+    if(ar->bIsDestroyProgress) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, destroy in progress\n", __func__));
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    if(ar->arTxPending[wmi_get_control_ep(ar->arWmi)]) {
+        /*
+        * sleep until the command queue drains
+        */
+        wait_event_interruptible_timeout(arEvent,
+        ar->arTxPending[wmi_get_control_ep(ar->arWmi)] == 0, wmitimeout * HZ);
+        if (signal_pending(current)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: cmd queue drain timeout\n", __func__));
+            up(&ar->arSem);
+            return -EINTR;
+        }
+    }
+
+    if(ar->arConnected == true &&
+       ar->arSsidLen == sme->ssid_len &&
+       !memcmp(ar->arSsid, sme->ssid, ar->arSsidLen)) {
+        reconnect_flag = true;
+        status = wmi_reconnect_cmd(ar->arWmi,
+                                   ar->arReqBssid,
+                                   ar->arChannelHint);
+
+        up(&ar->arSem);
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_reconnect_cmd failed\n", __func__));
+            return -EIO;
+        }
+        return 0;
+    } else if(ar->arSsidLen == sme->ssid_len &&
+              !memcmp(ar->arSsid, sme->ssid, ar->arSsidLen)) {
+            ar6000_disconnect(ar);
+    }
+
+    A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
+    ar->arSsidLen = sme->ssid_len;
+    memcpy(ar->arSsid, sme->ssid, sme->ssid_len);
+
+    if(sme->channel){
+        ar->arChannelHint = sme->channel->center_freq;
+    }
+
+    A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
+    if(sme->bssid){
+        if(memcmp(&sme->bssid, bcast_mac, AR6000_ETH_ADDR_LEN)) {
+            memcpy(ar->arReqBssid, sme->bssid, sizeof(ar->arReqBssid));
+        }
+    }
+
+    ar6k_set_wpa_version(ar, sme->crypto.wpa_versions);
+    ar6k_set_auth_type(ar, sme->auth_type);
+
+    if(sme->crypto.n_ciphers_pairwise) {
+        ar6k_set_cipher(ar, sme->crypto.ciphers_pairwise[0], true);
+    } else {
+        ar6k_set_cipher(ar, IW_AUTH_CIPHER_NONE, true);
+    }
+    ar6k_set_cipher(ar, sme->crypto.cipher_group, false);
+
+    if(sme->crypto.n_akm_suites) {
+        ar6k_set_key_mgmt(ar, sme->crypto.akm_suites[0]);
+    }
+
+    if((sme->key_len) &&
+       (NONE_AUTH == ar->arAuthMode) &&
+        (WEP_CRYPT == ar->arPairwiseCrypto)) {
+        struct ar_key *key = NULL;
+
+        if(sme->key_idx < WMI_MIN_KEY_INDEX || sme->key_idx > WMI_MAX_KEY_INDEX) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                            ("%s: key index %d out of bounds\n", __func__, sme->key_idx));
+            up(&ar->arSem);
+            return -ENOENT;
+        }
+
+        key = &ar->keys[sme->key_idx];
+        key->key_len = sme->key_len;
+        memcpy(key->key, sme->key, key->key_len);
+        key->cipher = ar->arPairwiseCrypto;
+        ar->arDefTxKeyIndex = sme->key_idx;
+
+        wmi_addKey_cmd(ar->arWmi, sme->key_idx,
+                    ar->arPairwiseCrypto,
+                    GROUP_USAGE | TX_USAGE,
+                    key->key_len,
+                    NULL,
+                    key->key, KEY_OP_INIT_VAL, NULL,
+                    NO_SYNC_WMIFLAG);
+    }
+
+    if (!ar->arUserBssFilter) {
+        if (wmi_bssfilter_cmd(ar->arWmi, ALL_BSS_FILTER, 0) != 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Couldn't set bss filtering\n", __func__));
+            up(&ar->arSem);
+            return -EIO;
+        }
+    }
+
+    ar->arNetworkType = ar->arNextMode;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Connect called with authmode %d dot11 auth %d"\
+                    " PW crypto %d PW crypto Len %d GRP crypto %d"\
+                    " GRP crypto Len %d channel hint %u\n",
+                    __func__, ar->arAuthMode, ar->arDot11AuthMode,
+                    ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
+                    ar->arGroupCrypto, ar->arGroupCryptoLen, ar->arChannelHint));
+
+    reconnect_flag = 0;
+    status = wmi_connect_cmd(ar->arWmi, ar->arNetworkType,
+                            ar->arDot11AuthMode, ar->arAuthMode,
+                            ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
+                            ar->arGroupCrypto,ar->arGroupCryptoLen,
+                            ar->arSsidLen, ar->arSsid,
+                            ar->arReqBssid, ar->arChannelHint,
+                            ar->arConnectCtrlFlags);
+
+    up(&ar->arSem);
+
+    if (A_EINVAL == status) {
+        A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
+        ar->arSsidLen = 0;
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Invalid request\n", __func__));
+        return -ENOENT;
+    } else if (status) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_connect_cmd failed\n", __func__));
+        return -EIO;
+    }
+
+    if ((!(ar->arConnectCtrlFlags & CONNECT_DO_WPA_OFFLOAD)) &&
+        ((WPA_PSK_AUTH == ar->arAuthMode) || (WPA2_PSK_AUTH == ar->arAuthMode)))
+    {
+        A_TIMEOUT_MS(&ar->disconnect_timer, A_DISCONNECT_TIMER_INTERVAL, 0);
+    }
+
+    ar->arConnectCtrlFlags &= ~CONNECT_DO_WPA_OFFLOAD;
+    ar->arConnectPending = true;
+
+    return 0;
+}
+
+void
+ar6k_cfg80211_connect_event(struct ar6_softc *ar, u16 channel,
+                u8 *bssid, u16 listenInterval,
+                u16 beaconInterval,NETWORK_TYPE networkType,
+                u8 beaconIeLen, u8 assocReqLen,
+                u8 assocRespLen, u8 *assocInfo)
+{
+    u16 size = 0;
+    u16 capability = 0;
+    struct cfg80211_bss *bss = NULL;
+    struct ieee80211_mgmt *mgmt = NULL;
+    struct ieee80211_channel *ibss_channel = NULL;
+    s32 signal = 50 * 100;
+    u8 ie_buf_len = 0;
+    unsigned char ie_buf[256];
+    unsigned char *ptr_ie_buf = ie_buf;
+    unsigned char *ieeemgmtbuf = NULL;
+    u8 source_mac[ATH_MAC_LEN];
+
+    u8 assocReqIeOffset = sizeof(u16)  +  /* capinfo*/
+                               sizeof(u16);    /* listen interval */
+    u8 assocRespIeOffset = sizeof(u16) +  /* capinfo*/
+                                sizeof(u16) +  /* status Code */
+                                sizeof(u16);   /* associd */
+    u8 *assocReqIe = assocInfo + beaconIeLen + assocReqIeOffset;
+    u8 *assocRespIe = assocInfo + beaconIeLen + assocReqLen + assocRespIeOffset;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    assocReqLen -= assocReqIeOffset;
+    assocRespLen -= assocRespIeOffset;
+
+    ar->arAutoAuthStage = AUTH_IDLE;
+
+    if((ADHOC_NETWORK & networkType)) {
+        if(NL80211_IFTYPE_ADHOC != ar->wdev->iftype) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                            ("%s: ath6k not in ibss mode\n", __func__));
+            return;
+        }
+    }
+
+    if((INFRA_NETWORK & networkType)) {
+        if(NL80211_IFTYPE_STATION != ar->wdev->iftype) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                            ("%s: ath6k not in station mode\n", __func__));
+            return;
+        }
+    }
+
+    /* Before informing the join/connect event, make sure that
+     * bss entry is present in scan list, if it not present
+     * construct and insert into scan list, otherwise that
+     * event will be dropped on the way by cfg80211, due to
+     * this keys will not be plumbed in case of WEP and
+     * application will not be aware of join/connect status. */
+    bss = cfg80211_get_bss(ar->wdev->wiphy, NULL, bssid,
+                           ar->wdev->ssid, ar->wdev->ssid_len,
+                           ((ADHOC_NETWORK & networkType) ? WLAN_CAPABILITY_IBSS : WLAN_CAPABILITY_ESS),
+                           ((ADHOC_NETWORK & networkType) ? WLAN_CAPABILITY_IBSS : WLAN_CAPABILITY_ESS));
+
+    /*
+     * Earlier we were updating the cfg about bss by making a beacon frame
+     * only if the entry for bss is not there. This can have some issue if
+     * ROAM event is generated and a heavy traffic is ongoing. The ROAM
+     * event is handled through a work queue and by the time it really gets
+     * handled, BSS would have been aged out. So it is better to update the
+     * cfg about BSS irrespective of its entry being present right now or
+     * not.
+     */
+
+    if (ADHOC_NETWORK & networkType) {
+            /* construct 802.11 mgmt beacon */
+            if(ptr_ie_buf) {
+                    *ptr_ie_buf++ = WLAN_EID_SSID;
+                    *ptr_ie_buf++ = ar->arSsidLen;
+                    memcpy(ptr_ie_buf, ar->arSsid, ar->arSsidLen);
+                    ptr_ie_buf +=ar->arSsidLen;
+
+                    *ptr_ie_buf++ = WLAN_EID_IBSS_PARAMS;
+                    *ptr_ie_buf++ = 2; /* length */
+                    *ptr_ie_buf++ = 0; /* ATIM window */
+                    *ptr_ie_buf++ = 0; /* ATIM window */
+
+                    /* TODO: update ibss params and include supported rates,
+                     * DS param set, extened support rates, wmm. */
+
+                    ie_buf_len = ptr_ie_buf - ie_buf;
+            }
+
+            capability |= IEEE80211_CAPINFO_IBSS;
+            if(WEP_CRYPT == ar->arPairwiseCrypto) {
+                    capability |= IEEE80211_CAPINFO_PRIVACY;
+            }
+            memcpy(source_mac, ar->arNetDev->dev_addr, ATH_MAC_LEN);
+            ptr_ie_buf = ie_buf;
+    } else {
+            capability = *(u16 *)(&assocInfo[beaconIeLen]);
+            memcpy(source_mac, bssid, ATH_MAC_LEN);
+            ptr_ie_buf = assocReqIe;
+            ie_buf_len = assocReqLen;
+    }
+
+    size = offsetof(struct ieee80211_mgmt, u)
+            + sizeof(mgmt->u.beacon)
+            + ie_buf_len;
+
+    ieeemgmtbuf = A_MALLOC_NOWAIT(size);
+    if(!ieeemgmtbuf) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                            ("%s: ieeeMgmtbuf alloc error\n", __func__));
+            cfg80211_put_bss(bss);
+            return;
+    }
+
+    A_MEMZERO(ieeemgmtbuf, size);
+    mgmt = (struct ieee80211_mgmt *)ieeemgmtbuf;
+    mgmt->frame_control = (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
+    memcpy(mgmt->da, bcast_mac, ATH_MAC_LEN);
+    memcpy(mgmt->sa, source_mac, ATH_MAC_LEN);
+    memcpy(mgmt->bssid, bssid, ATH_MAC_LEN);
+    mgmt->u.beacon.beacon_int = beaconInterval;
+    mgmt->u.beacon.capab_info = capability;
+    memcpy(mgmt->u.beacon.variable, ptr_ie_buf, ie_buf_len);
+
+    ibss_channel = ieee80211_get_channel(ar->wdev->wiphy, (int)channel);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                    ("%s: inform bss with bssid %pM channel %d beaconInterval %d "
+                     "capability 0x%x\n", __func__, mgmt->bssid,
+                     ibss_channel->hw_value, beaconInterval, capability));
+
+    bss = cfg80211_inform_bss_frame(ar->wdev->wiphy,
+                                    ibss_channel, mgmt,
+                                    le16_to_cpu(size),
+                                    signal, GFP_KERNEL);
+    kfree(ieeemgmtbuf);
+    cfg80211_put_bss(bss);
+
+    if((ADHOC_NETWORK & networkType)) {
+        cfg80211_ibss_joined(ar->arNetDev, bssid, GFP_KERNEL);
+        return;
+    }
+
+    if (false == ar->arConnected) {
+        /* inform connect result to cfg80211 */
+        ar->smeState = SME_DISCONNECTED;
+        cfg80211_connect_result(ar->arNetDev, bssid,
+                                assocReqIe, assocReqLen,
+                                assocRespIe, assocRespLen,
+                                WLAN_STATUS_SUCCESS, GFP_KERNEL);
+    } else {
+        /* inform roam event to cfg80211 */
+        cfg80211_roamed(ar->arNetDev, ibss_channel, bssid,
+                        assocReqIe, assocReqLen,
+                        assocRespIe, assocRespLen,
+                        GFP_KERNEL);
+    }
+}
+
+static int
+ar6k_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+                        u16 reason_code)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: reason=%u\n", __func__, reason_code));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->bIsDestroyProgress) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, destroy in progress\n", __func__));
+        return -EBUSY;
+    }
+
+    if(down_interruptible(&ar->arSem)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, couldn't get access\n", __func__));
+        return -ERESTARTSYS;
+    }
+
+    reconnect_flag = 0;
+    ar6000_disconnect(ar);
+    A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
+    ar->arSsidLen = 0;
+
+    if (ar->arSkipScan == false) {
+        A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
+    }
+
+    up(&ar->arSem);
+
+    return 0;
+}
+
+void
+ar6k_cfg80211_disconnect_event(struct ar6_softc *ar, u8 reason,
+                               u8 *bssid, u8 assocRespLen,
+                               u8 *assocInfo, u16 protocolReasonStatus)
+{
+
+    u16 status;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: reason=%u\n", __func__, reason));
+
+    if (ar->scan_request) {
+        cfg80211_scan_done(ar->scan_request, true);
+        ar->scan_request = NULL;
+    }
+    if((ADHOC_NETWORK & ar->arNetworkType)) {
+        if(NL80211_IFTYPE_ADHOC != ar->wdev->iftype) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                            ("%s: ath6k not in ibss mode\n", __func__));
+            return;
+        }
+        A_MEMZERO(bssid, ETH_ALEN);
+        cfg80211_ibss_joined(ar->arNetDev, bssid, GFP_KERNEL);
+        return;
+    }
+
+    if((INFRA_NETWORK & ar->arNetworkType)) {
+        if(NL80211_IFTYPE_STATION != ar->wdev->iftype) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                            ("%s: ath6k not in station mode\n", __func__));
+            return;
+        }
+    }
+
+    if(true == ar->arConnectPending) {
+        if(NO_NETWORK_AVAIL == reason) {
+            /* connect cmd failed */
+            wmi_disconnect_cmd(ar->arWmi);
+        } else if (reason == DISCONNECT_CMD) {
+                if (ar->arAutoAuthStage) {
+                        /*
+                         * If the current auth algorithm is open try shared
+                         * and make autoAuthStage idle. We do not make it
+                         * leap for now being.
+                         */
+                        if (ar->arDot11AuthMode == OPEN_AUTH) {
+                                struct ar_key *key = NULL;
+                                key = &ar->keys[ar->arDefTxKeyIndex];
+                                if (down_interruptible(&ar->arSem)) {
+                                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, couldn't get access\n", __func__));
+                                        return;
+                                }
+
+
+                                ar->arDot11AuthMode = SHARED_AUTH;
+                                ar->arAutoAuthStage = AUTH_IDLE;
+
+                                wmi_addKey_cmd(ar->arWmi, ar->arDefTxKeyIndex,
+                                                ar->arPairwiseCrypto,
+                                                GROUP_USAGE | TX_USAGE,
+                                                key->key_len,
+                                                NULL,
+                                                key->key, KEY_OP_INIT_VAL, NULL,
+                                                NO_SYNC_WMIFLAG);
+
+                                status = wmi_connect_cmd(ar->arWmi,
+                                                         ar->arNetworkType,
+                                                         ar->arDot11AuthMode,
+                                                         ar->arAuthMode,
+                                                         ar->arPairwiseCrypto,
+                                                         ar->arPairwiseCryptoLen,
+                                                         ar->arGroupCrypto,
+                                                         ar->arGroupCryptoLen,
+                                                         ar->arSsidLen,
+                                                         ar->arSsid,
+                                                         ar->arReqBssid,
+                                                         ar->arChannelHint,
+                                                         ar->arConnectCtrlFlags);
+                                up(&ar->arSem);
+
+                        } else if (ar->arDot11AuthMode == SHARED_AUTH) {
+                                /* should not reach here */
+                        }
+                } else {
+                        ar->arConnectPending = false;
+                        if (ar->smeState == SME_CONNECTING) {
+                                cfg80211_connect_result(ar->arNetDev, bssid,
+                                                        NULL, 0,
+                                                        NULL, 0,
+                                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                                        GFP_KERNEL);
+                        } else {
+                                cfg80211_disconnected(ar->arNetDev,
+                                                      reason,
+                                                      NULL, 0,
+                                                      GFP_KERNEL);
+                        }
+                        ar->smeState = SME_DISCONNECTED;
+                }
+        }
+    } else {
+            if (reason != DISCONNECT_CMD)
+                    wmi_disconnect_cmd(ar->arWmi);
+    }
+}
+
+void
+ar6k_cfg80211_scan_node(void *arg, bss_t *ni)
+{
+    struct wiphy *wiphy = (struct wiphy *)arg;
+    u16 size;
+    unsigned char *ieeemgmtbuf = NULL;
+    struct ieee80211_mgmt *mgmt;
+    struct ieee80211_channel *channel;
+    struct ieee80211_supported_band *band;
+    struct ieee80211_common_ie  *cie;
+    s32 signal;
+    int freq;
+
+    cie = &ni->ni_cie;
+
+#define CHAN_IS_11A(x)  (!((x >= 2412) && (x <= 2484)))
+    if(CHAN_IS_11A(cie->ie_chan)) {
+        /* 11a */
+        band = wiphy->bands[IEEE80211_BAND_5GHZ];
+    } else if((cie->ie_erp) || (cie->ie_xrates)) {
+        /* 11g */
+        band = wiphy->bands[IEEE80211_BAND_2GHZ];
+    } else {
+        /* 11b */
+        band = wiphy->bands[IEEE80211_BAND_2GHZ];
+    }
+
+    size = ni->ni_framelen + offsetof(struct ieee80211_mgmt, u);
+    ieeemgmtbuf = A_MALLOC_NOWAIT(size);
+    if(!ieeemgmtbuf)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: ieeeMgmtbuf alloc error\n", __func__));
+        return;
+    }
+
+    /* Note:
+       TODO: Update target to include 802.11 mac header while sending bss info.
+       Target removes 802.11 mac header while sending the bss info to host,
+       cfg80211 needs it, for time being just filling the da, sa and bssid fields alone.
+    */
+    mgmt = (struct ieee80211_mgmt *)ieeemgmtbuf;
+    memcpy(mgmt->da, bcast_mac, ATH_MAC_LEN);
+    memcpy(mgmt->sa, ni->ni_macaddr, ATH_MAC_LEN);
+    memcpy(mgmt->bssid, ni->ni_macaddr, ATH_MAC_LEN);
+    memcpy(ieeemgmtbuf + offsetof(struct ieee80211_mgmt, u),
+             ni->ni_buf, ni->ni_framelen);
+
+    freq    = cie->ie_chan;
+    channel = ieee80211_get_channel(wiphy, freq);
+    signal  = ni->ni_snr * 100;
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                ("%s: bssid %pM channel %d freq %d size %d\n", __func__,
+                        mgmt->bssid, channel->hw_value, freq, size));
+    cfg80211_inform_bss_frame(wiphy, channel, mgmt,
+                              le16_to_cpu(size),
+                              signal, GFP_KERNEL);
+
+    kfree (ieeemgmtbuf);
+}
+
+static int
+ar6k_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+                   struct cfg80211_scan_request *request)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(ndev);
+    int ret = 0;
+    u32 forceFgScan = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if (!ar->arUserBssFilter) {
+        if (wmi_bssfilter_cmd(ar->arWmi,
+                             (ar->arConnected ? ALL_BUT_BSS_FILTER : ALL_BSS_FILTER),
+                             0) != 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Couldn't set bss filtering\n", __func__));
+            return -EIO;
+        }
+    }
+
+    if(request->n_ssids &&
+       request->ssids[0].ssid_len) {
+        u8 i;
+
+        if(request->n_ssids > (MAX_PROBED_SSID_INDEX - 1)) {
+            request->n_ssids = MAX_PROBED_SSID_INDEX - 1;
+        }
+
+        for (i = 0; i < request->n_ssids; i++) {
+            wmi_probedSsid_cmd(ar->arWmi, i+1, SPECIFIC_SSID_FLAG,
+                               request->ssids[i].ssid_len,
+                               request->ssids[i].ssid);
+        }
+    }
+
+    if(ar->arConnected) {
+        forceFgScan = 1;
+    }
+
+    if(wmi_startscan_cmd(ar->arWmi, WMI_LONG_SCAN, forceFgScan, false, \
+                         0, 0, 0, NULL) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_startscan_cmd failed\n", __func__));
+        ret = -EIO;
+    }
+
+    ar->scan_request = request;
+
+    return ret;
+}
+
+void
+ar6k_cfg80211_scanComplete_event(struct ar6_softc *ar, int status)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: status %d\n", __func__, status));
+
+    if (!ar->scan_request)
+            return;
+
+    if ((status == A_ECANCELED) || (status == A_EBUSY)) {
+            cfg80211_scan_done(ar->scan_request, true);
+            goto out;
+    }
+
+    /* Translate data to cfg80211 mgmt format */
+    wmi_iterate_nodes(ar->arWmi, ar6k_cfg80211_scan_node, ar->wdev->wiphy);
+
+    cfg80211_scan_done(ar->scan_request, false);
+
+    if(ar->scan_request->n_ssids &&
+       ar->scan_request->ssids[0].ssid_len) {
+            u8 i;
+
+            for (i = 0; i < ar->scan_request->n_ssids; i++) {
+                    wmi_probedSsid_cmd(ar->arWmi, i+1, DISABLE_SSID_FLAG,
+                                       0, NULL);
+            }
+    }
+
+out:
+    ar->scan_request = NULL;
+}
+
+static int
+ar6k_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
+                      u8 key_index, bool pairwise, const u8 *mac_addr,
+                      struct key_params *params)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(ndev);
+    struct ar_key *key = NULL;
+    u8 key_usage;
+    u8 key_type;
+    int status = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s:\n", __func__));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(key_index < WMI_MIN_KEY_INDEX || key_index > WMI_MAX_KEY_INDEX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: key index %d out of bounds\n", __func__, key_index));
+        return -ENOENT;
+    }
+
+    key = &ar->keys[key_index];
+    A_MEMZERO(key, sizeof(struct ar_key));
+
+    if(!mac_addr || is_broadcast_ether_addr(mac_addr)) {
+        key_usage = GROUP_USAGE;
+    } else {
+        key_usage = PAIRWISE_USAGE;
+    }
+
+    if(params) {
+        if(params->key_len > WLAN_MAX_KEY_LEN ||
+            params->seq_len > IW_ENCODE_SEQ_MAX_SIZE)
+            return -EINVAL;
+
+        key->key_len = params->key_len;
+        memcpy(key->key, params->key, key->key_len);
+        key->seq_len = params->seq_len;
+        memcpy(key->seq, params->seq, key->seq_len);
+        key->cipher = params->cipher;
+    }
+
+    switch (key->cipher) {
+    case WLAN_CIPHER_SUITE_WEP40:
+    case WLAN_CIPHER_SUITE_WEP104:
+        key_type = WEP_CRYPT;
+        break;
+
+    case WLAN_CIPHER_SUITE_TKIP:
+        key_type = TKIP_CRYPT;
+        break;
+
+    case WLAN_CIPHER_SUITE_CCMP:
+        key_type = AES_CRYPT;
+        break;
+
+    default:
+        return -ENOTSUPP;
+    }
+
+    if (((WPA_PSK_AUTH == ar->arAuthMode) || (WPA2_PSK_AUTH == ar->arAuthMode)) &&
+        (GROUP_USAGE & key_usage))
+    {
+        A_UNTIMEOUT(&ar->disconnect_timer);
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                    ("%s: index %d, key_len %d, key_type 0x%x,"\
+                    " key_usage 0x%x, seq_len %d\n",
+                    __func__, key_index, key->key_len, key_type,
+                    key_usage, key->seq_len));
+
+    ar->arDefTxKeyIndex = key_index;
+    status = wmi_addKey_cmd(ar->arWmi, ar->arDefTxKeyIndex, key_type, key_usage,
+                    key->key_len, key->seq, key->key, KEY_OP_INIT_VAL,
+                    (u8 *)mac_addr, SYNC_BOTH_WMIFLAG);
+
+
+    if (status) {
+        return -EIO;
+    }
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
+                      u8 key_index, bool pairwise, const u8 *mac_addr)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(ndev);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d\n", __func__, key_index));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(key_index < WMI_MIN_KEY_INDEX || key_index > WMI_MAX_KEY_INDEX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: key index %d out of bounds\n", __func__, key_index));
+        return -ENOENT;
+    }
+
+    if(!ar->keys[key_index].key_len) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d is empty\n", __func__, key_index));
+        return 0;
+    }
+
+    ar->keys[key_index].key_len = 0;
+
+    return wmi_deleteKey_cmd(ar->arWmi, key_index);
+}
+
+
+static int
+ar6k_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
+                      u8 key_index, bool pairwise, const u8 *mac_addr,
+                      void *cookie,
+                      void (*callback)(void *cookie, struct key_params*))
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(ndev);
+    struct ar_key *key = NULL;
+    struct key_params params;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d\n", __func__, key_index));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(key_index < WMI_MIN_KEY_INDEX || key_index > WMI_MAX_KEY_INDEX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: key index %d out of bounds\n", __func__, key_index));
+        return -ENOENT;
+    }
+
+    key = &ar->keys[key_index];
+    A_MEMZERO(&params, sizeof(params));
+    params.cipher = key->cipher;
+    params.key_len = key->key_len;
+    params.seq_len = key->seq_len;
+    params.seq = key->seq;
+    params.key = key->key;
+
+    callback(cookie, &params);
+
+    return key->key_len ? 0 : -ENOENT;
+}
+
+
+static int
+ar6k_cfg80211_set_default_key(struct wiphy *wiphy, struct net_device *ndev,
+                              u8 key_index, bool unicast, bool multicast)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(ndev);
+    struct ar_key *key = NULL;
+    int status = 0;
+    u8 key_usage;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d\n", __func__, key_index));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(key_index < WMI_MIN_KEY_INDEX || key_index > WMI_MAX_KEY_INDEX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: key index %d out of bounds\n",
+                        __func__, key_index));
+        return -ENOENT;
+    }
+
+    if(!ar->keys[key_index].key_len) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: invalid key index %d\n",
+                        __func__, key_index));
+        return -EINVAL;
+    }
+
+    ar->arDefTxKeyIndex = key_index;
+    key = &ar->keys[ar->arDefTxKeyIndex];
+    key_usage = GROUP_USAGE;
+    if (WEP_CRYPT == ar->arPairwiseCrypto) {
+        key_usage |= TX_USAGE;
+    }
+
+    status = wmi_addKey_cmd(ar->arWmi, ar->arDefTxKeyIndex,
+                            ar->arPairwiseCrypto, key_usage,
+                            key->key_len, key->seq, key->key, KEY_OP_INIT_VAL,
+                            NULL, SYNC_BOTH_WMIFLAG);
+    if (status) {
+        return -EIO;
+    }
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_set_default_mgmt_key(struct wiphy *wiphy, struct net_device *ndev,
+                                   u8 key_index)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(ndev);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d\n", __func__, key_index));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: not supported\n", __func__));
+    return -ENOTSUPP;
+}
+
+void
+ar6k_cfg80211_tkip_micerr_event(struct ar6_softc *ar, u8 keyid, bool ismcast)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                    ("%s: keyid %d, ismcast %d\n", __func__, keyid, ismcast));
+
+    cfg80211_michael_mic_failure(ar->arNetDev, ar->arBssid,
+                                 (ismcast ? NL80211_KEYTYPE_GROUP : NL80211_KEYTYPE_PAIRWISE),
+                                 keyid, NULL, GFP_KERNEL);
+}
+
+static int
+ar6k_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)wiphy_priv(wiphy);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: changed 0x%x\n", __func__, changed));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
+        if (wmi_set_rts_cmd(ar->arWmi,wiphy->rts_threshold) != 0){
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_set_rts_cmd failed\n", __func__));
+            return -EIO;
+        }
+    }
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_set_bitrate_mask(struct wiphy *wiphy, struct net_device *dev,
+                               const u8 *peer,
+                               const struct cfg80211_bitrate_mask *mask)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Setting rates: Not supported\n"));
+    return -EIO;
+}
+
+/* The type nl80211_tx_power_setting replaces the following data type from 2.6.36 onwards */
+static int
+ar6k_cfg80211_set_txpower(struct wiphy *wiphy, enum nl80211_tx_power_setting type, int dbm)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)wiphy_priv(wiphy);
+    u8 ar_dbm;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: type 0x%x, dbm %d\n", __func__, type, dbm));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    ar->arTxPwrSet = false;
+    switch(type) {
+    case NL80211_TX_POWER_AUTOMATIC:
+        return 0;
+    case NL80211_TX_POWER_LIMITED:
+        ar->arTxPwr = ar_dbm = dbm;
+        ar->arTxPwrSet = true;
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: type 0x%x not supported\n", __func__, type));
+        return -EOPNOTSUPP;
+    }
+
+    wmi_set_txPwr_cmd(ar->arWmi, ar_dbm);
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_get_txpower(struct wiphy *wiphy, int *dbm)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)wiphy_priv(wiphy);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if((ar->arConnected == true)) {
+        ar->arTxPwr = 0;
+
+        if(wmi_get_txPwr_cmd(ar->arWmi) != 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_get_txPwr_cmd failed\n", __func__));
+            return -EIO;
+        }
+
+        wait_event_interruptible_timeout(arEvent, ar->arTxPwr != 0, 5 * HZ);
+
+        if(signal_pending(current)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Target did not respond\n", __func__));
+            return -EINTR;
+        }
+    }
+
+    *dbm = ar->arTxPwr;
+    return 0;
+}
+
+static int
+ar6k_cfg80211_set_power_mgmt(struct wiphy *wiphy,
+                             struct net_device *dev,
+                             bool pmgmt, int timeout)
+{
+    struct ar6_softc *ar = ar6k_priv(dev);
+    WMI_POWER_MODE_CMD pwrMode;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: pmgmt %d, timeout %d\n", __func__, pmgmt, timeout));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(pmgmt) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Max Perf\n", __func__));
+        pwrMode.powerMode = REC_POWER;
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Rec Power\n", __func__));
+        pwrMode.powerMode = MAX_PERF_POWER;
+    }
+
+    if(wmi_powermode_cmd(ar->arWmi, pwrMode.powerMode) != 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_powermode_cmd failed\n", __func__));
+        return -EIO;
+    }
+
+    return 0;
+}
+
+static struct net_device *
+ar6k_cfg80211_add_virtual_intf(struct wiphy *wiphy, char *name,
+                                            enum nl80211_iftype type, u32 *flags,
+                                            struct vif_params *params)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: not supported\n", __func__));
+
+    /* Multiple virtual interface is not supported.
+     * The default interface supports STA and IBSS type
+     */
+    return ERR_PTR(-EOPNOTSUPP);
+}
+
+static int
+ar6k_cfg80211_del_virtual_intf(struct wiphy *wiphy, struct net_device *dev)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: not supported\n", __func__));
+
+    /* Multiple virtual interface is not supported.
+     * The default interface supports STA and IBSS type
+     */
+    return -EOPNOTSUPP;
+}
+
+static int
+ar6k_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
+                           enum nl80211_iftype type, u32 *flags,
+                           struct vif_params *params)
+{
+    struct ar6_softc *ar = ar6k_priv(ndev);
+    struct wireless_dev *wdev = ar->wdev;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: type %u\n", __func__, type));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    switch (type) {
+    case NL80211_IFTYPE_STATION:
+        ar->arNextMode = INFRA_NETWORK;
+        break;
+    case NL80211_IFTYPE_ADHOC:
+        ar->arNextMode = ADHOC_NETWORK;
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: type %u\n", __func__, type));
+        return -EOPNOTSUPP;
+    }
+
+    wdev->iftype = type;
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+                        struct cfg80211_ibss_params *ibss_param)
+{
+    struct ar6_softc *ar = ar6k_priv(dev);
+    int status;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(!ibss_param->ssid_len || IEEE80211_MAX_SSID_LEN < ibss_param->ssid_len) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: ssid invalid\n", __func__));
+        return -EINVAL;
+    }
+
+    ar->arSsidLen = ibss_param->ssid_len;
+    memcpy(ar->arSsid, ibss_param->ssid, ar->arSsidLen);
+
+    if(ibss_param->channel) {
+        ar->arChannelHint = ibss_param->channel->center_freq;
+    }
+
+    if(ibss_param->channel_fixed) {
+        /* TODO: channel_fixed: The channel should be fixed, do not search for
+         * IBSSs to join on other channels. Target firmware does not support this
+         * feature, needs to be updated.*/
+    }
+
+    A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
+    if(ibss_param->bssid) {
+        if(memcmp(&ibss_param->bssid, bcast_mac, AR6000_ETH_ADDR_LEN)) {
+            memcpy(ar->arReqBssid, ibss_param->bssid, sizeof(ar->arReqBssid));
+        }
+    }
+
+    ar6k_set_wpa_version(ar, 0);
+    ar6k_set_auth_type(ar, NL80211_AUTHTYPE_OPEN_SYSTEM);
+
+    if(ibss_param->privacy) {
+        ar6k_set_cipher(ar, WLAN_CIPHER_SUITE_WEP40, true);
+        ar6k_set_cipher(ar, WLAN_CIPHER_SUITE_WEP40, false);
+    } else {
+        ar6k_set_cipher(ar, IW_AUTH_CIPHER_NONE, true);
+        ar6k_set_cipher(ar, IW_AUTH_CIPHER_NONE, false);
+    }
+
+    ar->arNetworkType = ar->arNextMode;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Connect called with authmode %d dot11 auth %d"\
+                    " PW crypto %d PW crypto Len %d GRP crypto %d"\
+                    " GRP crypto Len %d channel hint %u\n",
+                    __func__, ar->arAuthMode, ar->arDot11AuthMode,
+                    ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
+                    ar->arGroupCrypto, ar->arGroupCryptoLen, ar->arChannelHint));
+
+    status = wmi_connect_cmd(ar->arWmi, ar->arNetworkType,
+                            ar->arDot11AuthMode, ar->arAuthMode,
+                            ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
+                            ar->arGroupCrypto,ar->arGroupCryptoLen,
+                            ar->arSsidLen, ar->arSsid,
+                            ar->arReqBssid, ar->arChannelHint,
+                            ar->arConnectCtrlFlags);
+    ar->arConnectPending = true;
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+    struct ar6_softc *ar = (struct ar6_softc *)ar6k_priv(dev);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->arWmiReady == false) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    ar6000_disconnect(ar);
+    A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
+    ar->arSsidLen = 0;
+
+    return 0;
+}
+
+#ifdef CONFIG_NL80211_TESTMODE
+enum ar6k_testmode_attr {
+        __AR6K_TM_ATTR_INVALID  = 0,
+        AR6K_TM_ATTR_CMD        = 1,
+        AR6K_TM_ATTR_DATA       = 2,
+
+        /* keep last */
+        __AR6K_TM_ATTR_AFTER_LAST,
+        AR6K_TM_ATTR_MAX        = __AR6K_TM_ATTR_AFTER_LAST - 1
+};
+
+enum ar6k_testmode_cmd {
+        AR6K_TM_CMD_TCMD                = 0,
+        AR6K_TM_CMD_RX_REPORT           = 1,
+};
+
+#define AR6K_TM_DATA_MAX_LEN 5000
+
+static const struct nla_policy ar6k_testmode_policy[AR6K_TM_ATTR_MAX + 1] = {
+        [AR6K_TM_ATTR_CMD] = { .type = NLA_U32 },
+        [AR6K_TM_ATTR_DATA] = { .type = NLA_BINARY,
+                                .len = AR6K_TM_DATA_MAX_LEN },
+};
+
+void ar6000_testmode_rx_report_event(struct ar6_softc *ar, void *buf,
+                                     int buf_len)
+{
+        if (down_interruptible(&ar->arSem))
+                return;
+
+        kfree(ar->tcmd_rx_report);
+
+        ar->tcmd_rx_report = kmemdup(buf, buf_len, GFP_KERNEL);
+        ar->tcmd_rx_report_len = buf_len;
+
+        up(&ar->arSem);
+
+        wake_up(&arEvent);
+}
+
+static int ar6000_testmode_rx_report(struct ar6_softc *ar, void *buf,
+                                     int buf_len, struct sk_buff *skb)
+{
+        int ret = 0;
+        long left;
+
+        if (down_interruptible(&ar->arSem))
+                return -ERESTARTSYS;
+
+        if (ar->arWmiReady == false) {
+                ret = -EIO;
+                goto out;
+        }
+
+        if (ar->bIsDestroyProgress) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        WARN_ON(ar->tcmd_rx_report != NULL);
+        WARN_ON(ar->tcmd_rx_report_len > 0);
+
+        if (wmi_test_cmd(ar->arWmi, buf, buf_len) < 0) {
+                up(&ar->arSem);
+                return -EIO;
+        }
+
+        left = wait_event_interruptible_timeout(arEvent,
+                                               ar->tcmd_rx_report != NULL,
+                                               wmitimeout * HZ);
+
+        if (left == 0) {
+                ret = -ETIMEDOUT;
+                goto out;
+        } else if (left < 0) {
+                ret = left;
+                goto out;
+        }
+
+        if (ar->tcmd_rx_report == NULL || ar->tcmd_rx_report_len == 0) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        NLA_PUT(skb, AR6K_TM_ATTR_DATA, ar->tcmd_rx_report_len,
+                ar->tcmd_rx_report);
+
+        kfree(ar->tcmd_rx_report);
+        ar->tcmd_rx_report = NULL;
+
+out:
+        up(&ar->arSem);
+
+        return ret;
+
+nla_put_failure:
+        ret = -ENOBUFS;
+        goto out;
+}
+
+static int ar6k_testmode_cmd(struct wiphy *wiphy, void *data, int len)
+{
+        struct ar6_softc *ar = wiphy_priv(wiphy);
+        struct nlattr *tb[AR6K_TM_ATTR_MAX + 1];
+        int err, buf_len, reply_len;
+        struct sk_buff *skb;
+        void *buf;
+
+        err = nla_parse(tb, AR6K_TM_ATTR_MAX, data, len,
+                        ar6k_testmode_policy);
+        if (err)
+                return err;
+
+        if (!tb[AR6K_TM_ATTR_CMD])
+                return -EINVAL;
+
+        switch (nla_get_u32(tb[AR6K_TM_ATTR_CMD])) {
+        case AR6K_TM_CMD_TCMD:
+                if (!tb[AR6K_TM_ATTR_DATA])
+                        return -EINVAL;
+
+                buf = nla_data(tb[AR6K_TM_ATTR_DATA]);
+                buf_len = nla_len(tb[AR6K_TM_ATTR_DATA]);
+
+                wmi_test_cmd(ar->arWmi, buf, buf_len);
+
+                return 0;
+
+                break;
+        case AR6K_TM_CMD_RX_REPORT:
+                if (!tb[AR6K_TM_ATTR_DATA])
+                        return -EINVAL;
+
+                buf = nla_data(tb[AR6K_TM_ATTR_DATA]);
+                buf_len = nla_len(tb[AR6K_TM_ATTR_DATA]);
+
+                reply_len = nla_total_size(AR6K_TM_DATA_MAX_LEN);
+                skb = cfg80211_testmode_alloc_reply_skb(wiphy, reply_len);
+                if (!skb)
+                        return -ENOMEM;
+
+                err = ar6000_testmode_rx_report(ar, buf, buf_len, skb);
+                if (err < 0) {
+                        kfree_skb(skb);
+                        return err;
+                }
+
+                return cfg80211_testmode_reply(skb);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+#endif
+
+static const
+u32 cipher_suites[] = {
+    WLAN_CIPHER_SUITE_WEP40,
+    WLAN_CIPHER_SUITE_WEP104,
+    WLAN_CIPHER_SUITE_TKIP,
+    WLAN_CIPHER_SUITE_CCMP,
+};
+
+bool is_rate_legacy(s32 rate)
+{
+        static const s32 legacy[] = { 1000, 2000, 5500, 11000,
+                                      6000, 9000, 12000, 18000, 24000,
+                                      36000, 48000, 54000 };
+        u8 i;
+
+        for (i = 0; i < ARRAY_SIZE(legacy); i++) {
+                if (rate == legacy[i])
+                        return true;
+        }
+
+        return false;
+}
+
+bool is_rate_ht20(s32 rate, u8 *mcs, bool *sgi)
+{
+        static const s32 ht20[] = { 6500, 13000, 19500, 26000, 39000,
+                                    52000, 58500, 65000, 72200 };
+        u8 i;
+
+        for (i = 0; i < ARRAY_SIZE(ht20); i++) {
+                if (rate == ht20[i]) {
+                        if (i == ARRAY_SIZE(ht20) - 1)
+                                /* last rate uses sgi */
+                                *sgi = true;
+                        else
+                                *sgi = false;
+
+                        *mcs = i;
+                        return true;
+                }
+        }
+        return false;
+}
+
+bool is_rate_ht40(s32 rate, u8 *mcs, bool *sgi)
+{
+        static const s32 ht40[] = { 13500, 27000, 40500, 54000,
+                                    81000, 108000, 121500, 135000,
+                                    150000 };
+        u8 i;
+
+        for (i = 0; i < ARRAY_SIZE(ht40); i++) {
+                if (rate == ht40[i]) {
+                        if (i == ARRAY_SIZE(ht40) - 1)
+                                /* last rate uses sgi */
+                                *sgi = true;
+                        else
+                                *sgi = false;
+
+                        *mcs = i;
+                        return true;
+                }
+        }
+
+        return false;
+}
+
+static int ar6k_get_station(struct wiphy *wiphy, struct net_device *dev,
+                            u8 *mac, struct station_info *sinfo)
+{
+        struct ar6_softc *ar = ar6k_priv(dev);
+        long left;
+        bool sgi;
+        s32 rate;
+        int ret;
+        u8 mcs;
+
+        if (memcmp(mac, ar->arBssid, ETH_ALEN) != 0)
+                return -ENOENT;
+
+        if (down_interruptible(&ar->arSem))
+                return -EBUSY;
+
+        ar->statsUpdatePending = true;
+
+        ret = wmi_get_stats_cmd(ar->arWmi);
+
+        if (ret != 0) {
+                up(&ar->arSem);
+                return -EIO;
+        }
+
+        left = wait_event_interruptible_timeout(arEvent,
+                                                ar->statsUpdatePending == false,
+                                                wmitimeout * HZ);
+
+        up(&ar->arSem);
+
+        if (left == 0)
+                return -ETIMEDOUT;
+        else if (left < 0)
+                return left;
+
+        if (ar->arTargetStats.rx_bytes) {
+                sinfo->rx_bytes = ar->arTargetStats.rx_bytes;
+                sinfo->filled |= STATION_INFO_RX_BYTES;
+                sinfo->rx_packets = ar->arTargetStats.rx_packets;
+                sinfo->filled |= STATION_INFO_RX_PACKETS;
+        }
+
+        if (ar->arTargetStats.tx_bytes) {
+                sinfo->tx_bytes = ar->arTargetStats.tx_bytes;
+                sinfo->filled |= STATION_INFO_TX_BYTES;
+                sinfo->tx_packets = ar->arTargetStats.tx_packets;
+                sinfo->filled |= STATION_INFO_TX_PACKETS;
+        }
+
+        sinfo->signal = ar->arTargetStats.cs_rssi;
+        sinfo->filled |= STATION_INFO_SIGNAL;
+
+        rate = ar->arTargetStats.tx_unicast_rate;
+
+        if (is_rate_legacy(rate)) {
+                sinfo->txrate.legacy = rate / 100;
+        } else if (is_rate_ht20(rate, &mcs, &sgi)) {
+                if (sgi) {
+                        sinfo->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
+                        sinfo->txrate.mcs = mcs - 1;
+                } else {
+                        sinfo->txrate.mcs = mcs;
+                }
+
+                sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
+        } else if (is_rate_ht40(rate, &mcs, &sgi)) {
+                if (sgi) {
+                        sinfo->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
+                        sinfo->txrate.mcs = mcs - 1;
+                } else {
+                        sinfo->txrate.mcs = mcs;
+                }
+
+                sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
+        } else {
+                WARN(1, "invalid rate: %d", rate);
+                return 0;
+        }
+
+        sinfo->filled |= STATION_INFO_TX_BITRATE;
+
+        return 0;
+}
+
+static int ar6k_set_pmksa(struct wiphy *wiphy, struct net_device *netdev,
+                          struct cfg80211_pmksa *pmksa)
+{
+        struct ar6_softc *ar = ar6k_priv(netdev);
+        return wmi_setPmkid_cmd(ar->arWmi, pmksa->bssid, pmksa->pmkid, true);
+}
+
+static int ar6k_del_pmksa(struct wiphy *wiphy, struct net_device *netdev,
+                          struct cfg80211_pmksa *pmksa)
+{
+        struct ar6_softc *ar = ar6k_priv(netdev);
+        return wmi_setPmkid_cmd(ar->arWmi, pmksa->bssid, pmksa->pmkid, false);
+}
+
+static int ar6k_flush_pmksa(struct wiphy *wiphy, struct net_device *netdev)
+{
+        struct ar6_softc *ar = ar6k_priv(netdev);
+        if (ar->arConnected)
+                return wmi_setPmkid_cmd(ar->arWmi, ar->arBssid, NULL, false);
+        return 0;
+}
+
+static struct
+cfg80211_ops ar6k_cfg80211_ops = {
+    .change_virtual_intf = ar6k_cfg80211_change_iface,
+    .add_virtual_intf = ar6k_cfg80211_add_virtual_intf,
+    .del_virtual_intf = ar6k_cfg80211_del_virtual_intf,
+    .scan = ar6k_cfg80211_scan,
+    .connect = ar6k_cfg80211_connect,
+    .disconnect = ar6k_cfg80211_disconnect,
+    .add_key = ar6k_cfg80211_add_key,
+    .get_key = ar6k_cfg80211_get_key,
+    .del_key = ar6k_cfg80211_del_key,
+    .set_default_key = ar6k_cfg80211_set_default_key,
+    .set_default_mgmt_key = ar6k_cfg80211_set_default_mgmt_key,
+    .set_wiphy_params = ar6k_cfg80211_set_wiphy_params,
+    .set_bitrate_mask = ar6k_cfg80211_set_bitrate_mask,
+    .set_tx_power = ar6k_cfg80211_set_txpower,
+    .get_tx_power = ar6k_cfg80211_get_txpower,
+    .set_power_mgmt = ar6k_cfg80211_set_power_mgmt,
+    .join_ibss = ar6k_cfg80211_join_ibss,
+    .leave_ibss = ar6k_cfg80211_leave_ibss,
+    .get_station = ar6k_get_station,
+    .set_pmksa = ar6k_set_pmksa,
+    .del_pmksa = ar6k_del_pmksa,
+    .flush_pmksa = ar6k_flush_pmksa,
+    CFG80211_TESTMODE_CMD(ar6k_testmode_cmd)
+};
+
+struct wireless_dev *
+ar6k_cfg80211_init(struct device *dev)
+{
+    int ret = 0;
+    struct wireless_dev *wdev;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
+    if(!wdev) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: Couldn't allocate wireless device\n", __func__));
+        return ERR_PTR(-ENOMEM);
+    }
+
+    /* create a new wiphy for use with cfg80211 */
+    wdev->wiphy = wiphy_new(&ar6k_cfg80211_ops, sizeof(struct ar6_softc));
+    if(!wdev->wiphy) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: Couldn't allocate wiphy device\n", __func__));
+        kfree(wdev);
+        return ERR_PTR(-ENOMEM);
+    }
+
+    /* set device pointer for wiphy */
+    set_wiphy_dev(wdev->wiphy, dev);
+
+    wdev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                   BIT(NL80211_IFTYPE_ADHOC);
+    /* max num of ssids that can be probed during scanning */
+    wdev->wiphy->max_scan_ssids = MAX_PROBED_SSID_INDEX;
+    wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar6k_band_2ghz;
+    wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar6k_band_5ghz;
+    wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+
+    wdev->wiphy->cipher_suites = cipher_suites;
+    wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
+    ret = wiphy_register(wdev->wiphy);
+    if(ret < 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: Couldn't register wiphy device\n", __func__));
+        wiphy_free(wdev->wiphy);
+        return ERR_PTR(ret);
+    }
+
+    return wdev;
+}
+
+void
+ar6k_cfg80211_deinit(struct ar6_softc *ar)
+{
+    struct wireless_dev *wdev = ar->wdev;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->scan_request) {
+        cfg80211_scan_done(ar->scan_request, true);
+        ar->scan_request = NULL;
+    }
+
+    if(!wdev)
+        return;
+
+    wiphy_unregister(wdev->wiphy);
+    wiphy_free(wdev->wiphy);
+    kfree(wdev);
+}
+
+
+
+
+
+
+
diff --git a/drivers/staging/ath6kl/os/linux/export_hci_transport.c b/drivers/staging/ath6kl/os/linux/export_hci_transport.c
new file mode 100644
index 00000000000..430998edacc
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/export_hci_transport.c
@@ -0,0 +1,124 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HCI bridge implementation
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#include <a_config.h>
+#include <athdefs.h>
+#include "a_osapi.h"
+#include "htc_api.h"
+#include "a_drv.h"
+#include "hif.h"
+#include "common_drv.h"
+#include "a_debug.h"
+#include "hci_transport_api.h"
+
+#include "AR6002/hw4.0/hw/apb_athr_wlan_map.h"
+#include "AR6002/hw4.0/hw/uart_reg.h"
+#include "AR6002/hw4.0/hw/rtc_wlan_reg.h"
+
+HCI_TRANSPORT_HANDLE (*_HCI_TransportAttach)(void *HTCHandle, struct hci_transport_config_info *pInfo);
+void (*_HCI_TransportDetach)(HCI_TRANSPORT_HANDLE HciTrans);
+int    (*_HCI_TransportAddReceivePkts)(HCI_TRANSPORT_HANDLE HciTrans, struct htc_packet_queue *pQueue);
+int    (*_HCI_TransportSendPkt)(HCI_TRANSPORT_HANDLE HciTrans, struct htc_packet *pPacket, bool Synchronous);
+void        (*_HCI_TransportStop)(HCI_TRANSPORT_HANDLE HciTrans);
+int    (*_HCI_TransportStart)(HCI_TRANSPORT_HANDLE HciTrans);
+int    (*_HCI_TransportEnableDisableAsyncRecv)(HCI_TRANSPORT_HANDLE HciTrans, bool Enable);
+int    (*_HCI_TransportRecvHCIEventSync)(HCI_TRANSPORT_HANDLE HciTrans,
+                                          struct htc_packet           *pPacket,
+                                          int                  MaxPollMS);
+int    (*_HCI_TransportSetBaudRate)(HCI_TRANSPORT_HANDLE HciTrans, u32 Baud);
+int    (*_HCI_TransportEnablePowerMgmt)(HCI_TRANSPORT_HANDLE HciTrans, bool Enable);
+
+extern struct hci_transport_callbacks ar6kHciTransCallbacks;
+
+int ar6000_register_hci_transport(struct hci_transport_callbacks *hciTransCallbacks)
+{
+    ar6kHciTransCallbacks = *hciTransCallbacks;
+
+    _HCI_TransportAttach = HCI_TransportAttach;
+    _HCI_TransportDetach = HCI_TransportDetach;
+    _HCI_TransportAddReceivePkts = HCI_TransportAddReceivePkts;
+    _HCI_TransportSendPkt = HCI_TransportSendPkt;
+    _HCI_TransportStop = HCI_TransportStop;
+    _HCI_TransportStart = HCI_TransportStart;
+    _HCI_TransportEnableDisableAsyncRecv = HCI_TransportEnableDisableAsyncRecv;
+    _HCI_TransportRecvHCIEventSync = HCI_TransportRecvHCIEventSync;
+    _HCI_TransportSetBaudRate = HCI_TransportSetBaudRate;
+    _HCI_TransportEnablePowerMgmt = HCI_TransportEnablePowerMgmt;
+
+    return 0;
+}
+
+int
+ar6000_get_hif_dev(struct hif_device *device, void *config)
+{
+    int status;
+
+    status = HIFConfigureDevice(device,
+                                HIF_DEVICE_GET_OS_DEVICE,
+                                (struct hif_device_os_device_info *)config, 
+                                sizeof(struct hif_device_os_device_info));
+    return status;
+}
+
+int ar6000_set_uart_config(struct hif_device *hifDevice,
+                                u32 scale,
+                                u32 step)
+{
+    u32 regAddress;
+    u32 regVal;
+    int status;
+
+    regAddress = WLAN_UART_BASE_ADDRESS | UART_CLKDIV_ADDRESS;
+    regVal = ((u32)scale << 16) | step;
+    /* change the HCI UART scale/step values through the diagnostic window */
+    status = ar6000_WriteRegDiag(hifDevice, &regAddress, &regVal);                     
+
+    return status;
+}
+
+int ar6000_get_core_clock_config(struct hif_device *hifDevice, u32 *data)
+{
+    u32 regAddress;
+    int status;
+
+    regAddress = WLAN_RTC_BASE_ADDRESS | WLAN_CPU_CLOCK_ADDRESS;
+    /* read CPU clock settings*/
+    status = ar6000_ReadRegDiag(hifDevice, &regAddress, data);
+
+    return status;
+}
+
+EXPORT_SYMBOL(ar6000_register_hci_transport);
+EXPORT_SYMBOL(ar6000_get_hif_dev);
+EXPORT_SYMBOL(ar6000_set_uart_config);
+EXPORT_SYMBOL(ar6000_get_core_clock_config);
+EXPORT_SYMBOL(_HCI_TransportAttach);
+EXPORT_SYMBOL(_HCI_TransportDetach);
+EXPORT_SYMBOL(_HCI_TransportAddReceivePkts);
+EXPORT_SYMBOL(_HCI_TransportSendPkt);
+EXPORT_SYMBOL(_HCI_TransportStop);
+EXPORT_SYMBOL(_HCI_TransportStart);
+EXPORT_SYMBOL(_HCI_TransportEnableDisableAsyncRecv);
+EXPORT_SYMBOL(_HCI_TransportRecvHCIEventSync);
+EXPORT_SYMBOL(_HCI_TransportSetBaudRate);
+EXPORT_SYMBOL(_HCI_TransportEnablePowerMgmt);
diff --git a/drivers/staging/ath6kl/os/linux/hci_bridge.c b/drivers/staging/ath6kl/os/linux/hci_bridge.c
new file mode 100644
index 00000000000..6087edcb1d6
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/hci_bridge.c
@@ -0,0 +1,1141 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HCI bridge implementation
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+#include <linux/etherdevice.h>
+#include <a_config.h>
+#include <athdefs.h>
+#include "a_osapi.h"
+#include "htc_api.h"
+#include "wmi.h"
+#include "a_drv.h"
+#include "hif.h"
+#include "common_drv.h"
+#include "a_debug.h"
+#define  ATH_DEBUG_HCI_BRIDGE    ATH_DEBUG_MAKE_MODULE_MASK(6)
+#define  ATH_DEBUG_HCI_RECV      ATH_DEBUG_MAKE_MODULE_MASK(7)
+#define  ATH_DEBUG_HCI_SEND      ATH_DEBUG_MAKE_MODULE_MASK(8)
+#define  ATH_DEBUG_HCI_DUMP      ATH_DEBUG_MAKE_MODULE_MASK(9)
+#else
+#include "ar6000_drv.h"
+#endif  /* EXPORT_HCI_BRIDGE_INTERFACE */
+
+#ifdef ATH_AR6K_ENABLE_GMBOX
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+#include "export_hci_transport.h"
+#else
+#include "hci_transport_api.h"
+#endif
+#include "epping_test.h"
+#include "gmboxif.h"
+#include "ar3kconfig.h"
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+    /* only build on newer kernels which have BT configured */
+#if defined(CONFIG_BT_MODULE) || defined(CONFIG_BT)
+#define CONFIG_BLUEZ_HCI_BRIDGE  
+#endif
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+unsigned int ar3khcibaud = 0;
+unsigned int hciuartscale = 0;
+unsigned int hciuartstep = 0;
+
+module_param(ar3khcibaud, int, 0644);
+module_param(hciuartscale, int, 0644);
+module_param(hciuartstep, int, 0644);
+#else
+extern unsigned int ar3khcibaud;
+extern unsigned int hciuartscale;
+extern unsigned int hciuartstep;
+#endif /* EXPORT_HCI_BRIDGE_INTERFACE */
+
+struct ar6k_hci_bridge_info {
+    void                    *pHCIDev;          /* HCI bridge device */
+    struct hci_transport_properties HCIProps;         /* HCI bridge props */
+    struct hci_dev          *pBtStackHCIDev;   /* BT Stack HCI dev */
+    bool                  HciNormalMode;     /* Actual HCI mode enabled (non-TEST)*/
+    bool                  HciRegistered;     /* HCI device registered with stack */
+    struct htc_packet_queue        HTCPacketStructHead;
+    u8 *pHTCStructAlloc;
+    spinlock_t              BridgeLock;
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+    struct hci_transport_misc_handles    HCITransHdl; 
+#else
+    struct ar6_softc              *ar;
+#endif /* EXPORT_HCI_BRIDGE_INTERFACE */
+};
+
+#define MAX_ACL_RECV_BUFS           16
+#define MAX_EVT_RECV_BUFS           8
+#define MAX_HCI_WRITE_QUEUE_DEPTH   32
+#define MAX_ACL_RECV_LENGTH         1200
+#define MAX_EVT_RECV_LENGTH         257
+#define TX_PACKET_RSV_OFFSET        32
+#define NUM_HTC_PACKET_STRUCTS     ((MAX_ACL_RECV_BUFS + MAX_EVT_RECV_BUFS + MAX_HCI_WRITE_QUEUE_DEPTH) * 2)
+
+#define HCI_GET_OP_CODE(p)          (((u16)((p)[1])) << 8) | ((u16)((p)[0]))
+
+extern unsigned int setupbtdev;
+struct ar3k_config_info      ar3kconfig;
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+struct ar6k_hci_bridge_info *g_pHcidevInfo;
+#endif
+
+static int bt_setup_hci(struct ar6k_hci_bridge_info *pHcidevInfo);
+static void     bt_cleanup_hci(struct ar6k_hci_bridge_info *pHcidevInfo);
+static int bt_register_hci(struct ar6k_hci_bridge_info *pHcidevInfo);
+static bool   bt_indicate_recv(struct ar6k_hci_bridge_info      *pHcidevInfo,
+                                 HCI_TRANSPORT_PACKET_TYPE Type, 
+                                 struct sk_buff            *skb);
+static struct sk_buff *bt_alloc_buffer(struct ar6k_hci_bridge_info *pHcidevInfo, int Length);
+static void     bt_free_buffer(struct ar6k_hci_bridge_info *pHcidevInfo, struct sk_buff *skb);   
+                               
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+int ar6000_setup_hci(void *ar);
+void     ar6000_cleanup_hci(void *ar);
+int hci_test_send(void *ar, struct sk_buff *skb);
+#else
+int ar6000_setup_hci(struct ar6_softc *ar);
+void     ar6000_cleanup_hci(struct ar6_softc *ar);
+/* HCI bridge testing */
+int hci_test_send(struct ar6_softc *ar, struct sk_buff *skb);
+#endif /* EXPORT_HCI_BRIDGE_INTERFACE */
+
+#define LOCK_BRIDGE(dev)   spin_lock_bh(&(dev)->BridgeLock)
+#define UNLOCK_BRIDGE(dev) spin_unlock_bh(&(dev)->BridgeLock)
+
+static inline void FreeBtOsBuf(struct ar6k_hci_bridge_info *pHcidevInfo, void *osbuf)
+{    
+    if (pHcidevInfo->HciNormalMode) {
+        bt_free_buffer(pHcidevInfo, (struct sk_buff *)osbuf);
+    } else {
+            /* in test mode, these are just ordinary netbuf allocations */
+        A_NETBUF_FREE(osbuf);
+    }
+}
+
+static void FreeHTCStruct(struct ar6k_hci_bridge_info *pHcidevInfo, struct htc_packet *pPacket)
+{
+    LOCK_BRIDGE(pHcidevInfo);
+    HTC_PACKET_ENQUEUE(&pHcidevInfo->HTCPacketStructHead,pPacket);
+    UNLOCK_BRIDGE(pHcidevInfo);  
+}
+
+static struct htc_packet * AllocHTCStruct(struct ar6k_hci_bridge_info *pHcidevInfo)
+{
+    struct htc_packet  *pPacket = NULL;
+    LOCK_BRIDGE(pHcidevInfo);
+    pPacket = HTC_PACKET_DEQUEUE(&pHcidevInfo->HTCPacketStructHead);
+    UNLOCK_BRIDGE(pHcidevInfo);  
+    return pPacket;
+}
+
+#define BLOCK_ROUND_UP_PWR2(x, align)    (((int) (x) + ((align)-1)) & ~((align)-1))
+
+static void RefillRecvBuffers(struct ar6k_hci_bridge_info      *pHcidevInfo, 
+                              HCI_TRANSPORT_PACKET_TYPE Type, 
+                              int                       NumBuffers)
+{
+    int                 length, i;
+    void                *osBuf = NULL;
+    struct htc_packet_queue    queue;
+    struct htc_packet          *pPacket;
+
+    INIT_HTC_PACKET_QUEUE(&queue);
+    
+    if (Type == HCI_ACL_TYPE) {     
+        if (pHcidevInfo->HciNormalMode) {  
+            length = HCI_MAX_FRAME_SIZE;
+        } else {
+            length = MAX_ACL_RECV_LENGTH;    
+        }
+    } else {
+        length = MAX_EVT_RECV_LENGTH;
+    }
+    
+        /* add on transport head and tail room */ 
+    length += pHcidevInfo->HCIProps.HeadRoom + pHcidevInfo->HCIProps.TailRoom;
+        /* round up to the required I/O padding */      
+    length = BLOCK_ROUND_UP_PWR2(length,pHcidevInfo->HCIProps.IOBlockPad);
+             
+    for (i = 0; i < NumBuffers; i++) {   
+           
+        if (pHcidevInfo->HciNormalMode) {   
+            osBuf = bt_alloc_buffer(pHcidevInfo,length);       
+        } else {
+            osBuf = A_NETBUF_ALLOC(length);  
+        }
+          
+        if (NULL == osBuf) {
+            break;    
+        }            
+         
+        pPacket = AllocHTCStruct(pHcidevInfo);
+        if (NULL == pPacket) {
+            FreeBtOsBuf(pHcidevInfo,osBuf);
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to alloc HTC struct \n"));
+            break;    
+        }     
+        
+        SET_HTC_PACKET_INFO_RX_REFILL(pPacket,osBuf,A_NETBUF_DATA(osBuf),length,Type);
+            /* add to queue */
+        HTC_PACKET_ENQUEUE(&queue,pPacket);
+    }
+    
+    if (i > 0) {
+        HCI_TransportAddReceivePkts(pHcidevInfo->pHCIDev, &queue);    
+    }
+}
+
+#define HOST_INTEREST_ITEM_ADDRESS(ar, item) \
+        (((ar)->arTargetType == TARGET_TYPE_AR6002) ? AR6002_HOST_INTEREST_ITEM_ADDRESS(item) : \
+        (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0))
+static int ar6000_hci_transport_ready(HCI_TRANSPORT_HANDLE     HCIHandle,
+                                           struct hci_transport_properties *pProps, 
+                                           void                     *pContext)
+{
+    struct ar6k_hci_bridge_info *pHcidevInfo = (struct ar6k_hci_bridge_info *)pContext;
+    int              status;
+    u32 address, hci_uart_pwr_mgmt_params;
+//    struct ar3k_config_info      ar3kconfig;
+    
+    pHcidevInfo->pHCIDev = HCIHandle;
+    
+    memcpy(&pHcidevInfo->HCIProps,pProps,sizeof(*pProps));
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE,("HCI ready (hci:0x%lX, headroom:%d, tailroom:%d blockpad:%d) \n", 
+            (unsigned long)HCIHandle, 
+            pHcidevInfo->HCIProps.HeadRoom, 
+            pHcidevInfo->HCIProps.TailRoom,
+            pHcidevInfo->HCIProps.IOBlockPad));
+    
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+    A_ASSERT((pProps->HeadRoom + pProps->TailRoom) <= (struct net_device *)(pHcidevInfo->HCITransHdl.netDevice)->hard_header_len);
+#else
+    A_ASSERT((pProps->HeadRoom + pProps->TailRoom) <= pHcidevInfo->ar->arNetDev->hard_header_len);
+#endif
+                             
+        /* provide buffers */
+    RefillRecvBuffers(pHcidevInfo, HCI_ACL_TYPE, MAX_ACL_RECV_BUFS);
+    RefillRecvBuffers(pHcidevInfo, HCI_EVENT_TYPE, MAX_EVT_RECV_BUFS);
+   
+    do {
+            /* start transport */
+        status = HCI_TransportStart(pHcidevInfo->pHCIDev);
+         
+        if (status) {
+            break;    
+        }
+        
+        if (!pHcidevInfo->HciNormalMode) {
+                /* in test mode, no need to go any further */
+            break;    
+        }
+
+        // The delay is required when AR6K is driving the BT reset line
+        // where time is needed after the BT chip is out of reset (HCI_TransportStart)
+        // and before the first HCI command is issued (AR3KConfigure)
+        // FIXME
+        // The delay should be configurable and be only applied when AR6K driving the BT
+        // reset line. This could be done by some module parameter or based on some HW config
+        // info. For now apply 100ms delay blindly
+        A_MDELAY(100);
+        
+        A_MEMZERO(&ar3kconfig,sizeof(ar3kconfig));
+        ar3kconfig.pHCIDev = pHcidevInfo->pHCIDev;
+        ar3kconfig.pHCIProps = &pHcidevInfo->HCIProps;
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        ar3kconfig.pHIFDevice = (struct hif_device *)(pHcidevInfo->HCITransHdl.hifDevice);
+#else
+        ar3kconfig.pHIFDevice = pHcidevInfo->ar->arHifDevice;
+#endif
+        ar3kconfig.pBtStackHCIDev = pHcidevInfo->pBtStackHCIDev;
+        
+        if (ar3khcibaud != 0) {
+                /* user wants ar3k baud rate change */
+            ar3kconfig.Flags |= AR3K_CONFIG_FLAG_SET_AR3K_BAUD;
+            ar3kconfig.Flags |= AR3K_CONFIG_FLAG_AR3K_BAUD_CHANGE_DELAY;
+            ar3kconfig.AR3KBaudRate = ar3khcibaud;    
+        }
+        
+        if ((hciuartscale != 0) || (hciuartstep != 0)) {   
+                /* user wants to tune HCI bridge UART scale/step values */
+            ar3kconfig.AR6KScale = (u16)hciuartscale;
+            ar3kconfig.AR6KStep = (u16)hciuartstep;
+            ar3kconfig.Flags |= AR3K_CONFIG_FLAG_SET_AR6K_SCALE_STEP;
+        }
+        
+        /* Fetch the address of the hi_hci_uart_pwr_mgmt_params instance in the host interest area */
+        address = TARG_VTOP(pHcidevInfo->ar->arTargetType, 
+                            HOST_INTEREST_ITEM_ADDRESS(pHcidevInfo->ar, hi_hci_uart_pwr_mgmt_params));
+        status = ar6000_ReadRegDiag(pHcidevInfo->ar->arHifDevice, &address, &hci_uart_pwr_mgmt_params);
+        if (0 == status) {
+            ar3kconfig.PwrMgmtEnabled = (hci_uart_pwr_mgmt_params & 0x1);
+            ar3kconfig.IdleTimeout = (hci_uart_pwr_mgmt_params & 0xFFFF0000) >> 16;
+            ar3kconfig.WakeupTimeout = (hci_uart_pwr_mgmt_params & 0xFF00) >> 8;
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: failed to read hci_uart_pwr_mgmt_params! \n"));
+        }
+        /* configure the AR3K device */         
+                memcpy(ar3kconfig.bdaddr,pHcidevInfo->ar->bdaddr,6);
+        status = AR3KConfigure(&ar3kconfig);
+        if (status) {
+            break; 
+        }
+
+        /* Make sure both AR6K and AR3K have power management enabled */
+        if (ar3kconfig.PwrMgmtEnabled) {
+            status = HCI_TransportEnablePowerMgmt(pHcidevInfo->pHCIDev, true);
+            if (status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: failed to enable TLPM for AR6K! \n"));
+            }
+        }
+        
+        status = bt_register_hci(pHcidevInfo);
+        
+    } while (false);
+
+    return status; 
+}
+
+static void ar6000_hci_transport_failure(void *pContext, int Status)
+{
+    struct ar6k_hci_bridge_info *pHcidevInfo = (struct ar6k_hci_bridge_info *)pContext;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: transport failure! \n"));
+    
+    if (pHcidevInfo->HciNormalMode) {
+        /* TODO .. */    
+    }
+}
+
+static void ar6000_hci_transport_removed(void *pContext)
+{
+    struct ar6k_hci_bridge_info *pHcidevInfo = (struct ar6k_hci_bridge_info *)pContext;
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: transport removed. \n"));
+    
+    A_ASSERT(pHcidevInfo->pHCIDev != NULL);
+        
+    HCI_TransportDetach(pHcidevInfo->pHCIDev);
+    bt_cleanup_hci(pHcidevInfo);
+    pHcidevInfo->pHCIDev = NULL;
+}
+
+static void ar6000_hci_send_complete(void *pContext, struct htc_packet *pPacket)
+{
+    struct ar6k_hci_bridge_info *pHcidevInfo = (struct ar6k_hci_bridge_info *)pContext;
+    void                 *osbuf = pPacket->pPktContext;
+    A_ASSERT(osbuf != NULL);
+    A_ASSERT(pHcidevInfo != NULL);
+    
+    if (pPacket->Status) {
+        if ((pPacket->Status != A_ECANCELED) && (pPacket->Status != A_NO_RESOURCE)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: Send Packet Failed: %d \n",pPacket->Status)); 
+        }   
+    }
+            
+    FreeHTCStruct(pHcidevInfo,pPacket);    
+    FreeBtOsBuf(pHcidevInfo,osbuf);
+    
+}
+
+static void ar6000_hci_pkt_recv(void *pContext, struct htc_packet *pPacket)
+{
+    struct ar6k_hci_bridge_info *pHcidevInfo = (struct ar6k_hci_bridge_info *)pContext;
+    struct sk_buff       *skb;
+    
+    A_ASSERT(pHcidevInfo != NULL);
+    skb = (struct sk_buff *)pPacket->pPktContext;
+    A_ASSERT(skb != NULL);
+          
+    do {
+        
+        if (pPacket->Status) {
+            break;
+        }
+  
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_RECV, 
+                        ("HCI Bridge, packet received type : %d len:%d \n",
+                        HCI_GET_PACKET_TYPE(pPacket),pPacket->ActualLength));
+    
+            /* set the actual buffer position in the os buffer, HTC recv buffers posted to HCI are set
+             * to fill the front of the buffer */
+        A_NETBUF_PUT(skb,pPacket->ActualLength + pHcidevInfo->HCIProps.HeadRoom);
+        A_NETBUF_PULL(skb,pHcidevInfo->HCIProps.HeadRoom);
+        
+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_HCI_DUMP)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("<<< Recv HCI %s packet len:%d \n",
+                        (HCI_GET_PACKET_TYPE(pPacket) == HCI_EVENT_TYPE) ? "EVENT" : "ACL",
+                        skb->len));
+            AR_DEBUG_PRINTBUF(skb->data, skb->len,"BT HCI RECV Packet Dump");
+        }
+        
+        if (pHcidevInfo->HciNormalMode) {
+                /* indicate the packet */         
+            if (bt_indicate_recv(pHcidevInfo,HCI_GET_PACKET_TYPE(pPacket),skb)) {
+                    /* bt stack accepted the packet */
+                skb = NULL;
+            }  
+            break;
+        }
+        
+            /* for testing, indicate packet to the network stack */ 
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        skb->dev = (struct net_device *)(pHcidevInfo->HCITransHdl.netDevice);        
+        if ((((struct net_device *)pHcidevInfo->HCITransHdl.netDevice)->flags & IFF_UP) == IFF_UP) {
+            skb->protocol = eth_type_trans(skb, (struct net_device *)(pHcidevInfo->HCITransHdl.netDevice));
+#else
+        skb->dev = pHcidevInfo->ar->arNetDev;        
+        if ((pHcidevInfo->ar->arNetDev->flags & IFF_UP) == IFF_UP) {
+            skb->protocol = eth_type_trans(skb, pHcidevInfo->ar->arNetDev);
+#endif
+            netif_rx(skb);
+            skb = NULL;
+        } 
+        
+    } while (false);
+    
+    FreeHTCStruct(pHcidevInfo,pPacket);
+    
+    if (skb != NULL) {
+            /* packet was not accepted, free it */
+        FreeBtOsBuf(pHcidevInfo,skb);       
+    }
+    
+}
+
+static void  ar6000_hci_pkt_refill(void *pContext, HCI_TRANSPORT_PACKET_TYPE Type, int BuffersAvailable)
+{
+    struct ar6k_hci_bridge_info *pHcidevInfo = (struct ar6k_hci_bridge_info *)pContext;
+    int                  refillCount;
+
+    if (Type == HCI_ACL_TYPE) {
+        refillCount =  MAX_ACL_RECV_BUFS - BuffersAvailable;   
+    } else {
+        refillCount =  MAX_EVT_RECV_BUFS - BuffersAvailable;     
+    }
+    
+    if (refillCount > 0) {
+        RefillRecvBuffers(pHcidevInfo,Type,refillCount);
+    }
+    
+}
+
+static HCI_SEND_FULL_ACTION  ar6000_hci_pkt_send_full(void *pContext, struct htc_packet *pPacket)
+{
+    struct ar6k_hci_bridge_info    *pHcidevInfo = (struct ar6k_hci_bridge_info *)pContext;
+    HCI_SEND_FULL_ACTION    action = HCI_SEND_FULL_KEEP;
+    
+    if (!pHcidevInfo->HciNormalMode) {
+            /* for epping testing, check packet tag, some epping packets are
+             * special and cannot be dropped */
+        if (HTC_GET_TAG_FROM_PKT(pPacket) == AR6K_DATA_PKT_TAG) {
+            action = HCI_SEND_FULL_DROP;     
+        }
+    }
+    
+    return action;
+}
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+int ar6000_setup_hci(void *ar)
+#else
+int ar6000_setup_hci(struct ar6_softc *ar)
+#endif
+{
+    struct hci_transport_config_info config;
+    int                  status = 0;
+    int                       i;
+    struct htc_packet                *pPacket;
+    struct ar6k_hci_bridge_info      *pHcidevInfo;
+        
+       
+    do {
+        
+        pHcidevInfo = (struct ar6k_hci_bridge_info *)A_MALLOC(sizeof(struct ar6k_hci_bridge_info));
+        
+        if (NULL == pHcidevInfo) {
+            status = A_NO_MEMORY;
+            break;    
+        }
+        
+        A_MEMZERO(pHcidevInfo, sizeof(struct ar6k_hci_bridge_info));
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        g_pHcidevInfo = pHcidevInfo;
+        pHcidevInfo->HCITransHdl = *(struct hci_transport_misc_handles *)ar;
+#else
+        ar->hcidev_info = pHcidevInfo;
+        pHcidevInfo->ar = ar;
+#endif
+        spin_lock_init(&pHcidevInfo->BridgeLock);
+        INIT_HTC_PACKET_QUEUE(&pHcidevInfo->HTCPacketStructHead);
+
+        ar->exitCallback = AR3KConfigureExit;
+    
+        status = bt_setup_hci(pHcidevInfo);
+        if (status) {
+            break;    
+        }
+        
+        if (pHcidevInfo->HciNormalMode) {      
+            AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: running in normal mode... \n"));    
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: running in test mode... \n"));     
+        }
+        
+        pHcidevInfo->pHTCStructAlloc = (u8 *)A_MALLOC((sizeof(struct htc_packet)) * NUM_HTC_PACKET_STRUCTS);
+        
+        if (NULL == pHcidevInfo->pHTCStructAlloc) {
+            status = A_NO_MEMORY;
+            break;    
+        }
+        
+        pPacket = (struct htc_packet *)pHcidevInfo->pHTCStructAlloc;
+        for (i = 0; i < NUM_HTC_PACKET_STRUCTS; i++,pPacket++) {
+            FreeHTCStruct(pHcidevInfo,pPacket);                
+        }
+        
+        A_MEMZERO(&config,sizeof(struct hci_transport_config_info));        
+        config.ACLRecvBufferWaterMark = MAX_ACL_RECV_BUFS / 2;
+        config.EventRecvBufferWaterMark = MAX_EVT_RECV_BUFS / 2;
+        config.MaxSendQueueDepth = MAX_HCI_WRITE_QUEUE_DEPTH;
+        config.pContext = pHcidevInfo;    
+        config.TransportFailure = ar6000_hci_transport_failure;
+        config.TransportReady = ar6000_hci_transport_ready;
+        config.TransportRemoved = ar6000_hci_transport_removed;
+        config.pHCISendComplete = ar6000_hci_send_complete;
+        config.pHCIPktRecv = ar6000_hci_pkt_recv;
+        config.pHCIPktRecvRefill = ar6000_hci_pkt_refill;
+        config.pHCISendFull = ar6000_hci_pkt_send_full;
+       
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        pHcidevInfo->pHCIDev = HCI_TransportAttach(pHcidevInfo->HCITransHdl.htcHandle, &config);
+#else
+        pHcidevInfo->pHCIDev = HCI_TransportAttach(ar->arHtcTarget, &config);
+#endif
+
+        if (NULL == pHcidevInfo->pHCIDev) {
+            status = A_ERROR;      
+        }
+    
+    } while (false);
+    
+    if (status) {
+        if (pHcidevInfo != NULL) {
+            if (NULL == pHcidevInfo->pHCIDev) {
+                /* GMBOX may not be present in older chips */
+                /* just return success */ 
+                status = 0;
+            }
+        }
+        ar6000_cleanup_hci(ar);    
+    }
+    
+    return status;
+}
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+void  ar6000_cleanup_hci(void *ar)
+#else
+void  ar6000_cleanup_hci(struct ar6_softc *ar)
+#endif
+{
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+    struct ar6k_hci_bridge_info *pHcidevInfo = g_pHcidevInfo;
+#else
+    struct ar6k_hci_bridge_info *pHcidevInfo = (struct ar6k_hci_bridge_info *)ar->hcidev_info;
+#endif
+    
+    if (pHcidevInfo != NULL) {
+        bt_cleanup_hci(pHcidevInfo);   
+        
+        if (pHcidevInfo->pHCIDev != NULL) {
+            HCI_TransportStop(pHcidevInfo->pHCIDev);
+            HCI_TransportDetach(pHcidevInfo->pHCIDev);
+            pHcidevInfo->pHCIDev = NULL;
+        } 
+        
+        if (pHcidevInfo->pHTCStructAlloc != NULL) {
+            kfree(pHcidevInfo->pHTCStructAlloc);
+            pHcidevInfo->pHTCStructAlloc = NULL;    
+        }
+        
+        kfree(pHcidevInfo);
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+        ar->hcidev_info = NULL;
+#endif
+    }
+    
+    
+}
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+int hci_test_send(void *ar, struct sk_buff *skb)
+#else
+int hci_test_send(struct ar6_softc *ar, struct sk_buff *skb)
+#endif
+{
+    int              status = 0;
+    int              length;
+    EPPING_HEADER    *pHeader;
+    struct htc_packet       *pPacket;   
+    HTC_TX_TAG       htc_tag = AR6K_DATA_PKT_TAG;
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+    struct ar6k_hci_bridge_info *pHcidevInfo = g_pHcidevInfo;
+#else
+    struct ar6k_hci_bridge_info *pHcidevInfo = (struct ar6k_hci_bridge_info *)ar->hcidev_info;
+#endif
+            
+    do {
+        
+        if (NULL == pHcidevInfo) {
+            status = A_ERROR;
+            break;    
+        }
+        
+        if (NULL == pHcidevInfo->pHCIDev) {
+            status = A_ERROR;
+            break;    
+        }
+        
+        if (pHcidevInfo->HciNormalMode) {
+                /* this interface cannot run when normal WMI is running */
+            status = A_ERROR;
+            break;    
+        }
+        
+        pHeader = (EPPING_HEADER *)A_NETBUF_DATA(skb);
+        
+        if (!IS_EPPING_PACKET(pHeader)) {
+            status = A_EINVAL;
+            break;
+        }
+                       
+        if (IS_EPING_PACKET_NO_DROP(pHeader)) {
+            htc_tag = AR6K_CONTROL_PKT_TAG;   
+        }
+        
+        length = sizeof(EPPING_HEADER) + pHeader->DataLength;
+                
+        pPacket = AllocHTCStruct(pHcidevInfo);
+        if (NULL == pPacket) {        
+            status = A_NO_MEMORY;
+            break;
+        } 
+     
+        SET_HTC_PACKET_INFO_TX(pPacket,
+                               skb,
+                               A_NETBUF_DATA(skb),
+                               length,
+                               HCI_ACL_TYPE,  /* send every thing out as ACL */
+                               htc_tag);
+             
+        HCI_TransportSendPkt(pHcidevInfo->pHCIDev,pPacket,false);
+        pPacket = NULL;
+            
+    } while (false);
+            
+    return status;
+}
+
+void ar6000_set_default_ar3kconfig(struct ar6_softc *ar, void *ar3kconfig)
+{
+    struct ar6k_hci_bridge_info *pHcidevInfo = (struct ar6k_hci_bridge_info *)ar->hcidev_info;
+    struct ar3k_config_info *config = (struct ar3k_config_info *)ar3kconfig;
+
+    config->pHCIDev = pHcidevInfo->pHCIDev;
+    config->pHCIProps = &pHcidevInfo->HCIProps;
+    config->pHIFDevice = ar->arHifDevice;
+    config->pBtStackHCIDev = pHcidevInfo->pBtStackHCIDev;
+    config->Flags |= AR3K_CONFIG_FLAG_SET_AR3K_BAUD;
+    config->AR3KBaudRate = 115200;    
+}
+
+#ifdef CONFIG_BLUEZ_HCI_BRIDGE   
+/*** BT Stack Entrypoints *******/
+
+/*
+ * bt_open - open a handle to the device
+*/
+static int bt_open(struct hci_dev *hdev)
+{
+ 
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_open - enter - x\n"));
+    set_bit(HCI_RUNNING, &hdev->flags);
+    set_bit(HCI_UP, &hdev->flags);
+    set_bit(HCI_INIT, &hdev->flags);         
+    return 0;
+}
+
+/*
+ * bt_close - close handle to the device
+*/
+static int bt_close(struct hci_dev *hdev)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_close - enter\n"));
+    clear_bit(HCI_RUNNING, &hdev->flags);
+    return 0;
+}
+
+/*
+ * bt_send_frame - send data frames
+*/
+static int bt_send_frame(struct sk_buff *skb)
+{
+    struct hci_dev             *hdev = (struct hci_dev *)skb->dev;
+    HCI_TRANSPORT_PACKET_TYPE  type;
+    struct ar6k_hci_bridge_info       *pHcidevInfo;
+    struct htc_packet                 *pPacket;
+    int                   status = 0;
+    struct sk_buff             *txSkb = NULL;
+    
+    if (!hdev) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("HCI Bridge: bt_send_frame - no device\n"));
+        return -ENODEV;
+    }
+      
+    if (!test_bit(HCI_RUNNING, &hdev->flags)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_send_frame - not open\n"));
+        return -EBUSY;
+    }
+  
+    pHcidevInfo = (struct ar6k_hci_bridge_info *)hdev->driver_data;   
+    A_ASSERT(pHcidevInfo != NULL);
+      
+    AR_DEBUG_PRINTF(ATH_DEBUG_HCI_SEND, ("+bt_send_frame type: %d \n",bt_cb(skb)->pkt_type));
+    type = HCI_COMMAND_TYPE;
+    
+    switch (bt_cb(skb)->pkt_type) {
+        case HCI_COMMAND_PKT:
+            type = HCI_COMMAND_TYPE;
+            hdev->stat.cmd_tx++;
+            break;
+ 
+        case HCI_ACLDATA_PKT:
+            type = HCI_ACL_TYPE;
+            hdev->stat.acl_tx++;
+            break;
+
+        case HCI_SCODATA_PKT:
+            /* we don't support SCO over the bridge */
+            kfree_skb(skb);
+            return 0;
+        default:
+            A_ASSERT(false);
+            kfree_skb(skb);
+            return 0;
+    } 
+
+    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_HCI_DUMP)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,(">>> Send HCI %s packet len: %d\n",
+                        (type == HCI_COMMAND_TYPE) ? "COMMAND" : "ACL",
+                        skb->len));
+        if (type == HCI_COMMAND_TYPE) {
+            u16 opcode = HCI_GET_OP_CODE(skb->data);
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("    HCI Command: OGF:0x%X OCF:0x%X \r\n", 
+                  opcode >> 10, opcode & 0x3FF));
+        }
+        AR_DEBUG_PRINTBUF(skb->data,skb->len,"BT HCI SEND Packet Dump");
+    }
+    
+    do {
+        
+        txSkb = bt_skb_alloc(TX_PACKET_RSV_OFFSET + pHcidevInfo->HCIProps.HeadRoom + 
+                             pHcidevInfo->HCIProps.TailRoom + skb->len, 
+                             GFP_ATOMIC);
+
+        if (txSkb == NULL) {
+            status = A_NO_MEMORY;
+            break;    
+        }
+        
+        bt_cb(txSkb)->pkt_type = bt_cb(skb)->pkt_type;
+        txSkb->dev = (void *)pHcidevInfo->pBtStackHCIDev;
+        skb_reserve(txSkb, TX_PACKET_RSV_OFFSET + pHcidevInfo->HCIProps.HeadRoom);
+        memcpy(txSkb->data, skb->data, skb->len);
+        skb_put(txSkb,skb->len);
+        
+        pPacket = AllocHTCStruct(pHcidevInfo);        
+        if (NULL == pPacket) {
+            status = A_NO_MEMORY;
+            break;    
+        }       
+              
+        /* HCI packet length here doesn't include the 1-byte transport header which
+         * will be handled by the HCI transport layer. Enough headroom has already
+         * been reserved above for the transport header
+         */
+        SET_HTC_PACKET_INFO_TX(pPacket,
+                               txSkb,
+                               txSkb->data,
+                               txSkb->len,
+                               type, 
+                               AR6K_CONTROL_PKT_TAG); /* HCI packets cannot be dropped */
+        
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_SEND, ("HCI Bridge: bt_send_frame skb:0x%lX \n",(unsigned long)txSkb));
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_SEND, ("HCI Bridge: type:%d, Total Length:%d Bytes \n",
+                                      type, txSkb->len));
+                                      
+        status = HCI_TransportSendPkt(pHcidevInfo->pHCIDev,pPacket,false);
+        pPacket = NULL;
+        txSkb = NULL;
+        
+    } while (false);
+   
+    if (txSkb != NULL) {
+        kfree_skb(txSkb);    
+    }
+    
+    kfree_skb(skb);        
+       
+    AR_DEBUG_PRINTF(ATH_DEBUG_HCI_SEND, ("-bt_send_frame  \n"));
+    return 0;
+}
+
+/*
+ * bt_ioctl - ioctl processing
+*/
+static int bt_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long arg)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_ioctl - enter\n"));
+    return -ENOIOCTLCMD;
+}
+
+/*
+ * bt_flush - flush outstandingbpackets
+*/
+static int bt_flush(struct hci_dev *hdev)
+{
+    struct ar6k_hci_bridge_info    *pHcidevInfo; 
+    
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_flush - enter\n"));
+    
+    pHcidevInfo = (struct ar6k_hci_bridge_info *)hdev->driver_data;   
+    
+    /* TODO??? */   
+    
+    return 0;
+}
+
+
+/*
+ * bt_destruct - 
+*/
+static void bt_destruct(struct hci_dev *hdev)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_destruct - enter\n"));
+    /* nothing to do here */
+}
+
+static int bt_setup_hci(struct ar6k_hci_bridge_info *pHcidevInfo)
+{
+    int                    status = 0;
+    struct hci_dev              *pHciDev = NULL;
+    struct hif_device_os_device_info   osDevInfo;
+    
+    if (!setupbtdev) {
+        return 0;
+    } 
+        
+    do {
+            
+        A_MEMZERO(&osDevInfo,sizeof(osDevInfo));
+            /* get the underlying OS device */
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        status = ar6000_get_hif_dev((struct hif_device *)(pHcidevInfo->HCITransHdl.hifDevice), 
+                                    &osDevInfo);
+#else
+        status = HIFConfigureDevice(pHcidevInfo->ar->arHifDevice, 
+                                    HIF_DEVICE_GET_OS_DEVICE,
+                                    &osDevInfo, 
+                                    sizeof(osDevInfo));
+#endif
+                                    
+        if (status) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to OS device info from HIF\n"));
+            break;
+        }
+        
+            /* allocate a BT HCI struct for this device */
+        pHciDev = hci_alloc_dev();
+        if (NULL == pHciDev) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge - failed to allocate bt struct \n"));
+            status = A_NO_MEMORY;
+            break;
+        }    
+            /* save the device, we'll register this later */
+        pHcidevInfo->pBtStackHCIDev = pHciDev;       
+        SET_HCIDEV_DEV(pHciDev,osDevInfo.pOSDevice);          
+        SET_HCI_BUS_TYPE(pHciDev, HCI_VIRTUAL, HCI_BREDR);
+        pHciDev->driver_data = pHcidevInfo;
+        pHciDev->open     = bt_open;
+        pHciDev->close    = bt_close;
+        pHciDev->send     = bt_send_frame;
+        pHciDev->ioctl    = bt_ioctl;
+        pHciDev->flush    = bt_flush;
+        pHciDev->destruct = bt_destruct;
+        pHciDev->owner = THIS_MODULE; 
+            /* driver is running in normal BT mode */
+        pHcidevInfo->HciNormalMode = true;
+        
+    } while (false);
+    
+    if (status) {
+        bt_cleanup_hci(pHcidevInfo);    
+    }
+    
+    return status;
+}
+
+static void bt_cleanup_hci(struct ar6k_hci_bridge_info *pHcidevInfo)
+{   
+    int   err;      
+        
+    if (pHcidevInfo->HciRegistered) {
+        pHcidevInfo->HciRegistered = false;
+        clear_bit(HCI_RUNNING, &pHcidevInfo->pBtStackHCIDev->flags);
+        clear_bit(HCI_UP, &pHcidevInfo->pBtStackHCIDev->flags);
+        clear_bit(HCI_INIT, &pHcidevInfo->pBtStackHCIDev->flags);   
+        A_ASSERT(pHcidevInfo->pBtStackHCIDev != NULL);
+            /* unregister */
+        if ((err = hci_unregister_dev(pHcidevInfo->pBtStackHCIDev)) < 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: failed to unregister with bluetooth %d\n",err));
+        }          
+    }   
+    
+    kfree(pHcidevInfo->pBtStackHCIDev);
+    pHcidevInfo->pBtStackHCIDev = NULL;  
+}
+
+static int bt_register_hci(struct ar6k_hci_bridge_info *pHcidevInfo)
+{
+    int       err;
+    int  status = 0;
+    
+    do {          
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: registering HCI... \n"));
+        A_ASSERT(pHcidevInfo->pBtStackHCIDev != NULL);
+             /* mark that we are registered */
+        pHcidevInfo->HciRegistered = true;
+        if ((err = hci_register_dev(pHcidevInfo->pBtStackHCIDev)) < 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: failed to register with bluetooth %d\n",err));
+            pHcidevInfo->HciRegistered = false;
+            status = A_ERROR;
+            break;
+        }
+    
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: HCI registered \n"));
+        
+    } while (false);
+    
+    return status;
+}
+
+static bool bt_indicate_recv(struct ar6k_hci_bridge_info      *pHcidevInfo,
+                               HCI_TRANSPORT_PACKET_TYPE Type, 
+                               struct                    sk_buff *skb)
+{
+    u8 btType;
+    int                   len;
+    bool                success = false;
+    BT_HCI_EVENT_HEADER   *pEvent;
+    
+    do {
+             
+        if (!test_bit(HCI_RUNNING, &pHcidevInfo->pBtStackHCIDev->flags)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("HCI Bridge: bt_indicate_recv - not running\n"));
+            break;
+        }
+    
+        switch (Type) {
+            case HCI_ACL_TYPE:
+                btType = HCI_ACLDATA_PKT;
+                break;
+            case HCI_EVENT_TYPE:  
+                btType = HCI_EVENT_PKT;  
+                break;
+            default:
+                btType = 0;
+                A_ASSERT(false);
+                break;
+        } 
+        
+        if (0 == btType) {
+            break;    
+        }
+        
+            /* set the final type */
+        bt_cb(skb)->pkt_type = btType;
+            /* set dev */
+        skb->dev = (void *)pHcidevInfo->pBtStackHCIDev;
+        len = skb->len;
+        
+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_HCI_RECV)) {
+            if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {                
+                pEvent = (BT_HCI_EVENT_HEADER *)skb->data; 
+                AR_DEBUG_PRINTF(ATH_DEBUG_HCI_RECV, ("BT HCI EventCode: %d, len:%d \n", 
+                        pEvent->EventCode, pEvent->ParamLength));
+            } 
+        }
+        
+            /* pass receive packet up the stack */    
+        if (hci_recv_frame(skb) != 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: hci_recv_frame failed \n"));
+            break;
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_HCI_RECV, 
+                    ("HCI Bridge: Indicated RCV of type:%d, Length:%d \n",btType,len));
+        }
+            
+        success = true;
+    
+    } while (false);
+    
+    return success;
+}
+
+static struct sk_buff* bt_alloc_buffer(struct ar6k_hci_bridge_info *pHcidevInfo, int Length) 
+{ 
+    struct sk_buff *skb;         
+        /* in normal HCI mode we need to alloc from the bt core APIs */
+    skb = bt_skb_alloc(Length, GFP_ATOMIC);
+    if (NULL == skb) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to alloc bt sk_buff \n"));
+    }
+    return skb;
+}
+
+static void bt_free_buffer(struct ar6k_hci_bridge_info *pHcidevInfo, struct sk_buff *skb)
+{
+    kfree_skb(skb);    
+}
+
+#else // { CONFIG_BLUEZ_HCI_BRIDGE
+
+    /* stubs when we only want to test the HCI bridging Interface without the HT stack */
+static int bt_setup_hci(struct ar6k_hci_bridge_info *pHcidevInfo)
+{
+    return 0;
+}
+static void bt_cleanup_hci(struct ar6k_hci_bridge_info *pHcidevInfo)
+{   
+     
+}
+static int bt_register_hci(struct ar6k_hci_bridge_info *pHcidevInfo)
+{
+    A_ASSERT(false);
+    return A_ERROR;    
+}
+
+static bool bt_indicate_recv(struct ar6k_hci_bridge_info      *pHcidevInfo,
+                               HCI_TRANSPORT_PACKET_TYPE Type, 
+                               struct                    sk_buff *skb)
+{
+    A_ASSERT(false);
+    return false;
+}
+
+static struct sk_buff* bt_alloc_buffer(struct ar6k_hci_bridge_info *pHcidevInfo, int Length) 
+{
+    A_ASSERT(false);
+    return NULL;
+}
+static void bt_free_buffer(struct ar6k_hci_bridge_info *pHcidevInfo, struct sk_buff *skb)
+{
+    A_ASSERT(false);
+}
+
+#endif // } CONFIG_BLUEZ_HCI_BRIDGE
+
+#else  // { ATH_AR6K_ENABLE_GMBOX
+
+    /* stubs when GMBOX support is not needed */
+    
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+int ar6000_setup_hci(void *ar)
+#else
+int ar6000_setup_hci(struct ar6_softc *ar)
+#endif
+{
+    return 0;
+}
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+void ar6000_cleanup_hci(void *ar)
+#else
+void ar6000_cleanup_hci(struct ar6_softc *ar)
+#endif
+{
+    return;    
+}
+
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+void ar6000_set_default_ar3kconfig(struct ar6_softc *ar, void *ar3kconfig)
+{
+    return;
+}
+#endif
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+int hci_test_send(void *ar, struct sk_buff *skb)
+#else
+int hci_test_send(struct ar6_softc *ar, struct sk_buff *skb)
+#endif
+{
+    return -EOPNOTSUPP;
+}
+
+#endif // } ATH_AR6K_ENABLE_GMBOX
+
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+static int __init
+hcibridge_init_module(void)
+{
+    int status;
+    struct hci_transport_callbacks hciTransCallbacks;
+
+    hciTransCallbacks.setupTransport = ar6000_setup_hci;
+    hciTransCallbacks.cleanupTransport = ar6000_cleanup_hci;
+
+    status = ar6000_register_hci_transport(&hciTransCallbacks);
+    if (status)
+        return -ENODEV;
+
+    return 0;
+}
+
+static void __exit
+hcibridge_cleanup_module(void)
+{
+}
+
+module_init(hcibridge_init_module);
+module_exit(hcibridge_cleanup_module);
+MODULE_LICENSE("Dual BSD/GPL");
+#endif
diff --git a/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h b/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
new file mode 100644
index 00000000000..80cef77738f
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
@@ -0,0 +1,776 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _AR6000_H_
+#define _AR6000_H_
+
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/spinlock.h>
+#include <linux/if_ether.h>
+#include <linux/etherdevice.h>
+#include <net/iw_handler.h>
+#include <linux/if_arp.h>
+#include <linux/ip.h>
+#include <linux/wireless.h>
+#include <net/cfg80211.h>
+#include <linux/module.h>
+#include <asm/io.h>
+
+#include <a_config.h>
+#include <athdefs.h>
+#include "a_osapi.h"
+#include "htc_api.h"
+#include "wmi.h"
+#include "a_drv.h"
+#include "bmi.h"
+#include <ieee80211.h>
+#include <ieee80211_ioctl.h>
+#include <wlan_api.h>
+#include <wmi_api.h>
+#include "pkt_log.h"
+#include "aggr_recv_api.h"
+#include <host_version.h>
+#include <linux/rtnetlink.h>
+#include <linux/moduleparam.h>
+#include "ar6000_api.h"
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+#include <testcmd.h>
+#endif
+#include <linux/firmware.h>
+
+#include "targaddrs.h"
+#include "dbglog_api.h"
+#include "ar6000_diag.h"
+#include "common_drv.h"
+#include "roaming.h"
+#include "hci_transport_api.h"
+#define ATH_MODULE_NAME driver
+#include "a_debug.h"
+#include "hw/apb_map.h"
+#include "hw/rtc_reg.h"
+#include "hw/mbox_reg.h"
+#include "gpio_reg.h"
+
+#define  ATH_DEBUG_DBG_LOG       ATH_DEBUG_MAKE_MODULE_MASK(0)
+#define  ATH_DEBUG_WLAN_CONNECT  ATH_DEBUG_MAKE_MODULE_MASK(1)
+#define  ATH_DEBUG_WLAN_SCAN     ATH_DEBUG_MAKE_MODULE_MASK(2)
+#define  ATH_DEBUG_WLAN_TX       ATH_DEBUG_MAKE_MODULE_MASK(3)
+#define  ATH_DEBUG_WLAN_RX       ATH_DEBUG_MAKE_MODULE_MASK(4)
+#define  ATH_DEBUG_HTC_RAW       ATH_DEBUG_MAKE_MODULE_MASK(5)
+#define  ATH_DEBUG_HCI_BRIDGE    ATH_DEBUG_MAKE_MODULE_MASK(6)
+#define  ATH_DEBUG_HCI_RECV      ATH_DEBUG_MAKE_MODULE_MASK(7)
+#define  ATH_DEBUG_HCI_SEND      ATH_DEBUG_MAKE_MODULE_MASK(8)
+#define  ATH_DEBUG_HCI_DUMP      ATH_DEBUG_MAKE_MODULE_MASK(9)
+
+#ifndef  __dev_put
+#define  __dev_put(dev) dev_put(dev)
+#endif
+
+
+#define USER_SAVEDKEYS_STAT_INIT     0
+#define USER_SAVEDKEYS_STAT_RUN      1
+
+// TODO this needs to move into the AR_SOFTC struct
+struct USER_SAVEDKEYS {
+    struct ieee80211req_key   ucast_ik;
+    struct ieee80211req_key   bcast_ik;
+    CRYPTO_TYPE               keyType;
+    bool                    keyOk;
+};
+
+#define DBG_INFO        0x00000001
+#define DBG_ERROR       0x00000002
+#define DBG_WARNING     0x00000004
+#define DBG_SDIO        0x00000008
+#define DBG_HIF         0x00000010
+#define DBG_HTC         0x00000020
+#define DBG_WMI         0x00000040
+#define DBG_WMI2        0x00000080
+#define DBG_DRIVER      0x00000100
+
+#define DBG_DEFAULTS    (DBG_ERROR|DBG_WARNING)
+
+
+int ar6000_ReadRegDiag(struct hif_device *hifDevice, u32 *address, u32 *data);
+int ar6000_WriteRegDiag(struct hif_device *hifDevice, u32 *address, u32 *data);
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define MAX_AR6000                        1
+#define AR6000_MAX_RX_BUFFERS             16
+#define AR6000_BUFFER_SIZE                1664
+#define AR6000_MAX_AMSDU_RX_BUFFERS       4
+#define AR6000_AMSDU_REFILL_THRESHOLD     3
+#define AR6000_AMSDU_BUFFER_SIZE          (WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH + 128)
+#define AR6000_MAX_RX_MESSAGE_SIZE        (max(WMI_MAX_NORMAL_RX_DATA_FRAME_LENGTH,WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH))
+
+#define AR6000_TX_TIMEOUT                 10
+#define AR6000_ETH_ADDR_LEN               6
+#define AR6000_MAX_ENDPOINTS              4
+#define MAX_NODE_NUM                      15
+/* MAX_HI_COOKIE_NUM are reserved for high priority traffic */
+#define MAX_DEF_COOKIE_NUM                180
+#define MAX_HI_COOKIE_NUM                 18 /* 10% of MAX_COOKIE_NUM */
+#define MAX_COOKIE_NUM                    (MAX_DEF_COOKIE_NUM + MAX_HI_COOKIE_NUM)
+
+/* MAX_DEFAULT_SEND_QUEUE_DEPTH is used to set the default queue depth for the
+ * WMM send queues.  If a queue exceeds this depth htc will query back to the
+ * OS specific layer by calling EpSendFull().  This gives the OS layer the
+ * opportunity to drop the packet if desired.  Therefore changing
+ * MAX_DEFAULT_SEND_QUEUE_DEPTH does not affect resource utilization but
+ * does impact the threshold used to identify if a packet should be
+ * dropped. */
+#define MAX_DEFAULT_SEND_QUEUE_DEPTH      (MAX_DEF_COOKIE_NUM / WMM_NUM_AC)
+
+#define AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT        1
+#define AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT  1
+#define A_DISCONNECT_TIMER_INTERVAL       10 * 1000
+#define A_DEFAULT_LISTEN_INTERVAL         100
+#define A_MAX_WOW_LISTEN_INTERVAL         1000
+
+enum {
+    DRV_HB_CHALLENGE = 0,
+    APP_HB_CHALLENGE
+};
+
+enum {
+    WLAN_INIT_MODE_NONE = 0,
+    WLAN_INIT_MODE_USR,
+    WLAN_INIT_MODE_UDEV,
+    WLAN_INIT_MODE_DRV
+};
+
+/* Suspend - configuration */
+enum {
+    WLAN_SUSPEND_CUT_PWR = 0,
+    WLAN_SUSPEND_DEEP_SLEEP,
+    WLAN_SUSPEND_WOW,
+    WLAN_SUSPEND_CUT_PWR_IF_BT_OFF
+};
+
+/* WiFi OFF - configuration */
+enum {
+    WLAN_OFF_CUT_PWR = 0,
+    WLAN_OFF_DEEP_SLEEP,
+};
+
+/* WLAN low power state */
+enum {
+    WLAN_POWER_STATE_ON = 0,
+    WLAN_POWER_STATE_CUT_PWR = 1,
+    WLAN_POWER_STATE_DEEP_SLEEP,
+    WLAN_POWER_STATE_WOW
+};
+
+/* WLAN WoW State */
+enum {
+    WLAN_WOW_STATE_NONE = 0,
+    WLAN_WOW_STATE_SUSPENDED,
+    WLAN_WOW_STATE_SUSPENDING
+};
+
+
+typedef enum _AR6K_BIN_FILE {
+    AR6K_OTP_FILE,
+    AR6K_FIRMWARE_FILE,
+    AR6K_PATCH_FILE,
+    AR6K_BOARD_DATA_FILE,
+} AR6K_BIN_FILE;
+
+#ifdef SETUPHCI_ENABLED
+#define SETUPHCI_DEFAULT           1
+#else
+#define SETUPHCI_DEFAULT           0
+#endif /* SETUPHCI_ENABLED */
+
+#ifdef SETUPBTDEV_ENABLED
+#define SETUPBTDEV_DEFAULT         1
+#else
+#define SETUPBTDEV_DEFAULT         0
+#endif /* SETUPBTDEV_ENABLED */
+
+#ifdef ENABLEUARTPRINT_SET
+#define ENABLEUARTPRINT_DEFAULT    1
+#else
+#define ENABLEUARTPRINT_DEFAULT    0
+#endif /* ENABLEARTPRINT_SET */
+
+#ifdef ATH6KL_CONFIG_HIF_VIRTUAL_SCATTER
+#define NOHIFSCATTERSUPPORT_DEFAULT    1
+#else /* ATH6KL_CONFIG_HIF_VIRTUAL_SCATTER */
+#define NOHIFSCATTERSUPPORT_DEFAULT    0
+#endif /* ATH6KL_CONFIG_HIF_VIRTUAL_SCATTER */
+
+
+#if defined(CONFIG_ATH6KL_ENABLE_COEXISTENCE)
+
+#ifdef CONFIG_AR600x_BT_QCOM
+#define ATH6KL_BT_DEV 1
+#elif defined(CONFIG_AR600x_BT_CSR)
+#define ATH6KL_BT_DEV 2
+#else
+#define ATH6KL_BT_DEV 3
+#endif
+
+#ifdef CONFIG_AR600x_DUAL_ANTENNA
+#define ATH6KL_BT_ANTENNA 2
+#else
+#define ATH6KL_BT_ANTENNA 1
+#endif
+
+#endif /* CONFIG_ATH6KL_ENABLE_COEXISTENCE */
+
+#ifdef AR600x_BT_AR3001
+#define AR3KHCIBAUD_DEFAULT        3000000
+#define HCIUARTSCALE_DEFAULT       1
+#define HCIUARTSTEP_DEFAULT        8937
+#else
+#define AR3KHCIBAUD_DEFAULT        0
+#define HCIUARTSCALE_DEFAULT       0
+#define HCIUARTSTEP_DEFAULT        0
+#endif /* AR600x_BT_AR3001 */
+
+#define WLAN_INIT_MODE_DEFAULT     WLAN_INIT_MODE_DRV
+
+#define AR6K_PATCH_DOWNLOAD_ADDRESS(_param, _ver) do { \
+    if ((_ver) == AR6003_REV1_VERSION) { \
+        (_param) = AR6003_REV1_PATCH_DOWNLOAD_ADDRESS; \
+    } else if ((_ver) == AR6003_REV2_VERSION) { \
+        (_param) = AR6003_REV2_PATCH_DOWNLOAD_ADDRESS; \
+    } else { \
+       AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+       A_ASSERT(0); \
+    } \
+} while (0)
+
+#define AR6K_DATA_DOWNLOAD_ADDRESS(_param, _ver) do { \
+    if ((_ver) == AR6003_REV1_VERSION) { \
+        (_param) = AR6003_REV1_DATA_DOWNLOAD_ADDRESS; \
+    } else if ((_ver) == AR6003_REV2_VERSION) { \
+        (_param) = AR6003_REV2_DATA_DOWNLOAD_ADDRESS; \
+    } else { \
+       AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+       A_ASSERT(0); \
+    } \
+} while (0)
+
+#define AR6K_DATASET_PATCH_ADDRESS(_param, _ver) do { \
+        if ((_ver) == AR6003_REV2_VERSION) { \
+                (_param) = AR6003_REV2_DATASET_PATCH_ADDRESS; \
+        } else if ((_ver) == AR6003_REV3_VERSION) { \
+                (_param) = AR6003_REV3_DATASET_PATCH_ADDRESS; \
+        } else { \
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+        A_ASSERT(0); \
+        } \
+} while (0)
+
+#define AR6K_APP_LOAD_ADDRESS(_param, _ver) do { \
+        if ((_ver) == AR6003_REV2_VERSION) { \
+                (_param) = AR6003_REV2_APP_LOAD_ADDRESS; \
+        } else if ((_ver) == AR6003_REV3_VERSION) { \
+                (_param) = AR6003_REV3_APP_LOAD_ADDRESS; \
+        } else { \
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+        A_ASSERT(0); \
+        } \
+} while (0)
+
+#define AR6K_APP_START_OVERRIDE_ADDRESS(_param, _ver) do { \
+        if ((_ver) == AR6003_REV2_VERSION) { \
+                (_param) = AR6003_REV2_APP_START_OVERRIDE; \
+        } else if ((_ver) == AR6003_REV3_VERSION) { \
+                (_param) = AR6003_REV3_APP_START_OVERRIDE; \
+        } else { \
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+        A_ASSERT(0); \
+        } \
+} while (0)
+
+/* AR6003 1.0 definitions */
+#define AR6003_REV1_VERSION                 0x300002ba
+#define AR6003_REV1_DATA_DOWNLOAD_ADDRESS   AR6003_REV1_OTP_DATA_ADDRESS
+#define AR6003_REV1_PATCH_DOWNLOAD_ADDRESS  0x57ea6c
+#define AR6003_REV1_OTP_FILE                "ath6k/AR6003/hw1.0/otp.bin.z77"
+#define AR6003_REV1_FIRMWARE_FILE           "ath6k/AR6003/hw1.0/athwlan.bin.z77"
+#define AR6003_REV1_TCMD_FIRMWARE_FILE      "ath6k/AR6003/hw1.0/athtcmd_ram.bin"
+#define AR6003_REV1_ART_FIRMWARE_FILE       "ath6k/AR6003/hw1.0/device.bin"
+#define AR6003_REV1_PATCH_FILE              "ath6k/AR6003/hw1.0/data.patch.bin"
+#define AR6003_REV1_EPPING_FIRMWARE_FILE    "ath6k/AR6003/hw1.0/endpointping.bin"
+#ifdef CONFIG_AR600x_SD31_XXX
+#define AR6003_REV1_BOARD_DATA_FILE         "ath6k/AR6003/hw1.0/bdata.SD31.bin"
+#elif defined(CONFIG_AR600x_SD32_XXX)
+#define AR6003_REV1_BOARD_DATA_FILE         "ath6k/AR6003/hw1.0/bdata.SD32.bin"
+#elif defined(CONFIG_AR600x_WB31_XXX)
+#define AR6003_REV1_BOARD_DATA_FILE         "ath6k/AR6003/hw1.0/bdata.WB31.bin"
+#else
+#define AR6003_REV1_BOARD_DATA_FILE         "ath6k/AR6003/hw1.0/bdata.CUSTOM.bin"
+#endif /* Board Data File */
+
+/* AR6003 2.0 definitions */
+#define AR6003_REV2_VERSION                 0x30000384 
+#define AR6003_REV2_DATA_DOWNLOAD_ADDRESS   AR6003_REV2_OTP_DATA_ADDRESS
+#define AR6003_REV2_PATCH_DOWNLOAD_ADDRESS  0x57e910
+#define AR6003_REV2_OTP_FILE                "ath6k/AR6003/hw2.0/otp.bin.z77"
+#define AR6003_REV2_FIRMWARE_FILE           "ath6k/AR6003/hw2.0/athwlan.bin.z77"
+#define AR6003_REV2_TCMD_FIRMWARE_FILE      "ath6k/AR6003/hw2.0/athtcmd_ram.bin"
+#define AR6003_REV2_ART_FIRMWARE_FILE       "ath6k/AR6003/hw2.0/device.bin"
+#define AR6003_REV2_PATCH_FILE              "ath6k/AR6003/hw2.0/data.patch.bin"
+#define AR6003_REV2_EPPING_FIRMWARE_FILE    "ath6k/AR6003/hw2.0/endpointping.bin"
+#ifdef CONFIG_AR600x_SD31_XXX
+#define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.SD31.bin"
+#elif defined(CONFIG_AR600x_SD32_XXX)
+#define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.SD32.bin"
+#elif defined(CONFIG_AR600x_WB31_XXX)
+#define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.WB31.bin"
+#else
+#define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.CUSTOM.bin"
+#endif /* Board Data File */
+
+/* AR6003 3.0 definitions */
+#define AR6003_REV3_VERSION                 0x30000582
+#define AR6003_REV3_OTP_FILE                "ath6k/AR6003/hw2.1.1/otp.bin"
+#define AR6003_REV3_FIRMWARE_FILE           "ath6k/AR6003/hw2.1.1/athwlan.bin"
+#define AR6003_REV3_TCMD_FIRMWARE_FILE    "ath6k/AR6003/hw2.1.1/athtcmd_ram.bin"
+#define AR6003_REV3_ART_FIRMWARE_FILE       "ath6k/AR6003/hw2.1.1/device.bin"
+#define AR6003_REV3_PATCH_FILE            "ath6k/AR6003/hw2.1.1/data.patch.bin"
+#define AR6003_REV3_EPPING_FIRMWARE_FILE "ath6k/AR6003/hw2.1.1/endpointping.bin"
+#ifdef CONFIG_AR600x_SD31_XXX
+#define AR6003_REV3_BOARD_DATA_FILE       "ath6k/AR6003/hw2.1.1/bdata.SD31.bin"
+#elif defined(CONFIG_AR600x_SD32_XXX)
+#define AR6003_REV3_BOARD_DATA_FILE        "ath6k/AR6003/hw2.1.1/bdata.SD32.bin"
+#elif defined(CONFIG_AR600x_WB31_XXX)
+#define AR6003_REV3_BOARD_DATA_FILE        "ath6k/AR6003/hw2.1.1/bdata.WB31.bin"
+#else
+#define AR6003_REV3_BOARD_DATA_FILE      "ath6k/AR6003/hw2.1.1/bdata.CUSTOM.bin"
+#endif /* Board Data File */
+
+
+/* Power states */
+enum {
+    WLAN_PWR_CTRL_UP = 0,
+    WLAN_PWR_CTRL_CUT_PWR,
+    WLAN_PWR_CTRL_DEEP_SLEEP,
+    WLAN_PWR_CTRL_WOW,
+    WLAN_PWR_CTRL_DEEP_SLEEP_DISABLED
+};
+
+/* HTC RAW streams */
+typedef enum _HTC_RAW_STREAM_ID {
+    HTC_RAW_STREAM_NOT_MAPPED = -1,
+    HTC_RAW_STREAM_0 = 0,
+    HTC_RAW_STREAM_1 = 1,
+    HTC_RAW_STREAM_2 = 2,
+    HTC_RAW_STREAM_3 = 3,
+    HTC_RAW_STREAM_NUM_MAX
+} HTC_RAW_STREAM_ID;
+
+#define RAW_HTC_READ_BUFFERS_NUM    4
+#define RAW_HTC_WRITE_BUFFERS_NUM   4
+
+#define HTC_RAW_BUFFER_SIZE  1664
+
+typedef struct {
+    int currPtr;
+    int length;
+    unsigned char data[HTC_RAW_BUFFER_SIZE];
+    struct htc_packet    HTCPacket;
+} raw_htc_buffer;
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+/*
+ *  add TCMD_MODE besides wmi and bypasswmi
+ *  in TCMD_MODE, only few TCMD releated wmi commands
+ *  counld be hanlder
+ */
+enum {
+    AR6000_WMI_MODE = 0,
+    AR6000_BYPASS_MODE,
+    AR6000_TCMD_MODE,
+    AR6000_WLAN_MODE
+};
+#endif /* CONFIG_HOST_TCMD_SUPPORT */
+
+struct ar_wep_key {
+    u8 arKeyIndex;
+    u8 arKeyLen;
+    u8 arKey[64];
+} ;
+
+struct ar_key {
+    u8 key[WLAN_MAX_KEY_LEN];
+    u8 key_len;
+    u8 seq[IW_ENCODE_SEQ_MAX_SIZE];
+    u8 seq_len;
+    u32 cipher;
+};
+
+enum {
+    SME_DISCONNECTED,
+    SME_CONNECTING,
+    SME_CONNECTED
+};
+
+struct ar_node_mapping {
+    u8 macAddress[6];
+    u8 epId;
+    u8 txPending;
+};
+
+struct ar_cookie {
+    unsigned long          arc_bp[2];    /* Must be first field */
+    struct htc_packet             HtcPkt;       /* HTC packet wrapper */
+    struct ar_cookie *arc_list_next;
+};
+
+struct ar_hb_chlng_resp {
+    A_TIMER                 timer;
+    u32 frequency;
+    u32 seqNum;
+    bool                  outstanding;
+    u8 missCnt;
+    u8 missThres;
+};
+
+/* Per STA data, used in AP mode */
+/*TODO: All this should move to OS independent dir */
+
+#define STA_PWR_MGMT_MASK 0x1
+#define STA_PWR_MGMT_SHIFT 0x0
+#define STA_PWR_MGMT_AWAKE 0x0
+#define STA_PWR_MGMT_SLEEP 0x1
+
+#define STA_SET_PWR_SLEEP(sta) (sta->flags |= (STA_PWR_MGMT_MASK << STA_PWR_MGMT_SHIFT))
+#define STA_CLR_PWR_SLEEP(sta) (sta->flags &= ~(STA_PWR_MGMT_MASK << STA_PWR_MGMT_SHIFT))
+#define STA_IS_PWR_SLEEP(sta) ((sta->flags >> STA_PWR_MGMT_SHIFT) & STA_PWR_MGMT_MASK)
+
+#define STA_PS_POLLED_MASK 0x1
+#define STA_PS_POLLED_SHIFT 0x1
+#define STA_SET_PS_POLLED(sta) (sta->flags |= (STA_PS_POLLED_MASK << STA_PS_POLLED_SHIFT))
+#define STA_CLR_PS_POLLED(sta) (sta->flags &= ~(STA_PS_POLLED_MASK << STA_PS_POLLED_SHIFT))
+#define STA_IS_PS_POLLED(sta) (sta->flags & (STA_PS_POLLED_MASK << STA_PS_POLLED_SHIFT))
+
+typedef struct {
+    u16 flags;
+    u8 mac[ATH_MAC_LEN];
+    u8 aid;
+    u8 keymgmt;
+    u8 ucipher;
+    u8 auth;
+    u8 wpa_ie[IEEE80211_MAX_IE];
+    A_NETBUF_QUEUE_T        psq;    /* power save q */
+    A_MUTEX_T               psqLock;
+} sta_t;
+
+typedef struct ar6_raw_htc {
+    HTC_ENDPOINT_ID         arRaw2EpMapping[HTC_RAW_STREAM_NUM_MAX];
+    HTC_RAW_STREAM_ID       arEp2RawMapping[ENDPOINT_MAX];
+    struct semaphore        raw_htc_read_sem[HTC_RAW_STREAM_NUM_MAX];
+    struct semaphore        raw_htc_write_sem[HTC_RAW_STREAM_NUM_MAX];
+    wait_queue_head_t       raw_htc_read_queue[HTC_RAW_STREAM_NUM_MAX];
+    wait_queue_head_t       raw_htc_write_queue[HTC_RAW_STREAM_NUM_MAX];
+    raw_htc_buffer          raw_htc_read_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_READ_BUFFERS_NUM];
+    raw_htc_buffer          raw_htc_write_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_WRITE_BUFFERS_NUM];
+    bool                  write_buffer_available[HTC_RAW_STREAM_NUM_MAX];
+    bool                  read_buffer_available[HTC_RAW_STREAM_NUM_MAX];
+} AR_RAW_HTC_T;
+
+struct ar6_softc {
+    struct net_device       *arNetDev;    /* net_device pointer */
+    void                    *arWmi;
+    int                     arTxPending[ENDPOINT_MAX];
+    int                     arTotalTxDataPending;
+    u8 arNumDataEndPts;
+    bool                  arWmiEnabled;
+    bool                  arWmiReady;
+    bool                  arConnected;
+    HTC_HANDLE              arHtcTarget;
+    void                    *arHifDevice;
+    spinlock_t              arLock;
+    struct semaphore        arSem;
+    int                     arSsidLen;
+    u_char                  arSsid[32];
+    u8 arNextMode;
+    u8 arNetworkType;
+    u8 arDot11AuthMode;
+    u8 arAuthMode;
+    u8 arPairwiseCrypto;
+    u8 arPairwiseCryptoLen;
+    u8 arGroupCrypto;
+    u8 arGroupCryptoLen;
+    u8 arDefTxKeyIndex;
+    struct ar_wep_key       arWepKeyList[WMI_MAX_KEY_INDEX + 1];
+    u8 arBssid[6];
+    u8 arReqBssid[6];
+    u16 arChannelHint;
+    u16 arBssChannel;
+    u16 arListenIntervalB;
+    u16 arListenIntervalT;
+    struct ar6000_version   arVersion;
+    u32 arTargetType;
+    s8 arRssi;
+    u8 arTxPwr;
+    bool                  arTxPwrSet;
+    s32 arBitRate;
+    struct net_device_stats arNetStats;
+    struct iw_statistics    arIwStats;
+    s8 arNumChannels;
+    u16 arChannelList[32];
+    u32 arRegCode;
+    bool                  statsUpdatePending;
+    TARGET_STATS            arTargetStats;
+    s8 arMaxRetries;
+    u8 arPhyCapability;
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+    u32 arTargetMode;
+    void *tcmd_rx_report;
+    int tcmd_rx_report_len;
+#endif
+    AR6000_WLAN_STATE       arWlanState;
+    struct ar_node_mapping  arNodeMap[MAX_NODE_NUM];
+    u8 arIbssPsEnable;
+    u8 arNodeNum;
+    u8 arNexEpId;
+    struct ar_cookie        *arCookieList;
+    u32 arCookieCount;
+    u32 arRateMask;
+    u8 arSkipScan;
+    u16 arBeaconInterval;
+    bool                  arConnectPending;
+    bool                  arWmmEnabled;
+    struct ar_hb_chlng_resp arHBChallengeResp;
+    u8 arKeepaliveConfigured;
+    u32 arMgmtFilter;
+    HTC_ENDPOINT_ID         arAc2EpMapping[WMM_NUM_AC];
+    bool                  arAcStreamActive[WMM_NUM_AC];
+    u8 arAcStreamPriMap[WMM_NUM_AC];
+    u8 arHiAcStreamActivePri;
+    u8 arEp2AcMapping[ENDPOINT_MAX];
+    HTC_ENDPOINT_ID         arControlEp;
+#ifdef HTC_RAW_INTERFACE
+    AR_RAW_HTC_T            *arRawHtc;
+#endif
+    bool                  arNetQueueStopped;
+    bool                  arRawIfInit;
+    int                     arDeviceIndex;
+    struct common_credit_state_info arCreditStateInfo;
+    bool                  arWMIControlEpFull;
+    bool                  dbgLogFetchInProgress;
+    u8                 log_buffer[DBGLOG_HOST_LOG_BUFFER_SIZE];
+    u32 log_cnt;
+    u32 dbglog_init_done;
+    u32 arConnectCtrlFlags;
+    s32 user_savedkeys_stat;
+    u32 user_key_ctrl;
+    struct USER_SAVEDKEYS   user_saved_keys;
+    USER_RSSI_THOLD rssi_map[12];
+    u8 arUserBssFilter;
+    u16 ap_profile_flag;    /* AP mode */
+    WMI_AP_ACL              g_acl;              /* AP mode */
+    sta_t                   sta_list[AP_MAX_NUM_STA]; /* AP mode */
+    u8 sta_list_index;     /* AP mode */
+    struct ieee80211req_key ap_mode_bkey;           /* AP mode */
+    A_NETBUF_QUEUE_T        mcastpsq;    /* power save q for Mcast frames */
+    A_MUTEX_T               mcastpsqLock;
+    bool                  DTIMExpired; /* flag to indicate DTIM expired */
+    u8 intra_bss;   /* enable/disable intra bss data forward */
+    void                    *aggr_cntxt;
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+    void                    *hcidev_info;
+#endif
+    WMI_AP_MODE_STAT        arAPStats;
+    u8 ap_hidden_ssid;
+    u8 ap_country_code[3];
+    u8 ap_wmode;
+    u8 ap_dtim_period;
+    u16 ap_beacon_interval;
+    u16 arRTS;
+    u16 arACS; /* AP mode - Auto Channel Selection */
+    struct htc_packet_queue        amsdu_rx_buffer_queue;
+    bool                  bIsDestroyProgress; /* flag to indicate ar6k destroy is in progress */
+    A_TIMER                 disconnect_timer;
+    u8 rxMetaVersion;
+#ifdef WAPI_ENABLE
+    u8 arWapiEnable;
+#endif
+        WMI_BTCOEX_CONFIG_EVENT arBtcoexConfig;
+        WMI_BTCOEX_STATS_EVENT  arBtcoexStats;
+    s32 (*exitCallback)(void *config);  /* generic callback at AR6K exit */
+    struct hif_device_os_device_info   osDevInfo;
+    struct wireless_dev *wdev;
+    struct cfg80211_scan_request    *scan_request;
+    struct ar_key   keys[WMI_MAX_KEY_INDEX + 1];
+    u32 smeState;
+    u16 arWlanPowerState;
+    bool                  arWlanOff;
+#ifdef CONFIG_PM
+    u16 arWowState;
+    bool                  arBTOff;
+    bool                  arBTSharing;
+    u16 arSuspendConfig;
+    u16 arWlanOffConfig;
+    u16 arWow2Config;
+#endif
+    u8 scan_triggered;
+    WMI_SCAN_PARAMS_CMD     scParams;
+#define AR_MCAST_FILTER_MAC_ADDR_SIZE  4
+    u8 mcast_filters[MAC_MAX_FILTERS_PER_LIST][AR_MCAST_FILTER_MAC_ADDR_SIZE];
+    u8 bdaddr[6];
+    bool                  scanSpecificSsid;
+#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+    void                    *arApDev;
+#endif
+    u8 arAutoAuthStage;
+
+        u8 *fw_otp;
+        size_t fw_otp_len;
+        u8 *fw;
+        size_t fw_len;
+        u8 *fw_patch;
+        size_t fw_patch_len;
+        u8 *fw_data;
+        size_t fw_data_len;
+};
+
+#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+struct ar_virtual_interface {
+    struct net_device       *arNetDev;    /* net_device pointer */
+    struct ar6_softc              *arDev;       /* ar device pointer */
+    struct net_device       *arStaNetDev; /* net_device pointer */
+};
+#endif /* CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
+
+static inline void *ar6k_priv(struct net_device *dev)
+{
+    return (wdev_priv(dev->ieee80211_ptr));
+}
+
+#define SET_HCI_BUS_TYPE(pHciDev, __bus, __type) do { \
+    (pHciDev)->bus = (__bus); \
+    (pHciDev)->dev_type = (__type); \
+} while(0)
+
+#define GET_INODE_FROM_FILEP(filp) \
+    (filp)->f_path.dentry->d_inode
+
+#define arAc2EndpointID(ar,ac)          (ar)->arAc2EpMapping[(ac)]
+#define arSetAc2EndpointIDMap(ar,ac,ep)  \
+{  (ar)->arAc2EpMapping[(ac)] = (ep); \
+   (ar)->arEp2AcMapping[(ep)] = (ac); }
+#define arEndpoint2Ac(ar,ep)           (ar)->arEp2AcMapping[(ep)]
+
+#define arRawIfEnabled(ar) (ar)->arRawIfInit
+#define arRawStream2EndpointID(ar,raw)          (ar)->arRawHtc->arRaw2EpMapping[(raw)]
+#define arSetRawStream2EndpointIDMap(ar,raw,ep)  \
+{  (ar)->arRawHtc->arRaw2EpMapping[(raw)] = (ep); \
+   (ar)->arRawHtc->arEp2RawMapping[(ep)] = (raw); }
+#define arEndpoint2RawStreamID(ar,ep)           (ar)->arRawHtc->arEp2RawMapping[(ep)]
+
+struct ar_giwscan_param {
+    char *current_ev;
+    char *end_buf;
+    u32 bytes_needed;
+    struct iw_request_info *info;
+};
+
+#define AR6000_STAT_INC(ar, stat)       (ar->arNetStats.stat++)
+
+#define AR6000_SPIN_LOCK(lock, param)   do {                            \
+    if (irqs_disabled()) {                                              \
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("IRQs disabled:AR6000_LOCK\n"));                 \
+    }                                                                   \
+    spin_lock_bh(lock);                                                 \
+} while (0)
+
+#define AR6000_SPIN_UNLOCK(lock, param) do {                            \
+    if (irqs_disabled()) {                                              \
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("IRQs disabled: AR6000_UNLOCK\n"));              \
+    }                                                                   \
+    spin_unlock_bh(lock);                                               \
+} while (0)
+
+void ar6000_init_profile_info(struct ar6_softc *ar);
+void ar6000_install_static_wep_keys(struct ar6_softc *ar);
+int ar6000_init(struct net_device *dev);
+int ar6000_dbglog_get_debug_logs(struct ar6_softc *ar);
+void ar6000_TxDataCleanup(struct ar6_softc *ar);
+int ar6000_acl_data_tx(struct sk_buff *skb, struct net_device *dev);
+void ar6000_restart_endpoint(struct net_device *dev);
+void ar6000_stop_endpoint(struct net_device *dev, bool keepprofile, bool getdbglogs);
+
+#ifdef HTC_RAW_INTERFACE
+
+#ifndef __user
+#define __user
+#endif
+
+int ar6000_htc_raw_open(struct ar6_softc *ar);
+int ar6000_htc_raw_close(struct ar6_softc *ar);
+ssize_t ar6000_htc_raw_read(struct ar6_softc *ar,
+                            HTC_RAW_STREAM_ID StreamID,
+                            char __user *buffer, size_t count);
+ssize_t ar6000_htc_raw_write(struct ar6_softc *ar,
+                             HTC_RAW_STREAM_ID StreamID,
+                             char __user *buffer, size_t count);
+
+#endif /* HTC_RAW_INTERFACE */
+
+/* AP mode */
+/*TODO: These routines should be moved to a file that is common across OS */
+sta_t *
+ieee80211_find_conn(struct ar6_softc *ar, u8 *node_addr);
+
+sta_t *
+ieee80211_find_conn_for_aid(struct ar6_softc *ar, u8 aid);
+
+u8 remove_sta(struct ar6_softc *ar, u8 *mac, u16 reason);
+
+/* HCI support */
+
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+int ar6000_setup_hci(struct ar6_softc *ar);
+void     ar6000_cleanup_hci(struct ar6_softc *ar);
+void     ar6000_set_default_ar3kconfig(struct ar6_softc *ar, void *ar3kconfig);
+
+/* HCI bridge testing */
+int hci_test_send(struct ar6_softc *ar, struct sk_buff *skb);
+#endif
+
+ATH_DEBUG_DECLARE_EXTERN(htc);
+ATH_DEBUG_DECLARE_EXTERN(wmi);
+ATH_DEBUG_DECLARE_EXTERN(bmi);
+ATH_DEBUG_DECLARE_EXTERN(hif);
+ATH_DEBUG_DECLARE_EXTERN(wlan);
+ATH_DEBUG_DECLARE_EXTERN(misc);
+
+extern u8 bcast_mac[];
+extern u8 null_mac[];
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _AR6000_H_ */
diff --git a/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
new file mode 100644
index 00000000000..39e0873aff2
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
@@ -0,0 +1,36 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+//      PAL driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _AR6K_PAL_H_
+#define _AR6K_PAL_H_
+#define HCI_GET_OP_CODE(p)          (((u16)((p)[1])) << 8) | ((u16)((p)[0]))
+
+/* transmit packet reserve offset */
+#define TX_PACKET_RSV_OFFSET        32
+/* pal specific config structure */
+typedef bool (*ar6k_pal_recv_pkt_t)(void *pHciPalInfo, void *skb);
+typedef struct ar6k_pal_config_s
+{
+        ar6k_pal_recv_pkt_t fpar6k_pal_recv_pkt;
+}ar6k_pal_config_t;
+
+void register_pal_cb(ar6k_pal_config_t *palConfig_p);
+#endif /* _AR6K_PAL_H_ */
diff --git a/drivers/staging/ath6kl/os/linux/include/ar6xapi_linux.h b/drivers/staging/ath6kl/os/linux/include/ar6xapi_linux.h
new file mode 100644
index 00000000000..184dbdb5049
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/ar6xapi_linux.h
@@ -0,0 +1,190 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _AR6XAPI_LINUX_H
+#define _AR6XAPI_LINUX_H
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct ar6_softc;
+
+void ar6000_ready_event(void *devt, u8 *datap, u8 phyCap,
+                        u32 sw_ver, u32 abi_ver);
+int ar6000_control_tx(void *devt, void *osbuf, HTC_ENDPOINT_ID eid);
+void ar6000_connect_event(struct ar6_softc *ar, u16 channel,
+                          u8 *bssid, u16 listenInterval,
+                          u16 beaconInterval, NETWORK_TYPE networkType,
+                          u8 beaconIeLen, u8 assocReqLen,
+                          u8 assocRespLen,u8 *assocInfo);
+void ar6000_disconnect_event(struct ar6_softc *ar, u8 reason,
+                             u8 *bssid, u8 assocRespLen,
+                             u8 *assocInfo, u16 protocolReasonStatus);
+void ar6000_tkip_micerr_event(struct ar6_softc *ar, u8 keyid,
+                              bool ismcast);
+void ar6000_bitrate_rx(void *devt, s32 rateKbps);
+void ar6000_channelList_rx(void *devt, s8 numChan, u16 *chanList);
+void ar6000_regDomain_event(struct ar6_softc *ar, u32 regCode);
+void ar6000_txPwr_rx(void *devt, u8 txPwr);
+void ar6000_keepalive_rx(void *devt, u8 configured);
+void ar6000_neighborReport_event(struct ar6_softc *ar, int numAps,
+                                 WMI_NEIGHBOR_INFO *info);
+void ar6000_set_numdataendpts(struct ar6_softc *ar, u32 num);
+void ar6000_scanComplete_event(struct ar6_softc *ar, int status);
+void ar6000_targetStats_event(struct ar6_softc *ar,  u8 *ptr, u32 len);
+void ar6000_rssiThreshold_event(struct ar6_softc *ar,
+                                WMI_RSSI_THRESHOLD_VAL newThreshold,
+                                s16 rssi);
+void ar6000_reportError_event(struct ar6_softc *, WMI_TARGET_ERROR_VAL errorVal);
+void ar6000_cac_event(struct ar6_softc *ar, u8 ac, u8 cac_indication,
+                                u8 statusCode, u8 *tspecSuggestion);
+void ar6000_channel_change_event(struct ar6_softc *ar, u16 oldChannel, u16 newChannel);
+void ar6000_hbChallengeResp_event(struct ar6_softc *, u32 cookie, u32 source);
+void
+ar6000_roam_tbl_event(struct ar6_softc *ar, WMI_TARGET_ROAM_TBL *pTbl);
+
+void
+ar6000_roam_data_event(struct ar6_softc *ar, WMI_TARGET_ROAM_DATA *p);
+
+void
+ar6000_wow_list_event(struct ar6_softc *ar, u8 num_filters,
+                      WMI_GET_WOW_LIST_REPLY *wow_reply);
+
+void ar6000_pmkid_list_event(void *devt, u8 numPMKID,
+                             WMI_PMKID *pmkidList, u8 *bssidList);
+
+void ar6000_gpio_intr_rx(u32 intr_mask, u32 input_values);
+void ar6000_gpio_data_rx(u32 reg_id, u32 value);
+void ar6000_gpio_ack_rx(void);
+
+s32 rssi_compensation_calc_tcmd(u32 freq, s32 rssi, u32 totalPkt);
+s16 rssi_compensation_calc(struct ar6_softc *ar, s16 rssi);
+s16 rssi_compensation_reverse_calc(struct ar6_softc *ar, s16 rssi, bool Above);
+
+void ar6000_dbglog_init_done(struct ar6_softc *ar);
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+void ar6000_tcmd_rx_report_event(void *devt, u8 *results, int len);
+#endif
+
+void ar6000_tx_retry_err_event(void *devt);
+
+void ar6000_snrThresholdEvent_rx(void *devt,
+                                 WMI_SNR_THRESHOLD_VAL newThreshold,
+                                 u8 snr);
+
+void ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL range, u8 lqVal);
+
+
+void ar6000_ratemask_rx(void *devt, u32 ratemask);
+
+int ar6000_get_driver_cfg(struct net_device *dev,
+                                u16 cfgParam,
+                                void *result);
+void ar6000_bssInfo_event_rx(struct ar6_softc *ar, u8 *data, int len);
+
+void ar6000_dbglog_event(struct ar6_softc *ar, u32 dropped,
+                         s8 *buffer, u32 length);
+
+int ar6000_dbglog_get_debug_logs(struct ar6_softc *ar);
+
+void ar6000_peer_event(void *devt, u8 eventCode, u8 *bssid);
+
+void ar6000_indicate_tx_activity(void *devt, u8 trafficClass, bool Active);
+HTC_ENDPOINT_ID  ar6000_ac2_endpoint_id ( void * devt, u8 ac);
+u8 ar6000_endpoint_id2_ac (void * devt, HTC_ENDPOINT_ID ep );
+
+void ar6000_btcoex_config_event(struct ar6_softc *ar,  u8 *ptr, u32 len);
+
+void ar6000_btcoex_stats_event(struct ar6_softc *ar,  u8 *ptr, u32 len) ;
+
+void ar6000_dset_open_req(void *devt,
+                          u32 id,
+                          u32 targ_handle,
+                          u32 targ_reply_fn,
+                          u32 targ_reply_arg);
+void ar6000_dset_close(void *devt, u32 access_cookie);
+void ar6000_dset_data_req(void *devt,
+                          u32 access_cookie,
+                          u32 offset,
+                          u32 length,
+                          u32 targ_buf,
+                          u32 targ_reply_fn,
+                          u32 targ_reply_arg);
+
+
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+void prof_count_rx(unsigned int addr, unsigned int count);
+#endif
+
+u32 ar6000_getnodeAge (void);
+
+u32 ar6000_getclkfreq (void);
+
+int ar6000_ap_mode_profile_commit(struct ar6_softc *ar);
+
+struct ieee80211req_wpaie;
+int
+ar6000_ap_mode_get_wpa_ie(struct ar6_softc *ar, struct ieee80211req_wpaie *wpaie);
+
+int is_iwioctl_allowed(u8 mode, u16 cmd);
+
+int is_xioctl_allowed(u8 mode, int cmd);
+
+void ar6000_pspoll_event(struct ar6_softc *ar,u8 aid);
+
+void ar6000_dtimexpiry_event(struct ar6_softc *ar);
+
+void ar6000_aggr_rcv_addba_req_evt(struct ar6_softc *ar, WMI_ADDBA_REQ_EVENT *cmd);
+void ar6000_aggr_rcv_addba_resp_evt(struct ar6_softc *ar, WMI_ADDBA_RESP_EVENT *cmd);
+void ar6000_aggr_rcv_delba_req_evt(struct ar6_softc *ar, WMI_DELBA_EVENT *cmd);
+void ar6000_hci_event_rcv_evt(struct ar6_softc *ar, WMI_HCI_EVENT *cmd);
+
+#ifdef WAPI_ENABLE
+int ap_set_wapi_key(struct ar6_softc *ar, void *ik);
+void ap_wapi_rekey_event(struct ar6_softc *ar, u8 type, u8 *mac);
+#endif
+
+int ar6000_connect_to_ap(struct ar6_softc *ar);
+int ar6000_disconnect(struct ar6_softc *ar);
+int ar6000_update_wlan_pwr_state(struct ar6_softc *ar, AR6000_WLAN_STATE state, bool suspending);
+int ar6000_set_wlan_state(struct ar6_softc *ar, AR6000_WLAN_STATE state);
+int ar6000_set_bt_hw_state(struct ar6_softc *ar, u32 state);
+
+#ifdef CONFIG_PM
+int ar6000_suspend_ev(void *context);
+int ar6000_resume_ev(void *context);
+int ar6000_power_change_ev(void *context, u32 config);
+void ar6000_check_wow_status(struct ar6_softc *ar, struct sk_buff *skb, bool isEvent);
+#endif
+
+#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+int ar6000_add_ap_interface(struct ar6_softc *ar, char *ifname);
+int ar6000_remove_ap_interface(struct ar6_softc *ar);
+#endif /* CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/drivers/staging/ath6kl/os/linux/include/athdrv_linux.h b/drivers/staging/ath6kl/os/linux/include/athdrv_linux.h
new file mode 100644
index 00000000000..3d5f01da543
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/athdrv_linux.h
@@ -0,0 +1,1217 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _ATHDRV_LINUX_H
+#define _ATHDRV_LINUX_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/*
+ * There are two types of ioctl's here: Standard ioctls and
+ * eXtended ioctls.  All extended ioctls (XIOCTL) are multiplexed
+ * off of the single ioctl command, AR6000_IOCTL_EXTENDED.  The
+ * arguments for every XIOCTL starts with a 32-bit command word
+ * that is used to select which extended ioctl is in use.  After
+ * the command word are command-specific arguments.
+ */
+
+/* Linux standard Wireless Extensions, private ioctl interfaces */
+#define IEEE80211_IOCTL_SETPARAM             (SIOCIWFIRSTPRIV+0)
+#define IEEE80211_IOCTL_SETKEY               (SIOCIWFIRSTPRIV+1)
+#define IEEE80211_IOCTL_DELKEY               (SIOCIWFIRSTPRIV+2)
+#define IEEE80211_IOCTL_SETMLME              (SIOCIWFIRSTPRIV+3)
+#define IEEE80211_IOCTL_ADDPMKID             (SIOCIWFIRSTPRIV+4)
+#define IEEE80211_IOCTL_SETOPTIE             (SIOCIWFIRSTPRIV+5)
+//#define IEEE80211_IOCTL_GETPARAM             (SIOCIWFIRSTPRIV+6)
+//#define IEEE80211_IOCTL_SETWMMPARAMS         (SIOCIWFIRSTPRIV+7)
+//#define IEEE80211_IOCTL_GETWMMPARAMS         (SIOCIWFIRSTPRIV+8)
+//#define IEEE80211_IOCTL_GETOPTIE             (SIOCIWFIRSTPRIV+9)
+//#define IEEE80211_IOCTL_SETAUTHALG           (SIOCIWFIRSTPRIV+10)
+#define IEEE80211_IOCTL_LASTONE              (SIOCIWFIRSTPRIV+10)
+
+
+
+/*                      ====WMI Ioctls====                                    */
+/*
+ *
+ * Many ioctls simply provide WMI services to application code:
+ * an application makes such an ioctl call with a set of arguments
+ * that are packaged into the corresponding WMI message, and sent
+ * to the Target.
+ */
+
+#define AR6000_IOCTL_WMI_GETREV              (SIOCIWFIRSTPRIV+11)
+/*
+ * arguments:
+ *   ar6000_version *revision
+ */
+
+#define AR6000_IOCTL_WMI_SETPWR              (SIOCIWFIRSTPRIV+12)
+/*
+ * arguments:
+ *   WMI_POWER_MODE_CMD pwrModeCmd (see include/wmi.h)
+ * uses: WMI_SET_POWER_MODE_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SETSCAN             (SIOCIWFIRSTPRIV+13)
+/*
+ * arguments:
+ *   WMI_SCAN_PARAMS_CMD scanParams (see include/wmi.h)
+ * uses: WMI_SET_SCAN_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SETLISTENINT        (SIOCIWFIRSTPRIV+14)
+/*
+ * arguments:
+ *   UINT32 listenInterval
+ * uses: WMI_SET_LISTEN_INT_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SETBSSFILTER        (SIOCIWFIRSTPRIV+15)
+/*
+ * arguments:
+ *   WMI_BSS_FILTER filter (see include/wmi.h)
+ * uses: WMI_SET_BSS_FILTER_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_CHANNELPARAMS   (SIOCIWFIRSTPRIV+16)
+/*
+ * arguments:
+ *   WMI_CHANNEL_PARAMS_CMD chParams
+ * uses: WMI_SET_CHANNEL_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_PROBEDSSID      (SIOCIWFIRSTPRIV+17)
+/*
+ * arguments:
+ *   WMI_PROBED_SSID_CMD probedSsids (see include/wmi.h)
+ * uses: WMI_SETPROBED_SSID_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_PMPARAMS        (SIOCIWFIRSTPRIV+18)
+/*
+ * arguments:
+ *   WMI_POWER_PARAMS_CMD powerParams (see include/wmi.h)
+ * uses: WMI_SET_POWER_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_BADAP           (SIOCIWFIRSTPRIV+19)
+/*
+ * arguments:
+ *   WMI_ADD_BAD_AP_CMD badAPs (see include/wmi.h)
+ * uses: WMI_ADD_BAD_AP_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_GET_QOS_QUEUE       (SIOCIWFIRSTPRIV+20)
+/*
+ * arguments:
+ *   ar6000_queuereq queueRequest (see below)
+ */
+
+#define AR6000_IOCTL_WMI_CREATE_QOS          (SIOCIWFIRSTPRIV+21)
+/*
+ * arguments:
+ *   WMI_CREATE_PSTREAM createPstreamCmd (see include/wmi.h)
+ * uses: WMI_CREATE_PSTREAM_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_DELETE_QOS          (SIOCIWFIRSTPRIV+22)
+/*
+ * arguments:
+ *   WMI_DELETE_PSTREAM_CMD deletePstreamCmd (see include/wmi.h)
+ * uses: WMI_DELETE_PSTREAM_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_SNRTHRESHOLD   (SIOCIWFIRSTPRIV+23)
+/*
+ * arguments:
+ *   WMI_SNR_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
+ * uses: WMI_SNR_THRESHOLD_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK (SIOCIWFIRSTPRIV+24)
+/*
+ * arguments:
+ *   WMI_TARGET_ERROR_REPORT_BITMASK errorReportBitMask (see include/wmi.h)
+ * uses: WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_GET_TARGET_STATS    (SIOCIWFIRSTPRIV+25)
+/*
+ * arguments:
+ *   TARGET_STATS *targetStats (see below)
+ * uses: WMI_GET_STATISTICS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_ASSOC_INFO      (SIOCIWFIRSTPRIV+26)
+/*
+ * arguments:
+ *   WMI_SET_ASSOC_INFO_CMD setAssocInfoCmd
+ * uses: WMI_SET_ASSOC_INFO_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_ACCESS_PARAMS   (SIOCIWFIRSTPRIV+27)
+/*
+ * arguments:
+ *   WMI_SET_ACCESS_PARAMS_CMD setAccessParams (see include/wmi.h)
+ * uses: WMI_SET_ACCESS_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_BMISS_TIME      (SIOCIWFIRSTPRIV+28)
+/*
+ * arguments:
+ *   UINT32 beaconMissTime
+ * uses: WMI_SET_BMISS_TIME_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_DISC_TIMEOUT    (SIOCIWFIRSTPRIV+29)
+/*
+ * arguments:
+ *   WMI_DISC_TIMEOUT_CMD disconnectTimeoutCmd (see include/wmi.h)
+ * uses: WMI_SET_DISC_TIMEOUT_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS    (SIOCIWFIRSTPRIV+30)
+/*
+ * arguments:
+ *   WMI_IBSS_PM_CAPS_CMD ibssPowerMgmtCapsCmd
+ * uses: WMI_SET_IBSS_PM_CAPS_CMDID
+ */
+
+/*
+ * There is a very small space available for driver-private
+ * wireless ioctls.  In order to circumvent this limitation,
+ * we multiplex a bunch of ioctls (XIOCTLs) on top of a
+ * single AR6000_IOCTL_EXTENDED ioctl.
+ */
+#define AR6000_IOCTL_EXTENDED                (SIOCIWFIRSTPRIV+31)
+
+
+/*                         ====BMI Extended Ioctls====                        */
+
+#define AR6000_XIOCTL_BMI_DONE                                  1
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_BMI_DONE)
+ * uses: BMI_DONE
+ */
+
+#define AR6000_XIOCTL_BMI_READ_MEMORY                           2
+/*
+ * arguments:
+ *   union {
+ *     struct {
+ *       UINT32 cmd (AR6000_XIOCTL_BMI_READ_MEMORY)
+ *       UINT32 address
+ *       UINT32 length
+ *     }
+ *     char results[length]
+ *   }
+ * uses: BMI_READ_MEMORY
+ */
+
+#define AR6000_XIOCTL_BMI_WRITE_MEMORY                          3
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_MEMORY)
+ *   UINT32 address
+ *   UINT32 length
+ *   char data[length]
+ * uses: BMI_WRITE_MEMORY
+ */
+
+#define AR6000_XIOCTL_BMI_EXECUTE                               4
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_BMI_EXECUTE)
+ *   UINT32 TargetAddress
+ *   UINT32 parameter
+ * uses: BMI_EXECUTE
+ */
+
+#define AR6000_XIOCTL_BMI_SET_APP_START                         5
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_BMI_SET_APP_START)
+ *   UINT32 TargetAddress
+ * uses: BMI_SET_APP_START
+ */
+
+#define AR6000_XIOCTL_BMI_READ_SOC_REGISTER                     6
+/*
+ * arguments:
+ *   union {
+ *     struct {
+ *       UINT32 cmd (AR6000_XIOCTL_BMI_READ_SOC_REGISTER)
+ *       UINT32 TargetAddress, 32-bit aligned
+ *     }
+ *     UINT32 result
+ *   }
+ * uses: BMI_READ_SOC_REGISTER
+ */
+
+#define AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER                    7
+/*
+ * arguments:
+ *     struct {
+ *       UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER)
+ *       UINT32 TargetAddress, 32-bit aligned
+ *       UINT32 newValue
+ *     }
+ * uses: BMI_WRITE_SOC_REGISTER
+ */
+
+#define AR6000_XIOCTL_BMI_TEST                                  8
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_BMI_TEST)
+ *   UINT32 address
+ *   UINT32 length
+ *   UINT32 count
+ */
+
+
+
+/* Historical Host-side DataSet support */
+#define AR6000_XIOCTL_UNUSED9                                   9
+#define AR6000_XIOCTL_UNUSED10                                  10
+#define AR6000_XIOCTL_UNUSED11                                  11
+
+/*                      ====Misc Extended Ioctls====                          */
+
+#define AR6000_XIOCTL_FORCE_TARGET_RESET                        12
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_FORCE_TARGET_RESET)
+ */
+
+
+#ifdef HTC_RAW_INTERFACE
+/* HTC Raw Interface Ioctls */
+#define AR6000_XIOCTL_HTC_RAW_OPEN                              13
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_OPEN)
+ */
+
+#define AR6000_XIOCTL_HTC_RAW_CLOSE                             14
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_CLOSE)
+ */
+
+#define AR6000_XIOCTL_HTC_RAW_READ                              15
+/*
+ * arguments:
+ *   union {
+ *     struct {
+ *       UINT32 cmd (AR6000_XIOCTL_HTC_RAW_READ)
+ *       UINT32 mailboxID
+ *       UINT32 length
+ *     }
+ *     results[length]
+ *   }
+ */
+
+#define AR6000_XIOCTL_HTC_RAW_WRITE                             16
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_WRITE)
+ *   UINT32 mailboxID
+ *   UINT32 length
+ *   char buffer[length]
+ */
+#endif /* HTC_RAW_INTERFACE */
+
+#define AR6000_XIOCTL_CHECK_TARGET_READY                        17
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_CHECK_TARGET_READY)
+ */
+
+
+
+/*                ====GPIO (General Purpose I/O) Extended Ioctls====          */
+
+#define AR6000_XIOCTL_GPIO_OUTPUT_SET                           18
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_OUTPUT_SET)
+ *   ar6000_gpio_output_set_cmd_s (see below)
+ * uses: WMIX_GPIO_OUTPUT_SET_CMDID
+ */
+
+#define AR6000_XIOCTL_GPIO_INPUT_GET                            19
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_INPUT_GET)
+ * uses: WMIX_GPIO_INPUT_GET_CMDID
+ */
+
+#define AR6000_XIOCTL_GPIO_REGISTER_SET                         20
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_SET)
+ *   ar6000_gpio_register_cmd_s (see below)
+ * uses: WMIX_GPIO_REGISTER_SET_CMDID
+ */
+
+#define AR6000_XIOCTL_GPIO_REGISTER_GET                         21
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_GET)
+ *   ar6000_gpio_register_cmd_s (see below)
+ * uses: WMIX_GPIO_REGISTER_GET_CMDID
+ */
+
+#define AR6000_XIOCTL_GPIO_INTR_ACK                             22
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_ACK)
+ *   ar6000_cpio_intr_ack_cmd_s (see below)
+ * uses: WMIX_GPIO_INTR_ACK_CMDID
+ */
+
+#define AR6000_XIOCTL_GPIO_INTR_WAIT                            23
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_WAIT)
+ */
+
+
+
+/*                    ====more wireless commands====                          */
+
+#define AR6000_XIOCTL_SET_ADHOC_BSSID                           24
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_SET_ADHOC_BSSID)
+ *   WMI_SET_ADHOC_BSSID_CMD setAdHocBssidCmd (see include/wmi.h)
+ */
+
+#define AR6000_XIOCTL_SET_OPT_MODE                              25
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_SET_OPT_MODE)
+ *   WMI_SET_OPT_MODE_CMD setOptModeCmd (see include/wmi.h)
+ * uses: WMI_SET_OPT_MODE_CMDID
+ */
+
+#define AR6000_XIOCTL_OPT_SEND_FRAME                            26
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_OPT_SEND_FRAME)
+ *   WMI_OPT_TX_FRAME_CMD optTxFrameCmd (see include/wmi.h)
+ * uses: WMI_OPT_TX_FRAME_CMDID
+ */
+
+#define AR6000_XIOCTL_SET_BEACON_INTVAL                         27
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_SET_BEACON_INTVAL)
+ *   WMI_BEACON_INT_CMD beaconIntCmd (see include/wmi.h)
+ * uses: WMI_SET_BEACON_INT_CMDID
+ */
+
+
+#define IEEE80211_IOCTL_SETAUTHALG                              28
+
+
+#define AR6000_XIOCTL_SET_VOICE_PKT_SIZE                        29
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_SET_VOICE_PKT_SIZE)
+ *   WMI_SET_VOICE_PKT_SIZE_CMD setVoicePktSizeCmd (see include/wmi.h)
+ * uses: WMI_SET_VOICE_PKT_SIZE_CMDID
+ */
+
+
+#define AR6000_XIOCTL_SET_MAX_SP                                30
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_SET_MAX_SP)
+ *   WMI_SET_MAX_SP_LEN_CMD maxSPLen(see include/wmi.h)
+ * uses: WMI_SET_MAX_SP_LEN_CMDID
+ */
+
+#define AR6000_XIOCTL_WMI_GET_ROAM_TBL                          31
+
+#define AR6000_XIOCTL_WMI_SET_ROAM_CTRL                         32
+
+#define AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS                 33
+
+
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS)
+ *   WMI_SET_POWERSAVE_TIMERS_CMD powerSaveTimers(see include/wmi.h)
+ *   WMI_SET_POWERSAVE_TIMERS_CMDID
+ */
+
+#define AR6000_XIOCTRL_WMI_GET_POWER_MODE                        34
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTRL_WMI_GET_POWER_MODE)
+ */
+
+#define AR6000_XIOCTRL_WMI_SET_WLAN_STATE                       35
+typedef enum {
+    WLAN_DISABLED,
+    WLAN_ENABLED
+} AR6000_WLAN_STATE;
+/*
+ * arguments:
+ * enable/disable
+ */
+
+#define AR6000_XIOCTL_WMI_GET_ROAM_DATA                         36
+
+#define AR6000_XIOCTL_WMI_SETRETRYLIMITS                37
+/*
+ * arguments:
+ *   WMI_SET_RETRY_LIMITS_CMD ibssSetRetryLimitsCmd
+ * uses: WMI_SET_RETRY_LIMITS_CMDID
+ */
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+/*       ====extended commands for radio test ====                          */
+
+#define AR6000_XIOCTL_TCMD_CONT_TX                      38
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_TX)
+ *   WMI_TCMD_CONT_TX_CMD contTxCmd (see include/wmi.h)
+ * uses: WMI_TCMD_CONT_TX_CMDID
+ */
+
+#define AR6000_XIOCTL_TCMD_CONT_RX                      39
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_RX)
+ *   WMI_TCMD_CONT_RX_CMD rxCmd (see include/wmi.h)
+ * uses: WMI_TCMD_CONT_RX_CMDID
+ */
+
+#define AR6000_XIOCTL_TCMD_PM                           40
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_TCMD_PM)
+ *   WMI_TCMD_PM_CMD pmCmd (see include/wmi.h)
+ * uses: WMI_TCMD_PM_CMDID
+ */
+
+#endif /* CONFIG_HOST_TCMD_SUPPORT */
+
+#define AR6000_XIOCTL_WMI_STARTSCAN                     41
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_WMI_STARTSCAN)
+ *   UINT8  scanType
+ *   UINT8  scanConnected
+ *   u32 forceFgScan
+ * uses: WMI_START_SCAN_CMDID
+ */
+
+#define AR6000_XIOCTL_WMI_SETFIXRATES                   42
+
+#define AR6000_XIOCTL_WMI_GETFIXRATES                   43
+
+
+#define AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD             44
+/*
+ * arguments:
+ *   WMI_RSSI_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
+ * uses: WMI_RSSI_THRESHOLD_PARAMS_CMDID
+ */
+
+#define AR6000_XIOCTL_WMI_CLR_RSSISNR                   45
+/*
+ * arguments:
+ *   WMI_CLR_RSSISNR_CMD thresholdParams (see include/wmi.h)
+ * uses: WMI_CLR_RSSISNR_CMDID
+ */
+
+#define AR6000_XIOCTL_WMI_SET_LQTHRESHOLD               46
+/*
+ * arguments:
+ *   WMI_LQ_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
+ * uses: WMI_LQ_THRESHOLD_PARAMS_CMDID
+ */
+
+#define AR6000_XIOCTL_WMI_SET_RTS                        47
+/*
+ * arguments:
+ *   WMI_SET_RTS_MODE_CMD (see include/wmi.h)
+ * uses: WMI_SET_RTS_MODE_CMDID
+ */
+
+#define AR6000_XIOCTL_WMI_SET_LPREAMBLE                 48
+
+#define AR6000_XIOCTL_WMI_SET_AUTHMODE                  49
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_AUTHMODE)
+ *   UINT8  mode
+ * uses: WMI_SET_RECONNECT_AUTH_MODE_CMDID
+ */
+
+#define AR6000_XIOCTL_WMI_SET_REASSOCMODE               50
+
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_WMM)
+ *   UINT8  mode
+ * uses: WMI_SET_WMM_CMDID
+ */
+#define AR6000_XIOCTL_WMI_SET_WMM                       51
+
+/*
+ * arguments:
+ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS)
+ * UINT32 frequency
+ * UINT8  threshold
+ */
+#define AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS  52
+
+/*
+ * arguments:
+ * UINT32 cmd (AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP)
+ * UINT32 cookie
+ */
+#define AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP         53
+
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_WMI_GET_RD)
+ *   UINT32 regDomain
+ */
+#define AR6000_XIOCTL_WMI_GET_RD                        54
+
+#define AR6000_XIOCTL_DIAG_READ                         55
+
+#define AR6000_XIOCTL_DIAG_WRITE                        56
+
+/*
+ * arguments cmd (AR6000_XIOCTL_SET_TXOP)
+ * WMI_TXOP_CFG  txopEnable
+ */
+#define AR6000_XIOCTL_WMI_SET_TXOP                      57
+
+/*
+ * arguments:
+ * UINT32 cmd (AR6000_XIOCTL_USER_SETKEYS)
+ * UINT32 keyOpCtrl
+ * uses struct ar6000_user_setkeys_info
+ */
+#define AR6000_XIOCTL_USER_SETKEYS                      58
+
+#define AR6000_XIOCTL_WMI_SET_KEEPALIVE                 59
+/*
+ * arguments:
+ *   UINT8 cmd (AR6000_XIOCTL_WMI_SET_KEEPALIVE)
+ *   UINT8 keepaliveInterval
+ * uses: WMI_SET_KEEPALIVE_CMDID
+ */
+
+#define AR6000_XIOCTL_WMI_GET_KEEPALIVE                 60
+/*
+ * arguments:
+ *   UINT8 cmd (AR6000_XIOCTL_WMI_GET_KEEPALIVE)
+ *   UINT8 keepaliveInterval
+ *   u32 configured
+ * uses: WMI_GET_KEEPALIVE_CMDID
+ */
+
+/*               ====ROM Patching Extended Ioctls====                       */
+
+#define AR6000_XIOCTL_BMI_ROMPATCH_INSTALL              61
+/*
+ * arguments:
+ *     union {
+ *       struct {
+ *         UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_INSTALL)
+ *         UINT32 ROM Address
+ *         UINT32 RAM Address
+ *         UINT32 number of bytes
+ *         UINT32 activate? (0 or 1)
+ *       }
+ *       u32 resulting rompatch ID
+ *     }
+ * uses: BMI_ROMPATCH_INSTALL
+ */
+
+#define AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL            62
+/*
+ * arguments:
+ *     struct {
+ *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL)
+ *       UINT32 rompatch ID
+ *     }
+ * uses: BMI_ROMPATCH_UNINSTALL
+ */
+
+#define AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE             63
+/*
+ * arguments:
+ *     struct {
+ *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE)
+ *       UINT32 rompatch count
+ *       UINT32 rompatch IDs[rompatch count]
+ *     }
+ * uses: BMI_ROMPATCH_ACTIVATE
+ */
+
+#define AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE           64
+/*
+ * arguments:
+ *     struct {
+ *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE)
+ *       UINT32 rompatch count
+ *       UINT32 rompatch IDs[rompatch count]
+ *     }
+ * uses: BMI_ROMPATCH_DEACTIVATE
+ */
+
+#define AR6000_XIOCTL_WMI_SET_APPIE             65
+/*
+ * arguments:
+ *      struct {
+ *          UINT32 cmd (AR6000_XIOCTL_WMI_SET_APPIE)
+ *          UINT32  app_frmtype;
+ *          UINT32  app_buflen;
+ *          UINT8   app_buf[];
+ *      }
+ */
+#define AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER    66
+/*
+ * arguments:
+ *      u32 filter_type;
+ */
+
+#define AR6000_XIOCTL_DBGLOG_CFG_MODULE             67
+
+#define AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS         68
+
+#define AR6000_XIOCTL_WMI_SET_WSC_STATUS            70
+/*
+ * arguments:
+ *      u32 wsc_status;
+ *            (WSC_REG_INACTIVE or WSC_REG_ACTIVE)
+ */
+
+/*
+ * arguments:
+ *      struct {
+ *          u8 streamType;
+ *          u8 status;
+ *      }
+ * uses: WMI_SET_BT_STATUS_CMDID
+ */
+#define AR6000_XIOCTL_WMI_SET_BT_STATUS             71
+
+/*
+ * arguments:
+ *      struct {
+ *           u8 paramType;
+ *           union {
+ *               u8 noSCOPkts;
+ *               BT_PARAMS_A2DP a2dpParams;
+ *               BT_COEX_REGS regs;
+ *           };
+ *      }
+ * uses: WMI_SET_BT_PARAM_CMDID
+ */
+#define AR6000_XIOCTL_WMI_SET_BT_PARAMS             72
+
+#define AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE       73
+#define AR6000_XIOCTL_WMI_SET_WOW_MODE              74
+#define AR6000_XIOCTL_WMI_GET_WOW_LIST              75
+#define AR6000_XIOCTL_WMI_ADD_WOW_PATTERN           76
+#define AR6000_XIOCTL_WMI_DEL_WOW_PATTERN           77
+
+
+
+#define AR6000_XIOCTL_TARGET_INFO                   78
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_TARGET_INFO)
+ *   u32 TargetVersion (returned)
+ *   u32 TargetType    (returned)
+ * (See also bmi_msg.h target_ver and target_type)
+ */
+
+#define AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE         79
+/*
+ * arguments:
+ *      none
+ */
+
+#define AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE       80
+/*
+ * This ioctl is used to emulate traffic activity
+ * timeouts.  Activity/inactivity will trigger the driver
+ * to re-balance credits.
+ *
+ * arguments:
+ *      ar6000_traffic_activity_change
+ */
+
+#define AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS    81
+/*
+ * This ioctl is used to set the connect control flags
+ *
+ * arguments:
+ *      u32 connectCtrlFlags
+ */
+
+#define AR6000_XIOCTL_WMI_SET_AKMP_PARAMS              82
+/*
+ * This IOCTL sets any Authentication,Key Management and Protection
+ * related parameters. This is used along with the information set in
+ * Connect Command.
+ * Currently this enables Multiple PMKIDs to an AP.
+ *
+ * arguments:
+ *      struct {
+ *          u32 akmpInfo;
+ *      }
+ * uses: WMI_SET_AKMP_PARAMS_CMD
+ */
+
+#define AR6000_XIOCTL_WMI_GET_PMKID_LIST            83
+
+#define AR6000_XIOCTL_WMI_SET_PMKID_LIST            84
+/*
+ * This IOCTL is used to set a list of PMKIDs. This list of
+ * PMKIDs is used in the [Re]AssocReq Frame. This list is used
+ * only if the MultiPMKID option is enabled via the
+ * AR6000_XIOCTL_WMI_SET_AKMP_PARAMS  IOCTL.
+ *
+ * arguments:
+ *      struct {
+ *          u32 numPMKID;
+ *          WMI_PMKID   pmkidList[WMI_MAX_PMKID_CACHE];
+ *      }
+ * uses: WMI_SET_PMKIDLIST_CMD
+ */
+
+#define AR6000_XIOCTL_WMI_SET_PARAMS                85
+#define AR6000_XIOCTL_WMI_SET_MCAST_FILTER     86
+#define AR6000_XIOCTL_WMI_DEL_MCAST_FILTER     87
+
+
+/* Historical DSETPATCH support for INI patches */
+#define AR6000_XIOCTL_UNUSED90                      90
+
+
+/* Support LZ-compressed firmware download */
+#define AR6000_XIOCTL_BMI_LZ_STREAM_START           91
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_BMI_LZ_STREAM_START)
+ *   UINT32 address
+ * uses: BMI_LZ_STREAM_START
+ */
+
+#define AR6000_XIOCTL_BMI_LZ_DATA                   92
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_BMI_LZ_DATA)
+ *   UINT32 length
+ *   char data[length]
+ * uses: BMI_LZ_DATA
+ */
+
+#define AR6000_XIOCTL_PROF_CFG                      93
+/*
+ * arguments:
+ *   u32 period
+ *   u32 nbins
+ */
+
+#define AR6000_XIOCTL_PROF_ADDR_SET                 94
+/*
+ * arguments:
+ *   u32 Target address
+ */
+
+#define AR6000_XIOCTL_PROF_START                    95
+
+#define AR6000_XIOCTL_PROF_STOP                     96
+
+#define AR6000_XIOCTL_PROF_COUNT_GET                97
+
+#define AR6000_XIOCTL_WMI_ABORT_SCAN                98
+
+/*
+ * AP mode
+ */
+#define AR6000_XIOCTL_AP_GET_STA_LIST               99
+
+#define AR6000_XIOCTL_AP_HIDDEN_SSID                100
+
+#define AR6000_XIOCTL_AP_SET_NUM_STA                101
+
+#define AR6000_XIOCTL_AP_SET_ACL_MAC                102
+
+#define AR6000_XIOCTL_AP_GET_ACL_LIST               103
+
+#define AR6000_XIOCTL_AP_COMMIT_CONFIG              104
+
+#define IEEE80211_IOCTL_GETWPAIE                    105
+
+#define AR6000_XIOCTL_AP_CONN_INACT_TIME            106
+
+#define AR6000_XIOCTL_AP_PROT_SCAN_TIME             107
+
+#define AR6000_XIOCTL_AP_SET_COUNTRY                108
+
+#define AR6000_XIOCTL_AP_SET_DTIM                   109
+
+
+
+
+#define AR6000_XIOCTL_WMI_TARGET_EVENT_REPORT       110
+
+#define AR6000_XIOCTL_SET_IP                        111
+
+#define AR6000_XIOCTL_AP_SET_ACL_POLICY             112
+
+#define AR6000_XIOCTL_AP_INTRA_BSS_COMM             113
+
+#define AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO        114
+
+#define AR6000_XIOCTL_MODULE_DEBUG_SET_MASK         115
+
+#define AR6000_XIOCTL_MODULE_DEBUG_GET_MASK         116
+
+#define AR6000_XIOCTL_DUMP_RCV_AGGR_STATS           117
+
+#define AR6000_XIOCTL_SET_HT_CAP                    118
+
+#define AR6000_XIOCTL_SET_HT_OP                     119
+
+#define AR6000_XIOCTL_AP_GET_STAT                   120
+
+#define AR6000_XIOCTL_SET_TX_SELECT_RATES           121
+
+#define AR6000_XIOCTL_SETUP_AGGR                    122
+
+#define AR6000_XIOCTL_ALLOW_AGGR                    123
+
+#define AR6000_XIOCTL_AP_GET_HIDDEN_SSID            124
+
+#define AR6000_XIOCTL_AP_GET_COUNTRY                125
+
+#define AR6000_XIOCTL_AP_GET_WMODE                  126
+
+#define AR6000_XIOCTL_AP_GET_DTIM                   127
+
+#define AR6000_XIOCTL_AP_GET_BINTVL                 128
+
+#define AR6000_XIOCTL_AP_GET_RTS                    129
+
+#define AR6000_XIOCTL_DELE_AGGR                     130
+
+#define AR6000_XIOCTL_FETCH_TARGET_REGS             131
+
+#define AR6000_XIOCTL_HCI_CMD                       132
+
+#define AR6000_XIOCTL_ACL_DATA                      133 /* used to be used for PAL */
+
+#define AR6000_XIOCTL_WLAN_CONN_PRECEDENCE          134
+
+#define AR6000_XIOCTL_AP_SET_11BG_RATESET           135
+
+/*
+ * arguments:
+ *   WMI_AP_PS_CMD apPsCmd
+ * uses: WMI_AP_PS_CMDID
+ */
+
+#define AR6000_XIOCTL_WMI_SET_AP_PS                 136
+
+#define AR6000_XIOCTL_WMI_MCAST_FILTER              137
+
+#define AR6000_XIOCTL_WMI_SET_BTCOEX_FE_ANT                                     138
+
+#define AR6000_XIOCTL_WMI_SET_BTCOEX_COLOCATED_BT_DEV                   139
+
+#define AR6000_XIOCTL_WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG      140
+
+#define AR6000_XIOCTL_WMI_SET_BTCOEX_SCO_CONFIG                         141
+
+#define AR6000_XIOCTL_WMI_SET_BTCOEX_A2DP_CONFIG                                142
+
+#define AR6000_XIOCTL_WMI_SET_BTCOEX_ACLCOEX_CONFIG                     143
+
+#define AR6000_XIOCTL_WMI_SET_BTCOEX_DEBUG                                              144
+
+#define AR6000_XIOCTL_WMI_SET_BT_OPERATING_STATUS                       145
+
+#define AR6000_XIOCTL_WMI_GET_BTCOEX_CONFIG                                     146
+
+#define AR6000_XIOCTL_WMI_GET_BTCOEX_STATS                                              147
+/*
+ * arguments:
+ *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_QOS_SUPP)
+ *   UINT8  mode
+ * uses: WMI_SET_QOS_SUPP_CMDID
+ */
+#define AR6000_XIOCTL_WMI_SET_QOS_SUPP                  148 
+
+#define AR6000_XIOCTL_GET_WLAN_SLEEP_STATE              149
+
+#define AR6000_XIOCTL_SET_BT_HW_POWER_STATE             150 
+
+#define AR6000_XIOCTL_GET_BT_HW_POWER_STATE             151
+
+#define AR6000_XIOCTL_ADD_AP_INTERFACE                  152
+
+#define AR6000_XIOCTL_REMOVE_AP_INTERFACE               153
+
+#define AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM              154
+
+#define AR6000_XIOCTL_WMI_SET_EXCESS_TX_RETRY_THRES     161
+
+/* used by AR6000_IOCTL_WMI_GETREV */
+struct ar6000_version {
+    u32 host_ver;
+    u32 target_ver;
+    u32 wlan_ver;
+    u32 abi_ver;
+};
+
+/* used by AR6000_IOCTL_WMI_GET_QOS_QUEUE */
+struct ar6000_queuereq {
+    u8 trafficClass;
+    u16 activeTsids;
+};
+
+/* used by AR6000_IOCTL_WMI_GET_TARGET_STATS */
+typedef struct targetStats_t {
+    u64 tx_packets;
+    u64 tx_bytes;
+    u64 tx_unicast_pkts;
+    u64 tx_unicast_bytes;
+    u64 tx_multicast_pkts;
+    u64 tx_multicast_bytes;
+    u64 tx_broadcast_pkts;
+    u64 tx_broadcast_bytes;
+    u64 tx_rts_success_cnt;
+    u64 tx_packet_per_ac[4];
+
+    u64 tx_errors;
+    u64 tx_failed_cnt;
+    u64 tx_retry_cnt;
+    u64 tx_mult_retry_cnt;
+    u64 tx_rts_fail_cnt;
+
+    u64 rx_packets;
+    u64 rx_bytes;
+    u64 rx_unicast_pkts;
+    u64 rx_unicast_bytes;
+    u64 rx_multicast_pkts;
+    u64 rx_multicast_bytes;
+    u64 rx_broadcast_pkts;
+    u64 rx_broadcast_bytes;
+    u64 rx_fragment_pkt;
+
+    u64 rx_errors;
+    u64 rx_crcerr;
+    u64 rx_key_cache_miss;
+    u64 rx_decrypt_err;
+    u64 rx_duplicate_frames;
+
+    u64 tkip_local_mic_failure;
+    u64 tkip_counter_measures_invoked;
+    u64 tkip_replays;
+    u64 tkip_format_errors;
+    u64 ccmp_format_errors;
+    u64 ccmp_replays;
+
+    u64 power_save_failure_cnt;
+
+    u64 cs_bmiss_cnt;
+    u64 cs_lowRssi_cnt;
+    u64 cs_connect_cnt;
+    u64 cs_disconnect_cnt;
+
+    s32 tx_unicast_rate;
+    s32 rx_unicast_rate;
+
+    u32 lq_val;
+
+    u32 wow_num_pkts_dropped;
+    u16 wow_num_events_discarded;
+
+    s16 noise_floor_calibation;
+    s16 cs_rssi;
+    s16 cs_aveBeacon_rssi;
+    u8 cs_aveBeacon_snr;
+    u8 cs_lastRoam_msec;
+    u8 cs_snr;
+
+    u8 wow_num_host_pkt_wakeups;
+    u8 wow_num_host_event_wakeups;
+
+    u32 arp_received;
+    u32 arp_matched;
+    u32 arp_replied;
+}TARGET_STATS;
+
+typedef struct targetStats_cmd_t {
+    TARGET_STATS targetStats;
+    int clearStats;
+} TARGET_STATS_CMD;
+
+/* used by AR6000_XIOCTL_USER_SETKEYS */
+
+/*
+ * Setting this bit to 1 doesnot initialize the RSC on the firmware
+ */
+#define AR6000_XIOCTL_USER_SETKEYS_RSC_CTRL    1
+#define AR6000_USER_SETKEYS_RSC_UNCHANGED     0x00000002
+
+struct ar6000_user_setkeys_info {
+    u32 keyOpCtrl;  /* Bit Map of Key Mgmt Ctrl Flags */
+}; /* XXX: unused !? */
+
+/* used by AR6000_XIOCTL_GPIO_OUTPUT_SET */
+struct ar6000_gpio_output_set_cmd_s {
+    u32 set_mask;
+    u32 clear_mask;
+    u32 enable_mask;
+    u32 disable_mask;
+};
+
+/*
+ * used by AR6000_XIOCTL_GPIO_REGISTER_GET and AR6000_XIOCTL_GPIO_REGISTER_SET
+ */
+struct ar6000_gpio_register_cmd_s {
+    u32 gpioreg_id;
+    u32 value;
+};
+
+/* used by AR6000_XIOCTL_GPIO_INTR_ACK */
+struct ar6000_gpio_intr_ack_cmd_s {
+    u32 ack_mask;
+};
+
+/* used by AR6000_XIOCTL_GPIO_INTR_WAIT */
+struct ar6000_gpio_intr_wait_cmd_s {
+    u32 intr_mask;
+    u32 input_values;
+};
+
+/* used by the AR6000_XIOCTL_DBGLOG_CFG_MODULE */
+typedef struct ar6000_dbglog_module_config_s {
+    u32 valid;
+    u16 mmask;
+    u16 tsr;
+    u32   rep;
+    u16 size;
+} DBGLOG_MODULE_CONFIG;
+
+typedef struct user_rssi_thold_t {
+    s16 tag;
+    s16 rssi;
+} USER_RSSI_THOLD;
+
+typedef struct user_rssi_params_t {
+    u8 weight;
+    u32 pollTime;
+    USER_RSSI_THOLD    tholds[12];
+} USER_RSSI_PARAMS;
+
+typedef struct ar6000_get_btcoex_config_cmd_t{
+        u32 btProfileType;
+        u32 linkId;
+ }AR6000_GET_BTCOEX_CONFIG_CMD;
+
+typedef struct ar6000_btcoex_config_t {
+    AR6000_GET_BTCOEX_CONFIG_CMD  configCmd;
+    u32 *configEvent;
+} AR6000_BTCOEX_CONFIG;
+
+typedef struct ar6000_btcoex_stats_t {
+    u32 *statsEvent;
+ }AR6000_BTCOEX_STATS;
+/*
+ * Host driver may have some config parameters. Typically, these
+ * config params are one time config parameters. These could
+ * correspond to any of the underlying modules. Host driver exposes
+ * an api for the underlying modules to get this config.
+ */
+#define AR6000_DRIVER_CFG_BASE                  0x8000
+
+/* Should driver perform wlan node caching? */
+#define AR6000_DRIVER_CFG_GET_WLANNODECACHING   0x8001
+/*Should we log raw WMI msgs */
+#define AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS      0x8002
+
+/* used by AR6000_XIOCTL_DIAG_READ & AR6000_XIOCTL_DIAG_WRITE */
+struct ar6000_diag_window_cmd_s {
+    unsigned int addr;
+    unsigned int value;
+};
+
+
+struct ar6000_traffic_activity_change {
+    u32 StreamID;   /* stream ID to indicate activity change */
+    u32 Active;     /* active (1) or inactive (0) */
+};
+
+/* Used with AR6000_XIOCTL_PROF_COUNT_GET */
+struct prof_count_s {
+    u32 addr;       /* bin start address */
+    u32 count;      /* hit count */
+};
+
+
+/* used by AR6000_XIOCTL_MODULE_DEBUG_SET_MASK */
+/*         AR6000_XIOCTL_MODULE_DEBUG_GET_MASK */
+/*         AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO */
+struct drv_debug_module_s {
+    char modulename[128];   /* name of module */
+    u32 mask;              /* new mask to set .. or .. current mask */
+};
+
+
+/* All HCI related rx events are sent up to the host app
+ * via a wmi event id. It can contain ACL data or HCI event, 
+ * based on which it will be de-multiplexed.
+ */
+typedef enum {
+    PAL_HCI_EVENT = 0,
+    PAL_HCI_RX_DATA,
+} WMI_PAL_EVENT_INFO;
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/drivers/staging/ath6kl/os/linux/include/cfg80211.h b/drivers/staging/ath6kl/os/linux/include/cfg80211.h
new file mode 100644
index 00000000000..d5253207b19
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/cfg80211.h
@@ -0,0 +1,61 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _AR6K_CFG80211_H_
+#define _AR6K_CFG80211_H_
+
+struct wireless_dev *ar6k_cfg80211_init(struct device *dev);
+void ar6k_cfg80211_deinit(struct ar6_softc *ar);
+
+void ar6k_cfg80211_scanComplete_event(struct ar6_softc *ar, int status);
+
+void ar6k_cfg80211_connect_event(struct ar6_softc *ar, u16 channel,
+                                u8 *bssid, u16 listenInterval,
+                                u16 beaconInterval,NETWORK_TYPE networkType,
+                                u8 beaconIeLen, u8 assocReqLen,
+                                u8 assocRespLen, u8 *assocInfo);
+
+void ar6k_cfg80211_disconnect_event(struct ar6_softc *ar, u8 reason,
+                                    u8 *bssid, u8 assocRespLen,
+                                    u8 *assocInfo, u16 protocolReasonStatus);
+
+void ar6k_cfg80211_tkip_micerr_event(struct ar6_softc *ar, u8 keyid, bool ismcast);
+
+#ifdef CONFIG_NL80211_TESTMODE
+void ar6000_testmode_rx_report_event(struct ar6_softc *ar, void *buf,
+                                     int buf_len);
+#else
+static inline void ar6000_testmode_rx_report_event(struct ar6_softc *ar,
+                                                   void *buf, int buf_len) 
+{
+}
+#endif
+
+
+#endif /* _AR6K_CFG80211_H_ */
+
+
+
+
+
+
diff --git a/drivers/staging/ath6kl/os/linux/include/config_linux.h b/drivers/staging/ath6kl/os/linux/include/config_linux.h
new file mode 100644
index 00000000000..dbbe1a00b92
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/config_linux.h
@@ -0,0 +1,51 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _CONFIG_LINUX_H_
+#define _CONFIG_LINUX_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Host side Test Command support
+ */
+#define CONFIG_HOST_TCMD_SUPPORT
+
+#define USE_4BYTE_REGISTER_ACCESS
+
+/* Host-side support for Target-side profiling */
+#undef CONFIG_TARGET_PROFILE_SUPPORT
+
+/* IP/TCP checksum offload */
+/* Checksum offload is currently not supported for 64 bit platforms */
+#ifndef __LP64__
+#define CONFIG_CHECKSUM_OFFLOAD
+#endif /* __LP64__ */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/drivers/staging/ath6kl/os/linux/include/debug_linux.h b/drivers/staging/ath6kl/os/linux/include/debug_linux.h
new file mode 100644
index 00000000000..b8dba52badc
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/debug_linux.h
@@ -0,0 +1,50 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _DEBUG_LINUX_H_
+#define _DEBUG_LINUX_H_
+
+    /* macro to remove parens */
+#define ATH_PRINTX_ARG(arg...) arg
+
+#ifdef DEBUG
+    /* NOTE: the AR_DEBUG_PRINTF macro is defined here to handle special handling of variable arg macros
+     * which may be compiler dependent. */
+#define AR_DEBUG_PRINTF(mask, args) do {        \
+    if (GET_ATH_MODULE_DEBUG_VAR_MASK(ATH_MODULE_NAME) & (mask)) {                    \
+        A_LOGGER(mask, ATH_MODULE_NAME, ATH_PRINTX_ARG args);    \
+    }                                            \
+} while (0)
+#else
+    /* on non-debug builds, keep in error and warning messages in the driver, all other
+     * message tracing will get compiled out */
+#define AR_DEBUG_PRINTF(mask, args) \
+    if ((mask) & (ATH_DEBUG_ERR | ATH_DEBUG_WARN)) { A_PRINTF(ATH_PRINTX_ARG args); }
+
+#endif
+
+    /* compile specific macro to get the function name string */
+#define _A_FUNCNAME_  __func__
+
+
+#endif /* _DEBUG_LINUX_H_ */
diff --git a/drivers/staging/ath6kl/os/linux/include/export_hci_transport.h b/drivers/staging/ath6kl/os/linux/include/export_hci_transport.h
new file mode 100644
index 00000000000..74f98618334
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/export_hci_transport.h
@@ -0,0 +1,76 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HCI bridge implementation
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include "hci_transport_api.h"
+#include "common_drv.h"
+
+extern HCI_TRANSPORT_HANDLE (*_HCI_TransportAttach)(void *HTCHandle, struct hci_transport_config_info *pInfo);
+extern void (*_HCI_TransportDetach)(HCI_TRANSPORT_HANDLE HciTrans);
+extern int    (*_HCI_TransportAddReceivePkts)(HCI_TRANSPORT_HANDLE HciTrans, struct htc_packet_queue *pQueue);
+extern int    (*_HCI_TransportSendPkt)(HCI_TRANSPORT_HANDLE HciTrans, struct htc_packet *pPacket, bool Synchronous);
+extern void        (*_HCI_TransportStop)(HCI_TRANSPORT_HANDLE HciTrans);
+extern int    (*_HCI_TransportStart)(HCI_TRANSPORT_HANDLE HciTrans);
+extern int    (*_HCI_TransportEnableDisableAsyncRecv)(HCI_TRANSPORT_HANDLE HciTrans, bool Enable);
+extern int    (*_HCI_TransportRecvHCIEventSync)(HCI_TRANSPORT_HANDLE HciTrans,
+                                          struct htc_packet           *pPacket,
+                                          int                  MaxPollMS);
+extern int    (*_HCI_TransportSetBaudRate)(HCI_TRANSPORT_HANDLE HciTrans, u32 Baud);
+extern int    (*_HCI_TransportEnablePowerMgmt)(HCI_TRANSPORT_HANDLE HciTrans, bool Enable);
+
+
+#define HCI_TransportAttach(HTCHandle, pInfo)   \
+            _HCI_TransportAttach((HTCHandle), (pInfo))
+#define HCI_TransportDetach(HciTrans)    \
+            _HCI_TransportDetach(HciTrans)
+#define HCI_TransportAddReceivePkts(HciTrans, pQueue)   \
+            _HCI_TransportAddReceivePkts((HciTrans), (pQueue))
+#define HCI_TransportSendPkt(HciTrans, pPacket, Synchronous)  \
+            _HCI_TransportSendPkt((HciTrans), (pPacket), (Synchronous))
+#define HCI_TransportStop(HciTrans)  \
+            _HCI_TransportStop((HciTrans))
+#define HCI_TransportStart(HciTrans)  \
+            _HCI_TransportStart((HciTrans))
+#define HCI_TransportEnableDisableAsyncRecv(HciTrans, Enable)   \
+            _HCI_TransportEnableDisableAsyncRecv((HciTrans), (Enable))
+#define HCI_TransportRecvHCIEventSync(HciTrans, pPacket, MaxPollMS)   \
+            _HCI_TransportRecvHCIEventSync((HciTrans), (pPacket), (MaxPollMS))
+#define HCI_TransportSetBaudRate(HciTrans, Baud)    \
+            _HCI_TransportSetBaudRate((HciTrans), (Baud))
+#define HCI_TransportEnablePowerMgmt(HciTrans, Enable)    \
+            _HCI_TransportEnablePowerMgmt((HciTrans), (Enable))
+
+
+extern int ar6000_register_hci_transport(struct hci_transport_callbacks *hciTransCallbacks);
+
+extern int ar6000_get_hif_dev(struct hif_device *device, void *config);
+
+extern int ar6000_set_uart_config(struct hif_device *hifDevice, u32 scale, u32 step);
+
+/* get core clock register settings
+ * data: 0 - 40/44MHz
+ *       1 - 80/88MHz
+ *       where (5G band/2.4G band)
+ * assume 2.4G band for now
+ */
+extern int ar6000_get_core_clock_config(struct hif_device *hifDevice, u32 *data);
diff --git a/drivers/staging/ath6kl/os/linux/include/ieee80211_ioctl.h b/drivers/staging/ath6kl/os/linux/include/ieee80211_ioctl.h
new file mode 100644
index 00000000000..e6e96de3fc6
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/ieee80211_ioctl.h
@@ -0,0 +1,177 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _IEEE80211_IOCTL_H_
+#define _IEEE80211_IOCTL_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Extracted from the MADWIFI net80211/ieee80211_ioctl.h
+ */
+
+/*
+ * WPA/RSN get/set key request.  Specify the key/cipher
+ * type and whether the key is to be used for sending and/or
+ * receiving.  The key index should be set only when working
+ * with global keys (use IEEE80211_KEYIX_NONE for ``no index'').
+ * Otherwise a unicast/pairwise key is specified by the bssid
+ * (on a station) or mac address (on an ap).  They key length
+ * must include any MIC key data; otherwise it should be no
+ more than IEEE80211_KEYBUF_SIZE.
+ */
+struct ieee80211req_key {
+    u_int8_t    ik_type;    /* key/cipher type */
+    u_int8_t    ik_pad;
+    u_int16_t   ik_keyix;   /* key index */
+    u_int8_t    ik_keylen;  /* key length in bytes */
+    u_int8_t    ik_flags;
+#define IEEE80211_KEY_XMIT  0x01
+#define IEEE80211_KEY_RECV  0x02
+#define IEEE80211_KEY_DEFAULT   0x80    /* default xmit key */
+    u_int8_t    ik_macaddr[IEEE80211_ADDR_LEN];
+    u_int64_t   ik_keyrsc;  /* key receive sequence counter */
+    u_int64_t   ik_keytsc;  /* key transmit sequence counter */
+    u_int8_t    ik_keydata[IEEE80211_KEYBUF_SIZE+IEEE80211_MICBUF_SIZE];
+};
+/*
+ * Delete a key either by index or address.  Set the index
+ * to IEEE80211_KEYIX_NONE when deleting a unicast key.
+ */
+struct ieee80211req_del_key {
+    u_int8_t    idk_keyix;  /* key index */
+    u_int8_t    idk_macaddr[IEEE80211_ADDR_LEN];
+};
+/*
+ * MLME state manipulation request.  IEEE80211_MLME_ASSOC
+ * only makes sense when operating as a station.  The other
+ * requests can be used when operating as a station or an
+ * ap (to effect a station).
+ */
+struct ieee80211req_mlme {
+    u_int8_t    im_op;      /* operation to perform */
+#define IEEE80211_MLME_ASSOC        1   /* associate station */
+#define IEEE80211_MLME_DISASSOC     2   /* disassociate station */
+#define IEEE80211_MLME_DEAUTH       3   /* deauthenticate station */
+#define IEEE80211_MLME_AUTHORIZE    4   /* authorize station */
+#define IEEE80211_MLME_UNAUTHORIZE  5   /* unauthorize station */
+    u_int16_t   im_reason;  /* 802.11 reason code */
+    u_int8_t    im_macaddr[IEEE80211_ADDR_LEN];
+};
+
+struct ieee80211req_addpmkid {
+    u_int8_t    pi_bssid[IEEE80211_ADDR_LEN];
+    u_int8_t    pi_enable;
+    u_int8_t    pi_pmkid[16];
+};
+
+#define AUTH_ALG_OPEN_SYSTEM    0x01
+#define AUTH_ALG_SHARED_KEY 0x02
+#define AUTH_ALG_LEAP       0x04
+
+struct ieee80211req_authalg {
+   u_int8_t auth_alg;
+};  
+
+/* 
+ * Request to add an IE to a Management Frame
+ */
+enum{
+    IEEE80211_APPIE_FRAME_BEACON     = 0,
+    IEEE80211_APPIE_FRAME_PROBE_REQ  = 1,
+    IEEE80211_APPIE_FRAME_PROBE_RESP = 2,
+    IEEE80211_APPIE_FRAME_ASSOC_REQ  = 3,
+    IEEE80211_APPIE_FRAME_ASSOC_RESP = 4,
+    IEEE80211_APPIE_NUM_OF_FRAME     = 5
+};
+
+/*
+ * The Maximum length of the IE that can be added to a Management frame
+ */
+#define IEEE80211_APPIE_FRAME_MAX_LEN  200
+
+struct ieee80211req_getset_appiebuf {
+    u_int32_t app_frmtype; /* management frame type for which buffer is added */
+    u_int32_t app_buflen;  /*application supplied buffer length */
+    u_int8_t  app_buf[];
+};
+
+/* 
+ * The following definitions are used by an application to set filter
+ * for receiving management frames 
+ */
+enum {
+     IEEE80211_FILTER_TYPE_BEACON      =   0x1,
+     IEEE80211_FILTER_TYPE_PROBE_REQ   =   0x2,
+     IEEE80211_FILTER_TYPE_PROBE_RESP  =   0x4,
+     IEEE80211_FILTER_TYPE_ASSOC_REQ   =   0x8,
+     IEEE80211_FILTER_TYPE_ASSOC_RESP  =   0x10,
+     IEEE80211_FILTER_TYPE_AUTH        =   0x20,
+     IEEE80211_FILTER_TYPE_DEAUTH      =   0x40,
+     IEEE80211_FILTER_TYPE_DISASSOC    =   0x80,
+     IEEE80211_FILTER_TYPE_ALL         =   0xFF  /* used to check the valid filter bits */
+};
+
+struct ieee80211req_set_filter {
+      u_int32_t app_filterype; /* management frame filter type */
+};
+
+enum {
+    IEEE80211_PARAM_AUTHMODE = 3,   /* Authentication Mode */
+    IEEE80211_PARAM_MCASTCIPHER = 5,
+    IEEE80211_PARAM_MCASTKEYLEN = 6,    /* multicast key length */
+    IEEE80211_PARAM_UCASTCIPHER = 8,
+    IEEE80211_PARAM_UCASTKEYLEN = 9,    /* unicast key length */
+    IEEE80211_PARAM_WPA     = 10,   /* WPA mode (0,1,2) */
+    IEEE80211_PARAM_ROAMING     = 12,   /* roaming mode */
+    IEEE80211_PARAM_PRIVACY     = 13,   /* privacy invoked */
+    IEEE80211_PARAM_COUNTERMEASURES = 14,   /* WPA/TKIP countermeasures */
+    IEEE80211_PARAM_DROPUNENCRYPTED = 15,   /* discard unencrypted frames */
+    IEEE80211_PARAM_WAPI = 16,   /* WAPI policy from wapid */        
+};
+
+/*
+ * Values for IEEE80211_PARAM_WPA
+ */
+#define WPA_MODE_WPA1   1
+#define WPA_MODE_WPA2   2
+#define WPA_MODE_AUTO   3
+#define WPA_MODE_NONE   4
+
+struct ieee80211req_wpaie {
+    u_int8_t    wpa_macaddr[IEEE80211_ADDR_LEN];
+    u_int8_t    wpa_ie[IEEE80211_MAX_IE];
+    u_int8_t    rsn_ie[IEEE80211_MAX_IE];
+};
+
+#ifndef IW_ENCODE_ALG_PMK
+#define IW_ENCODE_ALG_PMK       4
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _IEEE80211_IOCTL_H_ */
diff --git a/drivers/staging/ath6kl/os/linux/include/osapi_linux.h b/drivers/staging/ath6kl/os/linux/include/osapi_linux.h
new file mode 100644
index 00000000000..41f43730772
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/osapi_linux.h
@@ -0,0 +1,339 @@
+//------------------------------------------------------------------------------
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _OSAPI_LINUX_H_
+#define _OSAPI_LINUX_H_
+
+#ifdef __KERNEL__
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/jiffies.h>
+#include <linux/timer.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/semaphore.h>
+#include <linux/cache.h>
+
+#ifdef __GNUC__
+#define __ATTRIB_PACK           __attribute__ ((packed))
+#define __ATTRIB_PRINTF         __attribute__ ((format (printf, 1, 2)))
+#define __ATTRIB_NORETURN       __attribute__ ((noreturn))
+#ifndef INLINE
+#define INLINE                  __inline__
+#endif
+#else /* Not GCC */
+#define __ATTRIB_PACK
+#define __ATTRIB_PRINTF
+#define __ATTRIB_NORETURN
+#ifndef INLINE
+#define INLINE                  __inline
+#endif
+#endif /* End __GNUC__ */
+
+#define PREPACK
+#define POSTPACK                __ATTRIB_PACK
+
+/*
+ * Endianes macros
+ */
+#define A_BE2CPU8(x)       ntohb(x)
+#define A_BE2CPU16(x)      ntohs(x)
+#define A_BE2CPU32(x)      ntohl(x)
+
+#define A_LE2CPU8(x)       (x)
+#define A_LE2CPU16(x)      (x)
+#define A_LE2CPU32(x)      (x)
+
+#define A_CPU2BE8(x)       htonb(x)
+#define A_CPU2BE16(x)      htons(x)
+#define A_CPU2BE32(x)      htonl(x)
+
+#define A_MEMZERO(addr, len)            memset(addr, 0, len)
+#define A_MALLOC(size)                  kmalloc((size), GFP_KERNEL)
+#define A_MALLOC_NOWAIT(size)           kmalloc((size), GFP_ATOMIC)
+
+#define A_LOGGER(mask, mod, args...)    printk(KERN_ALERT args)
+#define A_PRINTF(args...)               printk(KERN_ALERT args)
+
+#define A_PRINTF_LOG(args...)           printk(args)
+#define A_SPRINTF(buf, args...)                 sprintf (buf, args)
+
+/* Mutual Exclusion */
+typedef spinlock_t                      A_MUTEX_T;
+#define A_MUTEX_INIT(mutex)             spin_lock_init(mutex)
+#define A_MUTEX_LOCK(mutex)             spin_lock_bh(mutex)
+#define A_MUTEX_UNLOCK(mutex)           spin_unlock_bh(mutex)
+#define A_IS_MUTEX_VALID(mutex)         true  /* okay to return true, since A_MUTEX_DELETE does nothing */
+#define A_MUTEX_DELETE(mutex)           /* spin locks are not kernel resources so nothing to free.. */
+
+/* Get current time in ms adding a constant offset (in ms) */
+#define A_GET_MS(offset)    \
+        (((jiffies / HZ) * 1000) + (offset))
+
+/*
+ * Timer Functions
+ */
+#define A_MDELAY(msecs)                 mdelay(msecs)
+typedef struct timer_list               A_TIMER;
+
+#define A_INIT_TIMER(pTimer, pFunction, pArg) do {              \
+    init_timer(pTimer);                                         \
+    (pTimer)->function = (pFunction);                           \
+    (pTimer)->data   = (unsigned long)(pArg);                   \
+} while (0)
+
+/*
+ * Start a Timer that elapses after 'periodMSec' milli-seconds
+ * Support is provided for a one-shot timer. The 'repeatFlag' is
+ * ignored.
+ */
+#define A_TIMEOUT_MS(pTimer, periodMSec, repeatFlag) do {                   \
+    if (repeatFlag) {                                                       \
+        printk("\n" __FILE__ ":%d: Timer Repeat requested\n",__LINE__);     \
+        panic("Timer Repeat");                                              \
+    }                                                                       \
+    mod_timer((pTimer), jiffies + HZ * (periodMSec) / 1000);                \
+} while (0)
+
+/*
+ * Cancel the Timer. 
+ */
+#define A_UNTIMEOUT(pTimer) do {                                \
+    del_timer((pTimer));                                        \
+} while (0)
+
+#define A_DELETE_TIMER(pTimer) do {                             \
+} while (0)
+
+/*
+ * Wait Queue related functions
+ */
+typedef wait_queue_head_t               A_WAITQUEUE_HEAD;
+#define A_INIT_WAITQUEUE_HEAD(head)     init_waitqueue_head(head)
+#ifndef wait_event_interruptible_timeout
+#define __wait_event_interruptible_timeout(wq, condition, ret)          \
+do {                                                                    \
+        wait_queue_t __wait;                                            \
+        init_waitqueue_entry(&__wait, current);                         \
+                                                                        \
+        add_wait_queue(&wq, &__wait);                                   \
+        for (;;) {                                                      \
+                set_current_state(TASK_INTERRUPTIBLE);                  \
+                if (condition)                                          \
+                        break;                                          \
+                if (!signal_pending(current)) {                         \
+                        ret = schedule_timeout(ret);                    \
+                        if (!ret)                                       \
+                                break;                                  \
+                        continue;                                       \
+                }                                                       \
+                ret = -ERESTARTSYS;                                     \
+                break;                                                  \
+        }                                                               \
+        current->state = TASK_RUNNING;                                  \
+        remove_wait_queue(&wq, &__wait);                                \
+} while (0)
+
+#define wait_event_interruptible_timeout(wq, condition, timeout)        \
+({                                                                      \
+        long __ret = timeout;                                           \
+        if (!(condition))                                               \
+                __wait_event_interruptible_timeout(wq, condition, __ret); \
+        __ret;                                                          \
+})
+#endif /* wait_event_interruptible_timeout */
+
+#define A_WAIT_EVENT_INTERRUPTIBLE_TIMEOUT(head, condition, timeout) do { \
+    wait_event_interruptible_timeout(head, condition, timeout); \
+} while (0)
+
+#define A_WAKE_UP(head)                 wake_up(head)
+
+#ifdef DEBUG
+extern unsigned int panic_on_assert;
+#define A_ASSERT(expr)  \
+    if (!(expr)) {   \
+        printk(KERN_ALERT"Debug Assert Caught, File %s, Line: %d, Test:%s \n",__FILE__, __LINE__,#expr); \
+        if (panic_on_assert) panic(#expr);                                                               \
+    }
+#else
+#define A_ASSERT(expr)
+#endif /* DEBUG */
+
+#define A_REQUEST_FIRMWARE(_ppf, _pfile, _dev) request_firmware(_ppf, _pfile, _dev)
+#define A_RELEASE_FIRMWARE(_pf) release_firmware(_pf)
+
+/*
+ * Initialization of the network buffer subsystem
+ */
+#define A_NETBUF_INIT()
+
+/*
+ * Network buffer queue support
+ */
+typedef struct sk_buff_head A_NETBUF_QUEUE_T;
+
+#define A_NETBUF_QUEUE_INIT(q)  \
+    a_netbuf_queue_init(q)
+
+#define A_NETBUF_ENQUEUE(q, pkt) \
+    a_netbuf_enqueue((q), (pkt))
+#define A_NETBUF_PREQUEUE(q, pkt) \
+    a_netbuf_prequeue((q), (pkt))
+#define A_NETBUF_DEQUEUE(q) \
+    (a_netbuf_dequeue(q))
+#define A_NETBUF_QUEUE_SIZE(q)  \
+    a_netbuf_queue_size(q)
+#define A_NETBUF_QUEUE_EMPTY(q) \
+    (a_netbuf_queue_empty(q) ? true : false)
+
+/*
+ * Network buffer support
+ */
+#define A_NETBUF_ALLOC(size) \
+    a_netbuf_alloc(size)
+#define A_NETBUF_ALLOC_RAW(size) \
+    a_netbuf_alloc_raw(size)
+#define A_NETBUF_FREE(bufPtr) \
+    a_netbuf_free(bufPtr)
+#define A_NETBUF_DATA(bufPtr) \
+    a_netbuf_to_data(bufPtr)
+#define A_NETBUF_LEN(bufPtr) \
+    a_netbuf_to_len(bufPtr)
+#define A_NETBUF_PUSH(bufPtr, len) \
+    a_netbuf_push(bufPtr, len)
+#define A_NETBUF_PUT(bufPtr, len) \
+    a_netbuf_put(bufPtr, len)
+#define A_NETBUF_TRIM(bufPtr,len) \
+    a_netbuf_trim(bufPtr, len)
+#define A_NETBUF_PULL(bufPtr, len) \
+    a_netbuf_pull(bufPtr, len)
+#define A_NETBUF_HEADROOM(bufPtr)\
+    a_netbuf_headroom(bufPtr)
+#define A_NETBUF_SETLEN(bufPtr,len) \
+    a_netbuf_setlen(bufPtr, len)
+
+/* Add data to end of a buffer  */
+#define A_NETBUF_PUT_DATA(bufPtr, srcPtr,  len) \
+    a_netbuf_put_data(bufPtr, srcPtr, len) 
+
+/* Add data to start of the  buffer */
+#define A_NETBUF_PUSH_DATA(bufPtr, srcPtr,  len) \
+    a_netbuf_push_data(bufPtr, srcPtr, len) 
+
+/* Remove data at start of the buffer */
+#define A_NETBUF_PULL_DATA(bufPtr, dstPtr, len) \
+    a_netbuf_pull_data(bufPtr, dstPtr, len) 
+
+/* Remove data from the end of the buffer */
+#define A_NETBUF_TRIM_DATA(bufPtr, dstPtr, len) \
+    a_netbuf_trim_data(bufPtr, dstPtr, len) 
+
+/* View data as "size" contiguous bytes of type "t" */
+#define A_NETBUF_VIEW_DATA(bufPtr, t, size) \
+    (t )( ((struct skbuf *)(bufPtr))->data)
+
+/* return the beginning of the headroom for the buffer */
+#define A_NETBUF_HEAD(bufPtr) \
+        ((((struct sk_buff *)(bufPtr))->head))
+    
+/*
+ * OS specific network buffer access routines
+ */
+void *a_netbuf_alloc(int size);
+void *a_netbuf_alloc_raw(int size);
+void a_netbuf_free(void *bufPtr);
+void *a_netbuf_to_data(void *bufPtr);
+u32 a_netbuf_to_len(void *bufPtr);
+int a_netbuf_push(void *bufPtr, s32 len);
+int a_netbuf_push_data(void *bufPtr, char *srcPtr, s32 len);
+int a_netbuf_put(void *bufPtr, s32 len);
+int a_netbuf_put_data(void *bufPtr, char *srcPtr, s32 len);
+int a_netbuf_pull(void *bufPtr, s32 len);
+int a_netbuf_pull_data(void *bufPtr, char *dstPtr, s32 len);
+int a_netbuf_trim(void *bufPtr, s32 len);
+int a_netbuf_trim_data(void *bufPtr, char *dstPtr, s32 len);
+int a_netbuf_setlen(void *bufPtr, s32 len);
+s32 a_netbuf_headroom(void *bufPtr);
+void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt);
+void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt);
+void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q);
+int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q);
+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
+void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q);
+
+/*
+ * Kernel v.s User space functions
+ */
+u32 a_copy_to_user(void *to, const void *from, u32 n);
+u32 a_copy_from_user(void *to, const void *from, u32 n);
+
+/* In linux, WLAN Rx and Tx run in different contexts, so no need to check
+ * for any commands/data queued for WLAN */
+#define A_CHECK_DRV_TX()   
+             
+#define A_GET_CACHE_LINE_BYTES()    L1_CACHE_BYTES
+
+#define A_CACHE_LINE_PAD            128
+
+static inline void *A_ALIGN_TO_CACHE_LINE(void *ptr) {   
+    return (void *)L1_CACHE_ALIGN((unsigned long)ptr);
+}
+   
+#else /* __KERNEL__ */
+
+#ifdef __GNUC__
+#define __ATTRIB_PACK           __attribute__ ((packed))
+#define __ATTRIB_PRINTF         __attribute__ ((format (printf, 1, 2)))
+#define __ATTRIB_NORETURN       __attribute__ ((noreturn))
+#ifndef INLINE
+#define INLINE                  __inline__
+#endif
+#else /* Not GCC */
+#define __ATTRIB_PACK
+#define __ATTRIB_PRINTF
+#define __ATTRIB_NORETURN
+#ifndef INLINE
+#define INLINE                  __inline
+#endif
+#endif /* End __GNUC__ */
+
+#define PREPACK
+#define POSTPACK                __ATTRIB_PACK
+
+#define A_MEMZERO(addr, len)            memset((addr), 0, (len))
+#define A_MALLOC(size)                  malloc(size)
+
+#include <err.h>
+
+#endif /* __KERNEL__ */
+
+#endif /* _OSAPI_LINUX_H_ */
diff --git a/drivers/staging/ath6kl/os/linux/include/wlan_config.h b/drivers/staging/ath6kl/os/linux/include/wlan_config.h
new file mode 100644
index 00000000000..c1fe0c6e4fa
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/wlan_config.h
@@ -0,0 +1,108 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the tunable configuration items for the WLAN module
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HOST_WLAN_CONFIG_H_
+#define _HOST_WLAN_CONFIG_H_
+
+/* Include definitions here that can be used to tune the WLAN module behavior.
+ * Different customers can tune the behavior as per their needs, here. 
+ */
+
+/* This configuration item when defined will consider the barker preamble 
+ * mentioned in the ERP IE of the beacons from the AP to determine the short 
+ * preamble support sent in the (Re)Assoc request frames.
+ */
+#define WLAN_CONFIG_DONOT_IGNORE_BARKER_IN_ERP 0
+
+/* This config item when defined will not send the power module state transition
+ * failure events that happen during scan, to the host. 
+ */
+#define WLAN_CONFIG_IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN 0
+
+/*
+ * This configuration item enable/disable keepalive support.
+ * Keepalive support: In the absence of any data traffic to AP, null 
+ * frames will be sent to the AP at periodic interval, to keep the association
+ * active. This configuration item defines the periodic interval.
+ * Use value of zero to disable keepalive support
+ * Default: 60 seconds
+ */
+#define WLAN_CONFIG_KEEP_ALIVE_INTERVAL 60 
+
+/*
+ * This configuration item sets the value of disconnect timeout
+ * Firmware delays sending the disconnec event to the host for this
+ * timeout after is gets disconnected from the current AP.
+ * If the firmware successly roams within the disconnect timeout
+ * it sends a new connect event
+ */
+#define WLAN_CONFIG_DISCONNECT_TIMEOUT 10
+
+/*
+ * This configuration item disables 11n support. 
+ * 0 - Enable
+ * 1 - Disable
+ */
+#define WLAN_CONFIG_DISABLE_11N         0
+
+/*
+ * This configuration item enable BT clock sharing support
+ * 1 - Enable
+ * 0 - Disable (Default)
+ */
+#define WLAN_CONFIG_BT_SHARING          0
+
+/*
+ * This configuration item sets WIFI OFF policy
+ * 0 - CUT_POWER
+ * 1 - DEEP_SLEEP (Default)
+ */
+#define WLAN_CONFIG_WLAN_OFF                1
+
+/*
+ * This configuration item sets suspend policy
+ * 0 - CUT_POWER (Default)
+ * 1 - DEEP_SLEEP
+ * 2 - WoW
+ * 3 - CUT_POWER if BT OFF (clock sharing designs only)
+ */
+#define WLAN_CONFIG_PM_SUSPEND              0
+
+/*
+ * This configuration item sets suspend policy to use if PM_SUSPEND is
+ * set to WoW and device is not connected at the time of suspend
+ * 0 - CUT_POWER (Default)
+ * 1 - DEEP_SLEEP
+ * 2 - WoW
+ * 3 - CUT_POWER if BT OFF (clock sharing designs only)
+ */
+#define WLAN_CONFIG_PM_WOW2                 0
+
+/*
+ * This configuration item enables/disables transmit bursting 
+ * 0 - Enable tx Bursting (default)
+ * 1 - Disable tx bursting 
+ */
+#define WLAN_CONFIG_DISABLE_TX_BURSTING     0
+
+#endif /* _HOST_WLAN_CONFIG_H_ */
diff --git a/drivers/staging/ath6kl/os/linux/include/wmi_filter_linux.h b/drivers/staging/ath6kl/os/linux/include/wmi_filter_linux.h
new file mode 100644
index 00000000000..1eb6f822d64
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/include/wmi_filter_linux.h
@@ -0,0 +1,300 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _WMI_FILTER_LINUX_H_
+#define  _WMI_FILTER_LINUX_H_
+
+/*
+ * sioctl_filter - Standard ioctl
+ * pioctl_filter - Priv ioctl
+ * xioctl_filter - eXtended ioctl
+ *
+ * ---- Possible values for the WMI filter ---------------
+ * (0) - Block this cmd always (or) not implemented
+ * (INFRA_NETWORK) - Allow this cmd only in STA mode
+ * (ADHOC_NETWORK) - Allow this cmd only in IBSS mode
+ * (AP_NETWORK) -    Allow this cmd only in AP mode
+ * (INFRA_NETWORK | ADHOC_NETWORK) - Block this cmd in AP mode
+ * (ADHOC_NETWORK | AP_NETWORK) -    Block this cmd in STA mode
+ * (INFRA_NETWORK | AP_NETWORK) -    Block this cmd in IBSS mode
+ * (INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK)- allow only when mode is set
+ * (0xFF) - Allow this cmd always irrespective of mode
+ */
+
+u8 sioctl_filter[] = {
+(AP_NETWORK),                                   /* SIOCSIWCOMMIT   0x8B00   */
+(0xFF),                                         /* SIOCGIWNAME     0x8B01   */
+(0),                                            /* SIOCSIWNWID     0x8B02   */
+(0),                                            /* SIOCGIWNWID     0x8B03   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWFREQ     0x8B04   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWFREQ     0x8B05   */
+(0xFF),                                         /* SIOCSIWMODE     0x8B06   */
+(0xFF),                                         /* SIOCGIWMODE     0x8B07   */
+(0),                                            /* SIOCSIWSENS     0x8B08   */
+(0),                                            /* SIOCGIWSENS     0x8B09   */
+(0),                                            /* SIOCSIWRANGE    0x8B0A   */
+(0xFF),                                         /* SIOCGIWRANGE    0x8B0B   */
+(0),                                            /* SIOCSIWPRIV     0x8B0C   */
+(0),                                            /* SIOCGIWPRIV     0x8B0D   */
+(0),                                            /* SIOCSIWSTATS    0x8B0E   */
+(0),                                            /* SIOCGIWSTATS    0x8B0F   */
+(0),                                            /* SIOCSIWSPY      0x8B10   */
+(0),                                            /* SIOCGIWSPY      0x8B11   */
+(0),                                            /* SIOCSIWTHRSPY   0x8B12   */
+(0),                                            /* SIOCGIWTHRSPY   0x8B13   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWAP       0x8B14   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWAP       0x8B15   */
+#if (WIRELESS_EXT >= 18)
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCSIWMLME     0X8B16   */
+#else
+(0),                                            /* Dummy           0        */
+#endif /* WIRELESS_EXT */
+(0),                                            /* SIOCGIWAPLIST   0x8B17   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCSIWSCAN     0x8B18   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCGIWSCAN     0x8B19   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWESSID    0x8B1A   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWESSID    0x8B1B   */
+(0),                                            /* SIOCSIWNICKN    0x8B1C   */
+(0),                                            /* SIOCGIWNICKN    0x8B1D   */
+(0),                                            /* Dummy           0        */
+(0),                                            /* Dummy           0        */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWRATE     0x8B20   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWRATE     0x8B21   */
+(0),                                            /* SIOCSIWRTS      0x8B22   */
+(0),                                            /* SIOCGIWRTS      0x8B23   */
+(0),                                            /* SIOCSIWFRAG     0x8B24   */
+(0),                                            /* SIOCGIWFRAG     0x8B25   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWTXPOW    0x8B26   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWTXPOW    0x8B27   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCSIWRETRY    0x8B28   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCGIWRETRY    0x8B29   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWENCODE   0x8B2A   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWENCODE   0x8B2B   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWPOWER    0x8B2C   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWPOWER    0x8B2D   */
+};
+
+
+
+u8 pioctl_filter[] = {
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* IEEE80211_IOCTL_SETPARAM             (SIOCIWFIRSTPRIV+0)     */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* IEEE80211_IOCTL_SETKEY               (SIOCIWFIRSTPRIV+1)     */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* IEEE80211_IOCTL_DELKEY               (SIOCIWFIRSTPRIV+2)     */
+(AP_NETWORK),                                   /* IEEE80211_IOCTL_SETMLME              (SIOCIWFIRSTPRIV+3)     */
+(INFRA_NETWORK),                                /* IEEE80211_IOCTL_ADDPMKID             (SIOCIWFIRSTPRIV+4)     */
+(0),                                            /* IEEE80211_IOCTL_SETOPTIE             (SIOCIWFIRSTPRIV+5)     */
+(0),                                            /*                                      (SIOCIWFIRSTPRIV+6)     */
+(0),                                            /*                                      (SIOCIWFIRSTPRIV+7)     */
+(0),                                            /*                                      (SIOCIWFIRSTPRIV+8)     */
+(0),                                            /*                                      (SIOCIWFIRSTPRIV+9)     */
+(0),                                            /* IEEE80211_IOCTL_LASTONE              (SIOCIWFIRSTPRIV+10)    */
+(0xFF),                                         /* AR6000_IOCTL_WMI_GETREV              (SIOCIWFIRSTPRIV+11)    */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_IOCTL_WMI_SETPWR              (SIOCIWFIRSTPRIV+12)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SETSCAN             (SIOCIWFIRSTPRIV+13)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SETLISTENINT        (SIOCIWFIRSTPRIV+14)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SETBSSFILTER        (SIOCIWFIRSTPRIV+15)    */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_IOCTL_WMI_SET_CHANNELPARAMS   (SIOCIWFIRSTPRIV+16)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_PROBEDSSID      (SIOCIWFIRSTPRIV+17)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_PMPARAMS        (SIOCIWFIRSTPRIV+18)    */
+(INFRA_NETWORK),                                /* AR6000_IOCTL_WMI_SET_BADAP           (SIOCIWFIRSTPRIV+19)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_GET_QOS_QUEUE       (SIOCIWFIRSTPRIV+20)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_CREATE_QOS          (SIOCIWFIRSTPRIV+21)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_DELETE_QOS          (SIOCIWFIRSTPRIV+22)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_SNRTHRESHOLD    (SIOCIWFIRSTPRIV+23)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK (SIOCIWFIRSTPRIV+24)*/
+(0xFF),                                         /* AR6000_IOCTL_WMI_GET_TARGET_STATS    (SIOCIWFIRSTPRIV+25)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_ASSOC_INFO      (SIOCIWFIRSTPRIV+26)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_ACCESS_PARAMS   (SIOCIWFIRSTPRIV+27)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_BMISS_TIME      (SIOCIWFIRSTPRIV+28)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_DISC_TIMEOUT    (SIOCIWFIRSTPRIV+29)    */
+(ADHOC_NETWORK),                                /* AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS    (SIOCIWFIRSTPRIV+30)    */
+};
+
+
+
+u8 xioctl_filter[] = {
+(0xFF),                                         /* Dummy                                           0    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_DONE                          1    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_READ_MEMORY                   2    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_WRITE_MEMORY                  3    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_EXECUTE                       4    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_SET_APP_START                 5    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_READ_SOC_REGISTER             6    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER            7    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_TEST                          8    */
+(0xFF),                                         /* AR6000_XIOCTL_UNUSED9                           9    */
+(0xFF),                                         /* AR6000_XIOCTL_UNUSED10                          10   */
+(0xFF),                                         /* AR6000_XIOCTL_UNUSED11                          11   */
+(0xFF),                                         /* AR6000_XIOCTL_FORCE_TARGET_RESET                12   */
+(0xFF),                                         /* AR6000_XIOCTL_HTC_RAW_OPEN                      13   */
+(0xFF),                                         /* AR6000_XIOCTL_HTC_RAW_CLOSE                     14   */
+(0xFF),                                         /* AR6000_XIOCTL_HTC_RAW_READ                      15   */
+(0xFF),                                         /* AR6000_XIOCTL_HTC_RAW_WRITE                     16   */
+(0xFF),                                         /* AR6000_XIOCTL_CHECK_TARGET_READY                17   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_OUTPUT_SET                   18   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_INPUT_GET                    19   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_REGISTER_SET                 20   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_REGISTER_GET                 21   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_INTR_ACK                     22   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_INTR_WAIT                    23   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_SET_ADHOC_BSSID                   24   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_SET_OPT_MODE                      25   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_OPT_SEND_FRAME                    26   */
+(ADHOC_NETWORK | AP_NETWORK),                   /* AR6000_XIOCTL_SET_BEACON_INTVAL                 27   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* IEEE80211_IOCTL_SETAUTHALG                      28   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_SET_VOICE_PKT_SIZE                29   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_SET_MAX_SP                        30   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_ROAM_TBL                  31   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_ROAM_CTRL                 32   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS         33   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTRL_WMI_GET_POWER_MODE               34   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTRL_WMI_SET_WLAN_STATE               35   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_ROAM_DATA                 36   */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SETRETRYLIMITS                37   */
+(0xFF),                                         /* AR6000_XIOCTL_TCMD_CONT_TX                      38   */
+(0xFF),                                         /* AR6000_XIOCTL_TCMD_CONT_RX                      39   */
+(0xFF),                                         /* AR6000_XIOCTL_TCMD_PM                           40   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_STARTSCAN                     41   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SETFIXRATES                   42   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_GETFIXRATES                   43   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD             44   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_CLR_RSSISNR                   45   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_LQTHRESHOLD               46   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_RTS                       47   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_LPREAMBLE                 48   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_AUTHMODE                  49   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_REASSOCMODE               50   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_WMM                       51   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS  52   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP         53   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_GET_RD                        54   */
+(0xFF),                                         /* AR6000_XIOCTL_DIAG_READ                         55   */
+(0xFF),                                         /* AR6000_XIOCTL_DIAG_WRITE                        56   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_TXOP                      57   */
+(INFRA_NETWORK),                                /* AR6000_XIOCTL_USER_SETKEYS                      58   */
+(INFRA_NETWORK),                                /* AR6000_XIOCTL_WMI_SET_KEEPALIVE                 59   */
+(INFRA_NETWORK),                                /* AR6000_XIOCTL_WMI_GET_KEEPALIVE                 60   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_ROMPATCH_INSTALL              61   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL            62   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE             63   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE           64   */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_APPIE                     65   */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER        66   */
+(0xFF),                                         /* AR6000_XIOCTL_DBGLOG_CFG_MODULE                 67   */
+(0xFF),                                         /* AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS             68   */
+(0xFF),                                         /* Dummy                                           69   */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_WSC_STATUS                70   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BT_STATUS                 71   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BT_PARAMS                 72   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE           73   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_WOW_MODE                  74   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_WOW_LIST                  75   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_ADD_WOW_PATTERN               76   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_DEL_WOW_PATTERN               77   */
+(0xFF),                                         /* AR6000_XIOCTL_TARGET_INFO                       78   */
+(0xFF),                                         /* AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE             79   */
+(0xFF),                                         /* AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE           80   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS        81   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_AKMP_PARAMS               82   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_PMKID_LIST                83   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_PMKID_LIST                84   */
+(0xFF),                                         /* Dummy                                           85   */
+(0xFF),                                         /* Dummy                                           86   */
+(0xFF),                                         /* Dummy                                           87   */
+(0xFF),                                         /* Dummy                                           88   */
+(0xFF),                                         /* Dummy                                           89   */
+(0xFF),                                         /* AR6000_XIOCTL_UNUSED90                          90   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_LZ_STREAM_START               91   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_LZ_DATA                       92   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_CFG                          93   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_ADDR_SET                     94   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_START                        95   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_STOP                         96   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_COUNT_GET                    97   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_ABORT_SCAN                    98   */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_STA_LIST                   99   */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_HIDDEN_SSID                    100  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_NUM_STA                    101  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_ACL_MAC                    102  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_ACL_LIST                   103  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_COMMIT_CONFIG                  104  */
+(AP_NETWORK),                                   /* IEEE80211_IOCTL_GETWPAIE                        105  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_CONN_INACT_TIME                106  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_PROT_SCAN_TIME                 107  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_WMI_SET_COUNTRY                   108  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_DTIM                       109  */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_TARGET_EVENT_REPORT           110  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_SET_IP                            111  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_ACL_POLICY                 112  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_INTRA_BSS_COMM                 113  */
+(0xFF),                                         /* AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO            114  */
+(0xFF),                                         /* AR6000_XIOCTL_MODULE_DEBUG_SET_MASK             115  */
+(0xFF),                                         /* AR6000_XIOCTL_MODULE_DEBUG_GET_MASK             116  */
+(0xFF),                                         /* AR6000_XIOCTL_DUMP_RCV_AGGR_STATS               117  */
+(0xFF),                                         /* AR6000_XIOCTL_SET_HT_CAP                        118  */
+(0xFF),                                         /* AR6000_XIOCTL_SET_HT_OP                         119  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_STAT                       120  */
+(0xFF),                                         /* AR6000_XIOCTL_SET_TX_SELECT_RATES               121  */
+(0xFF),                                         /* AR6000_XIOCTL_SETUP_AGGR                        122  */
+(0xFF),                                         /* AR6000_XIOCTL_ALLOW_AGGR                        123  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_HIDDEN_SSID                124  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_COUNTRY                    125  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_WMODE                      126  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_DTIM                       127  */
+(AP_NETWORK | ADHOC_NETWORK),                   /* AR6000_XIOCTL_AP_GET_BINTVL                     128  */
+(0xFF),                                         /* AR6000_XIOCTL_AP_GET_RTS                        129  */
+(0xFF),                                         /* AR6000_XIOCTL_DELE_AGGR                         130  */
+(0xFF),                                         /* AR6000_XIOCTL_FETCH_TARGET_REGS                 131  */
+(0xFF),                                         /* AR6000_XIOCTL_HCI_CMD                           132  */
+(0xFF),                                         /* AR6000_XIOCTL_ACL_DATA(used to be used for PAL) 133  */
+(0xFF),                                         /* AR6000_XIOCTL_WLAN_CONN_PRECEDENCE              134  */
+(AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_11BG_RATESET               135  */
+(0xFF),
+(0xFF),
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BTCOEX_FE_ANT             138  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BTCOEX_COLOCATED_BT_DEV   139  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG  140  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BTCOEX_SCO_CONFIG         141  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BTCOEX_A2DP_CONFIG        142  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BTCOEX_ACLCOEX_CONFIG     143  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BTCOEX_DEBUG              144  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BT_OPERATING_STATUS       145  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_BTCOEX_CONFIG             146  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_BTCOEX_GET_STATS          147  */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_QOS_SUPP                  148  */
+(0xFF),                                         /* AR6000_XIOCTL_GET_WLAN_SLEEP_STATE              149  */
+(0xFF),                                         /* AR6000_XIOCTL_SET_BT_HW_POWER_STATE             150  */
+(0xFF),                                         /* AR6000_XIOCTL_GET_BT_HW_POWER_STATE             151  */
+(0xFF),                                         /* AR6000_XIOCTL_ADD_AP_INTERFACE                  152  */
+(0xFF),                                         /* AR6000_XIOCTL_REMOVE_AP_INTERFACE               153  */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM              154  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_WPA_OFFLOAD_STATE         155  */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_PASSPHRASE                156  */
+(0xFF),
+(0xFF),
+(0xFF),
+(0xFF),
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_EXCESS_TX_RETRY_THRES     161  */
+};
+
+#endif /*_WMI_FILTER_LINUX_H_*/
diff --git a/drivers/staging/ath6kl/os/linux/netbuf.c b/drivers/staging/ath6kl/os/linux/netbuf.c
new file mode 100644
index 00000000000..963a2fb76a9
--- /dev/null
+++ b/drivers/staging/ath6kl/os/linux/netbuf.c
@@ -0,0 +1,231 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+#include <a_config.h>
+#include "athdefs.h"
+#include "a_osapi.h"
+#include "htc_packet.h"
+
+#define AR6000_DATA_OFFSET    64
+
+void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt)
+{
+    skb_queue_tail((struct sk_buff_head *) q, (struct sk_buff *) pkt);
+}
+
+void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt)
+{
+    skb_queue_head((struct sk_buff_head *) q, (struct sk_buff *) pkt);
+}
+
+void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q)
+{
+    return((void *) skb_dequeue((struct sk_buff_head *) q));
+}
+
+int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q)
+{
+    return(skb_queue_len((struct sk_buff_head *) q));
+}
+
+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q)
+{
+    return(skb_queue_empty((struct sk_buff_head *) q));
+}
+
+void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q)
+{
+    skb_queue_head_init((struct sk_buff_head *) q);
+}
+
+void *
+a_netbuf_alloc(int size)
+{
+    struct sk_buff *skb;
+    size += 2 * (A_GET_CACHE_LINE_BYTES()); /* add some cacheline space at front and back of buffer */
+    skb = dev_alloc_skb(AR6000_DATA_OFFSET + sizeof(struct htc_packet) + size);
+    skb_reserve(skb, AR6000_DATA_OFFSET + sizeof(struct htc_packet) + A_GET_CACHE_LINE_BYTES());    
+    return ((void *)skb);
+}
+
+/*
+ * Allocate an SKB w.o. any encapsulation requirement.
+ */
+void *
+a_netbuf_alloc_raw(int size)
+{
+    struct sk_buff *skb;
+
+    skb = dev_alloc_skb(size);
+
+    return ((void *)skb);
+}
+
+void
+a_netbuf_free(void *bufPtr)
+{
+    struct sk_buff *skb = (struct sk_buff *)bufPtr;
+
+    dev_kfree_skb(skb);
+}
+
+u32 a_netbuf_to_len(void *bufPtr)
+{
+    return (((struct sk_buff *)bufPtr)->len);
+}
+
+void *
+a_netbuf_to_data(void *bufPtr)
+{
+    return (((struct sk_buff *)bufPtr)->data);
+}
+
+/*
+ * Add len # of bytes to the beginning of the network buffer
+ * pointed to by bufPtr
+ */
+int
+a_netbuf_push(void *bufPtr, s32 len)
+{
+    skb_push((struct sk_buff *)bufPtr, len);
+
+    return 0;
+}
+
+/*
+ * Add len # of bytes to the beginning of the network buffer
+ * pointed to by bufPtr and also fill with data
+ */
+int
+a_netbuf_push_data(void *bufPtr, char *srcPtr, s32 len)
+{
+    skb_push((struct sk_buff *) bufPtr, len);
+    memcpy(((struct sk_buff *)bufPtr)->data, srcPtr, len);
+
+    return 0;
+}
+
+/*
+ * Add len # of bytes to the end of the network buffer
+ * pointed to by bufPtr
+ */
+int
+a_netbuf_put(void *bufPtr, s32 len)
+{
+    skb_put((struct sk_buff *)bufPtr, len);
+
+    return 0;
+}
+
+/*
+ * Add len # of bytes to the end of the network buffer
+ * pointed to by bufPtr and also fill with data
+ */
+int
+a_netbuf_put_data(void *bufPtr, char *srcPtr, s32 len)
+{
+    char *start = (char*)(((struct sk_buff *)bufPtr)->data +
+        ((struct sk_buff *)bufPtr)->len);
+    skb_put((struct sk_buff *)bufPtr, len);
+    memcpy(start, srcPtr, len);
+
+    return 0;
+}
+
+
+/*
+ * Trim the network buffer pointed to by bufPtr to len # of bytes 
+ */
+int
+a_netbuf_setlen(void *bufPtr, s32 len)
+{
+    skb_trim((struct sk_buff *)bufPtr, len);
+
+    return 0;
+}
+
+/*
+ * Chop of len # of bytes from the end of the buffer.
+ */
+int
+a_netbuf_trim(void *bufPtr, s32 len)
+{
+    skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
+
+    return 0;
+}
+
+/*
+ * Chop of len # of bytes from the end of the buffer and return the data.
+ */
+int
+a_netbuf_trim_data(void *bufPtr, char *dstPtr, s32 len)
+{
+    char *start = (char*)(((struct sk_buff *)bufPtr)->data +
+        (((struct sk_buff *)bufPtr)->len - len));
+    
+    memcpy(dstPtr, start, len);
+    skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
+
+    return 0;
+}
+
+
+/*
+ * Returns the number of bytes available to a a_netbuf_push()
+ */
+s32 a_netbuf_headroom(void *bufPtr)
+{
+    return (skb_headroom((struct sk_buff *)bufPtr));
+}
+
+/*
+ * Removes specified number of bytes from the beginning of the buffer
+ */
+int
+a_netbuf_pull(void *bufPtr, s32 len)
+{
+    skb_pull((struct sk_buff *)bufPtr, len);
+
+    return 0;
+}
+
+/*
+ * Removes specified number of bytes from the beginning of the buffer
+ * and return the data
+ */
+int
+a_netbuf_pull_data(void *bufPtr, char *dstPtr, s32 len)
+{
+    memcpy(dstPtr, ((struct sk_buff *)bufPtr)->data, len);
+    skb_pull((struct sk_buff *)bufPtr, len);
+
+    return 0;
+}
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+EXPORT_SYMBOL(a_netbuf_to_data);
+EXPORT_SYMBOL(a_netbuf_put);
+EXPORT_SYMBOL(a_netbuf_pull);
+EXPORT_SYMBOL(a_netbuf_alloc);
+EXPORT_SYMBOL(a_netbuf_free);
+#endif
diff --git a/drivers/staging/ath6kl/reorder/aggr_rx_internal.h b/drivers/staging/ath6kl/reorder/aggr_rx_internal.h
new file mode 100644
index 00000000000..11125967d53
--- /dev/null
+++ b/drivers/staging/ath6kl/reorder/aggr_rx_internal.h
@@ -0,0 +1,117 @@
+/*
+ *
+ * Copyright (c) 2004-2010 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ * 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+ *
+ */
+
+#ifndef __AGGR_RX_INTERNAL_H__
+#define __AGGR_RX_INTERNAL_H__
+
+#include "a_osapi.h"
+#include "aggr_recv_api.h"
+
+#define AGGR_WIN_IDX(x, y)          ((x) % (y))
+#define AGGR_INCR_IDX(x, y)         AGGR_WIN_IDX(((x)+1), (y))
+#define AGGR_DCRM_IDX(x, y)         AGGR_WIN_IDX(((x)-1), (y))
+#define IEEE80211_MAX_SEQ_NO        0xFFF
+#define IEEE80211_NEXT_SEQ_NO(x)    (((x) + 1) & IEEE80211_MAX_SEQ_NO)
+
+
+#define NUM_OF_TIDS         8
+#define AGGR_SZ_DEFAULT     8
+
+#define AGGR_WIN_SZ_MIN     2
+#define AGGR_WIN_SZ_MAX     8
+/* TID Window sz is double of what is negotiated. Derive TID_WINDOW_SZ from win_sz, per tid */
+#define TID_WINDOW_SZ(_x)   ((_x) << 1)
+
+#define AGGR_NUM_OF_FREE_NETBUFS    16
+
+#define AGGR_GET_RXTID_STATS(_p, _x)    (&(_p->stat[(_x)]))
+#define AGGR_GET_RXTID(_p, _x)    (&(_p->RxTid[(_x)]))
+
+/* Hold q is a function of win_sz, which is negotiated per tid */
+#define HOLD_Q_SZ(_x)   (TID_WINDOW_SZ((_x))*sizeof(struct osbuf_hold_q))
+/* AGGR_RX_TIMEOUT value is important as a (too) small value can cause frames to be 
+ * delivered out of order and a (too) large value can cause undesirable latency in
+ * certain situations. */
+#define AGGR_RX_TIMEOUT     400  /* Timeout(in ms) for delivery of frames, if they are stuck */
+
+typedef enum {
+    ALL_SEQNO = 0,
+    CONTIGUOUS_SEQNO = 1,
+}DELIVERY_ORDER;
+
+struct osbuf_hold_q {
+    void        *osbuf;
+    bool      is_amsdu;
+    u16 seq_no;
+};
+
+
+#if 0
+/* XXX: unused ? */
+struct window_snapshot {
+    u16 seqno_st;
+    u16 seqno_end;
+};
+#endif
+
+struct rxtid {
+    bool              aggr;       /* is it ON or OFF */
+    bool              progress;   /* true when frames have arrived after a timer start */
+    bool              timerMon;   /* true if the timer started for the sake of this TID */
+    u16 win_sz;     /* negotiated window size */
+    u16 seq_next;   /* Next seq no, in current window */
+    u32 hold_q_sz;  /* Num of frames that can be held in hold q */
+    struct osbuf_hold_q        *hold_q;    /* Hold q for re-order */
+#if 0    
+    struct window_snapshot     old_win;    /* Sliding window snapshot - for timeout */
+#endif    
+    A_NETBUF_QUEUE_T    q;          /* q head for enqueuing frames for dispatch */
+    A_MUTEX_T           lock;
+};
+
+struct rxtid_stats {
+    u32 num_into_aggr;      /* hitting at the input of this module */
+    u32 num_dups;           /* duplicate */
+    u32 num_oow;            /* out of window */
+    u32 num_mpdu;           /* single payload 802.3/802.11 frame */
+    u32 num_amsdu;          /* AMSDU */
+    u32 num_delivered;      /* frames delivered to IP stack */
+    u32 num_timeouts;       /* num of timeouts, during which frames delivered */
+    u32 num_hole;           /* frame not present, when window moved over */
+    u32 num_bar;            /* num of resets of seq_num, via BAR */
+};
+
+struct aggr_info {
+    u8 aggr_sz;            /* config value of aggregation size */
+    u8 timerScheduled;
+    A_TIMER             timer;              /* timer for returning held up pkts in re-order que */    
+    void                *dev;               /* dev handle */
+    RX_CALLBACK         rx_fn;              /* callback function to return frames; to upper layer */
+    struct rxtid               RxTid[NUM_OF_TIDS]; /* Per tid window */
+    ALLOC_NETBUFS       netbuf_allocator;   /* OS netbuf alloc fn */
+    A_NETBUF_QUEUE_T    freeQ;              /* pre-allocated buffers - for A_MSDU slicing */
+    struct rxtid_stats         stat[NUM_OF_TIDS];  /* Tid based statistics */
+    PACKET_LOG          pkt_log;            /* Log info of the packets */
+};
+
+#endif /* __AGGR_RX_INTERNAL_H__ */
diff --git a/drivers/staging/ath6kl/reorder/rcv_aggr.c b/drivers/staging/ath6kl/reorder/rcv_aggr.c
new file mode 100644
index 00000000000..9b1509ec5a7
--- /dev/null
+++ b/drivers/staging/ath6kl/reorder/rcv_aggr.c
@@ -0,0 +1,661 @@
+/*
+ *
+ * Copyright (c) 2010 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ * 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+ *
+ */
+
+#include <a_config.h>
+#include <athdefs.h>
+#include <a_osapi.h>
+#include <a_debug.h>
+#include "pkt_log.h"
+#include "aggr_recv_api.h"
+#include "aggr_rx_internal.h"
+#include "wmi.h"
+
+extern int
+wmi_dot3_2_dix(void *osbuf);
+
+static void
+aggr_slice_amsdu(struct aggr_info *p_aggr, struct rxtid *rxtid, void **osbuf);
+
+static void
+aggr_timeout(unsigned long arg);
+
+static void
+aggr_deque_frms(struct aggr_info *p_aggr, u8 tid, u16 seq_no, u8 order);
+
+static void
+aggr_dispatch_frames(struct aggr_info *p_aggr, A_NETBUF_QUEUE_T *q);
+
+static void *
+aggr_get_osbuf(struct aggr_info *p_aggr);
+
+void *
+aggr_init(ALLOC_NETBUFS netbuf_allocator)
+{
+    struct aggr_info   *p_aggr = NULL;
+    struct rxtid *rxtid;
+    u8 i;
+    int status = 0;
+
+    A_PRINTF("In aggr_init..\n");
+
+    do {
+        p_aggr = A_MALLOC(sizeof(struct aggr_info));
+        if(!p_aggr) {
+            A_PRINTF("Failed to allocate memory for aggr_node\n");
+            status = A_ERROR;
+            break;
+        }
+
+        /* Init timer and data structures */
+        A_MEMZERO(p_aggr, sizeof(struct aggr_info));
+        p_aggr->aggr_sz = AGGR_SZ_DEFAULT;
+        A_INIT_TIMER(&p_aggr->timer, aggr_timeout, p_aggr);
+        p_aggr->timerScheduled = false;
+        A_NETBUF_QUEUE_INIT(&p_aggr->freeQ);
+
+        p_aggr->netbuf_allocator = netbuf_allocator;
+        p_aggr->netbuf_allocator(&p_aggr->freeQ, AGGR_NUM_OF_FREE_NETBUFS);
+
+        for(i = 0; i < NUM_OF_TIDS; i++) {
+            rxtid = AGGR_GET_RXTID(p_aggr, i);
+            rxtid->aggr = false;
+            rxtid->progress = false;
+            rxtid->timerMon = false;
+            A_NETBUF_QUEUE_INIT(&rxtid->q);
+            A_MUTEX_INIT(&rxtid->lock);
+        }
+    }while(false);
+
+    A_PRINTF("going out of aggr_init..status %s\n",
+                    (status == 0) ? "OK":"Error");
+
+    if (status) {
+        /* Cleanup */
+        aggr_module_destroy(p_aggr);
+    }
+    return ((status == 0) ? p_aggr : NULL);
+}
+
+/* utility function to clear rx hold_q for a tid */
+static void
+aggr_delete_tid_state(struct aggr_info *p_aggr, u8 tid)
+{
+    struct rxtid *rxtid;
+    struct rxtid_stats *stats;
+
+    A_ASSERT(tid < NUM_OF_TIDS && p_aggr);
+
+    rxtid = AGGR_GET_RXTID(p_aggr, tid);
+    stats = AGGR_GET_RXTID_STATS(p_aggr, tid);
+
+    if(rxtid->aggr) {
+        aggr_deque_frms(p_aggr, tid, 0, ALL_SEQNO);
+    }
+
+    rxtid->aggr = false;
+    rxtid->progress = false;
+    rxtid->timerMon = false;
+    rxtid->win_sz = 0;
+    rxtid->seq_next = 0;
+    rxtid->hold_q_sz = 0;
+
+    if(rxtid->hold_q) {
+        kfree(rxtid->hold_q);
+        rxtid->hold_q = NULL;
+    }
+
+    A_MEMZERO(stats, sizeof(struct rxtid_stats));
+}
+
+void
+aggr_module_destroy(void *cntxt)
+{
+    struct aggr_info *p_aggr = (struct aggr_info *)cntxt;
+    struct rxtid *rxtid;
+    u8 i, k;
+    A_PRINTF("%s(): aggr = %p\n",_A_FUNCNAME_, p_aggr);
+    A_ASSERT(p_aggr);
+
+    if(p_aggr) {
+        if(p_aggr->timerScheduled) {
+            A_UNTIMEOUT(&p_aggr->timer);
+            p_aggr->timerScheduled = false;
+        }
+
+        for(i = 0; i < NUM_OF_TIDS; i++) {
+            rxtid = AGGR_GET_RXTID(p_aggr, i);
+            /* Free the hold q contents and hold_q*/
+            if(rxtid->hold_q) {
+                for(k = 0; k< rxtid->hold_q_sz; k++) {
+                    if(rxtid->hold_q[k].osbuf) {
+                        A_NETBUF_FREE(rxtid->hold_q[k].osbuf);
+                    }
+                }
+                kfree(rxtid->hold_q);
+            }
+            /* Free the dispatch q contents*/
+            while(A_NETBUF_QUEUE_SIZE(&rxtid->q)) {
+                A_NETBUF_FREE(A_NETBUF_DEQUEUE(&rxtid->q));
+            }
+            if (A_IS_MUTEX_VALID(&rxtid->lock)) {
+                A_MUTEX_DELETE(&rxtid->lock);
+            }
+        }
+        /* free the freeQ and its contents*/
+        while(A_NETBUF_QUEUE_SIZE(&p_aggr->freeQ)) {
+            A_NETBUF_FREE(A_NETBUF_DEQUEUE(&p_aggr->freeQ));
+        }
+        kfree(p_aggr);
+    }
+    A_PRINTF("out aggr_module_destroy\n");
+}
+
+
+void
+aggr_register_rx_dispatcher(void *cntxt, void * dev, RX_CALLBACK fn)
+{
+    struct aggr_info *p_aggr = (struct aggr_info *)cntxt;
+
+    A_ASSERT(p_aggr && fn && dev);
+
+    p_aggr->rx_fn = fn;
+    p_aggr->dev = dev;
+}
+
+
+void
+aggr_process_bar(void *cntxt, u8 tid, u16 seq_no)
+{
+    struct aggr_info *p_aggr = (struct aggr_info *)cntxt;
+    struct rxtid_stats *stats;
+
+    A_ASSERT(p_aggr);
+    stats = AGGR_GET_RXTID_STATS(p_aggr, tid);
+    stats->num_bar++;
+
+    aggr_deque_frms(p_aggr, tid, seq_no, ALL_SEQNO);
+}
+
+
+void
+aggr_recv_addba_req_evt(void *cntxt, u8 tid, u16 seq_no, u8 win_sz)
+{
+    struct aggr_info *p_aggr = (struct aggr_info *)cntxt;
+    struct rxtid *rxtid;
+    struct rxtid_stats *stats;
+
+    A_ASSERT(p_aggr);
+    rxtid = AGGR_GET_RXTID(p_aggr, tid);
+    stats = AGGR_GET_RXTID_STATS(p_aggr, tid);
+
+    A_PRINTF("%s(): win_sz = %d aggr %d\n", _A_FUNCNAME_, win_sz, rxtid->aggr);
+    if(win_sz < AGGR_WIN_SZ_MIN || win_sz > AGGR_WIN_SZ_MAX) {
+        A_PRINTF("win_sz %d, tid %d\n", win_sz, tid);
+    }
+
+    if(rxtid->aggr) {
+        /* Just go and  deliver all the frames up from this
+         * queue, as if we got DELBA and re-initialize the queue
+         */
+        aggr_delete_tid_state(p_aggr, tid);
+    }
+
+    rxtid->seq_next = seq_no;
+    /* create these queues, only upon receiving of ADDBA for a
+     * tid, reducing memory requirement
+     */
+    rxtid->hold_q = A_MALLOC(HOLD_Q_SZ(win_sz));
+    if((rxtid->hold_q == NULL)) {
+        A_PRINTF("Failed to allocate memory, tid = %d\n", tid);
+        A_ASSERT(0);
+    }
+    A_MEMZERO(rxtid->hold_q, HOLD_Q_SZ(win_sz));
+
+    /* Update rxtid for the window sz */
+    rxtid->win_sz = win_sz;
+    /* hold_q_sz inicates the depth of holding q - which  is
+     * a factor of win_sz. Compute once, as it will be used often
+     */
+    rxtid->hold_q_sz = TID_WINDOW_SZ(win_sz);
+    /* There should be no frames on q - even when second ADDBA comes in.
+     * If aggr was previously ON on this tid, we would have cleaned up
+     * the q
+     */
+    if(A_NETBUF_QUEUE_SIZE(&rxtid->q) != 0) {
+        A_PRINTF("ERROR: Frames still on queue ?\n");
+        A_ASSERT(0);
+    }
+
+    rxtid->aggr = true;
+}
+
+void
+aggr_recv_delba_req_evt(void *cntxt, u8 tid)
+{
+    struct aggr_info *p_aggr = (struct aggr_info *)cntxt;
+    struct rxtid *rxtid;
+
+    A_ASSERT(p_aggr);
+    A_PRINTF("%s(): tid %d\n", _A_FUNCNAME_, tid);
+
+    rxtid = AGGR_GET_RXTID(p_aggr, tid);
+
+    if(rxtid->aggr) {
+        aggr_delete_tid_state(p_aggr, tid);
+    }
+}
+
+static void
+aggr_deque_frms(struct aggr_info *p_aggr, u8 tid, u16 seq_no, u8 order)
+{
+    struct rxtid *rxtid;
+    struct osbuf_hold_q *node;
+    u16 idx, idx_end, seq_end;
+    struct rxtid_stats *stats;
+
+    A_ASSERT(p_aggr);
+    rxtid = AGGR_GET_RXTID(p_aggr, tid);
+    stats = AGGR_GET_RXTID_STATS(p_aggr, tid);
+
+    /* idx is absolute location for first frame */
+    idx = AGGR_WIN_IDX(rxtid->seq_next, rxtid->hold_q_sz);
+
+    /* idx_end is typically the last possible frame in the window,
+     * but changes to 'the' seq_no, when BAR comes. If seq_no
+     * is non-zero, we will go up to that and stop.
+     * Note: last seq no in current window will occupy the same
+     * index position as index that is just previous to start.
+     * An imp point : if win_sz is 7, for seq_no space of 4095,
+     * then, there would be holes when sequence wrap around occurs.
+     * Target should judiciously choose the win_sz, based on
+     * this condition. For 4095, (TID_WINDOW_SZ = 2 x win_sz
+     * 2, 4, 8, 16 win_sz works fine).
+     * We must deque from "idx" to "idx_end", including both.
+     */
+    seq_end = (seq_no) ? seq_no : rxtid->seq_next;
+    idx_end = AGGR_WIN_IDX(seq_end, rxtid->hold_q_sz);
+
+    /* Critical section begins */
+    A_MUTEX_LOCK(&rxtid->lock);
+    do {
+
+        node = &rxtid->hold_q[idx];
+
+        if((order == CONTIGUOUS_SEQNO) && (!node->osbuf))
+            break;
+
+        /* chain frames and deliver frames bcos:
+         *  1. either the frames are in order and window is contiguous, OR
+         *  2. we need to deque frames, irrespective of holes
+         */
+        if(node->osbuf) {
+            if(node->is_amsdu) {
+                aggr_slice_amsdu(p_aggr, rxtid, &node->osbuf);
+            } else {
+                A_NETBUF_ENQUEUE(&rxtid->q, node->osbuf);
+            }
+            node->osbuf = NULL;
+        } else {
+            stats->num_hole++;
+        }
+
+        /* window is moving */
+        rxtid->seq_next = IEEE80211_NEXT_SEQ_NO(rxtid->seq_next);
+        idx = AGGR_WIN_IDX(rxtid->seq_next, rxtid->hold_q_sz);
+    } while(idx != idx_end);
+    /* Critical section ends */
+    A_MUTEX_UNLOCK(&rxtid->lock);
+
+    stats->num_delivered += A_NETBUF_QUEUE_SIZE(&rxtid->q);
+    aggr_dispatch_frames(p_aggr, &rxtid->q);
+}
+
+static void *
+aggr_get_osbuf(struct aggr_info *p_aggr)
+{
+    void *buf = NULL;
+
+    /* Starving for buffers?  get more from OS
+     *  check for low netbuffers( < 1/4 AGGR_NUM_OF_FREE_NETBUFS) :
+     *      re-allocate bufs if so
+     * allocate a free buf from freeQ
+     */
+    if (A_NETBUF_QUEUE_SIZE(&p_aggr->freeQ) < (AGGR_NUM_OF_FREE_NETBUFS >> 2)) {
+        p_aggr->netbuf_allocator(&p_aggr->freeQ, AGGR_NUM_OF_FREE_NETBUFS);
+    }
+
+    if (A_NETBUF_QUEUE_SIZE(&p_aggr->freeQ)) {
+        buf = A_NETBUF_DEQUEUE(&p_aggr->freeQ);
+    }
+
+    return buf;
+}
+
+
+static void
+aggr_slice_amsdu(struct aggr_info *p_aggr, struct rxtid *rxtid, void **osbuf)
+{
+    void *new_buf;
+    u16 frame_8023_len, payload_8023_len, mac_hdr_len, amsdu_len;
+    u8 *framep;
+
+    /* Frame format at this point:
+     *  [DIX hdr | 802.3 | 802.3 | ... | 802.3]
+     *
+     * Strip the DIX header.
+     * Iterate through the osbuf and do:
+     *  grab a free netbuf from freeQ
+     *  find the start and end of a frame
+     *  copy it to netbuf(Vista can do better here)
+     *  convert all msdu's(802.3) frames to upper layer format - os routine
+     *      -for now lets convert from 802.3 to dix
+     *  enque this to dispatch q of tid
+     * repeat
+     * free the osbuf - to OS. It's been sliced.
+     */
+
+    mac_hdr_len = sizeof(ATH_MAC_HDR);
+    framep = A_NETBUF_DATA(*osbuf) + mac_hdr_len;
+    amsdu_len = A_NETBUF_LEN(*osbuf) - mac_hdr_len;
+
+    while(amsdu_len > mac_hdr_len) {
+        /* Begin of a 802.3 frame */
+        payload_8023_len = A_BE2CPU16(((ATH_MAC_HDR *)framep)->typeOrLen);
+#define MAX_MSDU_SUBFRAME_PAYLOAD_LEN 1508
+#define MIN_MSDU_SUBFRAME_PAYLOAD_LEN 46
+        if(payload_8023_len < MIN_MSDU_SUBFRAME_PAYLOAD_LEN || payload_8023_len > MAX_MSDU_SUBFRAME_PAYLOAD_LEN) {
+            A_PRINTF("802.3 AMSDU frame bound check failed. len %d\n", payload_8023_len);
+            break;
+        }
+        frame_8023_len = payload_8023_len + mac_hdr_len;
+        new_buf = aggr_get_osbuf(p_aggr);
+        if(new_buf == NULL) {
+            A_PRINTF("No buffer available \n");
+            break;
+        }
+
+        memcpy(A_NETBUF_DATA(new_buf), framep, frame_8023_len);
+        A_NETBUF_PUT(new_buf, frame_8023_len);
+        if (wmi_dot3_2_dix(new_buf) != 0) {
+            A_PRINTF("dot3_2_dix err..\n");
+            A_NETBUF_FREE(new_buf);
+            break;
+        }
+
+        A_NETBUF_ENQUEUE(&rxtid->q, new_buf);
+
+        /* Is this the last subframe within this aggregate ? */
+        if ((amsdu_len - frame_8023_len) == 0) {
+            break;
+        }
+
+        /* Add the length of A-MSDU subframe padding bytes -
+         * Round to nearest word.
+         */
+        frame_8023_len = ((frame_8023_len + 3) & ~3);
+
+        framep += frame_8023_len;
+        amsdu_len -= frame_8023_len;
+    }
+
+    A_NETBUF_FREE(*osbuf);
+    *osbuf = NULL;
+}
+
+void
+aggr_process_recv_frm(void *cntxt, u8 tid, u16 seq_no, bool is_amsdu, void **osbuf)
+{
+    struct aggr_info *p_aggr = (struct aggr_info *)cntxt;
+    struct rxtid *rxtid;
+    struct rxtid_stats *stats;
+    u16 idx, st, cur, end;
+    u16 *log_idx;
+    struct osbuf_hold_q *node;
+    PACKET_LOG *log;
+
+    A_ASSERT(p_aggr);
+    A_ASSERT(tid < NUM_OF_TIDS);
+
+    rxtid = AGGR_GET_RXTID(p_aggr, tid);
+    stats = AGGR_GET_RXTID_STATS(p_aggr, tid);
+
+    stats->num_into_aggr++;
+
+    if(!rxtid->aggr) {
+        if(is_amsdu) {
+            aggr_slice_amsdu(p_aggr, rxtid, osbuf);
+            stats->num_amsdu++;
+            aggr_dispatch_frames(p_aggr, &rxtid->q);
+        }
+        return;
+    }
+
+    /* Check the incoming sequence no, if it's in the window */
+    st = rxtid->seq_next;
+    cur = seq_no;
+    end = (st + rxtid->hold_q_sz-1) & IEEE80211_MAX_SEQ_NO;
+    /* Log the pkt info for future analysis */
+    log = &p_aggr->pkt_log;
+    log_idx = &log->last_idx;
+    log->info[*log_idx].cur = cur;
+    log->info[*log_idx].st = st;
+    log->info[*log_idx].end = end;
+    *log_idx = IEEE80211_NEXT_SEQ_NO(*log_idx);
+
+    if(((st < end) && (cur < st || cur > end)) ||
+      ((st > end) && (cur > end) && (cur < st))) {
+        /* the cur frame is outside the window. Since we know
+         * our target would not do this without reason it must
+         * be assumed that the window has moved for some valid reason.
+         * Therefore, we dequeue all frames and start fresh.
+         */
+        u16 extended_end;
+
+        extended_end = (end + rxtid->hold_q_sz-1) & IEEE80211_MAX_SEQ_NO;
+
+        if(((end < extended_end) && (cur < end || cur > extended_end)) ||
+           ((end > extended_end) && (cur > extended_end) && (cur < end))) {
+            // dequeue all frames in queue and shift window to new frame
+            aggr_deque_frms(p_aggr, tid, 0, ALL_SEQNO);
+            //set window start so that new frame is last frame in window
+            if(cur >= rxtid->hold_q_sz-1) {
+                rxtid->seq_next = cur - (rxtid->hold_q_sz-1);
+            }else{
+                rxtid->seq_next = IEEE80211_MAX_SEQ_NO - (rxtid->hold_q_sz-2 - cur);
+            }
+        } else {
+            // dequeue only those frames that are outside the new shifted window
+            if(cur >= rxtid->hold_q_sz-1) {
+                st = cur - (rxtid->hold_q_sz-1);
+            }else{
+                st = IEEE80211_MAX_SEQ_NO - (rxtid->hold_q_sz-2 - cur);
+            }
+
+            aggr_deque_frms(p_aggr, tid, st, ALL_SEQNO);
+        }
+
+        stats->num_oow++;
+    }
+
+    idx = AGGR_WIN_IDX(seq_no, rxtid->hold_q_sz);
+
+    /*enque the frame, in hold_q */
+    node = &rxtid->hold_q[idx];
+
+    A_MUTEX_LOCK(&rxtid->lock);
+    if(node->osbuf) {
+        /* Is the cur frame duplicate or something beyond our
+         * window(hold_q -> which is 2x, already)?
+         * 1. Duplicate is easy - drop incoming frame.
+         * 2. Not falling in current sliding window.
+         *  2a. is the frame_seq_no preceding current tid_seq_no?
+         *      -> drop the frame. perhaps sender did not get our ACK.
+         *         this is taken care of above.
+         *  2b. is the frame_seq_no beyond window(st, TID_WINDOW_SZ);
+         *      -> Taken care of it above, by moving window forward.
+         *
+         */
+        A_NETBUF_FREE(node->osbuf);
+        stats->num_dups++;
+    }
+
+    node->osbuf = *osbuf;
+    node->is_amsdu = is_amsdu;
+    node->seq_no = seq_no;
+    if(node->is_amsdu) {
+        stats->num_amsdu++;
+    } else {
+        stats->num_mpdu++;
+    }
+    A_MUTEX_UNLOCK(&rxtid->lock);
+
+    *osbuf = NULL;
+    aggr_deque_frms(p_aggr, tid, 0, CONTIGUOUS_SEQNO);
+
+    if(p_aggr->timerScheduled) {
+        rxtid->progress = true;
+    }else{
+        for(idx=0 ; idx<rxtid->hold_q_sz ; idx++) {
+            if(rxtid->hold_q[idx].osbuf) {
+                /* there is a frame in the queue and no timer so
+                 * start a timer to ensure that the frame doesn't remain
+                 * stuck forever. */
+                p_aggr->timerScheduled = true;
+                A_TIMEOUT_MS(&p_aggr->timer, AGGR_RX_TIMEOUT, 0);
+                rxtid->progress = false;
+                rxtid->timerMon = true;
+                break;
+            }
+        }
+    }
+}
+
+/*
+ * aggr_reset_state -- Called when it is deemed necessary to clear the aggregate
+ *  hold Q state.  Examples include when a Connect event or disconnect event is
+ *  received.
+ */
+void
+aggr_reset_state(void *cntxt)
+{
+    u8 tid;
+    struct aggr_info *p_aggr = (struct aggr_info *)cntxt;
+
+    A_ASSERT(p_aggr);
+
+    for(tid=0 ; tid<NUM_OF_TIDS ; tid++) {
+        aggr_delete_tid_state(p_aggr, tid);
+    }
+}
+
+
+static void
+aggr_timeout(unsigned long arg)
+{
+    u8 i,j;
+    struct aggr_info *p_aggr = (struct aggr_info *)arg;
+    struct rxtid   *rxtid;
+    struct rxtid_stats *stats;
+    /*
+     * If the q for which the timer was originally started has
+     * not progressed then it is necessary to dequeue all the
+     * contained frames so that they are not held forever.
+     */
+    for(i = 0; i < NUM_OF_TIDS; i++) {
+        rxtid = AGGR_GET_RXTID(p_aggr, i);
+        stats = AGGR_GET_RXTID_STATS(p_aggr, i);
+
+        if(rxtid->aggr == false ||
+           rxtid->timerMon == false ||
+           rxtid->progress == true) {
+            continue;
+        }
+        // dequeue all frames in for this tid
+        stats->num_timeouts++;
+        A_PRINTF("TO: st %d end %d\n", rxtid->seq_next, ((rxtid->seq_next + rxtid->hold_q_sz-1) & IEEE80211_MAX_SEQ_NO));
+        aggr_deque_frms(p_aggr, i, 0, ALL_SEQNO);
+    }
+
+    p_aggr->timerScheduled = false;
+    // determine whether a new timer should be started.
+    for(i = 0; i < NUM_OF_TIDS; i++) {
+        rxtid = AGGR_GET_RXTID(p_aggr, i);
+
+        if(rxtid->aggr == true && rxtid->hold_q) {
+            for(j = 0 ; j < rxtid->hold_q_sz ; j++)
+            {
+                if(rxtid->hold_q[j].osbuf)
+                {
+                    p_aggr->timerScheduled = true;
+                    rxtid->timerMon = true;
+                    rxtid->progress = false;
+                    break;
+                }
+            }
+
+            if(j >= rxtid->hold_q_sz) {
+                rxtid->timerMon = false;
+            }
+        }
+    }
+
+    if(p_aggr->timerScheduled) {
+        /* Rearm the timer*/
+        A_TIMEOUT_MS(&p_aggr->timer, AGGR_RX_TIMEOUT, 0);
+    }
+
+}
+
+static void
+aggr_dispatch_frames(struct aggr_info *p_aggr, A_NETBUF_QUEUE_T *q)
+{
+    void *osbuf;
+
+    while((osbuf = A_NETBUF_DEQUEUE(q))) {
+        p_aggr->rx_fn(p_aggr->dev, osbuf);
+    }
+}
+
+void
+aggr_dump_stats(void *cntxt, PACKET_LOG **log_buf)
+{
+    struct aggr_info *p_aggr = (struct aggr_info *)cntxt;
+    struct rxtid   *rxtid;
+    struct rxtid_stats *stats;
+    u8 i;
+
+    *log_buf = &p_aggr->pkt_log;
+    A_PRINTF("\n\n================================================\n");
+    A_PRINTF("tid: num_into_aggr, dups, oow, mpdu, amsdu, delivered, timeouts, holes, bar, seq_next\n");
+    for(i = 0; i < NUM_OF_TIDS; i++) {
+        stats = AGGR_GET_RXTID_STATS(p_aggr, i);
+        rxtid = AGGR_GET_RXTID(p_aggr, i);
+        A_PRINTF("%d: %d %d %d %d %d %d %d %d %d : %d\n", i, stats->num_into_aggr, stats->num_dups,
+                    stats->num_oow, stats->num_mpdu,
+                    stats->num_amsdu, stats->num_delivered, stats->num_timeouts,
+                    stats->num_hole, stats->num_bar,
+                    rxtid->seq_next);
+    }
+    A_PRINTF("================================================\n\n");
+
+}
diff --git a/drivers/staging/ath6kl/wlan/include/ieee80211.h b/drivers/staging/ath6kl/wlan/include/ieee80211.h
new file mode 100644
index 00000000000..cf47d0657e7
--- /dev/null
+++ b/drivers/staging/ath6kl/wlan/include/ieee80211.h
@@ -0,0 +1,397 @@
+//------------------------------------------------------------------------------
+// <copyright file="ieee80211.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _NET80211_IEEE80211_H_
+#define _NET80211_IEEE80211_H_
+
+/*
+ * 802.11 protocol definitions.
+ */
+#define IEEE80211_WEP_KEYLEN        5   /* 40bit */
+#define IEEE80211_WEP_IVLEN         3   /* 24bit */
+#define IEEE80211_WEP_KIDLEN        1   /* 1 octet */
+#define IEEE80211_WEP_CRCLEN        4   /* CRC-32 */
+#define IEEE80211_WEP_NKID          4   /* number of key ids */
+
+/*
+ * 802.11i defines an extended IV for use with non-WEP ciphers.
+ * When the EXTIV bit is set in the key id byte an additional
+ * 4 bytes immediately follow the IV for TKIP.  For CCMP the
+ * EXTIV bit is likewise set but the 8 bytes represent the
+ * CCMP header rather than IV+extended-IV.
+ */
+#define IEEE80211_WEP_EXTIV         0x20
+#define IEEE80211_WEP_EXTIVLEN      4   /* extended IV length */
+#define IEEE80211_WEP_MICLEN        8   /* trailing MIC */
+
+#define IEEE80211_CRC_LEN           4
+
+#ifdef WAPI_ENABLE
+#define IEEE80211_WAPI_EXTIVLEN      10   /* extended IV length */
+#endif /* WAPI ENABLE */
+
+
+#define IEEE80211_ADDR_LEN  6       /* size of 802.11 address */
+/* is 802.11 address multicast/broadcast? */
+#define IEEE80211_IS_MULTICAST(_a)  (*(_a) & 0x01)
+#define IEEE80211_IS_BROADCAST(_a)  (*(_a) == 0xFF)
+#define WEP_HEADER (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN)
+#define WEP_TRAILER IEEE80211_WEP_CRCLEN
+#define CCMP_HEADER (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + \
+                    IEEE80211_WEP_EXTIVLEN)
+#define CCMP_TRAILER IEEE80211_WEP_MICLEN
+#define TKIP_HEADER (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + \
+                    IEEE80211_WEP_EXTIVLEN)
+#define TKIP_TRAILER IEEE80211_WEP_CRCLEN
+#define TKIP_MICLEN  IEEE80211_WEP_MICLEN
+
+
+#define IEEE80211_ADDR_EQ(addr1, addr2)     \
+    (memcmp(addr1, addr2, IEEE80211_ADDR_LEN) == 0)
+
+#define IEEE80211_ADDR_COPY(dst,src)    memcpy(dst,src,IEEE80211_ADDR_LEN)
+
+#define IEEE80211_KEYBUF_SIZE 16
+#define IEEE80211_MICBUF_SIZE (8+8)  /* space for both tx and rx */
+
+/*
+ * NB: these values are ordered carefully; there are lots of
+ * of implications in any reordering.  In particular beware
+ * that 4 is not used to avoid conflicting with IEEE80211_F_PRIVACY.
+ */
+#define IEEE80211_CIPHER_WEP            0
+#define IEEE80211_CIPHER_TKIP           1
+#define IEEE80211_CIPHER_AES_OCB        2
+#define IEEE80211_CIPHER_AES_CCM        3
+#define IEEE80211_CIPHER_CKIP           5
+#define IEEE80211_CIPHER_CCKM_KRK       6
+#define IEEE80211_CIPHER_NONE           7       /* pseudo value */
+
+#define IEEE80211_CIPHER_MAX            (IEEE80211_CIPHER_NONE+1)
+
+#define IEEE80211_IS_VALID_WEP_CIPHER_LEN(len) \
+        (((len) == 5) || ((len) == 13) || ((len) == 16))
+
+
+
+/*
+ * generic definitions for IEEE 802.11 frames
+ */
+PREPACK struct ieee80211_frame {
+    u8 i_fc[2];
+    u8 i_dur[2];
+    u8 i_addr1[IEEE80211_ADDR_LEN];
+    u8 i_addr2[IEEE80211_ADDR_LEN];
+    u8 i_addr3[IEEE80211_ADDR_LEN];
+    u8 i_seq[2];
+    /* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
+    /* see below */
+} POSTPACK;
+
+PREPACK struct ieee80211_qosframe {
+    u8 i_fc[2];
+    u8 i_dur[2];
+    u8 i_addr1[IEEE80211_ADDR_LEN];
+    u8 i_addr2[IEEE80211_ADDR_LEN];
+    u8 i_addr3[IEEE80211_ADDR_LEN];
+    u8 i_seq[2];
+    u8 i_qos[2];
+} POSTPACK;
+
+#define IEEE80211_FC0_VERSION_MASK          0x03
+#define IEEE80211_FC0_VERSION_SHIFT         0
+#define IEEE80211_FC0_VERSION_0             0x00
+#define IEEE80211_FC0_TYPE_MASK             0x0c
+#define IEEE80211_FC0_TYPE_SHIFT            2
+#define IEEE80211_FC0_TYPE_MGT              0x00
+#define IEEE80211_FC0_TYPE_CTL              0x04
+#define IEEE80211_FC0_TYPE_DATA             0x08
+
+#define IEEE80211_FC0_SUBTYPE_MASK          0xf0
+#define IEEE80211_FC0_SUBTYPE_SHIFT         4
+/* for TYPE_MGT */
+#define IEEE80211_FC0_SUBTYPE_ASSOC_REQ     0x00
+#define IEEE80211_FC0_SUBTYPE_ASSOC_RESP    0x10
+#define IEEE80211_FC0_SUBTYPE_REASSOC_REQ   0x20
+#define IEEE80211_FC0_SUBTYPE_REASSOC_RESP  0x30
+#define IEEE80211_FC0_SUBTYPE_PROBE_REQ     0x40
+#define IEEE80211_FC0_SUBTYPE_PROBE_RESP    0x50
+#define IEEE80211_FC0_SUBTYPE_BEACON        0x80
+#define IEEE80211_FC0_SUBTYPE_ATIM          0x90
+#define IEEE80211_FC0_SUBTYPE_DISASSOC      0xa0
+#define IEEE80211_FC0_SUBTYPE_AUTH          0xb0
+#define IEEE80211_FC0_SUBTYPE_DEAUTH        0xc0
+/* for TYPE_CTL */
+#define IEEE80211_FC0_SUBTYPE_PS_POLL       0xa0
+#define IEEE80211_FC0_SUBTYPE_RTS           0xb0
+#define IEEE80211_FC0_SUBTYPE_CTS           0xc0
+#define IEEE80211_FC0_SUBTYPE_ACK           0xd0
+#define IEEE80211_FC0_SUBTYPE_CF_END        0xe0
+#define IEEE80211_FC0_SUBTYPE_CF_END_ACK    0xf0
+/* for TYPE_DATA (bit combination) */
+#define IEEE80211_FC0_SUBTYPE_DATA          0x00
+#define IEEE80211_FC0_SUBTYPE_CF_ACK        0x10
+#define IEEE80211_FC0_SUBTYPE_CF_POLL       0x20
+#define IEEE80211_FC0_SUBTYPE_CF_ACPL       0x30
+#define IEEE80211_FC0_SUBTYPE_NODATA        0x40
+#define IEEE80211_FC0_SUBTYPE_CFACK         0x50
+#define IEEE80211_FC0_SUBTYPE_CFPOLL        0x60
+#define IEEE80211_FC0_SUBTYPE_CF_ACK_CF_ACK 0x70
+#define IEEE80211_FC0_SUBTYPE_QOS           0x80
+#define IEEE80211_FC0_SUBTYPE_QOS_NULL      0xc0
+
+#define IEEE80211_FC1_DIR_MASK              0x03
+#define IEEE80211_FC1_DIR_NODS              0x00    /* STA->STA */
+#define IEEE80211_FC1_DIR_TODS              0x01    /* STA->AP  */
+#define IEEE80211_FC1_DIR_FROMDS            0x02    /* AP ->STA */
+#define IEEE80211_FC1_DIR_DSTODS            0x03    /* AP ->AP  */
+
+#define IEEE80211_FC1_MORE_FRAG             0x04
+#define IEEE80211_FC1_RETRY                 0x08
+#define IEEE80211_FC1_PWR_MGT               0x10
+#define IEEE80211_FC1_MORE_DATA             0x20
+#define IEEE80211_FC1_WEP                   0x40
+#define IEEE80211_FC1_ORDER                 0x80
+
+#define IEEE80211_SEQ_FRAG_MASK             0x000f
+#define IEEE80211_SEQ_FRAG_SHIFT            0
+#define IEEE80211_SEQ_SEQ_MASK              0xfff0
+#define IEEE80211_SEQ_SEQ_SHIFT             4
+
+#define IEEE80211_NWID_LEN                  32
+
+/*
+ * 802.11 rate set.
+ */
+#define IEEE80211_RATE_SIZE     8       /* 802.11 standard */
+#define IEEE80211_RATE_MAXSIZE  15      /* max rates we'll handle */
+
+#define WMM_NUM_AC                  4   /* 4 AC categories */
+
+#define WMM_PARAM_ACI_M         0x60    /* Mask for ACI field */
+#define WMM_PARAM_ACI_S         5   /* Shift for ACI field */
+#define WMM_PARAM_ACM_M         0x10    /* Mask for ACM bit */
+#define WMM_PARAM_ACM_S         4       /* Shift for ACM bit */
+#define WMM_PARAM_AIFSN_M       0x0f    /* Mask for aifsn field */
+#define WMM_PARAM_LOGCWMIN_M    0x0f    /* Mask for CwMin field (in log) */
+#define WMM_PARAM_LOGCWMAX_M    0xf0    /* Mask for CwMax field (in log) */
+#define WMM_PARAM_LOGCWMAX_S    4   /* Shift for CwMax field */
+
+#define WMM_AC_TO_TID(_ac) (       \
+    ((_ac) == WMM_AC_VO) ? 6 : \
+    ((_ac) == WMM_AC_VI) ? 5 : \
+    ((_ac) == WMM_AC_BK) ? 1 : \
+    0)
+
+#define TID_TO_WMM_AC(_tid) (      \
+    ((_tid) < 1) ? WMM_AC_BE : \
+    ((_tid) < 3) ? WMM_AC_BK : \
+    ((_tid) < 6) ? WMM_AC_VI : \
+    WMM_AC_VO)
+/*
+ * Management information element payloads.
+ */
+
+enum {
+    IEEE80211_ELEMID_SSID       = 0,
+    IEEE80211_ELEMID_RATES      = 1,
+    IEEE80211_ELEMID_FHPARMS    = 2,
+    IEEE80211_ELEMID_DSPARMS    = 3,
+    IEEE80211_ELEMID_CFPARMS    = 4,
+    IEEE80211_ELEMID_TIM        = 5,
+    IEEE80211_ELEMID_IBSSPARMS  = 6,
+    IEEE80211_ELEMID_COUNTRY    = 7,
+    IEEE80211_ELEMID_CHALLENGE  = 16,
+    /* 17-31 reserved for challenge text extension */
+    IEEE80211_ELEMID_PWRCNSTR   = 32,
+    IEEE80211_ELEMID_PWRCAP     = 33,
+    IEEE80211_ELEMID_TPCREQ     = 34,
+    IEEE80211_ELEMID_TPCREP     = 35,
+    IEEE80211_ELEMID_SUPPCHAN   = 36,
+    IEEE80211_ELEMID_CHANSWITCH = 37,
+    IEEE80211_ELEMID_MEASREQ    = 38,
+    IEEE80211_ELEMID_MEASREP    = 39,
+    IEEE80211_ELEMID_QUIET      = 40,
+    IEEE80211_ELEMID_IBSSDFS    = 41,
+    IEEE80211_ELEMID_ERP        = 42,
+    IEEE80211_ELEMID_HTCAP_ANA  = 45,   /* Address ANA, and non-ANA story, for interop. CL#171733 */
+    IEEE80211_ELEMID_RSN        = 48,
+    IEEE80211_ELEMID_XRATES     = 50,
+    IEEE80211_ELEMID_HTINFO_ANA = 61,
+#ifdef WAPI_ENABLE
+    IEEE80211_ELEMID_WAPI       = 68,
+#endif
+    IEEE80211_ELEMID_TPC        = 150,
+    IEEE80211_ELEMID_CCKM       = 156,
+    IEEE80211_ELEMID_VENDOR     = 221,  /* vendor private */
+};
+
+#define ATH_OUI             0x7f0300        /* Atheros OUI */
+#define ATH_OUI_TYPE        0x01
+#define ATH_OUI_SUBTYPE     0x01
+#define ATH_OUI_VERSION     0x00
+
+#define WPA_OUI             0xf25000
+#define WPA_OUI_TYPE        0x01
+#define WPA_VERSION         1          /* current supported version */
+
+#define WPA_CSE_NULL        0x00
+#define WPA_CSE_WEP40       0x01
+#define WPA_CSE_TKIP        0x02
+#define WPA_CSE_CCMP        0x04
+#define WPA_CSE_WEP104      0x05
+
+#define WPA_ASE_NONE        0x00
+#define WPA_ASE_8021X_UNSPEC    0x01
+#define WPA_ASE_8021X_PSK   0x02
+
+#define RSN_OUI         0xac0f00
+#define RSN_VERSION     1       /* current supported version */
+
+#define RSN_CSE_NULL        0x00
+#define RSN_CSE_WEP40       0x01
+#define RSN_CSE_TKIP        0x02
+#define RSN_CSE_WRAP        0x03
+#define RSN_CSE_CCMP        0x04
+#define RSN_CSE_WEP104      0x05
+
+#define RSN_ASE_NONE            0x00
+#define RSN_ASE_8021X_UNSPEC    0x01
+#define RSN_ASE_8021X_PSK       0x02
+
+#define RSN_CAP_PREAUTH         0x01
+
+#define WMM_OUI                 0xf25000
+#define WMM_OUI_TYPE            0x02
+#define WMM_INFO_OUI_SUBTYPE    0x00
+#define WMM_PARAM_OUI_SUBTYPE   0x01
+#define WMM_VERSION             1
+
+/* WMM stream classes */
+#define WMM_NUM_AC  4
+#define WMM_AC_BE   0       /* best effort */
+#define WMM_AC_BK   1       /* background */
+#define WMM_AC_VI   2       /* video */
+#define WMM_AC_VO   3       /* voice */
+
+/* TSPEC related */
+#define ACTION_CATEGORY_CODE_TSPEC                 17
+#define ACTION_CODE_TSPEC_ADDTS                    0
+#define ACTION_CODE_TSPEC_ADDTS_RESP               1
+#define ACTION_CODE_TSPEC_DELTS                    2
+
+typedef enum {
+    TSPEC_STATUS_CODE_ADMISSION_ACCEPTED = 0,
+    TSPEC_STATUS_CODE_ADDTS_INVALID_PARAMS = 0x1,
+    TSPEC_STATUS_CODE_ADDTS_REQUEST_REFUSED = 0x3,
+    TSPEC_STATUS_CODE_UNSPECIFIED_QOS_RELATED_FAILURE = 0xC8,
+    TSPEC_STATUS_CODE_REQUESTED_REFUSED_POLICY_CONFIGURATION = 0xC9,
+    TSPEC_STATUS_CODE_INSUFFCIENT_BANDWIDTH = 0xCA,
+    TSPEC_STATUS_CODE_INVALID_PARAMS = 0xCB,
+    TSPEC_STATUS_CODE_DELTS_SENT    = 0x30,
+    TSPEC_STATUS_CODE_DELTS_RECV    = 0x31,
+} TSPEC_STATUS_CODE;
+
+#define TSPEC_TSID_MASK             0xF
+#define TSPEC_TSID_S                1
+
+/*
+ * WMM/802.11e Tspec Element
+ */
+typedef PREPACK struct wmm_tspec_ie_t {
+    u8 elementId;
+    u8 len;
+    u8 oui[3];
+    u8 ouiType;
+    u8 ouiSubType;
+    u8 version;
+    u16 tsInfo_info;
+    u8 tsInfo_reserved;
+    u16 nominalMSDU;
+    u16 maxMSDU;
+    u32 minServiceInt;
+    u32 maxServiceInt;
+    u32 inactivityInt;
+    u32 suspensionInt;
+    u32 serviceStartTime;
+    u32 minDataRate;
+    u32 meanDataRate;
+    u32 peakDataRate;
+    u32 maxBurstSize;
+    u32 delayBound;
+    u32 minPhyRate;
+    u16 sba;
+    u16 mediumTime;
+} POSTPACK WMM_TSPEC_IE;
+
+
+/*
+ * BEACON management packets
+ *
+ *  octet timestamp[8]
+ *  octet beacon interval[2]
+ *  octet capability information[2]
+ *  information element
+ *      octet elemid
+ *      octet length
+ *      octet information[length]
+ */
+
+#define IEEE80211_BEACON_INTERVAL(beacon) \
+    ((beacon)[8] | ((beacon)[9] << 8))
+#define IEEE80211_BEACON_CAPABILITY(beacon) \
+    ((beacon)[10] | ((beacon)[11] << 8))
+
+#define IEEE80211_CAPINFO_ESS               0x0001
+#define IEEE80211_CAPINFO_IBSS              0x0002
+#define IEEE80211_CAPINFO_CF_POLLABLE       0x0004
+#define IEEE80211_CAPINFO_CF_POLLREQ        0x0008
+#define IEEE80211_CAPINFO_PRIVACY           0x0010
+#define IEEE80211_CAPINFO_SHORT_PREAMBLE    0x0020
+#define IEEE80211_CAPINFO_PBCC              0x0040
+#define IEEE80211_CAPINFO_CHNL_AGILITY      0x0080
+/* bits 8-9 are reserved */
+#define IEEE80211_CAPINFO_SHORT_SLOTTIME    0x0400
+#define IEEE80211_CAPINFO_APSD              0x0800
+/* bit 12 is reserved */
+#define IEEE80211_CAPINFO_DSSSOFDM          0x2000
+/* bits 14-15 are reserved */
+
+/*
+ * Authentication Modes
+ */
+
+enum ieee80211_authmode {
+    IEEE80211_AUTH_NONE     = 0,
+    IEEE80211_AUTH_OPEN     = 1,
+    IEEE80211_AUTH_SHARED   = 2,
+    IEEE80211_AUTH_8021X    = 3,
+    IEEE80211_AUTH_AUTO     = 4,   /* auto-select/accept */
+    /* NB: these are used only for ioctls */
+    IEEE80211_AUTH_WPA      = 5,  /* WPA/RSN  w/ 802.1x */
+    IEEE80211_AUTH_WPA_PSK  = 6,  /* WPA/RSN  w/ PSK */
+    IEEE80211_AUTH_WPA_CCKM = 7,  /* WPA/RSN IE  w/ CCKM */
+};
+
+#define IEEE80211_PS_MAX_QUEUE    50 /*Maximum no of buffers that can be queues for PS*/
+
+#endif /* _NET80211_IEEE80211_H_ */
diff --git a/drivers/staging/ath6kl/wlan/include/ieee80211_node.h b/drivers/staging/ath6kl/wlan/include/ieee80211_node.h
new file mode 100644
index 00000000000..1cb01671c0d
--- /dev/null
+++ b/drivers/staging/ath6kl/wlan/include/ieee80211_node.h
@@ -0,0 +1,93 @@
+//------------------------------------------------------------------------------
+// <copyright file="ieee80211_node.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _IEEE80211_NODE_H_
+#define _IEEE80211_NODE_H_
+
+/*
+ * Node locking definitions.
+ */
+#define IEEE80211_NODE_LOCK_INIT(_nt)   A_MUTEX_INIT(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_LOCK_DESTROY(_nt) if (A_IS_MUTEX_VALID(&(_nt)->nt_nodelock)) { \
+                                               A_MUTEX_DELETE(&(_nt)->nt_nodelock); }
+       
+#define IEEE80211_NODE_LOCK(_nt)        A_MUTEX_LOCK(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_UNLOCK(_nt)      A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_LOCK_BH(_nt)     A_MUTEX_LOCK(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_UNLOCK_BH(_nt)   A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_LOCK_ASSERT(_nt)
+
+/*
+ * Node reference counting definitions.
+ *
+ * ieee80211_node_initref   initialize the reference count to 1
+ * ieee80211_node_incref    add a reference
+ * ieee80211_node_decref    remove a reference
+ * ieee80211_node_dectestref    remove a reference and return 1 if this
+ *              is the last reference, otherwise 0
+ * ieee80211_node_refcnt    reference count for printing (only)
+ */
+#define ieee80211_node_initref(_ni)     ((_ni)->ni_refcnt = 1)
+#define ieee80211_node_incref(_ni)      ((_ni)->ni_refcnt++)
+#define ieee80211_node_decref(_ni)      ((_ni)->ni_refcnt--)
+#define ieee80211_node_dectestref(_ni)  (((_ni)->ni_refcnt--) == 1)
+#define ieee80211_node_refcnt(_ni)      ((_ni)->ni_refcnt)
+
+#define IEEE80211_NODE_HASHSIZE 32
+/* simple hash is enough for variation of macaddr */
+#define IEEE80211_NODE_HASH(addr)   \
+    (((const u8 *)(addr))[IEEE80211_ADDR_LEN - 1] % \
+        IEEE80211_NODE_HASHSIZE)
+
+/*
+ * Table of ieee80211_node instances.  Each ieee80211com
+ * has at least one for holding the scan candidates.
+ * When operating as an access point or in ibss mode there
+ * is a second table for associated stations or neighbors.
+ */
+struct ieee80211_node_table {
+    void                   *nt_wmip;       /* back reference */
+    A_MUTEX_T               nt_nodelock;    /* on node table */
+    struct bss              *nt_node_first; /* information of all nodes */
+    struct bss              *nt_node_last;  /* information of all nodes */
+    struct bss              *nt_hash[IEEE80211_NODE_HASHSIZE];
+    const char              *nt_name;   /* for debugging */
+    u32 nt_scangen; /* gen# for timeout scan */
+#ifdef THREAD_X
+    A_TIMER                 nt_inact_timer;
+    u8 isTimerArmed;   /* is the node timer armed */
+#endif
+    u32 nt_nodeAge; /* node aging time */
+#ifdef OS_ROAM_MANAGEMENT
+    u32 nt_si_gen; /* gen# for scan indication*/
+#endif
+};
+
+#ifdef THREAD_X
+#define WLAN_NODE_INACT_TIMEOUT_MSEC            20000
+#else
+#define WLAN_NODE_INACT_TIMEOUT_MSEC            120000
+#endif
+   
+#define WLAN_NODE_INACT_CNT            4
+
+#endif /* _IEEE80211_NODE_H_ */
diff --git a/drivers/staging/ath6kl/wlan/src/wlan_node.c b/drivers/staging/ath6kl/wlan/src/wlan_node.c
new file mode 100644
index 00000000000..0fe5f4b1346
--- /dev/null
+++ b/drivers/staging/ath6kl/wlan/src/wlan_node.c
@@ -0,0 +1,636 @@
+//------------------------------------------------------------------------------
+// <copyright file="wlan_node.c" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// IEEE 802.11 node handling support.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#include <a_config.h>
+#include <athdefs.h>
+#include <a_osapi.h>
+#define ATH_MODULE_NAME wlan
+#include <a_debug.h>
+#include "htc.h"
+#include "htc_api.h"
+#include <wmi.h>
+#include <ieee80211.h>
+#include <wlan_api.h>
+#include <wmi_api.h>
+#include <ieee80211_node.h>
+
+#define ATH_DEBUG_WLAN ATH_DEBUG_MAKE_MODULE_MASK(0)
+
+#ifdef ATH_DEBUG_MODULE
+
+static struct ath_debug_mask_description wlan_debug_desc[] = {
+    { ATH_DEBUG_WLAN , "General WLAN Node Tracing"},
+};
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(wlan,
+                                 "wlan",
+                                 "WLAN Node Management",
+                                 ATH_DEBUG_MASK_DEFAULTS,
+                                 ATH_DEBUG_DESCRIPTION_COUNT(wlan_debug_desc),
+                                 wlan_debug_desc);
+                                 
+#endif
+
+#ifdef THREAD_X
+static void wlan_node_timeout(unsigned long arg);
+#endif
+
+static bss_t * _ieee80211_find_node (struct ieee80211_node_table *nt,
+                                     const u8 *macaddr);
+
+bss_t *
+wlan_node_alloc(struct ieee80211_node_table *nt, int wh_size)
+{
+    bss_t *ni;
+
+    ni = A_MALLOC_NOWAIT(sizeof(bss_t));
+
+    if (ni != NULL) {
+        if (wh_size)
+        {
+        ni->ni_buf = A_MALLOC_NOWAIT(wh_size);
+        if (ni->ni_buf == NULL) {
+            kfree(ni);
+            ni = NULL;
+            return ni;
+        }
+        }
+    } else {
+        return ni;
+    }
+
+    /* Make sure our lists are clean */
+    ni->ni_list_next = NULL;
+    ni->ni_list_prev = NULL;
+    ni->ni_hash_next = NULL;
+    ni->ni_hash_prev = NULL;
+
+    //
+    // ni_scangen never initialized before and during suspend/resume of winmobile,
+    // that some junk has been stored in this, due to this scan list didn't properly updated
+    //
+    ni->ni_scangen   = 0;
+
+#ifdef OS_ROAM_MANAGEMENT
+    ni->ni_si_gen    = 0;
+#endif
+
+    return ni;
+}
+
+void
+wlan_node_free(bss_t *ni)
+{
+    if (ni->ni_buf != NULL) {
+        kfree(ni->ni_buf);
+    }
+    kfree(ni);
+}
+
+void
+wlan_setup_node(struct ieee80211_node_table *nt, bss_t *ni,
+                const u8 *macaddr)
+{
+    int hash;
+    u32 timeoutValue = 0;
+
+    memcpy(ni->ni_macaddr, macaddr, IEEE80211_ADDR_LEN);
+    hash = IEEE80211_NODE_HASH (macaddr);
+    ieee80211_node_initref (ni);     /* mark referenced */
+
+    timeoutValue = nt->nt_nodeAge;
+
+    ni->ni_tstamp = A_GET_MS (0);
+    ni->ni_actcnt = WLAN_NODE_INACT_CNT;
+
+    IEEE80211_NODE_LOCK_BH(nt);
+
+    /* Insert at the end of the node list */
+    ni->ni_list_next = NULL;
+    ni->ni_list_prev = nt->nt_node_last;
+    if(nt->nt_node_last != NULL)
+    {
+        nt->nt_node_last->ni_list_next = ni;
+    }
+    nt->nt_node_last = ni;
+    if(nt->nt_node_first == NULL)
+    {
+        nt->nt_node_first = ni;
+    }
+
+    /* Insert into the hash list i.e. the bucket */
+    if((ni->ni_hash_next = nt->nt_hash[hash]) != NULL)
+    {
+        nt->nt_hash[hash]->ni_hash_prev = ni;
+    }
+    ni->ni_hash_prev = NULL;
+    nt->nt_hash[hash] = ni;
+
+#ifdef THREAD_X
+    if (!nt->isTimerArmed) {
+        A_TIMEOUT_MS(&nt->nt_inact_timer, timeoutValue, 0);
+        nt->isTimerArmed = true;
+    }
+#endif
+
+    IEEE80211_NODE_UNLOCK_BH(nt);
+}
+
+static bss_t *
+_ieee80211_find_node(struct ieee80211_node_table *nt,
+    const u8 *macaddr)
+{
+    bss_t *ni;
+    int hash;
+
+    IEEE80211_NODE_LOCK_ASSERT(nt);
+
+    hash = IEEE80211_NODE_HASH(macaddr);
+    for(ni = nt->nt_hash[hash]; ni; ni = ni->ni_hash_next) {
+        if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
+            ieee80211_node_incref(ni);  /* mark referenced */
+            return ni;
+        }
+    }
+    return NULL;
+}
+
+bss_t *
+wlan_find_node(struct ieee80211_node_table *nt, const u8 *macaddr)
+{
+    bss_t *ni;
+
+    IEEE80211_NODE_LOCK(nt);
+    ni = _ieee80211_find_node(nt, macaddr);
+    IEEE80211_NODE_UNLOCK(nt);
+    return ni;
+}
+
+/*
+ * Reclaim a node.  If this is the last reference count then
+ * do the normal free work.  Otherwise remove it from the node
+ * table and mark it gone by clearing the back-reference.
+ */
+void
+wlan_node_reclaim(struct ieee80211_node_table *nt, bss_t *ni)
+{
+    IEEE80211_NODE_LOCK(nt);
+
+    if(ni->ni_list_prev == NULL)
+    {
+        /* First in list so fix the list head */
+        nt->nt_node_first = ni->ni_list_next;
+    }
+    else
+    {
+        ni->ni_list_prev->ni_list_next = ni->ni_list_next;
+    }
+
+    if(ni->ni_list_next == NULL)
+    {
+        /* Last in list so fix list tail */
+        nt->nt_node_last = ni->ni_list_prev;
+    }
+    else
+    {
+        ni->ni_list_next->ni_list_prev = ni->ni_list_prev;
+    }
+
+    if(ni->ni_hash_prev == NULL)
+    {
+        /* First in list so fix the list head */
+        int hash;
+        hash = IEEE80211_NODE_HASH(ni->ni_macaddr);
+        nt->nt_hash[hash] = ni->ni_hash_next;
+    }
+    else
+    {
+        ni->ni_hash_prev->ni_hash_next = ni->ni_hash_next;
+    }
+
+    if(ni->ni_hash_next != NULL)
+    {
+        ni->ni_hash_next->ni_hash_prev = ni->ni_hash_prev;
+    }
+    wlan_node_free(ni);
+
+    IEEE80211_NODE_UNLOCK(nt);
+}
+
+static void
+wlan_node_dec_free(bss_t *ni)
+{
+    if (ieee80211_node_dectestref(ni)) {
+        wlan_node_free(ni);
+    }
+}
+
+void
+wlan_free_allnodes(struct ieee80211_node_table *nt)
+{
+    bss_t *ni;
+
+    while ((ni = nt->nt_node_first) != NULL) {
+        wlan_node_reclaim(nt, ni);
+    }
+}
+
+void
+wlan_iterate_nodes(struct ieee80211_node_table *nt, wlan_node_iter_func *f,
+                   void *arg)
+{
+    bss_t *ni;
+    u32 gen;
+
+    gen = ++nt->nt_scangen;
+
+    IEEE80211_NODE_LOCK(nt);
+    for (ni = nt->nt_node_first; ni; ni = ni->ni_list_next) {
+        if (ni->ni_scangen != gen) {
+            ni->ni_scangen = gen;
+            (void) ieee80211_node_incref(ni);
+            (*f)(arg, ni);
+            wlan_node_dec_free(ni);
+        }
+    }
+    IEEE80211_NODE_UNLOCK(nt);
+}
+
+/*
+ * Node table support.
+ */
+void
+wlan_node_table_init(void *wmip, struct ieee80211_node_table *nt)
+{
+    int i;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN, ("node table = 0x%lx\n", (unsigned long)nt));
+    IEEE80211_NODE_LOCK_INIT(nt);
+
+    A_REGISTER_MODULE_DEBUG_INFO(wlan);
+    
+    nt->nt_node_first = nt->nt_node_last = NULL;
+    for(i = 0; i < IEEE80211_NODE_HASHSIZE; i++)
+    {
+        nt->nt_hash[i] = NULL;
+    }
+
+#ifdef THREAD_X
+    A_INIT_TIMER(&nt->nt_inact_timer, wlan_node_timeout, nt);
+    nt->isTimerArmed = false;
+#endif
+    nt->nt_wmip = wmip;
+    nt->nt_nodeAge = WLAN_NODE_INACT_TIMEOUT_MSEC;
+
+    //
+    // nt_scangen never initialized before and during suspend/resume of winmobile, 
+    // that some junk has been stored in this, due to this scan list didn't properly updated
+    //
+    nt->nt_scangen   = 0;
+
+#ifdef OS_ROAM_MANAGEMENT
+    nt->nt_si_gen    = 0;
+#endif
+}
+
+void
+wlan_set_nodeage(struct ieee80211_node_table *nt, u32 nodeAge)
+{
+    nt->nt_nodeAge = nodeAge;
+    return;
+}
+void
+wlan_refresh_inactive_nodes (struct ieee80211_node_table *nt)
+{
+#ifdef THREAD_X
+    bss_t *bss, *nextBss;
+    u8 myBssid[IEEE80211_ADDR_LEN], reArmTimer = false;
+
+    wmi_get_current_bssid(nt->nt_wmip, myBssid);
+
+    bss = nt->nt_node_first;
+    while (bss != NULL)
+    {
+        nextBss = bss->ni_list_next;
+        if (memcmp(myBssid, bss->ni_macaddr, sizeof(myBssid)) != 0)
+        {
+               /*
+                * free up all but the current bss - if set
+                */
+                wlan_node_reclaim(nt, bss);
+
+        }
+        bss = nextBss;
+    }
+#else
+    bss_t *bss, *nextBss;
+    u8 myBssid[IEEE80211_ADDR_LEN];
+    u32 timeoutValue = 0;
+    u32 now = A_GET_MS(0);
+    timeoutValue = nt->nt_nodeAge;
+
+    wmi_get_current_bssid(nt->nt_wmip, myBssid);
+
+    bss = nt->nt_node_first;
+    while (bss != NULL)
+    {
+        nextBss = bss->ni_list_next;
+        if (memcmp(myBssid, bss->ni_macaddr, sizeof(myBssid)) != 0)
+        {
+
+            if (((now - bss->ni_tstamp) > timeoutValue)  || --bss->ni_actcnt == 0)
+            {
+               /*
+                * free up all but the current bss - if set
+                */
+                wlan_node_reclaim(nt, bss);
+            }
+        }
+        bss = nextBss;
+    }
+#endif
+}
+
+#ifdef THREAD_X
+static void
+wlan_node_timeout (unsigned long arg)
+{
+    struct ieee80211_node_table *nt = (struct ieee80211_node_table *)arg;
+    bss_t *bss, *nextBss;
+    u8 myBssid[IEEE80211_ADDR_LEN], reArmTimer = false;
+    u32 timeoutValue = 0;
+    u32 now = A_GET_MS(0);
+
+    timeoutValue = nt->nt_nodeAge;
+
+    wmi_get_current_bssid(nt->nt_wmip, myBssid);
+
+    bss = nt->nt_node_first;
+    while (bss != NULL)
+    {
+        nextBss = bss->ni_list_next;
+        if (memcmp(myBssid, bss->ni_macaddr, sizeof(myBssid)) != 0)
+        {
+
+            if ((now - bss->ni_tstamp) > timeoutValue)
+            {
+               /*
+                * free up all but the current bss - if set
+                */
+                wlan_node_reclaim(nt, bss);
+            }
+            else
+            {
+                /*
+                 * Re-arm timer, only when we have a bss other than
+                 * current bss AND it is not aged-out.
+                 */
+                reArmTimer = true;
+            }
+        }
+        bss = nextBss;
+    }
+
+    if (reArmTimer)
+        A_TIMEOUT_MS (&nt->nt_inact_timer, timeoutValue, 0);
+
+    nt->isTimerArmed = reArmTimer;
+}
+#endif
+
+void
+wlan_node_table_cleanup(struct ieee80211_node_table *nt)
+{
+#ifdef THREAD_X
+    A_UNTIMEOUT(&nt->nt_inact_timer);
+    A_DELETE_TIMER(&nt->nt_inact_timer);
+#endif
+    wlan_free_allnodes(nt);
+    IEEE80211_NODE_LOCK_DESTROY(nt);
+}
+
+bss_t *
+wlan_find_Ssidnode (struct ieee80211_node_table *nt, u8 *pSsid,
+                    u32 ssidLength, bool bIsWPA2, bool bMatchSSID)
+{
+    bss_t   *ni = NULL;
+    u8 *pIESsid = NULL;
+
+    IEEE80211_NODE_LOCK (nt);
+
+    for (ni = nt->nt_node_first; ni; ni = ni->ni_list_next) {
+        pIESsid = ni->ni_cie.ie_ssid;
+        if (pIESsid[1] <= 32) {
+
+            // Step 1 : Check SSID
+            if (0x00 == memcmp (pSsid, &pIESsid[2], ssidLength)) {
+
+                //
+                // Step 2.1 : Check MatchSSID is true, if so, return Matched SSID
+                // Profile, otherwise check whether WPA2 or WPA
+                //
+                if (true == bMatchSSID) {
+                    ieee80211_node_incref (ni);  /* mark referenced */
+                    IEEE80211_NODE_UNLOCK (nt);
+                    return ni;
+                }
+
+                // Step 2 : if SSID matches, check WPA or WPA2
+                if (true == bIsWPA2 && NULL != ni->ni_cie.ie_rsn) {
+                    ieee80211_node_incref (ni);  /* mark referenced */
+                    IEEE80211_NODE_UNLOCK (nt);
+                    return ni;
+                }
+                if (false == bIsWPA2 && NULL != ni->ni_cie.ie_wpa) {
+                    ieee80211_node_incref(ni);  /* mark referenced */
+                    IEEE80211_NODE_UNLOCK (nt);
+                    return ni;
+                }
+            }
+        }
+    }
+
+    IEEE80211_NODE_UNLOCK (nt);
+
+    return NULL;
+}
+
+void
+wlan_node_return (struct ieee80211_node_table *nt, bss_t *ni)
+{
+    IEEE80211_NODE_LOCK (nt);
+    wlan_node_dec_free (ni);
+    IEEE80211_NODE_UNLOCK (nt);
+}
+
+void
+wlan_node_remove_core (struct ieee80211_node_table *nt, bss_t *ni)
+{
+    if(ni->ni_list_prev == NULL)
+    {
+        /* First in list so fix the list head */
+        nt->nt_node_first = ni->ni_list_next;
+    }
+    else
+    {
+        ni->ni_list_prev->ni_list_next = ni->ni_list_next;
+    }
+
+    if(ni->ni_list_next == NULL)
+    {
+        /* Last in list so fix list tail */
+        nt->nt_node_last = ni->ni_list_prev;
+    }
+    else
+    {
+        ni->ni_list_next->ni_list_prev = ni->ni_list_prev;
+    }
+
+    if(ni->ni_hash_prev == NULL)
+    {
+        /* First in list so fix the list head */
+        int hash;
+        hash = IEEE80211_NODE_HASH(ni->ni_macaddr);
+        nt->nt_hash[hash] = ni->ni_hash_next;
+    }
+    else
+    {
+        ni->ni_hash_prev->ni_hash_next = ni->ni_hash_next;
+    }
+
+    if(ni->ni_hash_next != NULL)
+    {
+        ni->ni_hash_next->ni_hash_prev = ni->ni_hash_prev;
+    }
+}
+
+bss_t *
+wlan_node_remove(struct ieee80211_node_table *nt, u8 *bssid)
+{
+    bss_t *bss, *nextBss;
+
+    IEEE80211_NODE_LOCK(nt);
+
+    bss = nt->nt_node_first;
+
+    while (bss != NULL)
+    {
+        nextBss = bss->ni_list_next;
+
+        if (memcmp(bssid, bss->ni_macaddr, 6) == 0)
+        {
+            wlan_node_remove_core (nt, bss);
+            IEEE80211_NODE_UNLOCK(nt);
+            return bss;
+        }
+
+        bss = nextBss;
+    }
+
+    IEEE80211_NODE_UNLOCK(nt);
+    return NULL;
+}
+
+bss_t *
+wlan_find_matching_Ssidnode (struct ieee80211_node_table *nt, u8 *pSsid,
+                    u32 ssidLength, u32 dot11AuthMode, u32 authMode,
+                   u32 pairwiseCryptoType, u32 grpwiseCryptoTyp)
+{
+    bss_t   *ni = NULL;
+    bss_t   *best_ni = NULL;
+    u8 *pIESsid = NULL;
+
+    IEEE80211_NODE_LOCK (nt);
+
+    for (ni = nt->nt_node_first; ni; ni = ni->ni_list_next) {
+        pIESsid = ni->ni_cie.ie_ssid;
+        if (pIESsid[1] <= 32) {
+
+            // Step 1 : Check SSID
+            if (0x00 == memcmp (pSsid, &pIESsid[2], ssidLength)) {
+
+                if (ni->ni_cie.ie_capInfo & 0x10)
+                {
+
+                    if ((NULL != ni->ni_cie.ie_rsn) && (WPA2_PSK_AUTH == authMode))
+                    {
+                        /* WPA2 */
+                        if (NULL == best_ni)
+                        {
+                            best_ni = ni;
+                        }
+                        else if (ni->ni_rssi > best_ni->ni_rssi)
+                        {
+                            best_ni = ni;
+                        }
+                    }
+                    else if ((NULL != ni->ni_cie.ie_wpa) && (WPA_PSK_AUTH == authMode))
+                    {
+                        /* WPA */
+                        if (NULL == best_ni)
+                        {
+                            best_ni = ni;
+                        }
+                        else if (ni->ni_rssi > best_ni->ni_rssi)
+                        {
+                            best_ni = ni;
+                        }
+                    }
+                    else if (WEP_CRYPT == pairwiseCryptoType)
+                    {
+                        /* WEP */
+                        if (NULL == best_ni)
+                        {
+                            best_ni = ni;
+                        }
+                        else if (ni->ni_rssi > best_ni->ni_rssi)
+                        {
+                            best_ni = ni;
+                        }
+                    }
+                }
+                else
+                {
+                    /* open AP */
+                    if ((OPEN_AUTH == authMode) && (NONE_CRYPT == pairwiseCryptoType))
+                    {
+                        if (NULL == best_ni)
+                        {
+                            best_ni = ni;
+                        }
+                        else if (ni->ni_rssi > best_ni->ni_rssi)
+                        {
+                            best_ni = ni;
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    IEEE80211_NODE_UNLOCK (nt);
+
+    return best_ni;
+}
+
diff --git a/drivers/staging/ath6kl/wlan/src/wlan_recv_beacon.c b/drivers/staging/ath6kl/wlan/src/wlan_recv_beacon.c
new file mode 100644
index 00000000000..07b8313b16e
--- /dev/null
+++ b/drivers/staging/ath6kl/wlan/src/wlan_recv_beacon.c
@@ -0,0 +1,199 @@
+//------------------------------------------------------------------------------
+// <copyright file="wlan_recv_beacon.c" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// IEEE 802.11 input handling.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_osapi.h"
+#include <wmi.h>
+#include <ieee80211.h>
+#include <wlan_api.h>
+
+#define IEEE80211_VERIFY_LENGTH(_len, _minlen) do {         \
+    if ((_len) < (_minlen)) {                   \
+        return A_EINVAL;                         \
+    }                               \
+} while (0)
+
+#define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do {         \
+    if ((__elem) == NULL) {                     \
+        return A_EINVAL;                         \
+    }                               \
+    if ((__elem)[1] > (__maxlen)) {                 \
+        return A_EINVAL;                         \
+    }                               \
+} while (0)
+
+
+/* unaligned little endian access */
+#define LE_READ_2(p)                            \
+    ((u16)                            \
+     ((((u8 *)(p))[0]      ) | (((u8 *)(p))[1] <<  8)))
+
+#define LE_READ_4(p)                            \
+    ((u32)                            \
+     ((((u8 *)(p))[0]      ) | (((u8 *)(p))[1] <<  8) | \
+      (((u8 *)(p))[2] << 16) | (((u8 *)(p))[3] << 24)))
+
+
+static int __inline
+iswpaoui(const u8 *frm)
+{
+    return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
+}
+
+static int __inline
+iswmmoui(const u8 *frm)
+{
+    return frm[1] > 3 && LE_READ_4(frm+2) == ((WMM_OUI_TYPE<<24)|WMM_OUI);
+}
+
+/* unused functions for now */
+#if 0
+static int __inline
+iswmmparam(const u8 *frm)
+{
+    return frm[1] > 5 && frm[6] == WMM_PARAM_OUI_SUBTYPE;
+}
+
+static int __inline
+iswmminfo(const u8 *frm)
+{
+    return frm[1] > 5 && frm[6] == WMM_INFO_OUI_SUBTYPE;
+}
+#endif
+
+static int __inline
+isatherosoui(const u8 *frm)
+{
+    return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
+}
+
+static int __inline
+iswscoui(const u8 *frm)
+{
+    return frm[1] > 3 && LE_READ_4(frm+2) == ((0x04<<24)|WPA_OUI);
+}
+
+int
+wlan_parse_beacon(u8 *buf, int framelen, struct ieee80211_common_ie *cie)
+{
+    u8 *frm, *efrm;
+    u8 elemid_ssid = false;
+
+    frm = buf;
+    efrm = (u8 *) (frm + framelen);
+
+    /*
+     * beacon/probe response frame format
+     *  [8] time stamp
+     *  [2] beacon interval
+     *  [2] capability information
+     *  [tlv] ssid
+     *  [tlv] supported rates
+     *  [tlv] country information
+     *  [tlv] parameter set (FH/DS)
+     *  [tlv] erp information
+     *  [tlv] extended supported rates
+     *  [tlv] WMM
+     *  [tlv] WPA or RSN
+     *  [tlv] Atheros Advanced Capabilities
+     */
+    IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
+    A_MEMZERO(cie, sizeof(*cie));
+
+    cie->ie_tstamp = frm; frm += 8;
+    cie->ie_beaconInt = A_LE2CPU16(*(u16 *)frm);  frm += 2;
+    cie->ie_capInfo = A_LE2CPU16(*(u16 *)frm);  frm += 2;
+    cie->ie_chan = 0;
+
+    while (frm < efrm) {
+        switch (*frm) {
+        case IEEE80211_ELEMID_SSID:
+            if (!elemid_ssid) {
+                cie->ie_ssid = frm;
+                elemid_ssid = true;
+            }
+            break;
+        case IEEE80211_ELEMID_RATES:
+            cie->ie_rates = frm;
+            break;
+        case IEEE80211_ELEMID_COUNTRY:
+            cie->ie_country = frm;
+            break;
+        case IEEE80211_ELEMID_FHPARMS:
+            break;
+        case IEEE80211_ELEMID_DSPARMS:
+            cie->ie_chan = frm[2];
+            break;
+        case IEEE80211_ELEMID_TIM:
+            cie->ie_tim = frm;
+            break;
+        case IEEE80211_ELEMID_IBSSPARMS:
+            break;
+        case IEEE80211_ELEMID_XRATES:
+            cie->ie_xrates = frm;
+            break;
+        case IEEE80211_ELEMID_ERP:
+            if (frm[1] != 1) {
+                //A_PRINTF("Discarding ERP Element - Bad Len\n");
+                return A_EINVAL;
+            }
+            cie->ie_erp = frm[2];
+            break;
+        case IEEE80211_ELEMID_RSN:
+            cie->ie_rsn = frm;
+            break;
+        case IEEE80211_ELEMID_HTCAP_ANA:
+            cie->ie_htcap = frm;
+            break;
+        case IEEE80211_ELEMID_HTINFO_ANA:
+            cie->ie_htop = frm;
+            break;
+#ifdef WAPI_ENABLE
+                case IEEE80211_ELEMID_WAPI:
+            cie->ie_wapi = frm;
+            break;
+#endif
+        case IEEE80211_ELEMID_VENDOR:
+            if (iswpaoui(frm)) {
+                cie->ie_wpa = frm;
+            } else if (iswmmoui(frm)) {
+                cie->ie_wmm = frm;
+            } else if (isatherosoui(frm)) {
+                cie->ie_ath = frm;
+            } else if(iswscoui(frm)) {
+                cie->ie_wsc = frm;
+            }
+            break;
+        default:
+            break;
+        }
+        frm += frm[1] + 2;
+    }
+    IEEE80211_VERIFY_ELEMENT(cie->ie_rates, IEEE80211_RATE_MAXSIZE);
+    IEEE80211_VERIFY_ELEMENT(cie->ie_ssid, IEEE80211_NWID_LEN);
+
+    return 0;
+}
diff --git a/drivers/staging/ath6kl/wlan/src/wlan_utils.c b/drivers/staging/ath6kl/wlan/src/wlan_utils.c
new file mode 100644
index 00000000000..bc91599d9bf
--- /dev/null
+++ b/drivers/staging/ath6kl/wlan/src/wlan_utils.c
@@ -0,0 +1,58 @@
+//------------------------------------------------------------------------------
+// <copyright file="wlan_utils.c" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This module implements frequently used wlan utilies
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#include <a_config.h>
+#include <athdefs.h>
+#include <a_osapi.h>
+
+/*
+ * converts ieee channel number to frequency
+ */
+u16 wlan_ieee2freq(int chan)
+{
+    if (chan == 14) {
+        return 2484;
+    }
+    if (chan < 14) {    /* 0-13 */
+        return (2407 + (chan*5));
+    }
+    if (chan < 27) {    /* 15-26 */
+        return (2512 + ((chan-15)*20));
+    }
+    return (5000 + (chan*5));
+}
+
+/*
+ * Converts MHz frequency to IEEE channel number.
+ */
+u32 wlan_freq2ieee(u16 freq)
+{
+    if (freq == 2484)
+        return 14;
+    if (freq < 2484)
+        return (freq - 2407) / 5;
+    if (freq < 5000)
+        return 15 + ((freq - 2512) / 20);
+    return (freq - 5000) / 5;
+}
diff --git a/drivers/staging/ath6kl/wmi/wmi.c b/drivers/staging/ath6kl/wmi/wmi.c
new file mode 100644
index 00000000000..c7b5e5cf9df
--- /dev/null
+++ b/drivers/staging/ath6kl/wmi/wmi.c
@@ -0,0 +1,6444 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This module implements the hardware independent layer of the
+// Wireless Module Interface (WMI) protocol.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include <a_config.h>
+#include <athdefs.h>
+#include <a_osapi.h>
+#include "htc.h"
+#include "htc_api.h"
+#include "wmi.h"
+#include <wlan_api.h>
+#include <wmi_api.h>
+#include <ieee80211.h>
+#include <ieee80211_node.h>
+#include "dset_api.h"
+#include "wmi_host.h"
+#include "a_drv.h"
+#include "a_drv_api.h"
+#define ATH_MODULE_NAME wmi
+#include "a_debug.h"
+#include "dbglog_api.h"
+#include "roaming.h"
+#include "cfg80211.h"
+
+#define ATH_DEBUG_WMI ATH_DEBUG_MAKE_MODULE_MASK(0)
+
+#ifdef ATH_DEBUG_MODULE
+
+static struct ath_debug_mask_description wmi_debug_desc[] = {
+    { ATH_DEBUG_WMI , "General WMI Tracing"},
+};
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(wmi,
+                                 "wmi",
+                                 "Wireless Module Interface",
+                                 ATH_DEBUG_MASK_DEFAULTS,
+                                 ATH_DEBUG_DESCRIPTION_COUNT(wmi_debug_desc),
+                                 wmi_debug_desc);
+
+#endif
+
+#ifndef REXOS
+#define DBGARG      _A_FUNCNAME_
+#define DBGFMT      "%s() : "
+#define DBG_WMI     ATH_DEBUG_WMI
+#define DBG_ERROR   ATH_DEBUG_ERR
+#define DBG_WMI2    ATH_DEBUG_WMI
+#define A_DPRINTF   AR_DEBUG_PRINTF
+#endif
+
+static int wmi_ready_event_rx(struct wmi_t *wmip, u8 *datap, int len);
+
+static int wmi_connect_event_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+static int wmi_disconnect_event_rx(struct wmi_t *wmip, u8 *datap,
+                                        int len);
+
+static int wmi_tkip_micerr_event_rx(struct wmi_t *wmip, u8 *datap,
+                                        int len);
+static int wmi_bssInfo_event_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+static int wmi_opt_frame_event_rx(struct wmi_t *wmip, u8 *datap,
+                                       int len);
+static int wmi_pstream_timeout_event_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+static int wmi_sync_point(struct wmi_t *wmip);
+
+static int wmi_bitrate_reply_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+static int wmi_ratemask_reply_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+static int wmi_channelList_reply_rx(struct wmi_t *wmip, u8 *datap,
+                                         int len);
+static int wmi_regDomain_event_rx(struct wmi_t *wmip, u8 *datap,
+                                       int len);
+static int wmi_txPwr_reply_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_neighborReport_event_rx(struct wmi_t *wmip, u8 *datap,
+                                             int len);
+
+static int wmi_dset_open_req_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+#ifdef CONFIG_HOST_DSET_SUPPORT
+static int wmi_dset_close_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_dset_data_req_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+#endif /* CONFIG_HOST_DSET_SUPPORT */
+
+
+static int wmi_scanComplete_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+static int wmi_errorEvent_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_statsEvent_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_rssiThresholdEvent_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_hbChallengeResp_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_reportErrorEvent_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_cac_event_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_channel_change_event_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_roam_tbl_event_rx(struct wmi_t *wmip, u8 *datap,
+                                      int len);
+static int wmi_roam_data_event_rx(struct wmi_t *wmip, u8 *datap,
+                                      int len);
+static int wmi_get_wow_list_event_rx(struct wmi_t *wmip, u8 *datap,
+                                      int len);
+static int
+wmi_get_pmkid_list_event_rx(struct wmi_t *wmip, u8 *datap, u32 len);
+
+static int
+wmi_set_params_event_rx(struct wmi_t *wmip, u8 *datap, u32 len);
+
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+static int
+wmi_tcmd_test_report_rx(struct wmi_t *wmip, u8 *datap, int len);
+#endif
+
+static int
+wmi_txRetryErrEvent_rx(struct wmi_t *wmip, u8 *datap, int len);
+
+static int
+wmi_snrThresholdEvent_rx(struct wmi_t *wmip, u8 *datap, int len);
+
+static int
+wmi_lqThresholdEvent_rx(struct wmi_t *wmip, u8 *datap, int len);
+
+static bool
+wmi_is_bitrate_index_valid(struct wmi_t *wmip, s32 rateIndex);
+
+static int
+wmi_aplistEvent_rx(struct wmi_t *wmip, u8 *datap, int len);
+
+static int
+wmi_dbglog_event_rx(struct wmi_t *wmip, u8 *datap, int len);
+
+static int wmi_keepalive_reply_rx(struct wmi_t *wmip, u8 *datap, int len);
+
+int wmi_cmd_send_xtnd(struct wmi_t *wmip, void *osbuf, WMIX_COMMAND_ID cmdId,
+                  WMI_SYNC_FLAG syncflag);
+
+u8 ar6000_get_upper_threshold(s16 rssi, SQ_THRESHOLD_PARAMS *sq_thresh, u32 size);
+u8 ar6000_get_lower_threshold(s16 rssi, SQ_THRESHOLD_PARAMS *sq_thresh, u32 size);
+
+void wmi_cache_configure_rssithreshold(struct wmi_t *wmip, WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd);
+void wmi_cache_configure_snrthreshold(struct wmi_t *wmip, WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd);
+static int wmi_send_rssi_threshold_params(struct wmi_t *wmip,
+                              WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd);
+static int wmi_send_snr_threshold_params(struct wmi_t *wmip,
+                             WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd);
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+static int
+wmi_prof_count_rx(struct wmi_t *wmip, u8 *datap, int len);
+#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
+
+static int wmi_pspoll_event_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+static int wmi_dtimexpiry_event_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+
+static int wmi_peer_node_event_rx (struct wmi_t *wmip, u8 *datap,
+                                        int len);
+static int wmi_addba_req_event_rx(struct wmi_t *, u8 *, int);
+static int wmi_addba_resp_event_rx(struct wmi_t *, u8 *, int);
+static int wmi_delba_req_event_rx(struct wmi_t *, u8 *, int);
+static int wmi_btcoex_config_event_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_btcoex_stats_event_rx(struct wmi_t *wmip, u8 *datap, int len);
+static int wmi_hci_event_rx(struct wmi_t *, u8 *, int);
+
+#ifdef WAPI_ENABLE
+static int wmi_wapi_rekey_event_rx(struct wmi_t *wmip, u8 *datap,
+                                     int len);
+#endif
+
+#if defined(UNDER_CE)
+#if defined(NDIS51_MINIPORT)
+unsigned int processDot11Hdr = 0;
+#else
+unsigned int processDot11Hdr = 1;
+#endif
+#else
+extern unsigned int processDot11Hdr;
+#endif
+
+int wps_enable;
+static const s32 wmi_rateTable[][2] = {
+  //{W/O SGI, with SGI}
+    {1000, 1000},
+    {2000, 2000},
+    {5500, 5500},
+    {11000, 11000},
+    {6000, 6000},
+    {9000, 9000},
+    {12000, 12000},
+    {18000, 18000},
+    {24000, 24000},
+    {36000, 36000},
+    {48000, 48000},
+    {54000, 54000},
+    {6500, 7200},
+    {13000, 14400},
+    {19500, 21700},
+    {26000, 28900},
+    {39000, 43300},
+    {52000, 57800},
+    {58500, 65000},
+    {65000, 72200},
+    {13500, 15000},
+    {27000, 30000},
+    {40500, 45000},
+    {54000, 60000},
+    {81000, 90000},
+    {108000, 120000},
+    {121500, 135000},
+    {135000, 150000},
+    {0, 0}};
+
+#define MODE_A_SUPPORT_RATE_START       ((s32) 4)
+#define MODE_A_SUPPORT_RATE_STOP        ((s32) 11)
+
+#define MODE_GONLY_SUPPORT_RATE_START   MODE_A_SUPPORT_RATE_START
+#define MODE_GONLY_SUPPORT_RATE_STOP    MODE_A_SUPPORT_RATE_STOP
+
+#define MODE_B_SUPPORT_RATE_START       ((s32) 0)
+#define MODE_B_SUPPORT_RATE_STOP        ((s32) 3)
+
+#define MODE_G_SUPPORT_RATE_START       ((s32) 0)
+#define MODE_G_SUPPORT_RATE_STOP        ((s32) 11)
+
+#define MODE_GHT20_SUPPORT_RATE_START   ((s32) 0)
+#define MODE_GHT20_SUPPORT_RATE_STOP    ((s32) 19)
+
+#define MAX_NUMBER_OF_SUPPORT_RATES     (MODE_GHT20_SUPPORT_RATE_STOP + 1)
+
+/* 802.1d to AC mapping. Refer pg 57 of WMM-test-plan-v1.2 */
+const u8 up_to_ac[]= {
+                WMM_AC_BE,
+                WMM_AC_BK,
+                WMM_AC_BK,
+                WMM_AC_BE,
+                WMM_AC_VI,
+                WMM_AC_VI,
+                WMM_AC_VO,
+                WMM_AC_VO,
+            };
+
+/* This stuff is used when we want a simple layer-3 visibility */
+typedef PREPACK struct _iphdr {
+    u8 ip_ver_hdrlen;          /* version and hdr length */
+    u8 ip_tos;                 /* type of service */
+    u16 ip_len;                 /* total length */
+    u16 ip_id;                  /* identification */
+    s16 ip_off;                 /* fragment offset field */
+#define IP_DF 0x4000                    /* dont fragment flag */
+#define IP_MF 0x2000                    /* more fragments flag */
+#define IP_OFFMASK 0x1fff               /* mask for fragmenting bits */
+    u8 ip_ttl;                 /* time to live */
+    u8 ip_p;                   /* protocol */
+    u16 ip_sum;                 /* checksum */
+    u8 ip_src[4];              /* source and dest address */
+    u8 ip_dst[4];
+} POSTPACK iphdr;
+
+static s16 rssi_event_value = 0;
+static s16 snr_event_value = 0;
+
+bool is_probe_ssid = false;
+
+void *
+wmi_init(void *devt)
+{
+    struct wmi_t *wmip;
+
+    A_REGISTER_MODULE_DEBUG_INFO(wmi);
+
+    wmip = A_MALLOC (sizeof(struct wmi_t));
+    if (wmip == NULL) {
+        return (NULL);
+    }
+    A_MEMZERO(wmip, sizeof(struct wmi_t ));
+#ifdef THREAD_X
+    INIT_WMI_LOCK(wmip);
+#else
+        A_MUTEX_INIT(&wmip->wmi_lock);
+#endif
+    wmip->wmi_devt = devt;
+    wlan_node_table_init(wmip, &wmip->wmi_scan_table);
+    wmi_qos_state_init(wmip);
+
+    wmip->wmi_powerMode = REC_POWER;
+    wmip->wmi_phyMode = WMI_11G_MODE;
+
+    wmip->wmi_pair_crypto_type  = NONE_CRYPT;
+    wmip->wmi_grp_crypto_type   = NONE_CRYPT;
+
+    wmip->wmi_ht_allowed[A_BAND_24GHZ] = 1;
+    wmip->wmi_ht_allowed[A_BAND_5GHZ] = 1;
+
+    return (wmip);
+}
+
+void
+wmi_qos_state_init(struct wmi_t *wmip)
+{
+    u8 i;
+
+    if (wmip == NULL) {
+        return;
+    }
+    LOCK_WMI(wmip);
+
+    /* Initialize QoS States */
+    wmip->wmi_numQoSStream = 0;
+
+    wmip->wmi_fatPipeExists = 0;
+
+    for (i=0; i < WMM_NUM_AC; i++) {
+        wmip->wmi_streamExistsForAC[i]=0;
+    }
+
+    UNLOCK_WMI(wmip);
+
+    A_WMI_SET_NUMDATAENDPTS(wmip->wmi_devt, 1);
+}
+
+void
+wmi_set_control_ep(struct wmi_t * wmip, HTC_ENDPOINT_ID eid)
+{
+    A_ASSERT( eid != ENDPOINT_UNUSED);
+    wmip->wmi_endpoint_id = eid;
+}
+
+HTC_ENDPOINT_ID
+wmi_get_control_ep(struct wmi_t * wmip)
+{
+    return(wmip->wmi_endpoint_id);
+}
+
+void
+wmi_shutdown(struct wmi_t *wmip)
+{
+    if (wmip != NULL) {
+        wlan_node_table_cleanup(&wmip->wmi_scan_table);
+        if (A_IS_MUTEX_VALID(&wmip->wmi_lock)) {
+#ifdef THREAD_X
+            DELETE_WMI_LOCK(&wmip);
+#else
+            A_MUTEX_DELETE(&wmip->wmi_lock);
+#endif
+        }
+        kfree(wmip);
+    }
+}
+
+/*
+ *  performs DIX to 802.3 encapsulation for transmit packets.
+ *  uses passed in buffer.  Returns buffer or NULL if failed.
+ *  Assumes the entire DIX header is contigous and that there is
+ *  enough room in the buffer for a 802.3 mac header and LLC+SNAP headers.
+ */
+int
+wmi_dix_2_dot3(struct wmi_t *wmip, void *osbuf)
+{
+    u8 *datap;
+    u16 typeorlen;
+    ATH_MAC_HDR      macHdr;
+    ATH_LLC_SNAP_HDR *llcHdr;
+
+    A_ASSERT(osbuf != NULL);
+
+    if (A_NETBUF_HEADROOM(osbuf) <
+        (sizeof(ATH_LLC_SNAP_HDR) + sizeof(WMI_DATA_HDR)))
+    {
+        return A_NO_MEMORY;
+    }
+
+    datap = A_NETBUF_DATA(osbuf);
+
+    typeorlen = *(u16 *)(datap + ATH_MAC_LEN + ATH_MAC_LEN);
+
+    if (!IS_ETHERTYPE(A_BE2CPU16(typeorlen))) {
+        /*
+         * packet is already in 802.3 format - return success
+         */
+        A_DPRINTF(DBG_WMI, (DBGFMT "packet already 802.3\n", DBGARG));
+        return (0);
+    }
+
+    /*
+     * Save mac fields and length to be inserted later
+     */
+    memcpy(macHdr.dstMac, datap, ATH_MAC_LEN);
+    memcpy(macHdr.srcMac, datap + ATH_MAC_LEN, ATH_MAC_LEN);
+    macHdr.typeOrLen = A_CPU2BE16(A_NETBUF_LEN(osbuf) - sizeof(ATH_MAC_HDR) +
+                                  sizeof(ATH_LLC_SNAP_HDR));
+
+    /*
+     * Make room for LLC+SNAP headers
+     */
+    if (A_NETBUF_PUSH(osbuf, sizeof(ATH_LLC_SNAP_HDR)) != 0) {
+        return A_NO_MEMORY;
+    }
+    datap = A_NETBUF_DATA(osbuf);
+
+    memcpy(datap, &macHdr, sizeof (ATH_MAC_HDR));
+
+    llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(ATH_MAC_HDR));
+    llcHdr->dsap      = 0xAA;
+    llcHdr->ssap      = 0xAA;
+    llcHdr->cntl      = 0x03;
+    llcHdr->orgCode[0] = 0x0;
+    llcHdr->orgCode[1] = 0x0;
+    llcHdr->orgCode[2] = 0x0;
+    llcHdr->etherType = typeorlen;
+
+    return (0);
+}
+
+int wmi_meta_add(struct wmi_t *wmip, void *osbuf, u8 *pVersion,void *pTxMetaS)
+{
+    switch(*pVersion){
+        case 0:
+                return (0);
+        case WMI_META_VERSION_1:
+                {
+                WMI_TX_META_V1     *pV1= NULL;
+                A_ASSERT(osbuf != NULL);
+                if (A_NETBUF_PUSH(osbuf, WMI_MAX_TX_META_SZ) != 0) {
+                        return A_NO_MEMORY;
+                }
+
+                pV1 = (WMI_TX_META_V1 *)A_NETBUF_DATA(osbuf);
+                /* the pktID is used in conjunction with txComplete messages
+                * allowing the target to notify which tx requests have been
+                * completed and how. */
+                pV1->pktID = 0;
+                /* the ratePolicyID allows the host to specify which rate policy
+                * to use for transmitting this packet. 0 means use default behavior. */
+                pV1->ratePolicyID = 0;
+                A_ASSERT(pVersion != NULL);
+                /* the version must be used to populate the meta field of the WMI_DATA_HDR */
+                *pVersion = WMI_META_VERSION_1;
+                return (0);
+                }
+        case WMI_META_VERSION_2:
+                {
+                WMI_TX_META_V2 *pV2 ;
+                A_ASSERT(osbuf != NULL);
+                if (A_NETBUF_PUSH(osbuf, WMI_MAX_TX_META_SZ) != 0) {
+                        return A_NO_MEMORY;
+                }
+                pV2 = (WMI_TX_META_V2 *)A_NETBUF_DATA(osbuf);
+                memcpy(pV2,(WMI_TX_META_V2 *)pTxMetaS,sizeof(WMI_TX_META_V2));
+                return (0);
+                }
+        default:
+                return (0);
+    }
+}
+
+/* Adds a WMI data header */
+int
+wmi_data_hdr_add(struct wmi_t *wmip, void *osbuf, u8 msgType, bool bMoreData,
+                    WMI_DATA_HDR_DATA_TYPE data_type,u8 metaVersion, void *pTxMetaS)
+{
+    WMI_DATA_HDR     *dtHdr;
+//    u8 metaVersion = 0;
+    int status;
+
+    A_ASSERT(osbuf != NULL);
+
+    /* adds the meta data field after the wmi data hdr. If metaVersion
+     * is returns 0 then no meta field was added. */
+    if ((status = wmi_meta_add(wmip, osbuf, &metaVersion,pTxMetaS)) != 0) {
+        return status;
+    }
+
+    if (A_NETBUF_PUSH(osbuf, sizeof(WMI_DATA_HDR)) != 0) {
+        return A_NO_MEMORY;
+    }
+
+    dtHdr = (WMI_DATA_HDR *)A_NETBUF_DATA(osbuf);
+    A_MEMZERO(dtHdr, sizeof(WMI_DATA_HDR));
+
+    WMI_DATA_HDR_SET_MSG_TYPE(dtHdr, msgType);
+    WMI_DATA_HDR_SET_DATA_TYPE(dtHdr, data_type);
+
+    if (bMoreData) {
+        WMI_DATA_HDR_SET_MORE_BIT(dtHdr);
+    }
+
+    WMI_DATA_HDR_SET_META(dtHdr, metaVersion);
+
+    dtHdr->info3 = 0;
+
+    return (0);
+}
+
+
+u8 wmi_implicit_create_pstream(struct wmi_t *wmip, void *osbuf, u32 layer2Priority, bool wmmEnabled)
+{
+    u8 *datap;
+    u8 trafficClass = WMM_AC_BE;
+    u16 ipType = IP_ETHERTYPE;
+    WMI_DATA_HDR    *dtHdr;
+    u8 streamExists = 0;
+    u8 userPriority;
+    u32 hdrsize, metasize;
+    ATH_LLC_SNAP_HDR    *llcHdr;
+
+    WMI_CREATE_PSTREAM_CMD  cmd;
+
+    A_ASSERT(osbuf != NULL);
+
+    //
+    // Initialize header size
+    //
+    hdrsize = 0;
+
+    datap = A_NETBUF_DATA(osbuf);
+    dtHdr = (WMI_DATA_HDR *)datap;
+    metasize = (WMI_DATA_HDR_GET_META(dtHdr))? WMI_MAX_TX_META_SZ : 0;
+
+    if (!wmmEnabled)
+    {
+            /* If WMM is disabled all traffic goes as BE traffic */
+        userPriority = 0;
+    }
+    else
+    {
+        if (processDot11Hdr)
+        {
+             hdrsize = A_ROUND_UP(sizeof(struct ieee80211_qosframe),sizeof(u32));
+             llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(WMI_DATA_HDR) + metasize +
+                          hdrsize);
+
+
+        }
+        else
+        {
+            llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(WMI_DATA_HDR) + metasize +
+                          sizeof(ATH_MAC_HDR));
+        }
+
+        if (llcHdr->etherType == A_CPU2BE16(ipType))
+        {
+            /* Extract the endpoint info from the TOS field in the IP header */
+
+            userPriority = wmi_determine_userPriority (((u8 *)llcHdr) + sizeof(ATH_LLC_SNAP_HDR),layer2Priority);
+        }
+        else
+        {
+            userPriority = layer2Priority & 0x7;
+        }
+    }
+
+
+    /* workaround for WMM S5 */
+    if ((WMM_AC_VI == wmip->wmi_traffic_class) && ((5 == userPriority) || (4 == userPriority)))
+    {
+        userPriority = 1;
+    }
+
+    trafficClass = convert_userPriority_to_trafficClass(userPriority);
+
+    WMI_DATA_HDR_SET_UP(dtHdr, userPriority);
+    /* lower 3-bits are 802.1d priority */
+    //dtHdr->info |= (userPriority & WMI_DATA_HDR_UP_MASK) << WMI_DATA_HDR_UP_SHIFT;
+
+    LOCK_WMI(wmip);
+    streamExists = wmip->wmi_fatPipeExists;
+    UNLOCK_WMI(wmip);
+
+    if (!(streamExists & (1 << trafficClass)))
+    {
+
+        A_MEMZERO(&cmd, sizeof(cmd));
+        cmd.trafficClass = trafficClass;
+        cmd.userPriority = userPriority;
+        cmd.inactivityInt = WMI_IMPLICIT_PSTREAM_INACTIVITY_INT;
+            /* Implicit streams are created with TSID 0xFF */
+
+        cmd.tsid = WMI_IMPLICIT_PSTREAM;
+        wmi_create_pstream_cmd(wmip, &cmd);
+    }
+
+    return trafficClass;
+}
+
+int
+wmi_dot11_hdr_add (struct wmi_t *wmip, void *osbuf, NETWORK_TYPE mode)
+{
+    u8 *datap;
+    u16 typeorlen;
+    ATH_MAC_HDR      macHdr;
+    ATH_LLC_SNAP_HDR *llcHdr;
+    struct           ieee80211_frame *wh;
+    u32 hdrsize;
+
+    A_ASSERT(osbuf != NULL);
+
+    if (A_NETBUF_HEADROOM(osbuf) <
+        (sizeof(struct ieee80211_qosframe) +  sizeof(ATH_LLC_SNAP_HDR) + sizeof(WMI_DATA_HDR)))
+    {
+        return A_NO_MEMORY;
+    }
+
+    datap = A_NETBUF_DATA(osbuf);
+
+    typeorlen = *(u16 *)(datap + ATH_MAC_LEN + ATH_MAC_LEN);
+
+    if (!IS_ETHERTYPE(A_BE2CPU16(typeorlen))) {
+/*
+         * packet is already in 802.3 format - return success
+         */
+        A_DPRINTF(DBG_WMI, (DBGFMT "packet already 802.3\n", DBGARG));
+        goto AddDot11Hdr;
+    }
+
+    /*
+     * Save mac fields and length to be inserted later
+     */
+    memcpy(macHdr.dstMac, datap, ATH_MAC_LEN);
+    memcpy(macHdr.srcMac, datap + ATH_MAC_LEN, ATH_MAC_LEN);
+    macHdr.typeOrLen = A_CPU2BE16(A_NETBUF_LEN(osbuf) - sizeof(ATH_MAC_HDR) +
+                                  sizeof(ATH_LLC_SNAP_HDR));
+
+    // Remove the Ethernet hdr
+    A_NETBUF_PULL(osbuf, sizeof(ATH_MAC_HDR));
+    /*
+     * Make room for LLC+SNAP headers
+     */
+    if (A_NETBUF_PUSH(osbuf, sizeof(ATH_LLC_SNAP_HDR)) != 0) {
+        return A_NO_MEMORY;
+    }
+    datap = A_NETBUF_DATA(osbuf);
+
+    llcHdr = (ATH_LLC_SNAP_HDR *)(datap);
+    llcHdr->dsap       = 0xAA;
+    llcHdr->ssap       = 0xAA;
+    llcHdr->cntl       = 0x03;
+    llcHdr->orgCode[0] = 0x0;
+    llcHdr->orgCode[1] = 0x0;
+    llcHdr->orgCode[2] = 0x0;
+    llcHdr->etherType  = typeorlen;
+
+AddDot11Hdr:
+    /* Make room for 802.11 hdr */
+    if (wmip->wmi_is_wmm_enabled)
+    {
+        hdrsize = A_ROUND_UP(sizeof(struct ieee80211_qosframe),sizeof(u32));
+        if (A_NETBUF_PUSH(osbuf, hdrsize) != 0)
+        {
+            return A_NO_MEMORY;
+        }
+        wh = (struct ieee80211_frame *) A_NETBUF_DATA(osbuf);
+        wh->i_fc[0] = IEEE80211_FC0_SUBTYPE_QOS;
+    }
+    else
+    {
+        hdrsize = A_ROUND_UP(sizeof(struct ieee80211_frame),sizeof(u32));
+        if (A_NETBUF_PUSH(osbuf, hdrsize) != 0)
+        {
+            return A_NO_MEMORY;
+        }
+        wh = (struct ieee80211_frame *) A_NETBUF_DATA(osbuf);
+        wh->i_fc[0] = IEEE80211_FC0_SUBTYPE_DATA;
+    }
+    /* Setup the SA & DA */
+    IEEE80211_ADDR_COPY(wh->i_addr2, macHdr.srcMac);
+
+    if (mode == INFRA_NETWORK) {
+        IEEE80211_ADDR_COPY(wh->i_addr3, macHdr.dstMac);
+    }
+    else if (mode == ADHOC_NETWORK) {
+        IEEE80211_ADDR_COPY(wh->i_addr1, macHdr.dstMac);
+    }
+
+    return (0);
+}
+
+int
+wmi_dot11_hdr_remove(struct wmi_t *wmip, void *osbuf)
+{
+    u8 *datap;
+    struct           ieee80211_frame *pwh,wh;
+    u8 type,subtype;
+    ATH_LLC_SNAP_HDR *llcHdr;
+    ATH_MAC_HDR      macHdr;
+    u32 hdrsize;
+
+    A_ASSERT(osbuf != NULL);
+    datap = A_NETBUF_DATA(osbuf);
+
+    pwh = (struct ieee80211_frame *)datap;
+    type = pwh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
+    subtype = pwh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+
+    memcpy((u8 *)&wh, datap, sizeof(struct ieee80211_frame));
+
+    /* strip off the 802.11 hdr*/
+    if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
+        hdrsize = A_ROUND_UP(sizeof(struct ieee80211_qosframe),sizeof(u32));
+        A_NETBUF_PULL(osbuf, hdrsize);
+    } else if (subtype == IEEE80211_FC0_SUBTYPE_DATA) {
+        A_NETBUF_PULL(osbuf, sizeof(struct ieee80211_frame));
+    }
+
+    datap = A_NETBUF_DATA(osbuf);
+    llcHdr = (ATH_LLC_SNAP_HDR *)(datap);
+
+    macHdr.typeOrLen = llcHdr->etherType;
+    A_MEMZERO(macHdr.dstMac, sizeof(macHdr.dstMac));
+    A_MEMZERO(macHdr.srcMac, sizeof(macHdr.srcMac));
+
+    switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
+    case IEEE80211_FC1_DIR_NODS:
+        IEEE80211_ADDR_COPY(macHdr.dstMac, wh.i_addr1);
+        IEEE80211_ADDR_COPY(macHdr.srcMac, wh.i_addr2);
+        break;
+    case IEEE80211_FC1_DIR_TODS:
+        IEEE80211_ADDR_COPY(macHdr.dstMac, wh.i_addr3);
+        IEEE80211_ADDR_COPY(macHdr.srcMac, wh.i_addr2);
+        break;
+    case IEEE80211_FC1_DIR_FROMDS:
+        IEEE80211_ADDR_COPY(macHdr.dstMac, wh.i_addr1);
+        IEEE80211_ADDR_COPY(macHdr.srcMac, wh.i_addr3);
+        break;
+    case IEEE80211_FC1_DIR_DSTODS:
+        break;
+    }
+
+    // Remove the LLC Hdr.
+    A_NETBUF_PULL(osbuf, sizeof(ATH_LLC_SNAP_HDR));
+
+    // Insert the ATH MAC hdr.
+
+    A_NETBUF_PUSH(osbuf, sizeof(ATH_MAC_HDR));
+    datap = A_NETBUF_DATA(osbuf);
+
+    memcpy (datap, &macHdr, sizeof(ATH_MAC_HDR));
+
+    return 0;
+}
+
+/*
+ *  performs 802.3 to DIX encapsulation for received packets.
+ *  Assumes the entire 802.3 header is contigous.
+ */
+int
+wmi_dot3_2_dix(void *osbuf)
+{
+    u8 *datap;
+    ATH_MAC_HDR      macHdr;
+    ATH_LLC_SNAP_HDR *llcHdr;
+
+    A_ASSERT(osbuf != NULL);
+    datap = A_NETBUF_DATA(osbuf);
+
+    memcpy(&macHdr, datap, sizeof(ATH_MAC_HDR));
+    llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(ATH_MAC_HDR));
+    macHdr.typeOrLen = llcHdr->etherType;
+
+    if (A_NETBUF_PULL(osbuf, sizeof(ATH_LLC_SNAP_HDR)) != 0) {
+        return A_NO_MEMORY;
+    }
+
+    datap = A_NETBUF_DATA(osbuf);
+
+    memcpy(datap, &macHdr, sizeof (ATH_MAC_HDR));
+
+    return (0);
+}
+
+/*
+ * Removes a WMI data header
+ */
+int
+wmi_data_hdr_remove(struct wmi_t *wmip, void *osbuf)
+{
+    A_ASSERT(osbuf != NULL);
+
+    return (A_NETBUF_PULL(osbuf, sizeof(WMI_DATA_HDR)));
+}
+
+void
+wmi_iterate_nodes(struct wmi_t *wmip, wlan_node_iter_func *f, void *arg)
+{
+    wlan_iterate_nodes(&wmip->wmi_scan_table, f, arg);
+}
+
+/*
+ * WMI Extended Event received from Target.
+ */
+int
+wmi_control_rx_xtnd(struct wmi_t *wmip, void *osbuf)
+{
+    WMIX_CMD_HDR *cmd;
+    u16 id;
+    u8 *datap;
+    u32 len;
+    int status = 0;
+
+    if (A_NETBUF_LEN(osbuf) < sizeof(WMIX_CMD_HDR)) {
+        A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 1\n", DBGARG));
+        wmip->wmi_stats.cmd_len_err++;
+        return A_ERROR;
+    }
+
+    cmd = (WMIX_CMD_HDR *)A_NETBUF_DATA(osbuf);
+    id = cmd->commandId;
+
+    if (A_NETBUF_PULL(osbuf, sizeof(WMIX_CMD_HDR)) != 0) {
+        A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 2\n", DBGARG));
+        wmip->wmi_stats.cmd_len_err++;
+        return A_ERROR;
+    }
+
+    datap = A_NETBUF_DATA(osbuf);
+    len = A_NETBUF_LEN(osbuf);
+
+    switch (id) {
+    case (WMIX_DSETOPENREQ_EVENTID):
+        status = wmi_dset_open_req_rx(wmip, datap, len);
+        break;
+#ifdef CONFIG_HOST_DSET_SUPPORT
+    case (WMIX_DSETCLOSE_EVENTID):
+        status = wmi_dset_close_rx(wmip, datap, len);
+        break;
+    case (WMIX_DSETDATAREQ_EVENTID):
+        status = wmi_dset_data_req_rx(wmip, datap, len);
+        break;
+#endif /* CONFIG_HOST_DSET_SUPPORT */
+    case (WMIX_HB_CHALLENGE_RESP_EVENTID):
+        wmi_hbChallengeResp_rx(wmip, datap, len);
+        break;
+    case (WMIX_DBGLOG_EVENTID):
+        wmi_dbglog_event_rx(wmip, datap, len);
+        break;
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+    case (WMIX_PROF_COUNT_EVENTID):
+        wmi_prof_count_rx(wmip, datap, len);
+        break;
+#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
+    default:
+        A_DPRINTF(DBG_WMI|DBG_ERROR,
+            (DBGFMT "Unknown id 0x%x\n", DBGARG, id));
+        wmip->wmi_stats.cmd_id_err++;
+        status = A_ERROR;
+        break;
+    }
+
+    return status;
+}
+
+/*
+ * Control Path
+ */
+u32 cmdRecvNum;
+
+int
+wmi_control_rx(struct wmi_t *wmip, void *osbuf)
+{
+    WMI_CMD_HDR *cmd;
+    u16 id;
+    u8 *datap;
+    u32 len, i, loggingReq;
+    int status = 0;
+
+    A_ASSERT(osbuf != NULL);
+    if (A_NETBUF_LEN(osbuf) < sizeof(WMI_CMD_HDR)) {
+        A_NETBUF_FREE(osbuf);
+        A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 1\n", DBGARG));
+        wmip->wmi_stats.cmd_len_err++;
+        return A_ERROR;
+    }
+
+    cmd = (WMI_CMD_HDR *)A_NETBUF_DATA(osbuf);
+    id = cmd->commandId;
+
+    if (A_NETBUF_PULL(osbuf, sizeof(WMI_CMD_HDR)) != 0) {
+        A_NETBUF_FREE(osbuf);
+        A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 2\n", DBGARG));
+        wmip->wmi_stats.cmd_len_err++;
+        return A_ERROR;
+    }
+
+    datap = A_NETBUF_DATA(osbuf);
+    len = A_NETBUF_LEN(osbuf);
+
+    loggingReq = 0;
+
+    ar6000_get_driver_cfg(wmip->wmi_devt,
+                    AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS,
+                    &loggingReq);
+
+    if(loggingReq) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("WMI %d \n",id));
+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("WMI recv, MsgNo %d : ", cmdRecvNum));
+        for(i = 0; i < len; i++)
+            AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("%x ", datap[i]));
+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("\n"));
+    }
+
+    LOCK_WMI(wmip);
+    cmdRecvNum++;
+    UNLOCK_WMI(wmip);
+
+    switch (id) {
+    case (WMI_GET_BITRATE_CMDID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_BITRATE_CMDID\n", DBGARG));
+        status = wmi_bitrate_reply_rx(wmip, datap, len);
+        break;
+    case (WMI_GET_CHANNEL_LIST_CMDID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_CHANNEL_LIST_CMDID\n", DBGARG));
+        status = wmi_channelList_reply_rx(wmip, datap, len);
+        break;
+    case (WMI_GET_TX_PWR_CMDID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_TX_PWR_CMDID\n", DBGARG));
+        status = wmi_txPwr_reply_rx(wmip, datap, len);
+        break;
+    case (WMI_READY_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_READY_EVENTID\n", DBGARG));
+        status = wmi_ready_event_rx(wmip, datap, len);
+        A_WMI_DBGLOG_INIT_DONE(wmip->wmi_devt);
+        break;
+    case (WMI_CONNECT_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CONNECT_EVENTID\n", DBGARG));
+        status = wmi_connect_event_rx(wmip, datap, len);
+        break;
+    case (WMI_DISCONNECT_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_DISCONNECT_EVENTID\n", DBGARG));
+        status = wmi_disconnect_event_rx(wmip, datap, len);
+        break;
+    case (WMI_PEER_NODE_EVENTID):
+        A_DPRINTF (DBG_WMI, (DBGFMT "WMI_PEER_NODE_EVENTID\n", DBGARG));
+        status = wmi_peer_node_event_rx(wmip, datap, len);
+        break;
+    case (WMI_TKIP_MICERR_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TKIP_MICERR_EVENTID\n", DBGARG));
+        status = wmi_tkip_micerr_event_rx(wmip, datap, len);
+        break;
+    case (WMI_BSSINFO_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_BSSINFO_EVENTID\n", DBGARG));
+        {
+            /*
+             * convert WMI_BSS_INFO_HDR2 to WMI_BSS_INFO_HDR
+             * Take a local copy of the WMI_BSS_INFO_HDR2 from the wmi buffer
+             * and reconstruct the WMI_BSS_INFO_HDR in its place
+            */
+            WMI_BSS_INFO_HDR2 bih2;
+            WMI_BSS_INFO_HDR *bih;
+            memcpy(&bih2, datap, sizeof(WMI_BSS_INFO_HDR2));
+
+            A_NETBUF_PUSH(osbuf, 4);
+            datap = A_NETBUF_DATA(osbuf);
+            len = A_NETBUF_LEN(osbuf);
+            bih = (WMI_BSS_INFO_HDR *)datap;
+
+            bih->channel = bih2.channel;
+            bih->frameType = bih2.frameType;
+            bih->snr = bih2.snr;
+            bih->rssi = bih2.snr - 95;
+            bih->ieMask = bih2.ieMask;
+            memcpy(bih->bssid, bih2.bssid, ATH_MAC_LEN);
+
+            status = wmi_bssInfo_event_rx(wmip, datap, len);
+        }
+        break;
+    case (WMI_REGDOMAIN_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REGDOMAIN_EVENTID\n", DBGARG));
+        status = wmi_regDomain_event_rx(wmip, datap, len);
+        break;
+    case (WMI_PSTREAM_TIMEOUT_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_PSTREAM_TIMEOUT_EVENTID\n", DBGARG));
+        status = wmi_pstream_timeout_event_rx(wmip, datap, len);
+        break;
+    case (WMI_NEIGHBOR_REPORT_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_NEIGHBOR_REPORT_EVENTID\n", DBGARG));
+        status = wmi_neighborReport_event_rx(wmip, datap, len);
+        break;
+    case (WMI_SCAN_COMPLETE_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SCAN_COMPLETE_EVENTID\n", DBGARG));
+        status = wmi_scanComplete_rx(wmip, datap, len);
+        break;
+    case (WMI_CMDERROR_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CMDERROR_EVENTID\n", DBGARG));
+        status = wmi_errorEvent_rx(wmip, datap, len);
+        break;
+    case (WMI_REPORT_STATISTICS_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_STATISTICS_EVENTID\n", DBGARG));
+        status = wmi_statsEvent_rx(wmip, datap, len);
+        break;
+    case (WMI_RSSI_THRESHOLD_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_RSSI_THRESHOLD_EVENTID\n", DBGARG));
+        status = wmi_rssiThresholdEvent_rx(wmip, datap, len);
+        break;
+    case (WMI_ERROR_REPORT_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_ERROR_REPORT_EVENTID\n", DBGARG));
+        status = wmi_reportErrorEvent_rx(wmip, datap, len);
+        break;
+    case (WMI_OPT_RX_FRAME_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_OPT_RX_FRAME_EVENTID\n", DBGARG));
+        status = wmi_opt_frame_event_rx(wmip, datap, len);
+        break;
+    case (WMI_REPORT_ROAM_TBL_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_ROAM_TBL_EVENTID\n", DBGARG));
+        status = wmi_roam_tbl_event_rx(wmip, datap, len);
+        break;
+    case (WMI_EXTENSION_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_EXTENSION_EVENTID\n", DBGARG));
+        status = wmi_control_rx_xtnd(wmip, osbuf);
+        break;
+    case (WMI_CAC_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CAC_EVENTID\n", DBGARG));
+        status = wmi_cac_event_rx(wmip, datap, len);
+        break;
+    case (WMI_CHANNEL_CHANGE_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CHANNEL_CHANGE_EVENTID\n", DBGARG));
+        status = wmi_channel_change_event_rx(wmip, datap, len);
+        break;
+    case (WMI_REPORT_ROAM_DATA_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_ROAM_DATA_EVENTID\n", DBGARG));
+        status = wmi_roam_data_event_rx(wmip, datap, len);
+        break;
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+    case (WMI_TEST_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TEST_EVENTID\n", DBGARG));
+        status = wmi_tcmd_test_report_rx(wmip, datap, len);
+        break;
+#endif
+    case (WMI_GET_FIXRATES_CMDID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_FIXRATES_CMDID\n", DBGARG));
+        status = wmi_ratemask_reply_rx(wmip, datap, len);
+        break;
+    case (WMI_TX_RETRY_ERR_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TX_RETRY_ERR_EVENTID\n", DBGARG));
+        status = wmi_txRetryErrEvent_rx(wmip, datap, len);
+        break;
+    case (WMI_SNR_THRESHOLD_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SNR_THRESHOLD_EVENTID\n", DBGARG));
+        status = wmi_snrThresholdEvent_rx(wmip, datap, len);
+        break;
+    case (WMI_LQ_THRESHOLD_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_LQ_THRESHOLD_EVENTID\n", DBGARG));
+        status = wmi_lqThresholdEvent_rx(wmip, datap, len);
+        break;
+    case (WMI_APLIST_EVENTID):
+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Received APLIST Event\n"));
+        status = wmi_aplistEvent_rx(wmip, datap, len);
+        break;
+    case (WMI_GET_KEEPALIVE_CMDID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_KEEPALIVE_CMDID\n", DBGARG));
+        status = wmi_keepalive_reply_rx(wmip, datap, len);
+        break;
+    case (WMI_GET_WOW_LIST_EVENTID):
+        status = wmi_get_wow_list_event_rx(wmip, datap, len);
+        break;
+    case (WMI_GET_PMKID_LIST_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_PMKID_LIST Event\n", DBGARG));
+        status = wmi_get_pmkid_list_event_rx(wmip, datap, len);
+        break;
+    case (WMI_PSPOLL_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_PSPOLL_EVENT\n", DBGARG));
+        status = wmi_pspoll_event_rx(wmip, datap, len);
+        break;
+    case (WMI_DTIMEXPIRY_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_DTIMEXPIRY_EVENT\n", DBGARG));
+        status = wmi_dtimexpiry_event_rx(wmip, datap, len);
+        break;
+    case (WMI_SET_PARAMS_REPLY_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SET_PARAMS_REPLY Event\n", DBGARG));
+        status = wmi_set_params_event_rx(wmip, datap, len);
+        break;
+    case (WMI_ADDBA_REQ_EVENTID):
+        status = wmi_addba_req_event_rx(wmip, datap, len);
+        break;
+    case (WMI_ADDBA_RESP_EVENTID):
+        status = wmi_addba_resp_event_rx(wmip, datap, len);
+        break;
+    case (WMI_DELBA_REQ_EVENTID):
+        status = wmi_delba_req_event_rx(wmip, datap, len);
+        break;
+        case (WMI_REPORT_BTCOEX_CONFIG_EVENTID):
+            A_DPRINTF(DBG_WMI, (DBGFMT "WMI_BTCOEX_CONFIG_EVENTID", DBGARG));
+        status = wmi_btcoex_config_event_rx(wmip, datap, len);
+            break;
+        case (WMI_REPORT_BTCOEX_STATS_EVENTID):
+            A_DPRINTF(DBG_WMI, (DBGFMT "WMI_BTCOEX_STATS_EVENTID", DBGARG));
+        status = wmi_btcoex_stats_event_rx(wmip, datap, len);
+            break;
+    case (WMI_TX_COMPLETE_EVENTID):
+        {
+            int index;
+            TX_COMPLETE_MSG_V1 *pV1;
+            WMI_TX_COMPLETE_EVENT *pEv = (WMI_TX_COMPLETE_EVENT *)datap;
+            A_PRINTF("comp: %d %d %d\n", pEv->numMessages, pEv->msgLen, pEv->msgType);
+
+            for(index = 0 ; index < pEv->numMessages ; index++) {
+                pV1 = (TX_COMPLETE_MSG_V1 *)(datap + sizeof(WMI_TX_COMPLETE_EVENT) + index*sizeof(TX_COMPLETE_MSG_V1));
+                A_PRINTF("msg: %d %d %d %d\n", pV1->status, pV1->pktID, pV1->rateIdx, pV1->ackFailures);
+            }
+        }
+        break;
+    case (WMI_HCI_EVENT_EVENTID):
+        status = wmi_hci_event_rx(wmip, datap, len);
+        break;
+#ifdef WAPI_ENABLE
+    case (WMI_WAPI_REKEY_EVENTID):
+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_WAPI_REKEY_EVENTID", DBGARG));
+        status = wmi_wapi_rekey_event_rx(wmip, datap, len);
+        break;
+#endif
+    default:
+        A_DPRINTF(DBG_WMI|DBG_ERROR,
+            (DBGFMT "Unknown id 0x%x\n", DBGARG, id));
+        wmip->wmi_stats.cmd_id_err++;
+        status = A_ERROR;
+        break;
+    }
+
+    A_NETBUF_FREE(osbuf);
+
+    return status;
+}
+
+/* Send a "simple" wmi command -- one with no arguments */
+static int
+wmi_simple_cmd(struct wmi_t *wmip, WMI_COMMAND_ID cmdid)
+{
+    void *osbuf;
+
+    osbuf = A_NETBUF_ALLOC(0);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    return (wmi_cmd_send(wmip, osbuf, cmdid, NO_SYNC_WMIFLAG));
+}
+
+/* Send a "simple" extended wmi command -- one with no arguments.
+   Enabling this command only if GPIO or profiling support is enabled.
+   This is to suppress warnings on some platforms */
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+static int
+wmi_simple_cmd_xtnd(struct wmi_t *wmip, WMIX_COMMAND_ID cmdid)
+{
+    void *osbuf;
+
+    osbuf = A_NETBUF_ALLOC(0);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    return (wmi_cmd_send_xtnd(wmip, osbuf, cmdid, NO_SYNC_WMIFLAG));
+}
+#endif
+
+static int
+wmi_ready_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_READY_EVENT *ev = (WMI_READY_EVENT *)datap;
+
+    if (len < sizeof(WMI_READY_EVENT)) {
+        return A_EINVAL;
+    }
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+    wmip->wmi_ready = true;
+    A_WMI_READY_EVENT(wmip->wmi_devt, ev->macaddr, ev->phyCapability,
+                      ev->sw_version, ev->abi_version);
+
+    return 0;
+}
+
+#define LE_READ_4(p)                            \
+    ((u32)                            \
+     ((((u8 *)(p))[0]      ) | (((u8 *)(p))[1] <<  8) | \
+      (((u8 *)(p))[2] << 16) | (((u8 *)(p))[3] << 24)))
+
+static int __inline
+iswmmoui(const u8 *frm)
+{
+    return frm[1] > 3 && LE_READ_4(frm+2) == ((WMM_OUI_TYPE<<24)|WMM_OUI);
+}
+
+static int __inline
+iswmmparam(const u8 *frm)
+{
+    return frm[1] > 5 && frm[6] == WMM_PARAM_OUI_SUBTYPE;
+}
+
+
+static int
+wmi_connect_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_CONNECT_EVENT *ev;
+    u8 *pie,*peie;
+
+    if (len < sizeof(WMI_CONNECT_EVENT))
+    {
+        return A_EINVAL;
+    }
+    ev = (WMI_CONNECT_EVENT *)datap;
+
+    A_DPRINTF(DBG_WMI,
+        (DBGFMT "freq %d bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
+        DBGARG, ev->channel,
+        ev->bssid[0], ev->bssid[1], ev->bssid[2],
+        ev->bssid[3], ev->bssid[4], ev->bssid[5]));
+
+    memcpy(wmip->wmi_bssid, ev->bssid, ATH_MAC_LEN);
+
+    /* initialize pointer to start of assoc rsp IEs */
+    pie = ev->assocInfo + ev->beaconIeLen + ev->assocReqLen +
+                            sizeof(u16)  +  /* capinfo*/
+                            sizeof(u16)  +  /* status Code */
+                            sizeof(u16)  ;  /* associd */
+
+    /* initialize pointer to end of assoc rsp IEs */
+    peie = ev->assocInfo + ev->beaconIeLen + ev->assocReqLen + ev->assocRespLen;
+
+    while (pie < peie)
+    {
+        switch (*pie)
+        {
+            case IEEE80211_ELEMID_VENDOR:
+                if (iswmmoui(pie))
+                {
+                    if(iswmmparam (pie))
+                    {
+                        wmip->wmi_is_wmm_enabled = true;
+                    }
+                }
+            break;
+        }
+
+        if (wmip->wmi_is_wmm_enabled)
+        {
+            break;
+        }
+        pie += pie[1] + 2;
+    }
+
+    A_WMI_CONNECT_EVENT(wmip->wmi_devt, ev->channel, ev->bssid,
+                         ev->listenInterval, ev->beaconInterval,
+                         (NETWORK_TYPE) ev->networkType, ev->beaconIeLen,
+                         ev->assocReqLen, ev->assocRespLen,
+                         ev->assocInfo);
+
+    return 0;
+}
+
+static int
+wmi_regDomain_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_REG_DOMAIN_EVENT *ev;
+
+    if (len < sizeof(*ev)) {
+        return A_EINVAL;
+    }
+    ev = (WMI_REG_DOMAIN_EVENT *)datap;
+
+    A_WMI_REGDOMAIN_EVENT(wmip->wmi_devt, ev->regDomain);
+
+    return 0;
+}
+
+static int
+wmi_neighborReport_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_NEIGHBOR_REPORT_EVENT *ev;
+    int numAps;
+
+    if (len < sizeof(*ev)) {
+        return A_EINVAL;
+    }
+    ev = (WMI_NEIGHBOR_REPORT_EVENT *)datap;
+    numAps = ev->numberOfAps;
+
+    if (len < (int)(sizeof(*ev) + ((numAps - 1) * sizeof(WMI_NEIGHBOR_INFO)))) {
+        return A_EINVAL;
+    }
+
+    A_WMI_NEIGHBORREPORT_EVENT(wmip->wmi_devt, numAps, ev->neighbor);
+
+    return 0;
+}
+
+static int
+wmi_disconnect_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_DISCONNECT_EVENT *ev;
+    wmip->wmi_traffic_class = 100;
+
+    if (len < sizeof(WMI_DISCONNECT_EVENT)) {
+        return A_EINVAL;
+    }
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    ev = (WMI_DISCONNECT_EVENT *)datap;
+
+    A_MEMZERO(wmip->wmi_bssid, sizeof(wmip->wmi_bssid));
+
+    wmip->wmi_is_wmm_enabled = false;
+    wmip->wmi_pair_crypto_type = NONE_CRYPT;
+    wmip->wmi_grp_crypto_type = NONE_CRYPT;
+
+    A_WMI_DISCONNECT_EVENT(wmip->wmi_devt, ev->disconnectReason, ev->bssid,
+                            ev->assocRespLen, ev->assocInfo, ev->protocolReasonStatus);
+
+    return 0;
+}
+
+static int
+wmi_peer_node_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_PEER_NODE_EVENT *ev;
+
+    if (len < sizeof(WMI_PEER_NODE_EVENT)) {
+        return A_EINVAL;
+    }
+    ev = (WMI_PEER_NODE_EVENT *)datap;
+    if (ev->eventCode == PEER_NODE_JOIN_EVENT) {
+        A_DPRINTF (DBG_WMI, (DBGFMT "Joined node with Macaddr: ", DBGARG));
+    } else if(ev->eventCode == PEER_NODE_LEAVE_EVENT) {
+        A_DPRINTF (DBG_WMI, (DBGFMT "left node with Macaddr: ", DBGARG));
+    }
+
+    A_WMI_PEER_EVENT (wmip->wmi_devt, ev->eventCode, ev->peerMacAddr);
+
+    return 0;
+}
+
+static int
+wmi_tkip_micerr_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_TKIP_MICERR_EVENT *ev;
+
+    if (len < sizeof(*ev)) {
+        return A_EINVAL;
+    }
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    ev = (WMI_TKIP_MICERR_EVENT *)datap;
+    A_WMI_TKIP_MICERR_EVENT(wmip->wmi_devt, ev->keyid, ev->ismcast);
+
+    return 0;
+}
+
+static int
+wmi_bssInfo_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    bss_t *bss = NULL;
+    WMI_BSS_INFO_HDR *bih;
+    u8 *buf;
+    u32 nodeCachingAllowed = 1;
+    u8 cached_ssid_len = 0;
+    u8 cached_ssid_buf[IEEE80211_NWID_LEN] = {0};
+    u8 beacon_ssid_len = 0;
+
+    if (len <= sizeof(WMI_BSS_INFO_HDR)) {
+        return A_EINVAL;
+    }
+
+    bih = (WMI_BSS_INFO_HDR *)datap;
+    bss = wlan_find_node(&wmip->wmi_scan_table, bih->bssid);
+
+    if (bih->rssi > 0) {
+        if (NULL == bss)
+            return 0;  //no node found in the table, just drop the node with incorrect RSSI
+        else
+            bih->rssi = bss->ni_rssi; //Adjust RSSI in datap in case it is used in A_WMI_BSSINFO_EVENT_RX
+    }
+
+    A_WMI_BSSINFO_EVENT_RX(wmip->wmi_devt, datap, len);
+    /* What is driver config for wlan node caching? */
+    if(ar6000_get_driver_cfg(wmip->wmi_devt,
+                    AR6000_DRIVER_CFG_GET_WLANNODECACHING,
+                    &nodeCachingAllowed) != 0) {
+        wmi_node_return(wmip, bss);
+        return A_EINVAL;
+    }
+
+    if(!nodeCachingAllowed) {
+        wmi_node_return(wmip, bss);
+        return 0;
+    }
+
+    buf = datap + sizeof(WMI_BSS_INFO_HDR);
+    len -= sizeof(WMI_BSS_INFO_HDR);
+
+        A_DPRINTF(DBG_WMI2, (DBGFMT "bssInfo event - ch %u, rssi %02x, "
+                "bssid \"%pM\"\n", DBGARG, bih->channel,
+                (unsigned char) bih->rssi, bih->bssid));
+
+    if(wps_enable && (bih->frameType == PROBERESP_FTYPE) ) {
+        wmi_node_return(wmip, bss);
+        return 0;
+    }
+
+    if (bss != NULL) {
+        /*
+         * Free up the node.  Not the most efficient process given
+         * we are about to allocate a new node but it is simple and should be
+         * adequate.
+         */
+
+        /* In case of hidden AP, beacon will not have ssid,
+         * but a directed probe response will have it,
+         * so cache the probe-resp-ssid if already present. */
+        if ((true == is_probe_ssid) && (BEACON_FTYPE == bih->frameType))
+        {
+            u8 *ie_ssid;
+
+            ie_ssid = bss->ni_cie.ie_ssid;
+            if(ie_ssid && (ie_ssid[1] <= IEEE80211_NWID_LEN) && (ie_ssid[2] != 0))
+            {
+                cached_ssid_len = ie_ssid[1];
+                memcpy(cached_ssid_buf, ie_ssid + 2, cached_ssid_len);
+            }
+        }
+
+        /*
+         * Use the current average rssi of associated AP base on assumpiton
+         * 1. Most os with GUI will update RSSI by wmi_get_stats_cmd() periodically
+         * 2. wmi_get_stats_cmd(..) will be called when calling wmi_startscan_cmd(...)
+         * The average value of RSSI give end-user better feeling for instance value of scan result
+         * It also sync up RSSI info in GUI between scan result and RSSI signal icon
+         */
+        if (IEEE80211_ADDR_EQ(wmip->wmi_bssid, bih->bssid)) {
+            bih->rssi = bss->ni_rssi;
+            bih->snr  = bss->ni_snr;
+        }
+
+        wlan_node_reclaim(&wmip->wmi_scan_table, bss);
+    }
+
+    /*  beacon/probe response frame format
+     *  [8] time stamp
+     *  [2] beacon interval
+     *  [2] capability information
+     *  [tlv] ssid */
+    beacon_ssid_len = buf[SSID_IE_LEN_INDEX];
+
+    /* If ssid is cached for this hidden AP, then change buffer len accordingly. */
+    if ((true == is_probe_ssid) && (BEACON_FTYPE == bih->frameType) &&
+        (0 != cached_ssid_len) &&
+        (0 == beacon_ssid_len || (cached_ssid_len > beacon_ssid_len && 0 == buf[SSID_IE_LEN_INDEX + 1])))
+    {
+        len += (cached_ssid_len - beacon_ssid_len);
+    }
+
+    bss = wlan_node_alloc(&wmip->wmi_scan_table, len);
+    if (bss == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    bss->ni_snr        = bih->snr;
+    bss->ni_rssi       = bih->rssi;
+    A_ASSERT(bss->ni_buf != NULL);
+
+    /* In case of hidden AP, beacon will not have ssid,
+     * but a directed probe response will have it,
+     * so place the cached-ssid(probe-resp) in the bssinfo. */
+    if ((true == is_probe_ssid) && (BEACON_FTYPE == bih->frameType) &&
+         (0 != cached_ssid_len) &&
+         (0 == beacon_ssid_len || (beacon_ssid_len && 0 == buf[SSID_IE_LEN_INDEX + 1])))
+    {
+        u8 *ni_buf = bss->ni_buf;
+        int buf_len = len;
+
+        /* copy the first 14 bytes such as
+         * time-stamp(8), beacon-interval(2), cap-info(2), ssid-id(1), ssid-len(1). */
+        memcpy(ni_buf, buf, SSID_IE_LEN_INDEX + 1);
+
+        ni_buf[SSID_IE_LEN_INDEX] = cached_ssid_len;
+        ni_buf += (SSID_IE_LEN_INDEX + 1);
+
+        buf += (SSID_IE_LEN_INDEX + 1);
+        buf_len -= (SSID_IE_LEN_INDEX + 1);
+
+        /* copy the cached ssid */
+        memcpy(ni_buf, cached_ssid_buf, cached_ssid_len);
+        ni_buf += cached_ssid_len;
+
+        buf += beacon_ssid_len;
+        buf_len -= beacon_ssid_len;
+
+        if (cached_ssid_len > beacon_ssid_len)
+            buf_len -= (cached_ssid_len - beacon_ssid_len);
+
+        /* now copy the rest of bytes */
+        memcpy(ni_buf, buf, buf_len);
+    }
+    else
+        memcpy(bss->ni_buf, buf, len);
+
+    bss->ni_framelen = len;
+    if (wlan_parse_beacon(bss->ni_buf, len, &bss->ni_cie) != 0) {
+        wlan_node_free(bss);
+        return A_EINVAL;
+    }
+
+    /*
+     * Update the frequency in ie_chan, overwriting of channel number
+     * which is done in wlan_parse_beacon
+     */
+    bss->ni_cie.ie_chan = bih->channel;
+    wlan_setup_node(&wmip->wmi_scan_table, bss, bih->bssid);
+
+    return 0;
+}
+
+static int
+wmi_opt_frame_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    bss_t *bss;
+    WMI_OPT_RX_INFO_HDR *bih;
+    u8 *buf;
+
+    if (len <= sizeof(WMI_OPT_RX_INFO_HDR)) {
+        return A_EINVAL;
+    }
+
+    bih = (WMI_OPT_RX_INFO_HDR *)datap;
+    buf = datap + sizeof(WMI_OPT_RX_INFO_HDR);
+    len -= sizeof(WMI_OPT_RX_INFO_HDR);
+
+    A_DPRINTF(DBG_WMI2, (DBGFMT "opt frame event %2.2x:%2.2x\n", DBGARG,
+        bih->bssid[4], bih->bssid[5]));
+
+    bss = wlan_find_node(&wmip->wmi_scan_table, bih->bssid);
+    if (bss != NULL) {
+        /*
+         * Free up the node.  Not the most efficient process given
+         * we are about to allocate a new node but it is simple and should be
+         * adequate.
+         */
+        wlan_node_reclaim(&wmip->wmi_scan_table, bss);
+    }
+
+    bss = wlan_node_alloc(&wmip->wmi_scan_table, len);
+    if (bss == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    bss->ni_snr        = bih->snr;
+    bss->ni_cie.ie_chan = bih->channel;
+    A_ASSERT(bss->ni_buf != NULL);
+    memcpy(bss->ni_buf, buf, len);
+    wlan_setup_node(&wmip->wmi_scan_table, bss, bih->bssid);
+
+    return 0;
+}
+
+    /* This event indicates inactivity timeout of a fatpipe(pstream)
+     * at the target
+     */
+static int
+wmi_pstream_timeout_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_PSTREAM_TIMEOUT_EVENT *ev;
+
+    if (len < sizeof(WMI_PSTREAM_TIMEOUT_EVENT)) {
+        return A_EINVAL;
+    }
+
+    A_DPRINTF(DBG_WMI, (DBGFMT "wmi_pstream_timeout_event_rx\n", DBGARG));
+
+    ev = (WMI_PSTREAM_TIMEOUT_EVENT *)datap;
+
+        /* When the pstream (fat pipe == AC) timesout, it means there were no
+         * thinStreams within this pstream & it got implicitly created due to
+         * data flow on this AC. We start the inactivity timer only for
+         * implicitly created pstream. Just reset the host state.
+     */
+        /* Set the activeTsids for this AC to 0 */
+    LOCK_WMI(wmip);
+    wmip->wmi_streamExistsForAC[ev->trafficClass]=0;
+    wmip->wmi_fatPipeExists &= ~(1 << ev->trafficClass);
+    UNLOCK_WMI(wmip);
+
+        /*Indicate inactivity to driver layer for this fatpipe (pstream)*/
+    A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt, ev->trafficClass);
+
+    return 0;
+}
+
+static int
+wmi_bitrate_reply_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_BIT_RATE_REPLY *reply;
+    s32 rate;
+    u32 sgi,index;
+    /* 54149:
+     * WMI_BIT_RATE_CMD structure is changed to WMI_BIT_RATE_REPLY.
+     * since there is difference in the length and to avoid returning
+     * error value.
+     */
+    if (len < sizeof(WMI_BIT_RATE_REPLY)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_BIT_RATE_REPLY *)datap;
+    A_DPRINTF(DBG_WMI,
+        (DBGFMT "Enter - rateindex %d\n", DBGARG, reply->rateIndex));
+
+    if (reply->rateIndex == (s8) RATE_AUTO) {
+        rate = RATE_AUTO;
+    } else {
+        // the SGI state is stored as the MSb of the rateIndex
+        index = reply->rateIndex & 0x7f;
+        sgi = (reply->rateIndex & 0x80)? 1:0;
+        rate = wmi_rateTable[index][sgi];
+    }
+
+    A_WMI_BITRATE_RX(wmip->wmi_devt, rate);
+    return 0;
+}
+
+static int
+wmi_ratemask_reply_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_FIX_RATES_REPLY *reply;
+
+    if (len < sizeof(WMI_FIX_RATES_REPLY)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_FIX_RATES_REPLY *)datap;
+    A_DPRINTF(DBG_WMI,
+        (DBGFMT "Enter - fixed rate mask %x\n", DBGARG, reply->fixRateMask));
+
+    A_WMI_RATEMASK_RX(wmip->wmi_devt, reply->fixRateMask);
+
+    return 0;
+}
+
+static int
+wmi_channelList_reply_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_CHANNEL_LIST_REPLY *reply;
+
+    if (len < sizeof(WMI_CHANNEL_LIST_REPLY)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_CHANNEL_LIST_REPLY *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_CHANNELLIST_RX(wmip->wmi_devt, reply->numChannels,
+                          reply->channelList);
+
+    return 0;
+}
+
+static int
+wmi_txPwr_reply_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_TX_PWR_REPLY *reply;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_TX_PWR_REPLY *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_TXPWR_RX(wmip->wmi_devt, reply->dbM);
+
+    return 0;
+}
+static int
+wmi_keepalive_reply_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_GET_KEEPALIVE_CMD *reply;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_GET_KEEPALIVE_CMD *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_KEEPALIVE_RX(wmip->wmi_devt, reply->configured);
+
+    return 0;
+}
+
+
+static int
+wmi_dset_open_req_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMIX_DSETOPENREQ_EVENT *dsetopenreq;
+
+    if (len < sizeof(WMIX_DSETOPENREQ_EVENT)) {
+        return A_EINVAL;
+    }
+    dsetopenreq = (WMIX_DSETOPENREQ_EVENT *)datap;
+    A_DPRINTF(DBG_WMI,
+        (DBGFMT "Enter - dset_id=0x%x\n", DBGARG, dsetopenreq->dset_id));
+    A_WMI_DSET_OPEN_REQ(wmip->wmi_devt,
+                        dsetopenreq->dset_id,
+                        dsetopenreq->targ_dset_handle,
+                        dsetopenreq->targ_reply_fn,
+                        dsetopenreq->targ_reply_arg);
+
+    return 0;
+}
+
+#ifdef CONFIG_HOST_DSET_SUPPORT
+static int
+wmi_dset_close_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMIX_DSETCLOSE_EVENT *dsetclose;
+
+    if (len < sizeof(WMIX_DSETCLOSE_EVENT)) {
+        return A_EINVAL;
+    }
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    dsetclose = (WMIX_DSETCLOSE_EVENT *)datap;
+    A_WMI_DSET_CLOSE(wmip->wmi_devt, dsetclose->access_cookie);
+
+    return 0;
+}
+
+static int
+wmi_dset_data_req_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMIX_DSETDATAREQ_EVENT *dsetdatareq;
+
+    if (len < sizeof(WMIX_DSETDATAREQ_EVENT)) {
+        return A_EINVAL;
+    }
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    dsetdatareq = (WMIX_DSETDATAREQ_EVENT *)datap;
+    A_WMI_DSET_DATA_REQ(wmip->wmi_devt,
+                         dsetdatareq->access_cookie,
+                         dsetdatareq->offset,
+                         dsetdatareq->length,
+                         dsetdatareq->targ_buf,
+                         dsetdatareq->targ_reply_fn,
+                         dsetdatareq->targ_reply_arg);
+
+    return 0;
+}
+#endif /* CONFIG_HOST_DSET_SUPPORT */
+
+static int
+wmi_scanComplete_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_SCAN_COMPLETE_EVENT *ev;
+
+    ev = (WMI_SCAN_COMPLETE_EVENT *)datap;
+    if ((int)ev->status == 0) {
+        wlan_refresh_inactive_nodes(&wmip->wmi_scan_table);
+    }
+    A_WMI_SCANCOMPLETE_EVENT(wmip->wmi_devt, (int) ev->status);
+    is_probe_ssid = false;
+
+    return 0;
+}
+
+/*
+ * Target is reporting a programming error.  This is for
+ * developer aid only.  Target only checks a few common violations
+ * and it is responsibility of host to do all error checking.
+ * Behavior of target after wmi error event is undefined.
+ * A reset is recommended.
+ */
+static int
+wmi_errorEvent_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_CMD_ERROR_EVENT *ev;
+
+    ev = (WMI_CMD_ERROR_EVENT *)datap;
+    AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Programming Error: cmd=%d ", ev->commandId));
+    switch (ev->errorCode) {
+    case (INVALID_PARAM):
+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Illegal Parameter\n"));
+        break;
+    case (ILLEGAL_STATE):
+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Illegal State\n"));
+        break;
+    case (INTERNAL_ERROR):
+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Internal Error\n"));
+        break;
+    }
+
+    return 0;
+}
+
+
+static int
+wmi_statsEvent_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_TARGETSTATS_EVENT(wmip->wmi_devt, datap, len);
+
+    return 0;
+}
+
+static int
+wmi_rssiThresholdEvent_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_RSSI_THRESHOLD_EVENT *reply;
+    WMI_RSSI_THRESHOLD_VAL newThreshold;
+    WMI_RSSI_THRESHOLD_PARAMS_CMD cmd;
+    SQ_THRESHOLD_PARAMS *sq_thresh =
+           &wmip->wmi_SqThresholdParams[SIGNAL_QUALITY_METRICS_RSSI];
+    u8 upper_rssi_threshold, lower_rssi_threshold;
+    s16 rssi;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_RSSI_THRESHOLD_EVENT *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+    newThreshold = (WMI_RSSI_THRESHOLD_VAL) reply->range;
+    rssi = reply->rssi;
+
+    /*
+     * Identify the threshold breached and communicate that to the app. After
+     * that install a new set of thresholds based on the signal quality
+     * reported by the target
+     */
+    if (newThreshold) {
+        /* Upper threshold breached */
+        if (rssi < sq_thresh->upper_threshold[0]) {
+            A_DPRINTF(DBG_WMI, (DBGFMT "Spurious upper RSSI threshold event: "
+                      " %d\n", DBGARG, rssi));
+        } else if ((rssi < sq_thresh->upper_threshold[1]) &&
+                   (rssi >= sq_thresh->upper_threshold[0]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD1_ABOVE;
+        } else if ((rssi < sq_thresh->upper_threshold[2]) &&
+                   (rssi >= sq_thresh->upper_threshold[1]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD2_ABOVE;
+        } else if ((rssi < sq_thresh->upper_threshold[3]) &&
+                   (rssi >= sq_thresh->upper_threshold[2]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD3_ABOVE;
+        } else if ((rssi < sq_thresh->upper_threshold[4]) &&
+                   (rssi >= sq_thresh->upper_threshold[3]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD4_ABOVE;
+        } else if ((rssi < sq_thresh->upper_threshold[5]) &&
+                   (rssi >= sq_thresh->upper_threshold[4]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD5_ABOVE;
+        } else if (rssi >= sq_thresh->upper_threshold[5]) {
+            newThreshold = WMI_RSSI_THRESHOLD6_ABOVE;
+        }
+    } else {
+        /* Lower threshold breached */
+        if (rssi > sq_thresh->lower_threshold[0]) {
+            A_DPRINTF(DBG_WMI, (DBGFMT "Spurious lower RSSI threshold event: "
+                      "%d %d\n", DBGARG, rssi, sq_thresh->lower_threshold[0]));
+        } else if ((rssi > sq_thresh->lower_threshold[1]) &&
+                   (rssi <= sq_thresh->lower_threshold[0]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD6_BELOW;
+        } else if ((rssi > sq_thresh->lower_threshold[2]) &&
+                   (rssi <= sq_thresh->lower_threshold[1]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD5_BELOW;
+        } else if ((rssi > sq_thresh->lower_threshold[3]) &&
+                   (rssi <= sq_thresh->lower_threshold[2]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD4_BELOW;
+        } else if ((rssi > sq_thresh->lower_threshold[4]) &&
+                   (rssi <= sq_thresh->lower_threshold[3]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD3_BELOW;
+        } else if ((rssi > sq_thresh->lower_threshold[5]) &&
+                   (rssi <= sq_thresh->lower_threshold[4]))
+        {
+            newThreshold = WMI_RSSI_THRESHOLD2_BELOW;
+        } else if (rssi <= sq_thresh->lower_threshold[5]) {
+            newThreshold = WMI_RSSI_THRESHOLD1_BELOW;
+        }
+    }
+    /* Calculate and install the next set of thresholds */
+    lower_rssi_threshold = ar6000_get_lower_threshold(rssi, sq_thresh,
+                                      sq_thresh->lower_threshold_valid_count);
+    upper_rssi_threshold = ar6000_get_upper_threshold(rssi, sq_thresh,
+                                      sq_thresh->upper_threshold_valid_count);
+    /* Issue a wmi command to install the thresholds */
+    cmd.thresholdAbove1_Val = upper_rssi_threshold;
+    cmd.thresholdBelow1_Val = lower_rssi_threshold;
+    cmd.weight = sq_thresh->weight;
+    cmd.pollTime = sq_thresh->polling_interval;
+
+    rssi_event_value = rssi;
+
+    if (wmi_send_rssi_threshold_params(wmip, &cmd) != 0) {
+        A_DPRINTF(DBG_WMI, (DBGFMT "Unable to configure the RSSI thresholds\n",
+                  DBGARG));
+    }
+
+    A_WMI_RSSI_THRESHOLD_EVENT(wmip->wmi_devt, newThreshold, reply->rssi);
+
+    return 0;
+}
+
+
+static int
+wmi_reportErrorEvent_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_TARGET_ERROR_REPORT_EVENT *reply;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_TARGET_ERROR_REPORT_EVENT *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_REPORT_ERROR_EVENT(wmip->wmi_devt, (WMI_TARGET_ERROR_VAL) reply->errorVal);
+
+    return 0;
+}
+
+static int
+wmi_cac_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_CAC_EVENT *reply;
+    WMM_TSPEC_IE *tspec_ie;
+    u16 activeTsids;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_CAC_EVENT *)datap;
+
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    if ((reply->cac_indication == CAC_INDICATION_ADMISSION_RESP) &&
+        (reply->statusCode != TSPEC_STATUS_CODE_ADMISSION_ACCEPTED)) {
+        tspec_ie = (WMM_TSPEC_IE *) &(reply->tspecSuggestion);
+
+        wmi_delete_pstream_cmd(wmip, reply->ac,
+                (tspec_ie->tsInfo_info >> TSPEC_TSID_S) & TSPEC_TSID_MASK);
+    }
+    else if (reply->cac_indication == CAC_INDICATION_NO_RESP) {
+        u8 i;
+
+        /* following assumes that there is only one outstanding ADDTS request
+           when this event is received */
+        LOCK_WMI(wmip);
+        activeTsids = wmip->wmi_streamExistsForAC[reply->ac];
+        UNLOCK_WMI(wmip);
+
+        for (i = 0; i < sizeof(activeTsids) * 8; i++) {
+            if ((activeTsids >> i) & 1) {
+                break;
+            }
+        }
+        if (i < (sizeof(activeTsids) * 8)) {
+            wmi_delete_pstream_cmd(wmip, reply->ac, i);
+        }
+    }
+        /*
+         * Ev#72990: Clear active tsids and Add missing handling
+         * for delete qos stream from AP
+         */
+    else if (reply->cac_indication == CAC_INDICATION_DELETE) {
+        u8 tsid = 0;
+
+        tspec_ie = (WMM_TSPEC_IE *) &(reply->tspecSuggestion);
+        tsid= ((tspec_ie->tsInfo_info >> TSPEC_TSID_S) & TSPEC_TSID_MASK);
+        LOCK_WMI(wmip);
+        wmip->wmi_streamExistsForAC[reply->ac] &= ~(1<<tsid);
+        activeTsids = wmip->wmi_streamExistsForAC[reply->ac];
+        UNLOCK_WMI(wmip);
+
+
+        /* Indicate stream inactivity to driver layer only if all tsids
+         * within this AC are deleted.
+         */
+       if (!activeTsids) {
+           A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt, reply->ac);
+           wmip->wmi_fatPipeExists &= ~(1 << reply->ac);
+        }
+    }
+
+    A_WMI_CAC_EVENT(wmip->wmi_devt, reply->ac,
+                reply->cac_indication, reply->statusCode,
+                reply->tspecSuggestion);
+
+    return 0;
+}
+
+static int
+wmi_channel_change_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_CHANNEL_CHANGE_EVENT *reply;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_CHANNEL_CHANGE_EVENT *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_CHANNEL_CHANGE_EVENT(wmip->wmi_devt, reply->oldChannel,
+                               reply->newChannel);
+
+    return 0;
+}
+
+static int
+wmi_hbChallengeResp_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMIX_HB_CHALLENGE_RESP_EVENT *reply;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMIX_HB_CHALLENGE_RESP_EVENT *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "wmi: challenge response event\n", DBGARG));
+
+    A_WMI_HBCHALLENGERESP_EVENT(wmip->wmi_devt, reply->cookie, reply->source);
+
+    return 0;
+}
+
+static int
+wmi_roam_tbl_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_TARGET_ROAM_TBL *reply;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_TARGET_ROAM_TBL *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_ROAM_TABLE_EVENT(wmip->wmi_devt, reply);
+
+    return 0;
+}
+
+static int
+wmi_roam_data_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_TARGET_ROAM_DATA *reply;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_TARGET_ROAM_DATA *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_ROAM_DATA_EVENT(wmip->wmi_devt, reply);
+
+    return 0;
+}
+
+static int
+wmi_txRetryErrEvent_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    if (len < sizeof(WMI_TX_RETRY_ERR_EVENT)) {
+        return A_EINVAL;
+    }
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_TX_RETRY_ERR_EVENT(wmip->wmi_devt);
+
+    return 0;
+}
+
+static int
+wmi_snrThresholdEvent_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_SNR_THRESHOLD_EVENT *reply;
+    SQ_THRESHOLD_PARAMS *sq_thresh =
+           &wmip->wmi_SqThresholdParams[SIGNAL_QUALITY_METRICS_SNR];
+    WMI_SNR_THRESHOLD_VAL newThreshold;
+    WMI_SNR_THRESHOLD_PARAMS_CMD cmd;
+    u8 upper_snr_threshold, lower_snr_threshold;
+    s16 snr;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_SNR_THRESHOLD_EVENT *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    newThreshold = (WMI_SNR_THRESHOLD_VAL) reply->range;
+    snr = reply->snr;
+    /*
+     * Identify the threshold breached and communicate that to the app. After
+     * that install a new set of thresholds based on the signal quality
+     * reported by the target
+     */
+    if (newThreshold) {
+        /* Upper threshold breached */
+        if (snr < sq_thresh->upper_threshold[0]) {
+            A_DPRINTF(DBG_WMI, (DBGFMT "Spurious upper SNR threshold event: "
+                     "%d\n", DBGARG, snr));
+        } else if ((snr < sq_thresh->upper_threshold[1]) &&
+                   (snr >= sq_thresh->upper_threshold[0]))
+        {
+            newThreshold = WMI_SNR_THRESHOLD1_ABOVE;
+        } else if ((snr < sq_thresh->upper_threshold[2]) &&
+                   (snr >= sq_thresh->upper_threshold[1]))
+        {
+            newThreshold = WMI_SNR_THRESHOLD2_ABOVE;
+        } else if ((snr < sq_thresh->upper_threshold[3]) &&
+                   (snr >= sq_thresh->upper_threshold[2]))
+        {
+            newThreshold = WMI_SNR_THRESHOLD3_ABOVE;
+        } else if (snr >= sq_thresh->upper_threshold[3]) {
+            newThreshold = WMI_SNR_THRESHOLD4_ABOVE;
+        }
+    } else {
+        /* Lower threshold breached */
+        if (snr > sq_thresh->lower_threshold[0]) {
+            A_DPRINTF(DBG_WMI, (DBGFMT "Spurious lower SNR threshold event: "
+                      "%d %d\n", DBGARG, snr, sq_thresh->lower_threshold[0]));
+        } else if ((snr > sq_thresh->lower_threshold[1]) &&
+                   (snr <= sq_thresh->lower_threshold[0]))
+        {
+            newThreshold = WMI_SNR_THRESHOLD4_BELOW;
+        } else if ((snr > sq_thresh->lower_threshold[2]) &&
+                   (snr <= sq_thresh->lower_threshold[1]))
+        {
+            newThreshold = WMI_SNR_THRESHOLD3_BELOW;
+        } else if ((snr > sq_thresh->lower_threshold[3]) &&
+                   (snr <= sq_thresh->lower_threshold[2]))
+        {
+            newThreshold = WMI_SNR_THRESHOLD2_BELOW;
+        } else if (snr <= sq_thresh->lower_threshold[3]) {
+            newThreshold = WMI_SNR_THRESHOLD1_BELOW;
+        }
+    }
+
+    /* Calculate and install the next set of thresholds */
+    lower_snr_threshold = ar6000_get_lower_threshold(snr, sq_thresh,
+                                      sq_thresh->lower_threshold_valid_count);
+    upper_snr_threshold = ar6000_get_upper_threshold(snr, sq_thresh,
+                                      sq_thresh->upper_threshold_valid_count);
+
+    /* Issue a wmi command to install the thresholds */
+    cmd.thresholdAbove1_Val = upper_snr_threshold;
+    cmd.thresholdBelow1_Val = lower_snr_threshold;
+    cmd.weight = sq_thresh->weight;
+    cmd.pollTime = sq_thresh->polling_interval;
+
+    A_DPRINTF(DBG_WMI, (DBGFMT "snr: %d, threshold: %d, lower: %d, upper: %d\n"
+              ,DBGARG, snr, newThreshold, lower_snr_threshold,
+              upper_snr_threshold));
+
+    snr_event_value = snr;
+
+    if (wmi_send_snr_threshold_params(wmip, &cmd) != 0) {
+        A_DPRINTF(DBG_WMI, (DBGFMT "Unable to configure the SNR thresholds\n",
+                  DBGARG));
+    }
+    A_WMI_SNR_THRESHOLD_EVENT_RX(wmip->wmi_devt, newThreshold, reply->snr);
+
+    return 0;
+}
+
+static int
+wmi_lqThresholdEvent_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_LQ_THRESHOLD_EVENT *reply;
+
+    if (len < sizeof(*reply)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_LQ_THRESHOLD_EVENT *)datap;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_LQ_THRESHOLD_EVENT_RX(wmip->wmi_devt,
+                                (WMI_LQ_THRESHOLD_VAL) reply->range,
+                                reply->lq);
+
+    return 0;
+}
+
+static int
+wmi_aplistEvent_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    u16 ap_info_entry_size;
+    WMI_APLIST_EVENT *ev = (WMI_APLIST_EVENT *)datap;
+    WMI_AP_INFO_V1 *ap_info_v1;
+    u8 i;
+
+    if (len < sizeof(WMI_APLIST_EVENT)) {
+        return A_EINVAL;
+    }
+
+    if (ev->apListVer == APLIST_VER1) {
+        ap_info_entry_size = sizeof(WMI_AP_INFO_V1);
+        ap_info_v1 = (WMI_AP_INFO_V1 *)ev->apList;
+    } else {
+        return A_EINVAL;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Number of APs in APLIST Event is %d\n", ev->numAP));
+    if (len < (int)(sizeof(WMI_APLIST_EVENT) +
+              (ev->numAP - 1) * ap_info_entry_size))
+    {
+        return A_EINVAL;
+    }
+
+    /*
+     * AP List Ver1 Contents
+     */
+    for (i = 0; i < ev->numAP; i++) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("AP#%d BSSID %2.2x %2.2x %2.2x %2.2x %2.2x %2.2x "\
+                    "Channel %d\n", i,
+                   ap_info_v1->bssid[0], ap_info_v1->bssid[1],
+                   ap_info_v1->bssid[2], ap_info_v1->bssid[3],
+                   ap_info_v1->bssid[4], ap_info_v1->bssid[5],
+                   ap_info_v1->channel));
+        ap_info_v1++;
+    }
+    return 0;
+}
+
+static int
+wmi_dbglog_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    u32 dropped;
+
+    dropped = *((u32 *)datap);
+    datap += sizeof(dropped);
+    len -= sizeof(dropped);
+    A_WMI_DBGLOG_EVENT(wmip->wmi_devt, dropped, (s8 *)datap, len);
+    return 0;
+}
+
+/*
+ * Called to send a wmi command. Command specific data is already built
+ * on osbuf and current osbuf->data points to it.
+ */
+int
+wmi_cmd_send(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
+               WMI_SYNC_FLAG syncflag)
+{
+    int status;
+#define IS_OPT_TX_CMD(cmdId) ((cmdId == WMI_OPT_TX_FRAME_CMDID))
+    WMI_CMD_HDR         *cHdr;
+    HTC_ENDPOINT_ID     eid  = wmip->wmi_endpoint_id;
+
+    A_ASSERT(osbuf != NULL);
+
+    if (syncflag >= END_WMIFLAG) {
+        A_NETBUF_FREE(osbuf);
+        return A_EINVAL;
+    }
+
+    if ((syncflag == SYNC_BEFORE_WMIFLAG) || (syncflag == SYNC_BOTH_WMIFLAG)) {
+        /*
+         * We want to make sure all data currently queued is transmitted before
+         * the cmd execution.  Establish a new sync point.
+         */
+        wmi_sync_point(wmip);
+    }
+
+    if (A_NETBUF_PUSH(osbuf, sizeof(WMI_CMD_HDR)) != 0) {
+        A_NETBUF_FREE(osbuf);
+        return A_NO_MEMORY;
+    }
+
+    cHdr = (WMI_CMD_HDR *)A_NETBUF_DATA(osbuf);
+    cHdr->commandId = (u16) cmdId;
+    cHdr->info1 = 0; // added for virtual interface
+
+    /*
+     * Only for OPT_TX_CMD, use BE endpoint.
+     */
+    if (IS_OPT_TX_CMD(cmdId)) {
+        if ((status=wmi_data_hdr_add(wmip, osbuf, OPT_MSGTYPE, false, false,0,NULL)) != 0) {
+            A_NETBUF_FREE(osbuf);
+            return status;
+        }
+        eid = A_WMI_Ac2EndpointID(wmip->wmi_devt, WMM_AC_BE);
+    }
+    A_WMI_CONTROL_TX(wmip->wmi_devt, osbuf, eid);
+
+    if ((syncflag == SYNC_AFTER_WMIFLAG) || (syncflag == SYNC_BOTH_WMIFLAG)) {
+        /*
+         * We want to make sure all new data queued waits for the command to
+         * execute. Establish a new sync point.
+         */
+        wmi_sync_point(wmip);
+    }
+    return (0);
+#undef IS_OPT_TX_CMD
+}
+
+int
+wmi_cmd_send_xtnd(struct wmi_t *wmip, void *osbuf, WMIX_COMMAND_ID cmdId,
+                  WMI_SYNC_FLAG syncflag)
+{
+    WMIX_CMD_HDR     *cHdr;
+
+    if (A_NETBUF_PUSH(osbuf, sizeof(WMIX_CMD_HDR)) != 0) {
+        A_NETBUF_FREE(osbuf);
+        return A_NO_MEMORY;
+    }
+
+    cHdr = (WMIX_CMD_HDR *)A_NETBUF_DATA(osbuf);
+    cHdr->commandId = (u32) cmdId;
+
+    return wmi_cmd_send(wmip, osbuf, WMI_EXTENSION_CMDID, syncflag);
+}
+
+int
+wmi_connect_cmd(struct wmi_t *wmip, NETWORK_TYPE netType,
+                DOT11_AUTH_MODE dot11AuthMode, AUTH_MODE authMode,
+                CRYPTO_TYPE pairwiseCrypto, u8 pairwiseCryptoLen,
+                CRYPTO_TYPE groupCrypto, u8 groupCryptoLen,
+                int ssidLength, u8 *ssid,
+                u8 *bssid, u16 channel, u32 ctrl_flags)
+{
+    void *osbuf;
+    WMI_CONNECT_CMD *cc;
+    wmip->wmi_traffic_class = 100;
+
+    if ((pairwiseCrypto == NONE_CRYPT) && (groupCrypto != NONE_CRYPT)) {
+        return A_EINVAL;
+    }
+    if ((pairwiseCrypto != NONE_CRYPT) && (groupCrypto == NONE_CRYPT)) {
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_CONNECT_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_CONNECT_CMD));
+
+    cc = (WMI_CONNECT_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cc, sizeof(*cc));
+
+    if (ssidLength)
+    {
+        memcpy(cc->ssid, ssid, ssidLength);
+    }
+
+    cc->ssidLength          = ssidLength;
+    cc->networkType         = netType;
+    cc->dot11AuthMode       = dot11AuthMode;
+    cc->authMode            = authMode;
+    cc->pairwiseCryptoType  = pairwiseCrypto;
+    cc->pairwiseCryptoLen   = pairwiseCryptoLen;
+    cc->groupCryptoType     = groupCrypto;
+    cc->groupCryptoLen      = groupCryptoLen;
+    cc->channel             = channel;
+    cc->ctrl_flags          = ctrl_flags;
+
+    if (bssid != NULL) {
+        memcpy(cc->bssid, bssid, ATH_MAC_LEN);
+    }
+
+    wmip->wmi_pair_crypto_type  = pairwiseCrypto;
+    wmip->wmi_grp_crypto_type   = groupCrypto;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_CONNECT_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_reconnect_cmd(struct wmi_t *wmip, u8 *bssid, u16 channel)
+{
+    void *osbuf;
+    WMI_RECONNECT_CMD *cc;
+    wmip->wmi_traffic_class = 100;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_RECONNECT_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_RECONNECT_CMD));
+
+    cc = (WMI_RECONNECT_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cc, sizeof(*cc));
+
+    cc->channel = channel;
+
+    if (bssid != NULL) {
+        memcpy(cc->bssid, bssid, ATH_MAC_LEN);
+    }
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_RECONNECT_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_disconnect_cmd(struct wmi_t *wmip)
+{
+    int status;
+    wmip->wmi_traffic_class = 100;
+
+    /* Bug fix for 24817(elevator bug) - the disconnect command does not
+       need to do a SYNC before.*/
+    status = wmi_simple_cmd(wmip, WMI_DISCONNECT_CMDID);
+
+    return status;
+}
+
+int
+wmi_startscan_cmd(struct wmi_t *wmip, WMI_SCAN_TYPE scanType,
+                  u32 forceFgScan, u32 isLegacy,
+                  u32 homeDwellTime, u32 forceScanInterval,
+                  s8 numChan, u16 *channelList)
+{
+    void *osbuf;
+    WMI_START_SCAN_CMD *sc;
+    s8 size;
+
+    size = sizeof (*sc);
+
+    if ((scanType != WMI_LONG_SCAN) && (scanType != WMI_SHORT_SCAN)) {
+        return A_EINVAL;
+    }
+
+    if (numChan) {
+        if (numChan > WMI_MAX_CHANNELS) {
+            return A_EINVAL;
+        }
+        size += sizeof(u16) * (numChan - 1);
+    }
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    sc = (WMI_START_SCAN_CMD *)(A_NETBUF_DATA(osbuf));
+    sc->scanType = scanType;
+    sc->forceFgScan = forceFgScan;
+    sc->isLegacy = isLegacy;
+    sc->homeDwellTime = homeDwellTime;
+    sc->forceScanInterval = forceScanInterval;
+    sc->numChannels = numChan;
+    if (numChan) {
+        memcpy(sc->channelList, channelList, numChan * sizeof(u16));
+    }
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_START_SCAN_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_scanparams_cmd(struct wmi_t *wmip, u16 fg_start_sec,
+                   u16 fg_end_sec, u16 bg_sec,
+                   u16 minact_chdw_msec, u16 maxact_chdw_msec,
+                   u16 pas_chdw_msec,
+                   u8 shScanRatio, u8 scanCtrlFlags,
+                   u32 max_dfsch_act_time, u16 maxact_scan_per_ssid)
+{
+    void *osbuf;
+    WMI_SCAN_PARAMS_CMD *sc;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*sc));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*sc));
+
+    sc = (WMI_SCAN_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(sc, sizeof(*sc));
+    sc->fg_start_period  = fg_start_sec;
+    sc->fg_end_period    = fg_end_sec;
+    sc->bg_period        = bg_sec;
+    sc->minact_chdwell_time = minact_chdw_msec;
+    sc->maxact_chdwell_time = maxact_chdw_msec;
+    sc->pas_chdwell_time = pas_chdw_msec;
+    sc->shortScanRatio   = shScanRatio;
+    sc->scanCtrlFlags    = scanCtrlFlags;
+    sc->max_dfsch_act_time = max_dfsch_act_time;
+    sc->maxact_scan_per_ssid = maxact_scan_per_ssid;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_SCAN_PARAMS_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_bssfilter_cmd(struct wmi_t *wmip, u8 filter, u32 ieMask)
+{
+    void *osbuf;
+    WMI_BSS_FILTER_CMD *cmd;
+
+    if (filter >= LAST_BSS_FILTER) {
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_BSS_FILTER_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->bssFilter = filter;
+    cmd->ieMask = ieMask;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BSS_FILTER_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_probedSsid_cmd(struct wmi_t *wmip, u8 index, u8 flag,
+                   u8 ssidLength, u8 *ssid)
+{
+    void *osbuf;
+    WMI_PROBED_SSID_CMD *cmd;
+
+    if (index > MAX_PROBED_SSID_INDEX) {
+        return A_EINVAL;
+    }
+    if (ssidLength > sizeof(cmd->ssid)) {
+        return A_EINVAL;
+    }
+    if ((flag & (DISABLE_SSID_FLAG | ANY_SSID_FLAG)) && (ssidLength > 0)) {
+        return A_EINVAL;
+    }
+    if ((flag & SPECIFIC_SSID_FLAG) && !ssidLength) {
+        return A_EINVAL;
+    }
+
+    if (flag & SPECIFIC_SSID_FLAG) {
+        is_probe_ssid = true;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_PROBED_SSID_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->entryIndex = index;
+    cmd->flag       = flag;
+    cmd->ssidLength = ssidLength;
+    memcpy(cmd->ssid, ssid, ssidLength);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_PROBED_SSID_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_listeninterval_cmd(struct wmi_t *wmip, u16 listenInterval, u16 listenBeacons)
+{
+    void *osbuf;
+    WMI_LISTEN_INT_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_LISTEN_INT_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->listenInterval = listenInterval;
+    cmd->numBeacons = listenBeacons;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_LISTEN_INT_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_bmisstime_cmd(struct wmi_t *wmip, u16 bmissTime, u16 bmissBeacons)
+{
+    void *osbuf;
+    WMI_BMISS_TIME_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_BMISS_TIME_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->bmissTime = bmissTime;
+    cmd->numBeacons =  bmissBeacons;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BMISS_TIME_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_associnfo_cmd(struct wmi_t *wmip, u8 ieType,
+                     u8 ieLen, u8 *ieInfo)
+{
+    void *osbuf;
+    WMI_SET_ASSOC_INFO_CMD *cmd;
+    u16 cmdLen;
+
+    cmdLen = sizeof(*cmd) + ieLen - 1;
+    osbuf = A_NETBUF_ALLOC(cmdLen);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, cmdLen);
+
+    cmd = (WMI_SET_ASSOC_INFO_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, cmdLen);
+    cmd->ieType = ieType;
+    cmd->bufferSize = ieLen;
+    memcpy(cmd->assocInfo, ieInfo, ieLen);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_ASSOC_INFO_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_powermode_cmd(struct wmi_t *wmip, u8 powerMode)
+{
+    void *osbuf;
+    WMI_POWER_MODE_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_POWER_MODE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->powerMode = powerMode;
+    wmip->wmi_powerMode = powerMode;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWER_MODE_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_ibsspmcaps_cmd(struct wmi_t *wmip, u8 pmEnable, u8 ttl,
+                   u16 atim_windows, u16 timeout_value)
+{
+    void *osbuf;
+    WMI_IBSS_PM_CAPS_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_IBSS_PM_CAPS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->power_saving = pmEnable;
+    cmd->ttl = ttl;
+    cmd->atim_windows = atim_windows;
+    cmd->timeout_value = timeout_value;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_IBSS_PM_CAPS_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_apps_cmd(struct wmi_t *wmip, u8 psType, u32 idle_time,
+                   u32 ps_period, u8 sleep_period)
+{
+    void *osbuf;
+    WMI_AP_PS_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_AP_PS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->psType = psType;
+    cmd->idle_time = idle_time;
+    cmd->ps_period = ps_period;
+    cmd->sleep_period = sleep_period;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_AP_PS_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_pmparams_cmd(struct wmi_t *wmip, u16 idlePeriod,
+                 u16 psPollNum, u16 dtimPolicy,
+                 u16 tx_wakeup_policy, u16 num_tx_to_wakeup,
+                 u16 ps_fail_event_policy)
+{
+    void *osbuf;
+    WMI_POWER_PARAMS_CMD *pm;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*pm));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*pm));
+
+    pm = (WMI_POWER_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(pm, sizeof(*pm));
+    pm->idle_period   = idlePeriod;
+    pm->pspoll_number = psPollNum;
+    pm->dtim_policy   = dtimPolicy;
+    pm->tx_wakeup_policy = tx_wakeup_policy;
+    pm->num_tx_to_wakeup = num_tx_to_wakeup;
+    pm->ps_fail_event_policy = ps_fail_event_policy;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWER_PARAMS_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_disctimeout_cmd(struct wmi_t *wmip, u8 timeout)
+{
+    void *osbuf;
+    WMI_DISC_TIMEOUT_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_DISC_TIMEOUT_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->disconnectTimeout = timeout;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_DISC_TIMEOUT_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_addKey_cmd(struct wmi_t *wmip, u8 keyIndex, CRYPTO_TYPE keyType,
+               u8 keyUsage, u8 keyLength, u8 *keyRSC,
+               u8 *keyMaterial, u8 key_op_ctrl, u8 *macAddr,
+               WMI_SYNC_FLAG sync_flag)
+{
+    void *osbuf;
+    WMI_ADD_CIPHER_KEY_CMD *cmd;
+
+    if ((keyIndex > WMI_MAX_KEY_INDEX) || (keyLength > WMI_MAX_KEY_LEN) ||
+        (keyMaterial == NULL))
+    {
+        return A_EINVAL;
+    }
+
+    if ((WEP_CRYPT != keyType) && (NULL == keyRSC)) {
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_ADD_CIPHER_KEY_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->keyIndex = keyIndex;
+    cmd->keyType  = keyType;
+    cmd->keyUsage = keyUsage;
+    cmd->keyLength = keyLength;
+    memcpy(cmd->key, keyMaterial, keyLength);
+#ifdef WAPI_ENABLE
+    if (NULL != keyRSC && key_op_ctrl != KEY_OP_INIT_WAPIPN) {
+#else
+    if (NULL != keyRSC) {
+#endif // WAPI_ENABLE
+        memcpy(cmd->keyRSC, keyRSC, sizeof(cmd->keyRSC));
+    }
+    cmd->key_op_ctrl = key_op_ctrl;
+
+    if(macAddr) {
+        memcpy(cmd->key_macaddr,macAddr,IEEE80211_ADDR_LEN);
+    }
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_ADD_CIPHER_KEY_CMDID, sync_flag));
+}
+
+int
+wmi_add_krk_cmd(struct wmi_t *wmip, u8 *krk)
+{
+    void *osbuf;
+    WMI_ADD_KRK_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_ADD_KRK_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    memcpy(cmd->krk, krk, WMI_KRK_LEN);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_ADD_KRK_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_delete_krk_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd(wmip, WMI_DELETE_KRK_CMDID);
+}
+
+int
+wmi_deleteKey_cmd(struct wmi_t *wmip, u8 keyIndex)
+{
+    void *osbuf;
+    WMI_DELETE_CIPHER_KEY_CMD *cmd;
+
+    if (keyIndex > WMI_MAX_KEY_INDEX) {
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_DELETE_CIPHER_KEY_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->keyIndex = keyIndex;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_CIPHER_KEY_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_setPmkid_cmd(struct wmi_t *wmip, u8 *bssid, u8 *pmkId,
+                 bool set)
+{
+    void *osbuf;
+    WMI_SET_PMKID_CMD *cmd;
+
+    if (bssid == NULL) {
+        return A_EINVAL;
+    }
+
+    if ((set == true) && (pmkId == NULL)) {
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_PMKID_CMD *)(A_NETBUF_DATA(osbuf));
+    memcpy(cmd->bssid, bssid, sizeof(cmd->bssid));
+    if (set == true) {
+        memcpy(cmd->pmkid, pmkId, sizeof(cmd->pmkid));
+        cmd->enable = PMKID_ENABLE;
+    } else {
+        A_MEMZERO(cmd->pmkid, sizeof(cmd->pmkid));
+        cmd->enable = PMKID_DISABLE;
+    }
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_PMKID_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_tkip_countermeasures_cmd(struct wmi_t *wmip, bool en)
+{
+    void *osbuf;
+    WMI_SET_TKIP_COUNTERMEASURES_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_TKIP_COUNTERMEASURES_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->cm_en = (en == true)? WMI_TKIP_CM_ENABLE : WMI_TKIP_CM_DISABLE;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_TKIP_COUNTERMEASURES_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_akmp_params_cmd(struct wmi_t *wmip,
+                        WMI_SET_AKMP_PARAMS_CMD *akmpParams)
+{
+    void *osbuf;
+    WMI_SET_AKMP_PARAMS_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+    cmd = (WMI_SET_AKMP_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->akmpInfo = akmpParams->akmpInfo;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_AKMP_PARAMS_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_pmkid_list_cmd(struct wmi_t *wmip,
+                       WMI_SET_PMKID_LIST_CMD *pmkInfo)
+{
+    void *osbuf;
+    WMI_SET_PMKID_LIST_CMD *cmd;
+    u16 cmdLen;
+    u8 i;
+
+    cmdLen = sizeof(pmkInfo->numPMKID) +
+             pmkInfo->numPMKID * sizeof(WMI_PMKID);
+
+    osbuf = A_NETBUF_ALLOC(cmdLen);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, cmdLen);
+    cmd = (WMI_SET_PMKID_LIST_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->numPMKID = pmkInfo->numPMKID;
+
+    for (i = 0; i < cmd->numPMKID; i++) {
+        memcpy(&cmd->pmkidList[i], &pmkInfo->pmkidList[i],
+                 WMI_PMKID_LEN);
+    }
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_PMKID_LIST_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_get_pmkid_list_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd(wmip, WMI_GET_PMKID_LIST_CMDID);
+}
+
+int
+wmi_dataSync_send(struct wmi_t *wmip, void *osbuf, HTC_ENDPOINT_ID eid)
+{
+    WMI_DATA_HDR     *dtHdr;
+
+    A_ASSERT( eid != wmip->wmi_endpoint_id);
+    A_ASSERT(osbuf != NULL);
+
+    if (A_NETBUF_PUSH(osbuf, sizeof(WMI_DATA_HDR)) != 0) {
+        return A_NO_MEMORY;
+    }
+
+    dtHdr = (WMI_DATA_HDR *)A_NETBUF_DATA(osbuf);
+    dtHdr->info =
+      (SYNC_MSGTYPE & WMI_DATA_HDR_MSG_TYPE_MASK) << WMI_DATA_HDR_MSG_TYPE_SHIFT;
+
+    dtHdr->info3 = 0;
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter - eid %d\n", DBGARG, eid));
+
+    return (A_WMI_CONTROL_TX(wmip->wmi_devt, osbuf, eid));
+}
+
+typedef struct _WMI_DATA_SYNC_BUFS {
+    u8 trafficClass;
+    void               *osbuf;
+}WMI_DATA_SYNC_BUFS;
+
+static int
+wmi_sync_point(struct wmi_t *wmip)
+{
+    void *cmd_osbuf;
+    WMI_SYNC_CMD *cmd;
+    WMI_DATA_SYNC_BUFS dataSyncBufs[WMM_NUM_AC];
+    u8 i,numPriStreams=0;
+    int status = 0;
+
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    memset(dataSyncBufs,0,sizeof(dataSyncBufs));
+
+    /* lock out while we walk through the priority list and assemble our local array */
+    LOCK_WMI(wmip);
+
+    for (i=0; i < WMM_NUM_AC ; i++) {
+        if (wmip->wmi_fatPipeExists & (1 << i)) {
+            numPriStreams++;
+            dataSyncBufs[numPriStreams-1].trafficClass = i;
+        }
+    }
+
+    UNLOCK_WMI(wmip);
+
+    /* dataSyncBufs is now filled with entries (starting at index 0) containing valid streamIDs */
+
+    do {
+        /*
+         * We allocate all network buffers needed so we will be able to
+         * send all required frames.
+         */
+        cmd_osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+        if (cmd_osbuf == NULL) {
+            status = A_NO_MEMORY;
+            break;
+    }
+
+        A_NETBUF_PUT(cmd_osbuf, sizeof(*cmd));
+
+        cmd = (WMI_SYNC_CMD *)(A_NETBUF_DATA(cmd_osbuf));
+        A_MEMZERO(cmd, sizeof(*cmd));
+
+        /* In the SYNC cmd sent on the control Ep, send a bitmap of the data
+         * eps on which the Data Sync will be sent
+         */
+        cmd->dataSyncMap = wmip->wmi_fatPipeExists;
+
+        for (i=0; i < numPriStreams ; i++) {
+            dataSyncBufs[i].osbuf = A_NETBUF_ALLOC(0);
+            if (dataSyncBufs[i].osbuf == NULL) {
+                status = A_NO_MEMORY;
+                break;
+            }
+        } //end for
+
+        /* if Buffer allocation for any of the dataSync fails, then do not
+         * send the Synchronize cmd on the control ep
+         */
+        if (status) {
+            break;
+        }
+
+    /*
+     * Send sync cmd followed by sync data messages on all endpoints being
+     * used
+     */
+    status = wmi_cmd_send(wmip, cmd_osbuf, WMI_SYNCHRONIZE_CMDID,
+                          NO_SYNC_WMIFLAG);
+
+        if (status) {
+            break;
+    }
+            /* cmd buffer sent, we no longer own it */
+        cmd_osbuf = NULL;
+
+        for(i=0; i < numPriStreams; i++) {
+            A_ASSERT(dataSyncBufs[i].osbuf != NULL);
+            status = wmi_dataSync_send(wmip,
+                                       dataSyncBufs[i].osbuf,
+                                       A_WMI_Ac2EndpointID(wmip->wmi_devt,
+                                                            dataSyncBufs[i].
+                                                            trafficClass)
+                                      );
+
+            if (status) {
+                break;
+            }
+            /* we don't own this buffer anymore, NULL it out of the array so it
+             * won't get cleaned up */
+            dataSyncBufs[i].osbuf = NULL;
+        } //end for
+
+    } while(false);
+
+    /* free up any resources left over (possibly due to an error) */
+
+    if (cmd_osbuf != NULL) {
+        A_NETBUF_FREE(cmd_osbuf);
+            }
+
+    for (i = 0; i < numPriStreams; i++) {
+        if (dataSyncBufs[i].osbuf != NULL) {
+            A_NETBUF_FREE(dataSyncBufs[i].osbuf);
+        }
+    }
+
+    return (status);
+}
+
+int
+wmi_create_pstream_cmd(struct wmi_t *wmip, WMI_CREATE_PSTREAM_CMD *params)
+{
+    void *osbuf;
+    WMI_CREATE_PSTREAM_CMD *cmd;
+    u8 fatPipeExistsForAC=0;
+    s32 minimalPHY = 0;
+    s32 nominalPHY = 0;
+
+    /* Validate all the parameters. */
+    if( !((params->userPriority < 8) &&
+         (params->userPriority <= 0x7) &&
+         (convert_userPriority_to_trafficClass(params->userPriority) == params->trafficClass)  &&
+         (params->trafficDirection == UPLINK_TRAFFIC ||
+            params->trafficDirection == DNLINK_TRAFFIC ||
+            params->trafficDirection == BIDIR_TRAFFIC) &&
+         (params->trafficType == TRAFFIC_TYPE_APERIODIC ||
+            params->trafficType == TRAFFIC_TYPE_PERIODIC ) &&
+         (params->voicePSCapability == DISABLE_FOR_THIS_AC  ||
+            params->voicePSCapability == ENABLE_FOR_THIS_AC ||
+            params->voicePSCapability == ENABLE_FOR_ALL_AC) &&
+         (params->tsid == WMI_IMPLICIT_PSTREAM || params->tsid <= WMI_MAX_THINSTREAM)) )
+    {
+        return  A_EINVAL;
+    }
+
+    //
+    // check nominal PHY rate is >= minimalPHY, so that DUT
+    // can allow TSRS IE
+    //
+
+    // get the physical rate
+    minimalPHY = ((params->minPhyRate / 1000)/1000); // unit of bps
+
+    // check minimal phy < nominal phy rate
+    //
+    if (params->nominalPHY >= minimalPHY)
+    {
+        nominalPHY = (params->nominalPHY * 1000)/500; // unit of 500 kbps
+        A_DPRINTF(DBG_WMI,
+                  (DBGFMT "TSRS IE Enabled::MinPhy %x->NominalPhy ===> %x\n", DBGARG,
+                  minimalPHY, nominalPHY));
+
+        params->nominalPHY = nominalPHY;
+    }
+    else
+    {
+        params->nominalPHY = 0;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    A_DPRINTF(DBG_WMI,
+        (DBGFMT "Sending create_pstream_cmd: ac=%d    tsid:%d\n", DBGARG,
+        params->trafficClass, params->tsid));
+
+    cmd = (WMI_CREATE_PSTREAM_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    memcpy(cmd, params, sizeof(*cmd));
+
+        /* this is an implicitly created Fat pipe */
+    if ((u32)params->tsid == (u32)WMI_IMPLICIT_PSTREAM) {
+        LOCK_WMI(wmip);
+        fatPipeExistsForAC = (wmip->wmi_fatPipeExists & (1 << params->trafficClass));
+        wmip->wmi_fatPipeExists |= (1<<params->trafficClass);
+        UNLOCK_WMI(wmip);
+    } else {
+            /* this is an explicitly created thin stream within a fat pipe */
+    LOCK_WMI(wmip);
+        fatPipeExistsForAC = (wmip->wmi_fatPipeExists & (1 << params->trafficClass));
+    wmip->wmi_streamExistsForAC[params->trafficClass] |= (1<<params->tsid);
+            /* if a thinstream becomes active, the fat pipe automatically
+            * becomes active
+            */
+        wmip->wmi_fatPipeExists |= (1<<params->trafficClass);
+    UNLOCK_WMI(wmip);
+    }
+
+        /* Indicate activty change to driver layer only if this is the
+         * first TSID to get created in this AC explicitly or an implicit
+         * fat pipe is getting created.
+         */
+    if (!fatPipeExistsForAC) {
+        A_WMI_STREAM_TX_ACTIVE(wmip->wmi_devt, params->trafficClass);
+    }
+
+    /* mike: should be SYNC_BEFORE_WMIFLAG */
+    return (wmi_cmd_send(wmip, osbuf, WMI_CREATE_PSTREAM_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_delete_pstream_cmd(struct wmi_t *wmip, u8 trafficClass, u8 tsid)
+{
+    void *osbuf;
+    WMI_DELETE_PSTREAM_CMD *cmd;
+    int status;
+    u16 activeTsids=0;
+
+    /* validate the parameters */
+    if (trafficClass > 3) {
+        A_DPRINTF(DBG_WMI, (DBGFMT "Invalid trafficClass: %d\n", DBGARG, trafficClass));
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_DELETE_PSTREAM_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+
+    cmd->trafficClass = trafficClass;
+    cmd->tsid = tsid;
+
+    LOCK_WMI(wmip);
+    activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
+    UNLOCK_WMI(wmip);
+
+        /* Check if the tsid was created & exists */
+    if (!(activeTsids & (1<<tsid))) {
+
+        A_NETBUF_FREE(osbuf);
+        A_DPRINTF(DBG_WMI,
+        (DBGFMT "TSID %d does'nt exist for trafficClass: %d\n", DBGARG, tsid, trafficClass));
+            /* TODO: return a more appropriate err code */
+        return A_ERROR;
+    }
+
+    A_DPRINTF(DBG_WMI,
+        (DBGFMT "Sending delete_pstream_cmd: trafficClass: %d tsid=%d\n", DBGARG, trafficClass, tsid));
+
+    status = (wmi_cmd_send(wmip, osbuf, WMI_DELETE_PSTREAM_CMDID,
+                         SYNC_BEFORE_WMIFLAG));
+
+    LOCK_WMI(wmip);
+    wmip->wmi_streamExistsForAC[trafficClass] &= ~(1<<tsid);
+    activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
+    UNLOCK_WMI(wmip);
+
+
+        /* Indicate stream inactivity to driver layer only if all tsids
+         * within this AC are deleted.
+         */
+    if(!activeTsids) {
+        A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt, trafficClass);
+        wmip->wmi_fatPipeExists &= ~(1<<trafficClass);
+    }
+
+    return status;
+}
+
+int
+wmi_set_framerate_cmd(struct wmi_t *wmip, u8 bEnable, u8 type, u8 subType, u16 rateMask)
+{
+    void *osbuf;
+    WMI_FRAME_RATES_CMD *cmd;
+    u8 frameType;
+
+    A_DPRINTF(DBG_WMI,
+        (DBGFMT " type %02X, subType %02X, rateMask %04x\n", DBGARG, type, subType, rateMask));
+
+    if((type != IEEE80211_FRAME_TYPE_MGT && type != IEEE80211_FRAME_TYPE_CTL) ||
+        (subType > 15)){
+
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_FRAME_RATES_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+
+    frameType = (u8)((subType << 4) | type);
+
+    cmd->bEnableMask = bEnable;
+    cmd->frameType = frameType;
+    cmd->frameRateMask = rateMask;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_FRAMERATES_CMDID, NO_SYNC_WMIFLAG));
+}
+
+/*
+ * used to set the bit rate.  rate is in Kbps.  If rate == -1
+ * then auto selection is used.
+ */
+int
+wmi_set_bitrate_cmd(struct wmi_t *wmip, s32 dataRate, s32 mgmtRate, s32 ctlRate)
+{
+    void *osbuf;
+    WMI_BIT_RATE_CMD *cmd;
+    s8 drix, mrix, crix, ret_val;
+
+    if (dataRate != -1) {
+        ret_val = wmi_validate_bitrate(wmip, dataRate, &drix);
+        if(ret_val == A_EINVAL){
+            return A_EINVAL;
+        }
+    } else {
+        drix = -1;
+    }
+
+    if (mgmtRate != -1) {
+        ret_val = wmi_validate_bitrate(wmip, mgmtRate, &mrix);
+        if(ret_val == A_EINVAL){
+            return A_EINVAL;
+        }
+    } else {
+        mrix = -1;
+    }
+    if (ctlRate != -1) {
+        ret_val = wmi_validate_bitrate(wmip, ctlRate, &crix);
+        if(ret_val == A_EINVAL){
+            return A_EINVAL;
+        }
+    } else {
+        crix = -1;
+    }
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_BIT_RATE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+
+    cmd->rateIndex = drix;
+    cmd->mgmtRateIndex = mrix;
+    cmd->ctlRateIndex  = crix;
+
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BITRATE_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_get_bitrate_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd(wmip, WMI_GET_BITRATE_CMDID);
+}
+
+/*
+ * Returns true iff the given rate index is legal in the current PHY mode.
+ */
+bool
+wmi_is_bitrate_index_valid(struct wmi_t *wmip, s32 rateIndex)
+{
+    WMI_PHY_MODE phyMode = (WMI_PHY_MODE) wmip->wmi_phyMode;
+    bool isValid = true;
+    switch(phyMode) {
+        case WMI_11A_MODE:
+            if (wmip->wmi_ht_allowed[A_BAND_5GHZ]){
+                if ((rateIndex < MODE_A_SUPPORT_RATE_START) || (rateIndex > MODE_GHT20_SUPPORT_RATE_STOP)) {
+                    isValid = false;
+                }
+            } else {
+                if ((rateIndex < MODE_A_SUPPORT_RATE_START) || (rateIndex > MODE_A_SUPPORT_RATE_STOP)) {
+                    isValid = false;
+                }
+            }
+            break;
+
+        case WMI_11B_MODE:
+            if ((rateIndex < MODE_B_SUPPORT_RATE_START) || (rateIndex > MODE_B_SUPPORT_RATE_STOP)) {
+                isValid = false;
+            }
+            break;
+
+        case WMI_11GONLY_MODE:
+            if (wmip->wmi_ht_allowed[A_BAND_24GHZ]){
+                if ((rateIndex < MODE_GONLY_SUPPORT_RATE_START) || (rateIndex > MODE_GHT20_SUPPORT_RATE_STOP)) {
+                    isValid = false;
+                }
+            } else {
+                if ((rateIndex < MODE_GONLY_SUPPORT_RATE_START) || (rateIndex > MODE_GONLY_SUPPORT_RATE_STOP)) {
+                    isValid = false;
+                }
+            }
+            break;
+
+        case WMI_11G_MODE:
+        case WMI_11AG_MODE:
+            if (wmip->wmi_ht_allowed[A_BAND_24GHZ]){
+                if ((rateIndex < MODE_G_SUPPORT_RATE_START) || (rateIndex > MODE_GHT20_SUPPORT_RATE_STOP)) {
+                    isValid = false;
+                }
+            } else {
+                if ((rateIndex < MODE_G_SUPPORT_RATE_START) || (rateIndex > MODE_G_SUPPORT_RATE_STOP)) {
+                    isValid = false;
+                }
+            }
+            break;
+        default:
+            A_ASSERT(false);
+            break;
+    }
+
+    return isValid;
+}
+
+s8 wmi_validate_bitrate(struct wmi_t *wmip, s32 rate, s8 *rate_idx)
+{
+    s8 i;
+
+    for (i=0;;i++)
+    {
+        if (wmi_rateTable[(u32) i][0] == 0) {
+            return A_EINVAL;
+        }
+        if (wmi_rateTable[(u32) i][0] == rate) {
+            break;
+        }
+    }
+
+    if(wmi_is_bitrate_index_valid(wmip, (s32) i) != true) {
+        return A_EINVAL;
+    }
+
+    *rate_idx = i;
+    return 0;
+}
+
+int
+wmi_set_fixrates_cmd(struct wmi_t *wmip, u32 fixRatesMask)
+{
+    void *osbuf;
+    WMI_FIX_RATES_CMD *cmd;
+#if 0
+    s32 rateIndex;
+/* This check does not work for AR6003 as the HT modes are enabled only when
+ * the STA is connected to a HT_BSS and is not based only on channel. It is
+ * safe to skip this check however because rate control will only use rates
+ * that are permitted by the valid rate mask and the fix rate mask. Meaning
+ * the fix rate mask is not sufficient by itself to cause an invalid rate
+ * to be used. */
+    /* Make sure all rates in the mask are valid in the current PHY mode */
+    for(rateIndex = 0; rateIndex < MAX_NUMBER_OF_SUPPORT_RATES; rateIndex++) {
+       if((1 << rateIndex) & (u32)fixRatesMask) {
+            if(wmi_is_bitrate_index_valid(wmip, rateIndex) != true) {
+                A_DPRINTF(DBG_WMI, (DBGFMT "Set Fix Rates command failed: Given rate is illegal in current PHY mode\n", DBGARG));
+                return A_EINVAL;
+            }
+       }
+    }
+#endif
+
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_FIX_RATES_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+
+    cmd->fixRateMask = fixRatesMask;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_FIXRATES_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_get_ratemask_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd(wmip, WMI_GET_FIXRATES_CMDID);
+}
+
+int
+wmi_get_channelList_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd(wmip, WMI_GET_CHANNEL_LIST_CMDID);
+}
+
+/*
+ * used to generate a wmi sey channel Parameters cmd.
+ * mode should always be specified and corresponds to the phy mode of the
+ * wlan.
+ * numChan should alway sbe specified. If zero indicates that all available
+ * channels should be used.
+ * channelList is an array of channel frequencies (in Mhz) which the radio
+ * should limit its operation to.  It should be NULL if numChan == 0.  Size of
+ * array should correspond to numChan entries.
+ */
+int
+wmi_set_channelParams_cmd(struct wmi_t *wmip, u8 scanParam,
+                          WMI_PHY_MODE mode, s8 numChan,
+                          u16 *channelList)
+{
+    void *osbuf;
+    WMI_CHANNEL_PARAMS_CMD *cmd;
+    s8 size;
+
+    size = sizeof (*cmd);
+
+    if (numChan) {
+        if (numChan > WMI_MAX_CHANNELS) {
+            return A_EINVAL;
+        }
+        size += sizeof(u16) * (numChan - 1);
+    }
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_CHANNEL_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+
+    wmip->wmi_phyMode = mode;
+    cmd->scanParam   = scanParam;
+    cmd->phyMode     = mode;
+    cmd->numChannels = numChan;
+    memcpy(cmd->channelList, channelList, numChan * sizeof(u16));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_CHANNEL_PARAMS_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+void
+wmi_cache_configure_rssithreshold(struct wmi_t *wmip, WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd)
+{
+    SQ_THRESHOLD_PARAMS *sq_thresh =
+           &wmip->wmi_SqThresholdParams[SIGNAL_QUALITY_METRICS_RSSI];
+    /*
+     * Parse the command and store the threshold values here. The checks
+     * for valid values can be put here
+     */
+    sq_thresh->weight = rssiCmd->weight;
+    sq_thresh->polling_interval = rssiCmd->pollTime;
+
+    sq_thresh->upper_threshold[0] = rssiCmd->thresholdAbove1_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->upper_threshold[1] = rssiCmd->thresholdAbove2_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->upper_threshold[2] = rssiCmd->thresholdAbove3_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->upper_threshold[3] = rssiCmd->thresholdAbove4_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->upper_threshold[4] = rssiCmd->thresholdAbove5_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->upper_threshold[5] = rssiCmd->thresholdAbove6_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->upper_threshold_valid_count = 6;
+
+    /* List sorted in descending order */
+    sq_thresh->lower_threshold[0] = rssiCmd->thresholdBelow6_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->lower_threshold[1] = rssiCmd->thresholdBelow5_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->lower_threshold[2] = rssiCmd->thresholdBelow4_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->lower_threshold[3] = rssiCmd->thresholdBelow3_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->lower_threshold[4] = rssiCmd->thresholdBelow2_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->lower_threshold[5] = rssiCmd->thresholdBelow1_Val - SIGNAL_QUALITY_NOISE_FLOOR;
+    sq_thresh->lower_threshold_valid_count = 6;
+
+    if (!rssi_event_value) {
+    /*
+     * Configuring the thresholds to their extremes allows the host to get an
+     * event from the target which is used for the configuring the correct
+     * thresholds
+     */
+    rssiCmd->thresholdAbove1_Val = sq_thresh->upper_threshold[0];
+    rssiCmd->thresholdBelow1_Val = sq_thresh->lower_threshold[0];
+    } else {
+        /*
+         * In case the user issues multiple times of rssi_threshold_setting,
+         * we should not use the extreames anymore, the target does not expect that.
+         */
+        rssiCmd->thresholdAbove1_Val = ar6000_get_upper_threshold(rssi_event_value, sq_thresh,
+                                              sq_thresh->upper_threshold_valid_count);
+        rssiCmd->thresholdBelow1_Val = ar6000_get_lower_threshold(rssi_event_value, sq_thresh,
+                                              sq_thresh->lower_threshold_valid_count);
+}
+}
+
+int
+wmi_set_rssi_threshold_params(struct wmi_t *wmip,
+                              WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd)
+{
+
+     /* Check these values are in ascending order */
+    if( rssiCmd->thresholdAbove6_Val <= rssiCmd->thresholdAbove5_Val ||
+        rssiCmd->thresholdAbove5_Val <= rssiCmd->thresholdAbove4_Val ||
+        rssiCmd->thresholdAbove4_Val <= rssiCmd->thresholdAbove3_Val ||
+        rssiCmd->thresholdAbove3_Val <= rssiCmd->thresholdAbove2_Val ||
+        rssiCmd->thresholdAbove2_Val <= rssiCmd->thresholdAbove1_Val ||
+        rssiCmd->thresholdBelow6_Val <= rssiCmd->thresholdBelow5_Val ||
+        rssiCmd->thresholdBelow5_Val <= rssiCmd->thresholdBelow4_Val ||
+        rssiCmd->thresholdBelow4_Val <= rssiCmd->thresholdBelow3_Val ||
+        rssiCmd->thresholdBelow3_Val <= rssiCmd->thresholdBelow2_Val ||
+        rssiCmd->thresholdBelow2_Val <= rssiCmd->thresholdBelow1_Val)
+    {
+        return A_EINVAL;
+    }
+
+    wmi_cache_configure_rssithreshold(wmip, rssiCmd);
+
+    return (wmi_send_rssi_threshold_params(wmip, rssiCmd));
+}
+
+int
+wmi_set_ip_cmd(struct wmi_t *wmip, WMI_SET_IP_CMD *ipCmd)
+{
+    void    *osbuf;
+    WMI_SET_IP_CMD *cmd;
+
+    /* Multicast address are not valid */
+    if((*((u8 *)&ipCmd->ips[0]) >= 0xE0) ||
+       (*((u8 *)&ipCmd->ips[1]) >= 0xE0)) {
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_SET_IP_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_SET_IP_CMD));
+    cmd = (WMI_SET_IP_CMD *)(A_NETBUF_DATA(osbuf));
+    memcpy(cmd, ipCmd, sizeof(WMI_SET_IP_CMD));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_IP_CMDID,
+                            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_host_sleep_mode_cmd(struct wmi_t *wmip,
+                              WMI_SET_HOST_SLEEP_MODE_CMD *hostModeCmd)
+{
+    void    *osbuf;
+    s8 size;
+    WMI_SET_HOST_SLEEP_MODE_CMD *cmd;
+    u16 activeTsids=0;
+    u8 streamExists=0;
+    u8 i;
+
+    if( hostModeCmd->awake == hostModeCmd->asleep) {
+        return A_EINVAL;
+    }
+
+    size = sizeof (*cmd);
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_SET_HOST_SLEEP_MODE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+    memcpy(cmd, hostModeCmd, sizeof(WMI_SET_HOST_SLEEP_MODE_CMD));
+
+    if(hostModeCmd->asleep) {
+        /*
+         * Relinquish credits from all implicitly created pstreams since when we
+         * go to sleep. If user created explicit thinstreams exists with in a
+         * fatpipe leave them intact for the user to delete
+         */
+        LOCK_WMI(wmip);
+        streamExists = wmip->wmi_fatPipeExists;
+        UNLOCK_WMI(wmip);
+
+        for(i=0;i< WMM_NUM_AC;i++) {
+            if (streamExists & (1<<i)) {
+                LOCK_WMI(wmip);
+                activeTsids = wmip->wmi_streamExistsForAC[i];
+                UNLOCK_WMI(wmip);
+                /* If there are no user created thin streams delete the fatpipe */
+                if(!activeTsids) {
+                    streamExists &= ~(1<<i);
+                    /*Indicate inactivity to drv layer for this fatpipe(pstream)*/
+                    A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt,i);
+                }
+            }
+        }
+
+        /* Update the fatpipes that exists*/
+        LOCK_WMI(wmip);
+        wmip->wmi_fatPipeExists = streamExists;
+        UNLOCK_WMI(wmip);
+    }
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_HOST_SLEEP_MODE_CMDID,
+                            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_wow_mode_cmd(struct wmi_t *wmip,
+                              WMI_SET_WOW_MODE_CMD *wowModeCmd)
+{
+    void    *osbuf;
+    s8 size;
+    WMI_SET_WOW_MODE_CMD *cmd;
+
+    size = sizeof (*cmd);
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_SET_WOW_MODE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+    memcpy(cmd, wowModeCmd, sizeof(WMI_SET_WOW_MODE_CMD));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WOW_MODE_CMDID,
+                            NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_get_wow_list_cmd(struct wmi_t *wmip,
+                              WMI_GET_WOW_LIST_CMD *wowListCmd)
+{
+    void    *osbuf;
+    s8 size;
+    WMI_GET_WOW_LIST_CMD *cmd;
+
+    size = sizeof (*cmd);
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_GET_WOW_LIST_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+    memcpy(cmd, wowListCmd, sizeof(WMI_GET_WOW_LIST_CMD));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_WOW_LIST_CMDID,
+                            NO_SYNC_WMIFLAG));
+
+}
+
+static int
+wmi_get_wow_list_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_GET_WOW_LIST_REPLY *reply;
+
+    if (len < sizeof(WMI_GET_WOW_LIST_REPLY)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_GET_WOW_LIST_REPLY *)datap;
+
+    A_WMI_WOW_LIST_EVENT(wmip->wmi_devt, reply->num_filters,
+                          reply);
+
+    return 0;
+}
+
+int wmi_add_wow_pattern_cmd(struct wmi_t *wmip,
+                                 WMI_ADD_WOW_PATTERN_CMD *addWowCmd,
+                                 u8 *pattern, u8 *mask,
+                                 u8 pattern_size)
+{
+    void    *osbuf;
+    s8 size;
+    WMI_ADD_WOW_PATTERN_CMD *cmd;
+    u8 *filter_mask = NULL;
+
+    size = sizeof (*cmd);
+
+    size += ((2 * addWowCmd->filter_size)* sizeof(u8));
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_ADD_WOW_PATTERN_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->filter_list_id = addWowCmd->filter_list_id;
+    cmd->filter_offset = addWowCmd->filter_offset;
+    cmd->filter_size = addWowCmd->filter_size;
+
+    memcpy(cmd->filter, pattern, addWowCmd->filter_size);
+
+    filter_mask = (u8 *)(cmd->filter + cmd->filter_size);
+    memcpy(filter_mask, mask, addWowCmd->filter_size);
+
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_ADD_WOW_PATTERN_CMDID,
+                            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_del_wow_pattern_cmd(struct wmi_t *wmip,
+                              WMI_DEL_WOW_PATTERN_CMD *delWowCmd)
+{
+    void    *osbuf;
+    s8 size;
+    WMI_DEL_WOW_PATTERN_CMD *cmd;
+
+    size = sizeof (*cmd);
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_DEL_WOW_PATTERN_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+    memcpy(cmd, delWowCmd, sizeof(WMI_DEL_WOW_PATTERN_CMD));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_DEL_WOW_PATTERN_CMDID,
+                            NO_SYNC_WMIFLAG));
+
+}
+
+void
+wmi_cache_configure_snrthreshold(struct wmi_t *wmip, WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd)
+{
+    SQ_THRESHOLD_PARAMS *sq_thresh =
+           &wmip->wmi_SqThresholdParams[SIGNAL_QUALITY_METRICS_SNR];
+    /*
+     * Parse the command and store the threshold values here. The checks
+     * for valid values can be put here
+     */
+    sq_thresh->weight = snrCmd->weight;
+    sq_thresh->polling_interval = snrCmd->pollTime;
+
+    sq_thresh->upper_threshold[0] = snrCmd->thresholdAbove1_Val;
+    sq_thresh->upper_threshold[1] = snrCmd->thresholdAbove2_Val;
+    sq_thresh->upper_threshold[2] = snrCmd->thresholdAbove3_Val;
+    sq_thresh->upper_threshold[3] = snrCmd->thresholdAbove4_Val;
+    sq_thresh->upper_threshold_valid_count = 4;
+
+    /* List sorted in descending order */
+    sq_thresh->lower_threshold[0] = snrCmd->thresholdBelow4_Val;
+    sq_thresh->lower_threshold[1] = snrCmd->thresholdBelow3_Val;
+    sq_thresh->lower_threshold[2] = snrCmd->thresholdBelow2_Val;
+    sq_thresh->lower_threshold[3] = snrCmd->thresholdBelow1_Val;
+    sq_thresh->lower_threshold_valid_count = 4;
+
+    if (!snr_event_value) {
+    /*
+     * Configuring the thresholds to their extremes allows the host to get an
+     * event from the target which is used for the configuring the correct
+     * thresholds
+     */
+    snrCmd->thresholdAbove1_Val = (u8)sq_thresh->upper_threshold[0];
+    snrCmd->thresholdBelow1_Val = (u8)sq_thresh->lower_threshold[0];
+    } else {
+        /*
+         * In case the user issues multiple times of snr_threshold_setting,
+         * we should not use the extreames anymore, the target does not expect that.
+         */
+        snrCmd->thresholdAbove1_Val = ar6000_get_upper_threshold(snr_event_value, sq_thresh,
+                                              sq_thresh->upper_threshold_valid_count);
+        snrCmd->thresholdBelow1_Val = ar6000_get_lower_threshold(snr_event_value, sq_thresh,
+                                              sq_thresh->lower_threshold_valid_count);
+    }
+
+}
+int
+wmi_set_snr_threshold_params(struct wmi_t *wmip,
+                             WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd)
+{
+    if( snrCmd->thresholdAbove4_Val <= snrCmd->thresholdAbove3_Val ||
+        snrCmd->thresholdAbove3_Val <= snrCmd->thresholdAbove2_Val ||
+        snrCmd->thresholdAbove2_Val <= snrCmd->thresholdAbove1_Val ||
+        snrCmd->thresholdBelow4_Val <= snrCmd->thresholdBelow3_Val ||
+        snrCmd->thresholdBelow3_Val <= snrCmd->thresholdBelow2_Val ||
+        snrCmd->thresholdBelow2_Val <= snrCmd->thresholdBelow1_Val)
+    {
+        return A_EINVAL;
+    }
+    wmi_cache_configure_snrthreshold(wmip, snrCmd);
+    return (wmi_send_snr_threshold_params(wmip, snrCmd));
+}
+
+int
+wmi_clr_rssi_snr(struct wmi_t *wmip)
+{
+    void    *osbuf;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(int));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_CLR_RSSI_SNR_CMDID,
+                            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_lq_threshold_params(struct wmi_t *wmip,
+                             WMI_LQ_THRESHOLD_PARAMS_CMD *lqCmd)
+{
+    void    *osbuf;
+    s8 size;
+    WMI_LQ_THRESHOLD_PARAMS_CMD *cmd;
+    /* These values are in ascending order */
+    if( lqCmd->thresholdAbove4_Val <= lqCmd->thresholdAbove3_Val ||
+        lqCmd->thresholdAbove3_Val <= lqCmd->thresholdAbove2_Val ||
+        lqCmd->thresholdAbove2_Val <= lqCmd->thresholdAbove1_Val ||
+        lqCmd->thresholdBelow4_Val <= lqCmd->thresholdBelow3_Val ||
+        lqCmd->thresholdBelow3_Val <= lqCmd->thresholdBelow2_Val ||
+        lqCmd->thresholdBelow2_Val <= lqCmd->thresholdBelow1_Val ) {
+
+        return A_EINVAL;
+    }
+
+    size = sizeof (*cmd);
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_LQ_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+    memcpy(cmd, lqCmd, sizeof(WMI_LQ_THRESHOLD_PARAMS_CMD));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_LQ_THRESHOLD_PARAMS_CMDID,
+                            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_error_report_bitmask(struct wmi_t *wmip, u32 mask)
+{
+    void    *osbuf;
+    s8 size;
+    WMI_TARGET_ERROR_REPORT_BITMASK *cmd;
+
+    size = sizeof (*cmd);
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_TARGET_ERROR_REPORT_BITMASK *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+
+    cmd->bitmask = mask;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
+                            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_get_challenge_resp_cmd(struct wmi_t *wmip, u32 cookie, u32 source)
+{
+    void *osbuf;
+    WMIX_HB_CHALLENGE_RESP_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMIX_HB_CHALLENGE_RESP_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->cookie = cookie;
+    cmd->source = source;
+
+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_HB_CHALLENGE_RESP_CMDID,
+                              NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_config_debug_module_cmd(struct wmi_t *wmip, u16 mmask,
+                            u16 tsr, bool rep, u16 size,
+                            u32 valid)
+{
+    void *osbuf;
+    WMIX_DBGLOG_CFG_MODULE_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMIX_DBGLOG_CFG_MODULE_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->config.cfgmmask = mmask;
+    cmd->config.cfgtsr = tsr;
+    cmd->config.cfgrep = rep;
+    cmd->config.cfgsize = size;
+    cmd->config.cfgvalid = valid;
+
+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DBGLOG_CFG_MODULE_CMDID,
+                              NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_get_stats_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd(wmip, WMI_GET_STATISTICS_CMDID);
+}
+
+int
+wmi_addBadAp_cmd(struct wmi_t *wmip, u8 apIndex, u8 *bssid)
+{
+    void *osbuf;
+    WMI_ADD_BAD_AP_CMD *cmd;
+
+    if ((bssid == NULL) || (apIndex > WMI_MAX_BAD_AP_INDEX)) {
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_ADD_BAD_AP_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->badApIndex = apIndex;
+    memcpy(cmd->bssid, bssid, sizeof(cmd->bssid));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_ADD_BAD_AP_CMDID, SYNC_BEFORE_WMIFLAG));
+}
+
+int
+wmi_deleteBadAp_cmd(struct wmi_t *wmip, u8 apIndex)
+{
+    void *osbuf;
+    WMI_DELETE_BAD_AP_CMD *cmd;
+
+    if (apIndex > WMI_MAX_BAD_AP_INDEX) {
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_DELETE_BAD_AP_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->badApIndex = apIndex;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_BAD_AP_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_abort_scan_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd(wmip, WMI_ABORT_SCAN_CMDID);
+}
+
+int
+wmi_set_txPwr_cmd(struct wmi_t *wmip, u8 dbM)
+{
+    void *osbuf;
+    WMI_SET_TX_PWR_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_TX_PWR_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->dbM = dbM;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_TX_PWR_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_get_txPwr_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd(wmip, WMI_GET_TX_PWR_CMDID);
+}
+
+u16 wmi_get_mapped_qos_queue(struct wmi_t *wmip, u8 trafficClass)
+{
+    u16 activeTsids=0;
+
+    LOCK_WMI(wmip);
+    activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
+    UNLOCK_WMI(wmip);
+
+    return activeTsids;
+}
+
+int
+wmi_get_roam_tbl_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd(wmip, WMI_GET_ROAM_TBL_CMDID);
+}
+
+int
+wmi_get_roam_data_cmd(struct wmi_t *wmip, u8 roamDataType)
+{
+    void *osbuf;
+    u32 size = sizeof(u8);
+    WMI_TARGET_ROAM_DATA *cmd;
+
+    osbuf = A_NETBUF_ALLOC(size);      /* no payload */
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_TARGET_ROAM_DATA *)(A_NETBUF_DATA(osbuf));
+    cmd->roamDataType = roamDataType;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_ROAM_DATA_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_roam_ctrl_cmd(struct wmi_t *wmip, WMI_SET_ROAM_CTRL_CMD *p,
+                      u8 size)
+{
+    void *osbuf;
+    WMI_SET_ROAM_CTRL_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_SET_ROAM_CTRL_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+
+    memcpy(cmd, p, size);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_ROAM_CTRL_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_powersave_timers_cmd(struct wmi_t *wmip,
+                            WMI_POWERSAVE_TIMERS_POLICY_CMD *pCmd,
+                            u8 size)
+{
+    void *osbuf;
+    WMI_POWERSAVE_TIMERS_POLICY_CMD *cmd;
+
+    /* These timers can't be zero */
+    if(!pCmd->psPollTimeout || !pCmd->triggerTimeout ||
+       !(pCmd->apsdTimPolicy == IGNORE_TIM_ALL_QUEUES_APSD ||
+         pCmd->apsdTimPolicy == PROCESS_TIM_ALL_QUEUES_APSD) ||
+       !(pCmd->simulatedAPSDTimPolicy == IGNORE_TIM_SIMULATED_APSD ||
+         pCmd->simulatedAPSDTimPolicy == PROCESS_TIM_SIMULATED_APSD))
+        return A_EINVAL;
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_POWERSAVE_TIMERS_POLICY_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+
+    memcpy(cmd, pCmd, size);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_access_params_cmd(struct wmi_t *wmip, u8 ac,  u16 txop, u8 eCWmin,
+                          u8 eCWmax, u8 aifsn)
+{
+    void *osbuf;
+    WMI_SET_ACCESS_PARAMS_CMD *cmd;
+
+    if ((eCWmin > WMI_MAX_CW_ACPARAM) || (eCWmax > WMI_MAX_CW_ACPARAM) ||
+        (aifsn > WMI_MAX_AIFSN_ACPARAM) || (ac >= WMM_NUM_AC))
+    {
+        return A_EINVAL;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_ACCESS_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->txop   = txop;
+    cmd->eCWmin = eCWmin;
+    cmd->eCWmax = eCWmax;
+    cmd->aifsn  = aifsn;
+    cmd->ac = ac;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_ACCESS_PARAMS_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_retry_limits_cmd(struct wmi_t *wmip, u8 frameType,
+                         u8 trafficClass, u8 maxRetries,
+                         u8 enableNotify)
+{
+    void *osbuf;
+    WMI_SET_RETRY_LIMITS_CMD *cmd;
+
+    if ((frameType != MGMT_FRAMETYPE) && (frameType != CONTROL_FRAMETYPE) &&
+        (frameType != DATA_FRAMETYPE))
+    {
+        return A_EINVAL;
+    }
+
+    if (maxRetries > WMI_MAX_RETRIES) {
+        return A_EINVAL;
+    }
+
+    if (frameType != DATA_FRAMETYPE) {
+        trafficClass = 0;
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_RETRY_LIMITS_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->frameType    = frameType;
+    cmd->trafficClass = trafficClass;
+    cmd->maxRetries   = maxRetries;
+    cmd->enableNotify = enableNotify;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_RETRY_LIMITS_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+void
+wmi_get_current_bssid(struct wmi_t *wmip, u8 *bssid)
+{
+    if (bssid != NULL) {
+        memcpy(bssid, wmip->wmi_bssid, ATH_MAC_LEN);
+    }
+}
+
+int
+wmi_set_opt_mode_cmd(struct wmi_t *wmip, u8 optMode)
+{
+    void *osbuf;
+    WMI_SET_OPT_MODE_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_OPT_MODE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->optMode = optMode;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_OPT_MODE_CMDID,
+                         SYNC_BOTH_WMIFLAG));
+}
+
+int
+wmi_opt_tx_frame_cmd(struct wmi_t *wmip,
+                      u8 frmType,
+                      u8 *dstMacAddr,
+                      u8 *bssid,
+                      u16 optIEDataLen,
+                      u8 *optIEData)
+{
+    void *osbuf;
+    WMI_OPT_TX_FRAME_CMD *cmd;
+    osbuf = A_NETBUF_ALLOC(optIEDataLen + sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, (optIEDataLen + sizeof(*cmd)));
+
+    cmd = (WMI_OPT_TX_FRAME_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, (optIEDataLen + sizeof(*cmd)-1));
+
+    cmd->frmType    = frmType;
+    cmd->optIEDataLen   = optIEDataLen;
+    //cmd->optIEData     = (u8 *)((int)cmd + sizeof(*cmd));
+    memcpy(cmd->bssid, bssid, sizeof(cmd->bssid));
+    memcpy(cmd->dstAddr, dstMacAddr, sizeof(cmd->dstAddr));
+    memcpy(&cmd->optIEData[0], optIEData, optIEDataLen);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_OPT_TX_FRAME_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_adhoc_bconIntvl_cmd(struct wmi_t *wmip, u16 intvl)
+{
+    void *osbuf;
+    WMI_BEACON_INT_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_BEACON_INT_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->beaconInterval = intvl;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BEACON_INT_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+
+int
+wmi_set_voice_pkt_size_cmd(struct wmi_t *wmip, u16 voicePktSize)
+{
+    void *osbuf;
+    WMI_SET_VOICE_PKT_SIZE_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_VOICE_PKT_SIZE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->voicePktSize = voicePktSize;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_VOICE_PKT_SIZE_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+
+int
+wmi_set_max_sp_len_cmd(struct wmi_t *wmip, u8 maxSPLen)
+{
+    void *osbuf;
+    WMI_SET_MAX_SP_LEN_CMD *cmd;
+
+    /* maxSPLen is a two-bit value. If user trys to set anything
+     * other than this, then its invalid
+     */
+    if(maxSPLen & ~0x03)
+        return  A_EINVAL;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_MAX_SP_LEN_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->maxSPLen = maxSPLen;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_MAX_SP_LEN_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+u8 wmi_determine_userPriority(
+    u8 *pkt,
+    u32 layer2Pri)
+{
+    u8 ipPri;
+    iphdr *ipHdr = (iphdr *)pkt;
+
+    /* Determine IPTOS priority */
+    /*
+     * IP Tos format :
+     *      (Refer Pg 57 WMM-test-plan-v1.2)
+     * IP-TOS - 8bits
+     *          : DSCP(6-bits) ECN(2-bits)
+     *          : DSCP - P2 P1 P0 X X X
+     *              where (P2 P1 P0) form 802.1D
+     */
+    ipPri = ipHdr->ip_tos >> 5;
+    ipPri &= 0x7;
+
+    if ((layer2Pri & 0x7) > ipPri)
+        return ((u8)layer2Pri & 0x7);
+    else
+        return ipPri;
+}
+
+u8 convert_userPriority_to_trafficClass(u8 userPriority)
+{
+    return  (up_to_ac[userPriority & 0x7]);
+}
+
+u8 wmi_get_power_mode_cmd(struct wmi_t *wmip)
+{
+    return wmip->wmi_powerMode;
+}
+
+int
+wmi_verify_tspec_params(WMI_CREATE_PSTREAM_CMD *pCmd, int tspecCompliance)
+{
+    int ret = 0;
+
+#define TSPEC_SUSPENSION_INTERVAL_ATHEROS_DEF (~0)
+#define TSPEC_SERVICE_START_TIME_ATHEROS_DEF  0
+#define TSPEC_MAX_BURST_SIZE_ATHEROS_DEF      0
+#define TSPEC_DELAY_BOUND_ATHEROS_DEF         0
+#define TSPEC_MEDIUM_TIME_ATHEROS_DEF         0
+#define TSPEC_SBA_ATHEROS_DEF                 0x2000  /* factor is 1 */
+
+    /* Verify TSPEC params for ATHEROS compliance */
+    if(tspecCompliance == ATHEROS_COMPLIANCE) {
+        if ((pCmd->suspensionInt != TSPEC_SUSPENSION_INTERVAL_ATHEROS_DEF) ||
+            (pCmd->serviceStartTime != TSPEC_SERVICE_START_TIME_ATHEROS_DEF) ||
+            (pCmd->minDataRate != pCmd->meanDataRate) ||
+            (pCmd->minDataRate != pCmd->peakDataRate) ||
+            (pCmd->maxBurstSize != TSPEC_MAX_BURST_SIZE_ATHEROS_DEF) ||
+            (pCmd->delayBound != TSPEC_DELAY_BOUND_ATHEROS_DEF) ||
+            (pCmd->sba != TSPEC_SBA_ATHEROS_DEF) ||
+            (pCmd->mediumTime != TSPEC_MEDIUM_TIME_ATHEROS_DEF)) {
+
+            A_DPRINTF(DBG_WMI, (DBGFMT "Invalid TSPEC params\n", DBGARG));
+            //A_PRINTF("%s: Invalid TSPEC params\n", __func__);
+            ret = A_EINVAL;
+        }
+    }
+
+    return ret;
+}
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+static int
+wmi_tcmd_test_report_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+        ar6000_testmode_rx_report_event(wmip->wmi_devt, datap, len);
+
+        return 0;
+}
+
+#endif /* CONFIG_HOST_TCMD_SUPPORT*/
+
+int
+wmi_set_authmode_cmd(struct wmi_t *wmip, u8 mode)
+{
+    void *osbuf;
+    WMI_SET_AUTH_MODE_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_AUTH_MODE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->mode = mode;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_AUTH_MODE_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_reassocmode_cmd(struct wmi_t *wmip, u8 mode)
+{
+    void *osbuf;
+    WMI_SET_REASSOC_MODE_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_REASSOC_MODE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->mode = mode;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_REASSOC_MODE_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_lpreamble_cmd(struct wmi_t *wmip, u8 status, u8 preamblePolicy)
+{
+    void *osbuf;
+    WMI_SET_LPREAMBLE_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_LPREAMBLE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->status = status;
+    cmd->preamblePolicy = preamblePolicy;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_LPREAMBLE_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_rts_cmd(struct wmi_t *wmip, u16 threshold)
+{
+    void *osbuf;
+    WMI_SET_RTS_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_RTS_CMD*)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->threshold = threshold;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_RTS_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_wmm_cmd(struct wmi_t *wmip, WMI_WMM_STATUS status)
+{
+    void *osbuf;
+    WMI_SET_WMM_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_WMM_CMD*)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->status = status;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WMM_CMDID,
+            NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_set_qos_supp_cmd(struct wmi_t *wmip, u8 status)
+{
+    void *osbuf;
+    WMI_SET_QOS_SUPP_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_QOS_SUPP_CMD*)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->status = status;
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_QOS_SUPP_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+
+int
+wmi_set_wmm_txop(struct wmi_t *wmip, WMI_TXOP_CFG cfg)
+{
+    void *osbuf;
+    WMI_SET_WMM_TXOP_CMD *cmd;
+
+    if( !((cfg == WMI_TXOP_DISABLED) || (cfg == WMI_TXOP_ENABLED)) )
+        return A_EINVAL;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_WMM_TXOP_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->txopEnable = cfg;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WMM_TXOP_CMDID,
+            NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_set_country(struct wmi_t *wmip, u8 *countryCode)
+{
+    void *osbuf;
+    WMI_AP_SET_COUNTRY_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_AP_SET_COUNTRY_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    memcpy(cmd->countryCode,countryCode,3);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_SET_COUNTRY_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+/* WMI  layer doesn't need to know the data type of the test cmd.
+   This would be beneficial for customers like Qualcomm, who might
+   have different test command requirements from different manufacturers
+ */
+int
+wmi_test_cmd(struct wmi_t *wmip, u8 *buf, u32 len)
+{
+    void *osbuf;
+    char *data;
+
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    osbuf= A_NETBUF_ALLOC(len);
+    if(osbuf == NULL)
+    {
+        return A_NO_MEMORY;
+    }
+    A_NETBUF_PUT(osbuf, len);
+    data = A_NETBUF_DATA(osbuf);
+    memcpy(data, buf, len);
+
+    return(wmi_cmd_send(wmip, osbuf, WMI_TEST_CMDID,
+         NO_SYNC_WMIFLAG));
+}
+
+#endif
+
+int
+wmi_set_bt_status_cmd(struct wmi_t *wmip, u8 streamType, u8 status)
+{
+    void *osbuf;
+    WMI_SET_BT_STATUS_CMD *cmd;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("Enter - streamType=%d, status=%d\n", streamType, status));
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_BT_STATUS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->streamType = streamType;
+    cmd->status = status;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BT_STATUS_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_bt_params_cmd(struct wmi_t *wmip, WMI_SET_BT_PARAMS_CMD* cmd)
+{
+    void *osbuf;
+    WMI_SET_BT_PARAMS_CMD* alloc_cmd;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("cmd params is %d\n", cmd->paramType));
+
+    if (cmd->paramType == BT_PARAM_SCO) {
+      AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("sco params %d %d %d %d %d %d %d %d %d %d %d %d\n", cmd->info.scoParams.numScoCyclesForceTrigger,
+        cmd->info.scoParams.dataResponseTimeout,
+        cmd->info.scoParams.stompScoRules,
+        cmd->info.scoParams.scoOptFlags,
+        cmd->info.scoParams.stompDutyCyleVal,
+        cmd->info.scoParams.stompDutyCyleMaxVal,
+        cmd->info.scoParams.psPollLatencyFraction,
+        cmd->info.scoParams.noSCOSlots,
+        cmd->info.scoParams.noIdleSlots,
+        cmd->info.scoParams.scoOptOffRssi,
+        cmd->info.scoParams.scoOptOnRssi,
+        cmd->info.scoParams.scoOptRtsCount));
+    }
+    else if (cmd->paramType == BT_PARAM_A2DP) {
+      AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("A2DP params %d %d %d %d %d %d %d %d\n", cmd->info.a2dpParams.a2dpWlanUsageLimit,
+        cmd->info.a2dpParams.a2dpBurstCntMin,
+        cmd->info.a2dpParams.a2dpDataRespTimeout,
+        cmd->info.a2dpParams.a2dpOptFlags,
+        cmd->info.a2dpParams.isCoLocatedBtRoleMaster,
+        cmd->info.a2dpParams.a2dpOptOffRssi,
+        cmd->info.a2dpParams.a2dpOptOnRssi,
+        cmd->info.a2dpParams.a2dpOptRtsCount));
+    }
+    else if (cmd->paramType == BT_PARAM_ANTENNA_CONFIG) {
+      AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("Ant config %d\n", cmd->info.antType));
+    }
+    else if (cmd->paramType == BT_PARAM_COLOCATED_BT_DEVICE) {
+      AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("co-located BT %d\n", cmd->info.coLocatedBtDev));
+    }
+    else if (cmd->paramType == BT_PARAM_ACLCOEX) {
+      AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("ACL params %d %d %d\n", cmd->info.aclCoexParams.aclWlanMediumUsageTime,
+        cmd->info.aclCoexParams.aclBtMediumUsageTime,
+        cmd->info.aclCoexParams.aclDataRespTimeout));
+    }
+    else if (cmd->paramType == BT_PARAM_11A_SEPARATE_ANT) {
+      A_DPRINTF(DBG_WMI, (DBGFMT "11A ant\n", DBGARG));
+    }
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    alloc_cmd = (WMI_SET_BT_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(alloc_cmd, sizeof(*cmd));
+    memcpy(alloc_cmd, cmd, sizeof(*cmd));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BT_PARAMS_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_btcoex_fe_ant_cmd(struct wmi_t *wmip, WMI_SET_BTCOEX_FE_ANT_CMD * cmd)
+{
+        void *osbuf;
+    WMI_SET_BTCOEX_FE_ANT_CMD *alloc_cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+    alloc_cmd = (WMI_SET_BTCOEX_FE_ANT_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(alloc_cmd, sizeof(*cmd));
+        memcpy(alloc_cmd,cmd,sizeof(WMI_SET_BTCOEX_FE_ANT_CMD));
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BTCOEX_FE_ANT_CMDID,
+                         NO_SYNC_WMIFLAG));
+
+}
+
+
+int
+wmi_set_btcoex_colocated_bt_dev_cmd(struct wmi_t *wmip,
+                                                WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD * cmd)
+{
+        void *osbuf;
+    WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD *alloc_cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+    alloc_cmd = (WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(alloc_cmd, sizeof(*cmd));
+    memcpy(alloc_cmd,cmd,sizeof(WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD));
+    A_PRINTF("colocated bt = %d\n", alloc_cmd->btcoexCoLocatedBTdev);
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID,
+                         NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_set_btcoex_btinquiry_page_config_cmd(struct wmi_t *wmip,
+                                                WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD* cmd)
+{
+        void *osbuf;
+    WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD *alloc_cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+    alloc_cmd = (WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(alloc_cmd, sizeof(*cmd));
+        memcpy(alloc_cmd,cmd,sizeof(WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD));
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID,
+                         NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_set_btcoex_sco_config_cmd(struct wmi_t *wmip,
+                                                WMI_SET_BTCOEX_SCO_CONFIG_CMD * cmd)
+{
+        void *osbuf;
+    WMI_SET_BTCOEX_SCO_CONFIG_CMD *alloc_cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+    alloc_cmd = (WMI_SET_BTCOEX_SCO_CONFIG_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(alloc_cmd, sizeof(*cmd));
+        memcpy(alloc_cmd,cmd,sizeof(WMI_SET_BTCOEX_SCO_CONFIG_CMD));
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BTCOEX_SCO_CONFIG_CMDID ,
+                         NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_set_btcoex_a2dp_config_cmd(struct wmi_t *wmip,
+                                                WMI_SET_BTCOEX_A2DP_CONFIG_CMD * cmd)
+{
+        void *osbuf;
+    WMI_SET_BTCOEX_A2DP_CONFIG_CMD *alloc_cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+    alloc_cmd = (WMI_SET_BTCOEX_A2DP_CONFIG_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(alloc_cmd, sizeof(*cmd));
+        memcpy(alloc_cmd,cmd,sizeof(WMI_SET_BTCOEX_A2DP_CONFIG_CMD));
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BTCOEX_A2DP_CONFIG_CMDID ,
+                         NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_set_btcoex_aclcoex_config_cmd(struct wmi_t *wmip,
+                                                WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD * cmd)
+{
+        void *osbuf;
+    WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD *alloc_cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+    alloc_cmd = (WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(alloc_cmd, sizeof(*cmd));
+        memcpy(alloc_cmd,cmd,sizeof(WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD));
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID ,
+                         NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_set_btcoex_debug_cmd(struct wmi_t *wmip, WMI_SET_BTCOEX_DEBUG_CMD * cmd)
+{
+        void *osbuf;
+        WMI_SET_BTCOEX_DEBUG_CMD *alloc_cmd;
+
+        osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+        if (osbuf == NULL) {
+                        return A_NO_MEMORY;
+        }
+        A_NETBUF_PUT(osbuf, sizeof(*cmd));
+        alloc_cmd = (WMI_SET_BTCOEX_DEBUG_CMD *)(A_NETBUF_DATA(osbuf));
+        A_MEMZERO(alloc_cmd, sizeof(*cmd));
+        memcpy(alloc_cmd,cmd,sizeof(WMI_SET_BTCOEX_DEBUG_CMD));
+        return (wmi_cmd_send(wmip, osbuf, WMI_SET_BTCOEX_DEBUG_CMDID ,
+                                                         NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_set_btcoex_bt_operating_status_cmd(struct wmi_t * wmip,
+                                        WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD * cmd)
+{
+        void *osbuf;
+        WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD *alloc_cmd;
+
+        osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+        if (osbuf == NULL) {
+                        return A_NO_MEMORY;
+        }
+        A_NETBUF_PUT(osbuf, sizeof(*cmd));
+        alloc_cmd = (WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD *)(A_NETBUF_DATA(osbuf));
+        A_MEMZERO(alloc_cmd, sizeof(*cmd));
+        memcpy(alloc_cmd,cmd,sizeof(WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD));
+        return (wmi_cmd_send(wmip, osbuf, WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID ,
+                                                                 NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_get_btcoex_config_cmd(struct wmi_t * wmip, WMI_GET_BTCOEX_CONFIG_CMD * cmd)
+{
+        void *osbuf;
+        WMI_GET_BTCOEX_CONFIG_CMD *alloc_cmd;
+
+        osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+        if (osbuf == NULL) {
+                        return A_NO_MEMORY;
+        }
+        A_NETBUF_PUT(osbuf, sizeof(*cmd));
+        alloc_cmd = (WMI_GET_BTCOEX_CONFIG_CMD *)(A_NETBUF_DATA(osbuf));
+        A_MEMZERO(alloc_cmd, sizeof(*cmd));
+        memcpy(alloc_cmd,cmd,sizeof(WMI_GET_BTCOEX_CONFIG_CMD));
+        return (wmi_cmd_send(wmip, osbuf, WMI_GET_BTCOEX_CONFIG_CMDID ,
+                                                         NO_SYNC_WMIFLAG));
+
+}
+
+int
+wmi_get_btcoex_stats_cmd(struct wmi_t *wmip)
+{
+
+    return wmi_simple_cmd(wmip, WMI_GET_BTCOEX_STATS_CMDID);
+
+}
+
+int
+wmi_get_keepalive_configured(struct wmi_t *wmip)
+{
+    void *osbuf;
+    WMI_GET_KEEPALIVE_CMD *cmd;
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+    cmd = (WMI_GET_KEEPALIVE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_KEEPALIVE_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+u8 wmi_get_keepalive_cmd(struct wmi_t *wmip)
+{
+    return wmip->wmi_keepaliveInterval;
+}
+
+int
+wmi_set_keepalive_cmd(struct wmi_t *wmip, u8 keepaliveInterval)
+{
+    void *osbuf;
+    WMI_SET_KEEPALIVE_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_KEEPALIVE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->keepaliveInterval = keepaliveInterval;
+    wmip->wmi_keepaliveInterval = keepaliveInterval;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_KEEPALIVE_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_params_cmd(struct wmi_t *wmip, u32 opcode, u32 length, char *buffer)
+{
+    void *osbuf;
+    WMI_SET_PARAMS_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd) + length);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd) + length);
+
+    cmd = (WMI_SET_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->opcode = opcode;
+    cmd->length = length;
+    memcpy(cmd->buffer, buffer, length);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_PARAMS_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+
+int
+wmi_set_mcast_filter_cmd(struct wmi_t *wmip, u8 dot1, u8 dot2, u8 dot3, u8 dot4)
+{
+    void *osbuf;
+    WMI_SET_MCAST_FILTER_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_MCAST_FILTER_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->multicast_mac[0] = 0x01;
+    cmd->multicast_mac[1] = 0x00;
+    cmd->multicast_mac[2] = 0x5e;
+    cmd->multicast_mac[3] = dot2&0x7F;
+    cmd->multicast_mac[4] = dot3;
+    cmd->multicast_mac[5] = dot4;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_MCAST_FILTER_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+
+int
+wmi_del_mcast_filter_cmd(struct wmi_t *wmip, u8 dot1, u8 dot2, u8 dot3, u8 dot4)
+{
+    void *osbuf;
+    WMI_SET_MCAST_FILTER_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_MCAST_FILTER_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->multicast_mac[0] = 0x01;
+    cmd->multicast_mac[1] = 0x00;
+    cmd->multicast_mac[2] = 0x5e;
+    cmd->multicast_mac[3] = dot2&0x7F;
+    cmd->multicast_mac[4] = dot3;
+    cmd->multicast_mac[5] = dot4;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_DEL_MCAST_FILTER_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_mcast_filter_cmd(struct wmi_t *wmip, u8 enable)
+{
+    void *osbuf;
+    WMI_MCAST_FILTER_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_MCAST_FILTER_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->enable = enable;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_MCAST_FILTER_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_appie_cmd(struct wmi_t *wmip, u8 mgmtFrmType, u8 ieLen,
+                  u8 *ieInfo)
+{
+    void *osbuf;
+    WMI_SET_APPIE_CMD *cmd;
+    u16 cmdLen;
+
+    cmdLen = sizeof(*cmd) + ieLen - 1;
+    osbuf = A_NETBUF_ALLOC(cmdLen);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, cmdLen);
+
+    cmd = (WMI_SET_APPIE_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, cmdLen);
+
+    cmd->mgmtFrmType = mgmtFrmType;
+    cmd->ieLen = ieLen;
+    memcpy(cmd->ieInfo, ieInfo, ieLen);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_APPIE_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_halparam_cmd(struct wmi_t *wmip, u8 *cmd, u16 dataLen)
+{
+    void *osbuf;
+    u8 *data;
+
+    osbuf = A_NETBUF_ALLOC(dataLen);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, dataLen);
+
+    data = A_NETBUF_DATA(osbuf);
+
+    memcpy(data, cmd, dataLen);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WHALPARAM_CMDID, NO_SYNC_WMIFLAG));
+}
+
+s32 wmi_get_rate(s8 rateindex)
+{
+    if (rateindex == RATE_AUTO) {
+        return 0;
+    } else {
+        return(wmi_rateTable[(u32) rateindex][0]);
+    }
+}
+
+void
+wmi_node_return (struct wmi_t *wmip, bss_t *bss)
+{
+    if (NULL != bss)
+    {
+        wlan_node_return (&wmip->wmi_scan_table, bss);
+    }
+}
+
+void
+wmi_set_nodeage(struct wmi_t *wmip, u32 nodeAge)
+{
+    wlan_set_nodeage(&wmip->wmi_scan_table,nodeAge);
+}
+
+bss_t *
+wmi_find_Ssidnode (struct wmi_t *wmip, u8 *pSsid,
+                   u32 ssidLength, bool bIsWPA2, bool bMatchSSID)
+{
+    bss_t *node = NULL;
+    node = wlan_find_Ssidnode (&wmip->wmi_scan_table, pSsid,
+                               ssidLength, bIsWPA2, bMatchSSID);
+    return node;
+}
+
+
+#ifdef THREAD_X
+void
+wmi_refresh_scan_table (struct wmi_t *wmip)
+{
+        wlan_refresh_inactive_nodes (&wmip->wmi_scan_table);
+}
+#endif
+
+void
+wmi_free_allnodes(struct wmi_t *wmip)
+{
+    wlan_free_allnodes(&wmip->wmi_scan_table);
+}
+
+bss_t *
+wmi_find_node(struct wmi_t *wmip, const u8 *macaddr)
+{
+    bss_t *ni=NULL;
+    ni=wlan_find_node(&wmip->wmi_scan_table,macaddr);
+    return ni;
+}
+
+void
+wmi_free_node(struct wmi_t *wmip, const u8 *macaddr)
+{
+    bss_t *ni=NULL;
+
+    ni=wlan_find_node(&wmip->wmi_scan_table,macaddr);
+    if (ni != NULL) {
+        wlan_node_reclaim(&wmip->wmi_scan_table, ni);
+    }
+
+    return;
+}
+
+int
+wmi_dset_open_reply(struct wmi_t *wmip,
+                    u32 status,
+                    u32 access_cookie,
+                    u32 dset_size,
+                    u32 dset_version,
+                    u32 targ_handle,
+                    u32 targ_reply_fn,
+                    u32 targ_reply_arg)
+{
+    void *osbuf;
+    WMIX_DSETOPEN_REPLY_CMD *open_reply;
+
+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter - wmip=0x%lx\n", DBGARG, (unsigned long)wmip));
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*open_reply));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*open_reply));
+    open_reply = (WMIX_DSETOPEN_REPLY_CMD *)(A_NETBUF_DATA(osbuf));
+
+    open_reply->status                   = status;
+    open_reply->targ_dset_handle         = targ_handle;
+    open_reply->targ_reply_fn            = targ_reply_fn;
+    open_reply->targ_reply_arg           = targ_reply_arg;
+    open_reply->access_cookie            = access_cookie;
+    open_reply->size                     = dset_size;
+    open_reply->version                  = dset_version;
+
+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DSETOPEN_REPLY_CMDID,
+                             NO_SYNC_WMIFLAG));
+}
+
+static int
+wmi_get_pmkid_list_event_rx(struct wmi_t *wmip, u8 *datap, u32 len)
+{
+    WMI_PMKID_LIST_REPLY *reply;
+    u32 expected_len;
+
+    if (len < sizeof(WMI_PMKID_LIST_REPLY)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_PMKID_LIST_REPLY *)datap;
+    expected_len = sizeof(reply->numPMKID) + reply->numPMKID * WMI_PMKID_LEN;
+
+    if (len < expected_len) {
+        return A_EINVAL;
+    }
+
+    A_WMI_PMKID_LIST_EVENT(wmip->wmi_devt, reply->numPMKID,
+                           reply->pmkidList, reply->bssidList[0]);
+
+    return 0;
+}
+
+
+static int
+wmi_set_params_event_rx(struct wmi_t *wmip, u8 *datap, u32 len)
+{
+    WMI_SET_PARAMS_REPLY *reply;
+
+    if (len < sizeof(WMI_SET_PARAMS_REPLY)) {
+        return A_EINVAL;
+    }
+    reply = (WMI_SET_PARAMS_REPLY *)datap;
+
+    if (0 == reply->status)
+    {
+
+    }
+    else
+    {
+
+    }
+
+    return 0;
+}
+
+
+#ifdef CONFIG_HOST_DSET_SUPPORT
+int
+wmi_dset_data_reply(struct wmi_t *wmip,
+                    u32 status,
+                    u8 *user_buf,
+                    u32 length,
+                    u32 targ_buf,
+                    u32 targ_reply_fn,
+                    u32 targ_reply_arg)
+{
+    void *osbuf;
+    WMIX_DSETDATA_REPLY_CMD *data_reply;
+    u32 size;
+
+    size = sizeof(*data_reply) + length;
+
+    if (size <= length) {
+        return A_ERROR;
+    }
+
+    A_DPRINTF(DBG_WMI,
+        (DBGFMT "Enter - length=%d status=%d\n", DBGARG, length, status));
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+    A_NETBUF_PUT(osbuf, size);
+    data_reply = (WMIX_DSETDATA_REPLY_CMD *)(A_NETBUF_DATA(osbuf));
+
+    data_reply->status                     = status;
+    data_reply->targ_buf                   = targ_buf;
+    data_reply->targ_reply_fn              = targ_reply_fn;
+    data_reply->targ_reply_arg             = targ_reply_arg;
+    data_reply->length                     = length;
+
+    if (status == 0) {
+        if (a_copy_from_user(data_reply->buf, user_buf, length)) {
+            A_NETBUF_FREE(osbuf);
+            return A_ERROR;
+        }
+    }
+
+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DSETDATA_REPLY_CMDID,
+                             NO_SYNC_WMIFLAG));
+}
+#endif /* CONFIG_HOST_DSET_SUPPORT */
+
+int
+wmi_set_wsc_status_cmd(struct wmi_t *wmip, u32 status)
+{
+    void *osbuf;
+    char *cmd;
+
+    wps_enable = status;
+
+    osbuf = a_netbuf_alloc(sizeof(1));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    a_netbuf_put(osbuf, sizeof(1));
+
+    cmd = (char *)(a_netbuf_to_data(osbuf));
+
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd[0] = (status?1:0);
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WSC_STATUS_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+int
+wmi_prof_cfg_cmd(struct wmi_t *wmip,
+                 u32 period,
+                 u32 nbins)
+{
+    void *osbuf;
+    WMIX_PROF_CFG_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMIX_PROF_CFG_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->period = period;
+    cmd->nbins  = nbins;
+
+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_PROF_CFG_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_prof_addr_set_cmd(struct wmi_t *wmip, u32 addr)
+{
+    void *osbuf;
+    WMIX_PROF_ADDR_SET_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMIX_PROF_ADDR_SET_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->addr = addr;
+
+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_PROF_ADDR_SET_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_prof_start_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd_xtnd(wmip, WMIX_PROF_START_CMDID);
+}
+
+int
+wmi_prof_stop_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd_xtnd(wmip, WMIX_PROF_STOP_CMDID);
+}
+
+int
+wmi_prof_count_get_cmd(struct wmi_t *wmip)
+{
+    return wmi_simple_cmd_xtnd(wmip, WMIX_PROF_COUNT_GET_CMDID);
+}
+
+/* Called to handle WMIX_PROF_CONT_EVENTID */
+static int
+wmi_prof_count_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMIX_PROF_COUNT_EVENT *prof_data = (WMIX_PROF_COUNT_EVENT *)datap;
+
+    A_DPRINTF(DBG_WMI,
+        (DBGFMT "Enter - addr=0x%x count=%d\n", DBGARG,
+        prof_data->addr, prof_data->count));
+
+    A_WMI_PROF_COUNT_RX(prof_data->addr, prof_data->count);
+
+    return 0;
+}
+#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
+
+#ifdef OS_ROAM_MANAGEMENT
+
+#define ETHERNET_MAC_ADDRESS_LENGTH    6
+
+void
+wmi_scan_indication (struct wmi_t *wmip)
+{
+    struct ieee80211_node_table *nt;
+    u32 gen;
+    u32 size;
+    u32 bsssize;
+    bss_t *bss;
+    u32 numbss;
+    PNDIS_802_11_BSSID_SCAN_INFO psi;
+    PBYTE  pie;
+    NDIS_802_11_FIXED_IEs *pFixed;
+    NDIS_802_11_VARIABLE_IEs *pVar;
+    u32 RateSize;
+
+    struct ar6kScanIndication
+    {
+        NDIS_802_11_STATUS_INDICATION     ind;
+        NDIS_802_11_BSSID_SCAN_INFO_LIST  slist;
+    } *pAr6kScanIndEvent;
+
+    nt = &wmip->wmi_scan_table;
+
+    ++nt->nt_si_gen;
+
+
+    gen = nt->nt_si_gen;
+
+    size = offsetof(struct ar6kScanIndication, slist) +
+           offsetof(NDIS_802_11_BSSID_SCAN_INFO_LIST, BssidScanInfo);
+
+    numbss = 0;
+
+    IEEE80211_NODE_LOCK(nt);
+
+    //calc size
+    for (bss = nt->nt_node_first; bss; bss = bss->ni_list_next) {
+        if (bss->ni_si_gen != gen) {
+            bsssize = offsetof(NDIS_802_11_BSSID_SCAN_INFO, Bssid) + offsetof(NDIS_WLAN_BSSID_EX, IEs);
+            bsssize = bsssize + sizeof(NDIS_802_11_FIXED_IEs);
+
+#ifdef SUPPORT_WPA2
+            if (bss->ni_cie.ie_rsn) {
+                bsssize = bsssize + bss->ni_cie.ie_rsn[1] + 2;
+            }
+#endif
+            if (bss->ni_cie.ie_wpa) {
+                bsssize = bsssize + bss->ni_cie.ie_wpa[1] + 2;
+            }
+
+            // bsssize must be a multiple of 4 to maintain alignment.
+            bsssize = (bsssize + 3) & ~3;
+
+            size += bsssize;
+
+            numbss++;
+        }
+    }
+
+    if (0 == numbss)
+    {
+//        RETAILMSG(1, (L"AR6K: scan indication: 0 bss\n"));
+        ar6000_scan_indication (wmip->wmi_devt, NULL, 0);
+        IEEE80211_NODE_UNLOCK (nt);
+        return;
+    }
+
+    pAr6kScanIndEvent = A_MALLOC(size);
+
+    if (NULL == pAr6kScanIndEvent)
+    {
+        IEEE80211_NODE_UNLOCK(nt);
+        return;
+    }
+
+    A_MEMZERO(pAr6kScanIndEvent, size);
+
+    //copy data
+    pAr6kScanIndEvent->ind.StatusType = Ndis802_11StatusType_BssidScanInfoList;
+    pAr6kScanIndEvent->slist.Version = 1;
+    pAr6kScanIndEvent->slist.NumItems = numbss;
+
+    psi = &pAr6kScanIndEvent->slist.BssidScanInfo[0];
+
+    for (bss = nt->nt_node_first; bss; bss = bss->ni_list_next) {
+        if (bss->ni_si_gen != gen) {
+
+            bss->ni_si_gen = gen;
+
+            //Set scan time
+            psi->ScanTime = bss->ni_tstamp - WLAN_NODE_INACT_TIMEOUT_MSEC;
+
+            // Copy data to bssid_ex
+            bsssize = offsetof(NDIS_WLAN_BSSID_EX, IEs);
+            bsssize = bsssize + sizeof(NDIS_802_11_FIXED_IEs);
+
+#ifdef SUPPORT_WPA2
+            if (bss->ni_cie.ie_rsn) {
+                bsssize = bsssize + bss->ni_cie.ie_rsn[1] + 2;
+            }
+#endif
+            if (bss->ni_cie.ie_wpa) {
+                bsssize = bsssize + bss->ni_cie.ie_wpa[1] + 2;
+            }
+
+            // bsssize must be a multiple of 4 to maintain alignment.
+            bsssize = (bsssize + 3) & ~3;
+
+            psi->Bssid.Length = bsssize;
+
+            memcpy (psi->Bssid.MacAddress, bss->ni_macaddr, ETHERNET_MAC_ADDRESS_LENGTH);
+
+
+//if (((bss->ni_macaddr[3] == 0xCE) && (bss->ni_macaddr[4] == 0xF0) && (bss->ni_macaddr[5] == 0xE7)) ||
+//  ((bss->ni_macaddr[3] == 0x03) && (bss->ni_macaddr[4] == 0xE2) && (bss->ni_macaddr[5] == 0x70)))
+//            RETAILMSG (1, (L"%x\n",bss->ni_macaddr[5]));
+
+            psi->Bssid.Ssid.SsidLength = 0;
+            pie = bss->ni_cie.ie_ssid;
+
+            if (pie) {
+                // Format of SSID IE is:
+                //  Type   (1 octet)
+                //  Length (1 octet)
+                //  SSID (Length octets)
+                //
+                //  Validation of the IE should have occurred within WMI.
+                //
+                if (pie[1] <= 32) {
+                    psi->Bssid.Ssid.SsidLength = pie[1];
+                    memcpy(psi->Bssid.Ssid.Ssid, &pie[2], psi->Bssid.Ssid.SsidLength);
+                }
+            }
+            psi->Bssid.Privacy = (bss->ni_cie.ie_capInfo & 0x10) ? 1 : 0;
+
+            //Post the RSSI value relative to the Standard Noise floor value.
+            psi->Bssid.Rssi = bss->ni_rssi;
+
+            if (bss->ni_cie.ie_chan >= 2412 && bss->ni_cie.ie_chan <= 2484) {
+
+                if (bss->ni_cie.ie_rates && bss->ni_cie.ie_xrates) {
+                    psi->Bssid.NetworkTypeInUse = Ndis802_11OFDM24;
+                }
+                else {
+                    psi->Bssid.NetworkTypeInUse = Ndis802_11DS;
+                }
+            }
+            else {
+                psi->Bssid.NetworkTypeInUse = Ndis802_11OFDM5;
+            }
+
+            psi->Bssid.Configuration.Length = sizeof(psi->Bssid.Configuration);
+            psi->Bssid.Configuration.BeaconPeriod = bss->ni_cie.ie_beaconInt; // Units are Kmicroseconds (1024 us)
+            psi->Bssid.Configuration.ATIMWindow =  0;
+            psi->Bssid.Configuration.DSConfig =  bss->ni_cie.ie_chan * 1000;
+            psi->Bssid.InfrastructureMode = ((bss->ni_cie.ie_capInfo & 0x03) == 0x01 ) ? Ndis802_11Infrastructure : Ndis802_11IBSS;
+
+            RateSize = 0;
+            pie = bss->ni_cie.ie_rates;
+            if (pie) {
+                RateSize = (pie[1] < NDIS_802_11_LENGTH_RATES_EX) ? pie[1] : NDIS_802_11_LENGTH_RATES_EX;
+                memcpy(psi->Bssid.SupportedRates, &pie[2], RateSize);
+            }
+            pie = bss->ni_cie.ie_xrates;
+            if (pie && RateSize < NDIS_802_11_LENGTH_RATES_EX) {
+                memcpy(psi->Bssid.SupportedRates + RateSize, &pie[2],
+                       (pie[1] < (NDIS_802_11_LENGTH_RATES_EX - RateSize)) ? pie[1] : (NDIS_802_11_LENGTH_RATES_EX - RateSize));
+            }
+
+            // Copy the fixed IEs
+            psi->Bssid.IELength = sizeof(NDIS_802_11_FIXED_IEs);
+
+            pFixed = (NDIS_802_11_FIXED_IEs *)psi->Bssid.IEs;
+            memcpy(pFixed->Timestamp, bss->ni_cie.ie_tstamp, sizeof(pFixed->Timestamp));
+            pFixed->BeaconInterval = bss->ni_cie.ie_beaconInt;
+            pFixed->Capabilities = bss->ni_cie.ie_capInfo;
+
+            // Copy selected variable IEs
+
+            pVar = (NDIS_802_11_VARIABLE_IEs *)((PBYTE)pFixed + sizeof(NDIS_802_11_FIXED_IEs));
+
+#ifdef SUPPORT_WPA2
+            // Copy the WPAv2 IE
+            if (bss->ni_cie.ie_rsn) {
+                pie = bss->ni_cie.ie_rsn;
+                psi->Bssid.IELength += pie[1] + 2;
+                memcpy(pVar, pie, pie[1] + 2);
+                pVar = (NDIS_802_11_VARIABLE_IEs *)((PBYTE)pVar + pie[1] + 2);
+            }
+#endif
+            // Copy the WPAv1 IE
+            if (bss->ni_cie.ie_wpa) {
+                pie = bss->ni_cie.ie_wpa;
+                psi->Bssid.IELength += pie[1] + 2;
+                memcpy(pVar, pie, pie[1] + 2);
+                pVar = (NDIS_802_11_VARIABLE_IEs *)((PBYTE)pVar + pie[1] + 2);
+            }
+
+            // Advance buffer pointer
+            psi = (PNDIS_802_11_BSSID_SCAN_INFO)((BYTE*)psi + bsssize + FIELD_OFFSET(NDIS_802_11_BSSID_SCAN_INFO, Bssid));
+        }
+    }
+
+    IEEE80211_NODE_UNLOCK(nt);
+
+//    wmi_free_allnodes(wmip);
+
+//    RETAILMSG(1, (L"AR6K: scan indication: %u bss\n", numbss));
+
+    ar6000_scan_indication (wmip->wmi_devt, pAr6kScanIndEvent, size);
+
+    kfree(pAr6kScanIndEvent);
+}
+#endif
+
+u8 ar6000_get_upper_threshold(s16 rssi, SQ_THRESHOLD_PARAMS *sq_thresh,
+                           u32 size)
+{
+    u32 index;
+    u8 threshold = (u8)sq_thresh->upper_threshold[size - 1];
+
+    /* The list is already in sorted order. Get the next lower value */
+    for (index = 0; index < size; index ++) {
+        if (rssi < sq_thresh->upper_threshold[index]) {
+            threshold = (u8)sq_thresh->upper_threshold[index];
+            break;
+        }
+    }
+
+    return threshold;
+}
+
+u8 ar6000_get_lower_threshold(s16 rssi, SQ_THRESHOLD_PARAMS *sq_thresh,
+                           u32 size)
+{
+    u32 index;
+    u8 threshold = (u8)sq_thresh->lower_threshold[size - 1];
+
+    /* The list is already in sorted order. Get the next lower value */
+    for (index = 0; index < size; index ++) {
+        if (rssi > sq_thresh->lower_threshold[index]) {
+            threshold = (u8)sq_thresh->lower_threshold[index];
+            break;
+        }
+    }
+
+    return threshold;
+}
+static int
+wmi_send_rssi_threshold_params(struct wmi_t *wmip,
+                              WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd)
+{
+    void    *osbuf;
+    s8 size;
+    WMI_RSSI_THRESHOLD_PARAMS_CMD *cmd;
+
+    size = sizeof (*cmd);
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+
+    cmd = (WMI_RSSI_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+    memcpy(cmd, rssiCmd, sizeof(WMI_RSSI_THRESHOLD_PARAMS_CMD));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_RSSI_THRESHOLD_PARAMS_CMDID,
+                            NO_SYNC_WMIFLAG));
+}
+static int
+wmi_send_snr_threshold_params(struct wmi_t *wmip,
+                             WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd)
+{
+    void    *osbuf;
+    s8 size;
+    WMI_SNR_THRESHOLD_PARAMS_CMD *cmd;
+
+    size = sizeof (*cmd);
+
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+    cmd = (WMI_SNR_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, size);
+    memcpy(cmd, snrCmd, sizeof(WMI_SNR_THRESHOLD_PARAMS_CMD));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SNR_THRESHOLD_PARAMS_CMDID,
+                            NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_target_event_report_cmd(struct wmi_t *wmip, WMI_SET_TARGET_EVENT_REPORT_CMD* cmd)
+{
+    void *osbuf;
+    WMI_SET_TARGET_EVENT_REPORT_CMD* alloc_cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    alloc_cmd = (WMI_SET_TARGET_EVENT_REPORT_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(alloc_cmd, sizeof(*cmd));
+    memcpy(alloc_cmd, cmd, sizeof(*cmd));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_TARGET_EVENT_REPORT_CMDID,
+            NO_SYNC_WMIFLAG));
+}
+
+bss_t *wmi_rm_current_bss (struct wmi_t *wmip, u8 *id)
+{
+    wmi_get_current_bssid (wmip, id);
+    return wlan_node_remove (&wmip->wmi_scan_table, id);
+}
+
+int wmi_add_current_bss (struct wmi_t *wmip, u8 *id, bss_t *bss)
+{
+    wlan_setup_node (&wmip->wmi_scan_table, bss, id);
+    return 0;
+}
+
+static int
+wmi_addba_req_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_ADDBA_REQ_EVENT *cmd = (WMI_ADDBA_REQ_EVENT *)datap;
+
+    A_WMI_AGGR_RECV_ADDBA_REQ_EVT(wmip->wmi_devt, cmd);
+
+    return 0;
+}
+
+
+static int
+wmi_addba_resp_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_ADDBA_RESP_EVENT *cmd = (WMI_ADDBA_RESP_EVENT *)datap;
+
+    A_WMI_AGGR_RECV_ADDBA_RESP_EVT(wmip->wmi_devt, cmd);
+
+    return 0;
+}
+
+static int
+wmi_delba_req_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_DELBA_EVENT *cmd = (WMI_DELBA_EVENT *)datap;
+
+    A_WMI_AGGR_RECV_DELBA_REQ_EVT(wmip->wmi_devt, cmd);
+
+    return 0;
+}
+
+int
+wmi_btcoex_config_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+        A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_BTCOEX_CONFIG_EVENT(wmip->wmi_devt, datap, len);
+
+     return 0;
+}
+
+
+int
+wmi_btcoex_stats_event_rx(struct wmi_t * wmip,u8 *datap,int len)
+{
+        A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
+    A_WMI_BTCOEX_STATS_EVENT(wmip->wmi_devt, datap, len);
+
+     return 0;
+
+}
+
+static int
+wmi_hci_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_HCI_EVENT *cmd = (WMI_HCI_EVENT *)datap;
+    A_WMI_HCI_EVENT_EVT(wmip->wmi_devt, cmd);
+
+    return 0;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+////                                                                        ////
+////                AP mode functions                                       ////
+////                                                                        ////
+////////////////////////////////////////////////////////////////////////////////
+/*
+ * IOCTL: AR6000_XIOCTL_AP_COMMIT_CONFIG
+ *
+ * When AR6K in AP mode, This command will be called after
+ * changing ssid, channel etc. It will pass the profile to
+ * target with a flag which will indicate which parameter changed,
+ * also if this flag is 0, there was no change in parametes, so
+ * commit cmd will not be sent to target. Without calling this IOCTL
+ * the changes will not take effect.
+ */
+int
+wmi_ap_profile_commit(struct wmi_t *wmip, WMI_CONNECT_CMD *p)
+{
+    void *osbuf;
+    WMI_CONNECT_CMD *cm;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cm));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cm));
+    cm = (WMI_CONNECT_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cm, sizeof(*cm));
+
+    memcpy(cm,p,sizeof(*cm));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_CONFIG_COMMIT_CMDID, NO_SYNC_WMIFLAG));
+}
+
+/*
+ * IOCTL: AR6000_XIOCTL_AP_HIDDEN_SSID
+ *
+ * This command will be used to enable/disable hidden ssid functioanlity of
+ * beacon. If it is enabled, ssid will be NULL in beacon.
+ */
+int
+wmi_ap_set_hidden_ssid(struct wmi_t *wmip, u8 hidden_ssid)
+{
+    void *osbuf;
+    WMI_AP_HIDDEN_SSID_CMD *hs;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_HIDDEN_SSID_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_HIDDEN_SSID_CMD));
+    hs = (WMI_AP_HIDDEN_SSID_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(hs, sizeof(*hs));
+
+    hs->hidden_ssid          = hidden_ssid;
+
+    A_DPRINTF(DBG_WMI, (DBGFMT "AR6000_XIOCTL_AP_HIDDEN_SSID %d\n", DBGARG , hidden_ssid));
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_HIDDEN_SSID_CMDID, NO_SYNC_WMIFLAG));
+}
+
+/*
+ * IOCTL: AR6000_XIOCTL_AP_SET_MAX_NUM_STA
+ *
+ * This command is used to limit max num of STA that can connect
+ * with this AP. This value should not exceed AP_MAX_NUM_STA (this
+ * is max num of STA supported by AP). Value was already validated
+ * in ioctl.c
+ */
+int
+wmi_ap_set_num_sta(struct wmi_t *wmip, u8 num_sta)
+{
+    void *osbuf;
+    WMI_AP_SET_NUM_STA_CMD *ns;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_SET_NUM_STA_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_SET_NUM_STA_CMD));
+    ns = (WMI_AP_SET_NUM_STA_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(ns, sizeof(*ns));
+
+    ns->num_sta          = num_sta;
+
+    A_DPRINTF(DBG_WMI, (DBGFMT "AR6000_XIOCTL_AP_SET_MAX_NUM_STA %d\n", DBGARG , num_sta));
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_SET_NUM_STA_CMDID, NO_SYNC_WMIFLAG));
+}
+
+/*
+ * IOCTL: AR6000_XIOCTL_AP_SET_ACL_MAC
+ *
+ * This command is used to send list of mac of STAs which will
+ * be allowed to connect with this AP. When this list is empty
+ * firware will allow all STAs till the count reaches AP_MAX_NUM_STA.
+ */
+int
+wmi_ap_acl_mac_list(struct wmi_t *wmip, WMI_AP_ACL_MAC_CMD *acl)
+{
+    void *osbuf;
+    WMI_AP_ACL_MAC_CMD *a;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_ACL_MAC_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_ACL_MAC_CMD));
+    a = (WMI_AP_ACL_MAC_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(a, sizeof(*a));
+    memcpy(a,acl,sizeof(*acl));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_ACL_MAC_LIST_CMDID, NO_SYNC_WMIFLAG));
+}
+
+/*
+ * IOCTL: AR6000_XIOCTL_AP_SET_MLME
+ *
+ * This command is used to send list of mac of STAs which will
+ * be allowed to connect with this AP. When this list is empty
+ * firware will allow all STAs till the count reaches AP_MAX_NUM_STA.
+ */
+int
+wmi_ap_set_mlme(struct wmi_t *wmip, u8 cmd, u8 *mac, u16 reason)
+{
+    void *osbuf;
+    WMI_AP_SET_MLME_CMD *mlme;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_SET_MLME_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_SET_MLME_CMD));
+    mlme = (WMI_AP_SET_MLME_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(mlme, sizeof(*mlme));
+
+    mlme->cmd = cmd;
+    memcpy(mlme->mac, mac, ATH_MAC_LEN);
+    mlme->reason = reason;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_SET_MLME_CMDID, NO_SYNC_WMIFLAG));
+}
+
+static int
+wmi_pspoll_event_rx(struct wmi_t *wmip, u8 *datap, int len)
+{
+    WMI_PSPOLL_EVENT *ev;
+
+    if (len < sizeof(WMI_PSPOLL_EVENT)) {
+        return A_EINVAL;
+    }
+    ev = (WMI_PSPOLL_EVENT *)datap;
+
+    A_WMI_PSPOLL_EVENT(wmip->wmi_devt, ev->aid);
+    return 0;
+}
+
+static int
+wmi_dtimexpiry_event_rx(struct wmi_t *wmip, u8 *datap,int len)
+{
+    A_WMI_DTIMEXPIRY_EVENT(wmip->wmi_devt);
+    return 0;
+}
+
+#ifdef WAPI_ENABLE
+static int
+wmi_wapi_rekey_event_rx(struct wmi_t *wmip, u8 *datap,int len)
+{
+    u8 *ev;
+
+    if (len < 7) {
+        return A_EINVAL;
+    }
+    ev = (u8 *)datap;
+
+    A_WMI_WAPI_REKEY_EVENT(wmip->wmi_devt, *ev, &ev[1]);
+    return 0;
+}
+#endif
+
+int
+wmi_set_pvb_cmd(struct wmi_t *wmip, u16 aid, bool flag)
+{
+    WMI_AP_SET_PVB_CMD *cmd;
+    void *osbuf = NULL;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_SET_PVB_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_SET_PVB_CMD));
+    cmd = (WMI_AP_SET_PVB_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+
+    cmd->aid = aid;
+    cmd->flag = flag;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_SET_PVB_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_ap_conn_inact_time(struct wmi_t *wmip, u32 period)
+{
+    WMI_AP_CONN_INACT_CMD *cmd;
+    void *osbuf = NULL;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_CONN_INACT_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_CONN_INACT_CMD));
+    cmd = (WMI_AP_CONN_INACT_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+
+    cmd->period = period;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_CONN_INACT_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_ap_bgscan_time(struct wmi_t *wmip, u32 period, u32 dwell)
+{
+    WMI_AP_PROT_SCAN_TIME_CMD *cmd;
+    void *osbuf = NULL;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_PROT_SCAN_TIME_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_PROT_SCAN_TIME_CMD));
+    cmd = (WMI_AP_PROT_SCAN_TIME_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+
+    cmd->period_min = period;
+    cmd->dwell_ms   = dwell;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_PROT_SCAN_TIME_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_ap_set_dtim(struct wmi_t *wmip, u8 dtim)
+{
+    WMI_AP_SET_DTIM_CMD *cmd;
+    void *osbuf = NULL;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_SET_DTIM_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_SET_DTIM_CMD));
+    cmd = (WMI_AP_SET_DTIM_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+
+    cmd->dtim = dtim;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_SET_DTIM_CMDID, NO_SYNC_WMIFLAG));
+}
+
+/*
+ * IOCTL: AR6000_XIOCTL_AP_SET_ACL_POLICY
+ *
+ * This command is used to set ACL policay. While changing policy, if you
+ * want to retain the existing MAC addresses in the ACL list, policy should be
+ * OR with AP_ACL_RETAIN_LIST_MASK, else the existing list will be cleared.
+ * If there is no chage in policy, the list will be intact.
+ */
+int
+wmi_ap_set_acl_policy(struct wmi_t *wmip, u8 policy)
+{
+    void *osbuf;
+    WMI_AP_ACL_POLICY_CMD *po;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_ACL_POLICY_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+}
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_ACL_POLICY_CMD));
+    po = (WMI_AP_ACL_POLICY_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(po, sizeof(*po));
+
+    po->policy = policy;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_ACL_POLICY_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_ap_set_rateset(struct wmi_t *wmip, u8 rateset)
+{
+    void *osbuf;
+    WMI_AP_SET_11BG_RATESET_CMD *rs;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_AP_SET_11BG_RATESET_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_AP_SET_11BG_RATESET_CMD));
+    rs = (WMI_AP_SET_11BG_RATESET_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(rs, sizeof(*rs));
+
+    rs->rateset = rateset;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_AP_SET_11BG_RATESET_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_ht_cap_cmd(struct wmi_t *wmip, WMI_SET_HT_CAP_CMD *cmd)
+{
+    void *osbuf;
+    WMI_SET_HT_CAP_CMD *htCap;
+    u8 band;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*htCap));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*htCap));
+
+    band = (cmd->band)? A_BAND_5GHZ : A_BAND_24GHZ;
+    wmip->wmi_ht_allowed[band] = (cmd->enable)? 1:0;
+
+    htCap = (WMI_SET_HT_CAP_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(htCap, sizeof(*htCap));
+    memcpy(htCap, cmd, sizeof(*htCap));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_HT_CAP_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_ht_op_cmd(struct wmi_t *wmip, u8 sta_chan_width)
+{
+    void *osbuf;
+    WMI_SET_HT_OP_CMD *htInfo;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*htInfo));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*htInfo));
+
+    htInfo = (WMI_SET_HT_OP_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(htInfo, sizeof(*htInfo));
+    htInfo->sta_chan_width = sta_chan_width;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_HT_OP_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_tx_select_rates_cmd(struct wmi_t *wmip, u32 *pMaskArray)
+{
+    void *osbuf;
+    WMI_SET_TX_SELECT_RATES_CMD *pData;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*pData));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*pData));
+
+    pData = (WMI_SET_TX_SELECT_RATES_CMD *)(A_NETBUF_DATA(osbuf));
+    memcpy(pData, pMaskArray, sizeof(*pData));
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_TX_SELECT_RATES_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+
+int
+wmi_send_hci_cmd(struct wmi_t *wmip, u8 *buf, u16 sz)
+{
+    void *osbuf;
+    WMI_HCI_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd) + sz);
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd) + sz);
+    cmd = (WMI_HCI_CMD *)(A_NETBUF_DATA(osbuf));
+
+    cmd->cmd_buf_sz = sz;
+    memcpy(cmd->buf, buf, sz);
+    return (wmi_cmd_send(wmip, osbuf, WMI_HCI_CMD_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_allow_aggr_cmd(struct wmi_t *wmip, u16 tx_tidmask, u16 rx_tidmask)
+{
+    void *osbuf;
+    WMI_ALLOW_AGGR_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_ALLOW_AGGR_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->tx_allow_aggr = tx_tidmask;
+    cmd->rx_allow_aggr = rx_tidmask;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_ALLOW_AGGR_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_setup_aggr_cmd(struct wmi_t *wmip, u8 tid)
+{
+    void *osbuf;
+    WMI_ADDBA_REQ_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_ADDBA_REQ_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->tid = tid;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_ADDBA_REQ_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_delete_aggr_cmd(struct wmi_t *wmip, u8 tid, bool uplink)
+{
+    void *osbuf;
+    WMI_DELBA_REQ_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_DELBA_REQ_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->tid = tid;
+    cmd->is_sender_initiator = uplink;  /* uplink =1 - uplink direction, 0=downlink direction */
+
+    /* Delete the local aggr state, on host */
+    return (wmi_cmd_send(wmip, osbuf, WMI_DELBA_REQ_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_rx_frame_format_cmd(struct wmi_t *wmip, u8 rxMetaVersion,
+                            bool rxDot11Hdr, bool defragOnHost)
+{
+    void *osbuf;
+    WMI_RX_FRAME_FORMAT_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_RX_FRAME_FORMAT_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->dot11Hdr = (rxDot11Hdr==true)? 1:0;
+    cmd->defragOnHost = (defragOnHost==true)? 1:0;
+    cmd->metaVersion = rxMetaVersion;  /*  */
+
+    /* Delete the local aggr state, on host */
+    return (wmi_cmd_send(wmip, osbuf, WMI_RX_FRAME_FORMAT_CMDID, NO_SYNC_WMIFLAG));
+}
+
+
+int
+wmi_set_thin_mode_cmd(struct wmi_t *wmip, bool bThinMode)
+{
+    void *osbuf;
+    WMI_SET_THIN_MODE_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_THIN_MODE_CMD *)(A_NETBUF_DATA(osbuf));
+    cmd->enable = (bThinMode==true)? 1:0;
+
+    /* Delete the local aggr state, on host */
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_THIN_MODE_CMDID, NO_SYNC_WMIFLAG));
+}
+
+
+int
+wmi_set_wlan_conn_precedence_cmd(struct wmi_t *wmip, BT_WLAN_CONN_PRECEDENCE precedence)
+{
+    void *osbuf;
+    WMI_SET_BT_WLAN_CONN_PRECEDENCE *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_BT_WLAN_CONN_PRECEDENCE *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->precedence = precedence;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BT_WLAN_CONN_PRECEDENCE_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_pmk_cmd(struct wmi_t *wmip, u8 *pmk)
+{
+    void *osbuf;
+    WMI_SET_PMK_CMD *p;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_SET_PMK_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_SET_PMK_CMD));
+
+    p = (WMI_SET_PMK_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(p, sizeof(*p));
+
+    memcpy(p->pmk, pmk, WMI_PMK_LEN);
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_PMK_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_set_excess_tx_retry_thres_cmd(struct wmi_t *wmip, WMI_SET_EXCESS_TX_RETRY_THRES_CMD *cmd)
+{
+    void *osbuf;
+    WMI_SET_EXCESS_TX_RETRY_THRES_CMD *p;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_SET_EXCESS_TX_RETRY_THRES_CMD));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(WMI_SET_EXCESS_TX_RETRY_THRES_CMD));
+
+    p = (WMI_SET_EXCESS_TX_RETRY_THRES_CMD *)(A_NETBUF_DATA(osbuf));
+    memset(p, 0, sizeof(*p));
+
+    p->threshold = cmd->threshold;
+
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_EXCESS_TX_RETRY_THRES_CMDID, NO_SYNC_WMIFLAG));
+}
+
+int
+wmi_SGI_cmd(struct wmi_t *wmip, u32 sgiMask, u8 sgiPERThreshold)
+{
+    void *osbuf;
+    WMI_SET_TX_SGI_PARAM_CMD *cmd;
+
+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+    if (osbuf == NULL) {
+        return A_NO_MEMORY ;
+    }
+
+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
+    cmd = (WMI_SET_TX_SGI_PARAM_CMD *)(A_NETBUF_DATA(osbuf));
+    A_MEMZERO(cmd, sizeof(*cmd));
+    cmd->sgiMask = sgiMask;
+    cmd->sgiPERThreshold = sgiPERThreshold;
+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_TX_SGI_PARAM_CMDID,
+                         NO_SYNC_WMIFLAG));
+}
+
+bss_t *
+wmi_find_matching_Ssidnode (struct wmi_t *wmip, u8 *pSsid,
+                   u32 ssidLength,
+                   u32 dot11AuthMode, u32 authMode,
+                   u32 pairwiseCryptoType, u32 grpwiseCryptoTyp)
+{
+    bss_t *node = NULL;
+    node = wlan_find_matching_Ssidnode (&wmip->wmi_scan_table, pSsid,
+                               ssidLength, dot11AuthMode, authMode, pairwiseCryptoType, grpwiseCryptoTyp);
+
+    return node;
+}
+
+u16 wmi_ieee2freq (int chan)
+{
+    u16 freq = 0;
+    freq = wlan_ieee2freq (chan);
+    return freq;
+
+}
+
+u32 wmi_freq2ieee (u16 freq)
+{
+    u16 chan = 0;
+    chan = wlan_freq2ieee (freq);
+    return chan;
+}
diff --git a/drivers/staging/ath6kl/wmi/wmi_host.h b/drivers/staging/ath6kl/wmi/wmi_host.h
new file mode 100644
index 00000000000..53e4f085dfe
--- /dev/null
+++ b/drivers/staging/ath6kl/wmi/wmi_host.h
@@ -0,0 +1,102 @@
+//------------------------------------------------------------------------------
+// <copyright file="wmi_host.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains local definitios for the wmi host module.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _WMI_HOST_H_
+#define _WMI_HOST_H_
+
+#include "roaming.h"
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct wmi_stats {
+    u32 cmd_len_err;
+    u32 cmd_id_err;
+};
+
+#define SSID_IE_LEN_INDEX 13
+
+/* Host side link management data structures */
+#define SIGNAL_QUALITY_THRESHOLD_LEVELS 6
+#define SIGNAL_QUALITY_UPPER_THRESHOLD_LEVELS SIGNAL_QUALITY_THRESHOLD_LEVELS
+#define SIGNAL_QUALITY_LOWER_THRESHOLD_LEVELS SIGNAL_QUALITY_THRESHOLD_LEVELS
+typedef struct sq_threshold_params_s {
+    s16 upper_threshold[SIGNAL_QUALITY_UPPER_THRESHOLD_LEVELS];
+    s16 lower_threshold[SIGNAL_QUALITY_LOWER_THRESHOLD_LEVELS];
+    u32 upper_threshold_valid_count;
+    u32 lower_threshold_valid_count;
+    u32 polling_interval;
+    u8 weight;
+    u8 last_rssi; //normally you would expect this to be bss specific but we keep only one instance because its only valid when the device is in a connected state. Not sure if it belongs to host or target.
+    u8 last_rssi_poll_event; //Not sure if it belongs to host or target
+} SQ_THRESHOLD_PARAMS;
+
+/*
+ * These constants are used with A_WLAN_BAND_SET.
+ */ 
+#define A_BAND_24GHZ           0
+#define A_BAND_5GHZ            1
+#define A_NUM_BANDS            2
+
+struct wmi_t {
+    bool                          wmi_ready;
+    bool                          wmi_numQoSStream;
+    u16 wmi_streamExistsForAC[WMM_NUM_AC];
+    u8 wmi_fatPipeExists;
+    void                           *wmi_devt;
+    struct wmi_stats                wmi_stats;
+    struct ieee80211_node_table     wmi_scan_table;
+    u8 wmi_bssid[ATH_MAC_LEN];
+    u8 wmi_powerMode;
+    u8 wmi_phyMode;
+    u8 wmi_keepaliveInterval;
+#ifdef THREAD_X
+    A_CSECT_T                       wmi_lock;
+#else 
+    A_MUTEX_T                       wmi_lock;
+#endif
+    HTC_ENDPOINT_ID                 wmi_endpoint_id;
+    SQ_THRESHOLD_PARAMS             wmi_SqThresholdParams[SIGNAL_QUALITY_METRICS_NUM_MAX];
+    CRYPTO_TYPE                     wmi_pair_crypto_type;
+    CRYPTO_TYPE                     wmi_grp_crypto_type;
+    bool                          wmi_is_wmm_enabled;
+    u8 wmi_ht_allowed[A_NUM_BANDS];
+    u8 wmi_traffic_class;
+};
+
+#ifdef THREAD_X
+#define INIT_WMI_LOCK(w)    A_CSECT_INIT(&(w)->wmi_lock)
+#define LOCK_WMI(w)         A_CSECT_ENTER(&(w)->wmi_lock);
+#define UNLOCK_WMI(w)       A_CSECT_LEAVE(&(w)->wmi_lock);
+#define DELETE_WMI_LOCK(w)  A_CSECT_DELETE(&(w)->wmi_lock);
+#else
+#define LOCK_WMI(w)     A_MUTEX_LOCK(&(w)->wmi_lock);
+#define UNLOCK_WMI(w)   A_MUTEX_UNLOCK(&(w)->wmi_lock);
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMI_HOST_H_ */