15 files changed, 18097 insertions, 0 deletions

diff --git a/drivers/staging/brcm80211/brcmfmac/Makefile b/drivers/staging/brcm80211/brcmfmac/Makefile
new file mode 100644
index 00000000000..da3c8057590
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/Makefile
@@ -0,0 +1,39 @@
+#
+# Makefile fragment for Broadcom 802.11n Networking Device Driver
+#
+# Copyright (c) 2010 Broadcom Corporation
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ccflags-y :=                    \
+        -DBRCMF_FIRSTREAD=64    \
+        -DBRCMF_SDALIGN=64      \
+        -DMAX_HDR_READ=64
+
+ccflags-$(CONFIG_BRCMDBG)       += -DSHOW_EVENTS
+
+ccflags-y += \
+        -Idrivers/staging/brcm80211/brcmfmac    \
+        -Idrivers/staging/brcm80211/include
+
+DHDOFILES = \
+        wl_cfg80211.o \
+        dhd_cdc.o \
+        dhd_common.o \
+        dhd_sdio.o      \
+        dhd_linux.o \
+        bcmsdh.o \
+        bcmsdh_sdmmc.o
+
+obj-$(CONFIG_BRCMFMAC) += brcmfmac.o
+brcmfmac-objs += $(DHDOFILES)
diff --git a/drivers/staging/brcm80211/brcmfmac/bcmchip.h b/drivers/staging/brcm80211/brcmfmac/bcmchip.h
new file mode 100644
index 00000000000..d7d3afd5a10
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/bcmchip.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2011 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _bcmchip_h_
+#define _bcmchip_h_
+
+/* bcm4329 */
+/* SDIO device core, ID 0x829 */
+#define BCM4329_CORE_BUS_BASE           0x18011000
+/* internal memory core, ID 0x80e */
+#define BCM4329_CORE_SOCRAM_BASE        0x18003000
+/* ARM Cortex M3 core, ID 0x82a */
+#define BCM4329_CORE_ARM_BASE           0x18002000
+#define BCM4329_RAMSIZE                 0x48000
+/* firmware name */
+#define BCM4329_FW_NAME                 "brcm/bcm4329-fullmac-4.bin"
+#define BCM4329_NV_NAME                 "brcm/bcm4329-fullmac-4.txt"
+
+#endif                          /* _bcmchip_h_ */
diff --git a/drivers/staging/brcm80211/brcmfmac/bcmsdh.c b/drivers/staging/brcm80211/brcmfmac/bcmsdh.c
new file mode 100644
index 00000000000..f4e72ed126b
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/bcmsdh.c
@@ -0,0 +1,642 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/* ****************** SDIO CARD Interface Functions **************************/
+
+#include <linux/types.h>
+#include <linux/netdevice.h>
+#include <linux/pci.h>
+#include <linux/pci_ids.h>
+#include <linux/sched.h>
+#include <linux/completion.h>
+
+#include <defs.h>
+#include <brcm_hw_ids.h>
+#include <brcmu_utils.h>
+#include <brcmu_wifi.h>
+#include <soc.h>
+#include "dhd.h"
+#include "dhd_bus.h"
+#include "sdio_host.h"
+
+#define SDIOH_API_ACCESS_RETRY_LIMIT    2
+
+#define BRCMF_SD_ERROR_VAL      0x0001  /* Error */
+#define BRCMF_SD_INFO_VAL               0x0002  /* Info */
+
+
+#ifdef BCMDBG
+#define BRCMF_SD_ERROR(x) \
+        do { \
+                if ((brcmf_sdio_msglevel & BRCMF_SD_ERROR_VAL) && \
+                    net_ratelimit()) \
+                        printk x; \
+        } while (0)
+#define BRCMF_SD_INFO(x)        \
+        do { \
+                if ((brcmf_sdio_msglevel & BRCMF_SD_INFO_VAL) && \
+                    net_ratelimit()) \
+                        printk x; \
+        } while (0)
+#else                           /* BCMDBG */
+#define BRCMF_SD_ERROR(x)
+#define BRCMF_SD_INFO(x)
+#endif                          /* BCMDBG */
+
+/* debugging macros */
+#define SDLX_MSG(x)
+
+#define SDIOH_CMD_TYPE_NORMAL   0       /* Normal command */
+#define SDIOH_CMD_TYPE_APPEND   1       /* Append command */
+#define SDIOH_CMD_TYPE_CUTTHRU  2       /* Cut-through command */
+
+#define SDIOH_DATA_PIO          0       /* PIO mode */
+#define SDIOH_DATA_DMA          1       /* DMA mode */
+
+struct brcmf_sdio_card {
+        bool init_success;      /* underlying driver successfully attached */
+        void *sdioh;            /* handler for sdioh */
+        u32 vendevid;   /* Target Vendor and Device ID on SD bus */
+        bool regfail;           /* Save status of last
+                                 reg_read/reg_write call */
+        u32 sbwad;              /* Save backplane window address */
+};
+
+/**
+ * SDIO Host Controller info
+ */
+struct sdio_hc {
+        struct sdio_hc *next;
+        struct device *dev;     /* platform device handle */
+        void *regs;             /* SDIO Host Controller address */
+        struct brcmf_sdio_card *card;
+        void *ch;
+        unsigned int oob_irq;
+        unsigned long oob_flags;        /* OOB Host specifiction
+                                        as edge and etc */
+        bool oob_irq_registered;
+};
+
+/* local copy of bcm sd handler */
+static struct brcmf_sdio_card *l_card;
+
+const uint brcmf_sdio_msglevel = BRCMF_SD_ERROR_VAL;
+
+static struct sdio_hc *sdhcinfo;
+
+/* driver info, initialized when brcmf_sdio_register is called */
+static struct brcmf_sdioh_driver drvinfo = { NULL, NULL };
+
+/* Module parameters specific to each host-controller driver */
+
+module_param(sd_msglevel, uint, 0);
+
+extern uint sd_f2_blocksize;
+module_param(sd_f2_blocksize, int, 0);
+
+/* forward declarations */
+int brcmf_sdio_probe(struct device *dev);
+EXPORT_SYMBOL(brcmf_sdio_probe);
+
+int brcmf_sdio_remove(struct device *dev);
+EXPORT_SYMBOL(brcmf_sdio_remove);
+
+struct brcmf_sdio_card*
+brcmf_sdcard_attach(void *cfghdl, u32 *regsva, uint irq)
+{
+        struct brcmf_sdio_card *card;
+
+        card = kzalloc(sizeof(struct brcmf_sdio_card), GFP_ATOMIC);
+        if (card == NULL) {
+                BRCMF_SD_ERROR(("sdcard_attach: out of memory"));
+                return NULL;
+        }
+
+        /* save the handler locally */
+        l_card = card;
+
+        card->sdioh = brcmf_sdioh_attach(cfghdl, irq);
+        if (!card->sdioh) {
+                brcmf_sdcard_detach(card);
+                return NULL;
+        }
+
+        card->init_success = true;
+
+        *regsva = SI_ENUM_BASE;
+
+        /* Report the BAR, to fix if needed */
+        card->sbwad = SI_ENUM_BASE;
+        return card;
+}
+
+int brcmf_sdcard_detach(struct brcmf_sdio_card *card)
+{
+        if (card != NULL) {
+                if (card->sdioh) {
+                        brcmf_sdioh_detach(card->sdioh);
+                        card->sdioh = NULL;
+                }
+                kfree(card);
+        }
+
+        l_card = NULL;
+        return 0;
+}
+
+int
+brcmf_sdcard_iovar_op(struct brcmf_sdio_card *card, const char *name,
+                void *params, int plen, void *arg, int len, bool set)
+{
+        return brcmf_sdioh_iovar_op(card->sdioh, name, params, plen, arg,
+                                    len, set);
+}
+
+int brcmf_sdcard_intr_enable(struct brcmf_sdio_card *card)
+{
+        return brcmf_sdioh_interrupt_set(card->sdioh, true);
+}
+
+int brcmf_sdcard_intr_disable(struct brcmf_sdio_card *card)
+{
+        return brcmf_sdioh_interrupt_set(card->sdioh, false);
+}
+
+int brcmf_sdcard_intr_reg(struct brcmf_sdio_card *card,
+                          void (*fn)(void *), void *argh)
+{
+        return brcmf_sdioh_interrupt_register(card->sdioh, fn, argh);
+}
+
+int brcmf_sdcard_intr_dereg(struct brcmf_sdio_card *card)
+{
+        return brcmf_sdioh_interrupt_deregister(card->sdioh);
+}
+
+u8 brcmf_sdcard_cfg_read(struct brcmf_sdio_card *card, uint fnc_num, u32 addr,
+                         int *err)
+{
+        int status;
+        s32 retry = 0;
+        u8 data = 0;
+
+        if (!card)
+                card = l_card;
+
+        do {
+                if (retry)      /* wait for 1 ms till bus get settled down */
+                        udelay(1000);
+                status =
+                    brcmf_sdioh_cfg_read(card->sdioh, fnc_num, addr,
+                                   (u8 *) &data);
+        } while (status != 0
+                 && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+        if (err)
+                *err = status;
+
+        BRCMF_SD_INFO(("%s:fun = %d, addr = 0x%x, u8data = 0x%x\n",
+                     __func__, fnc_num, addr, data));
+
+        return data;
+}
+
+void
+brcmf_sdcard_cfg_write(struct brcmf_sdio_card *card, uint fnc_num, u32 addr,
+                       u8 data, int *err)
+{
+        int status;
+        s32 retry = 0;
+
+        if (!card)
+                card = l_card;
+
+        do {
+                if (retry)      /* wait for 1 ms till bus get settled down */
+                        udelay(1000);
+                status =
+                    brcmf_sdioh_cfg_write(card->sdioh, fnc_num, addr,
+                                    (u8 *) &data);
+        } while (status != 0
+                 && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+        if (err)
+                *err = status;
+
+        BRCMF_SD_INFO(("%s:fun = %d, addr = 0x%x, u8data = 0x%x\n",
+                     __func__, fnc_num, addr, data));
+}
+
+u32 brcmf_sdcard_cfg_read_word(struct brcmf_sdio_card *card, uint fnc_num,
+                               u32 addr, int *err)
+{
+        int status;
+        u32 data = 0;
+
+        if (!card)
+                card = l_card;
+
+        status = brcmf_sdioh_request_word(card->sdioh, SDIOH_CMD_TYPE_NORMAL,
+                SDIOH_READ, fnc_num, addr, &data, 4);
+
+        if (err)
+                *err = status;
+
+        BRCMF_SD_INFO(("%s:fun = %d, addr = 0x%x, u32data = 0x%x\n",
+                     __func__, fnc_num, addr, data));
+
+        return data;
+}
+
+void
+brcmf_sdcard_cfg_write_word(struct brcmf_sdio_card *card, uint fnc_num,
+                            u32 addr, u32 data, int *err)
+{
+        int status;
+
+        if (!card)
+                card = l_card;
+
+        status =
+            brcmf_sdioh_request_word(card->sdioh, SDIOH_CMD_TYPE_NORMAL,
+                               SDIOH_WRITE, fnc_num, addr, &data, 4);
+
+        if (err)
+                *err = status;
+
+        BRCMF_SD_INFO(("%s:fun = %d, addr = 0x%x, u32data = 0x%x\n",
+                     __func__, fnc_num, addr, data));
+}
+
+int brcmf_sdcard_cis_read(struct brcmf_sdio_card *card, uint func, u8 * cis,
+                          uint length)
+{
+        int status;
+
+        u8 *tmp_buf, *tmp_ptr;
+        u8 *ptr;
+        bool ascii = func & ~0xf;
+        func &= 0x7;
+
+        if (!card)
+                card = l_card;
+
+        status = brcmf_sdioh_cis_read(card->sdioh, func, cis, length);
+
+        if (ascii) {
+                /* Move binary bits to tmp and format them
+                         into the provided buffer. */
+                tmp_buf = kmalloc(length, GFP_ATOMIC);
+                if (tmp_buf == NULL) {
+                        BRCMF_SD_ERROR(("%s: out of memory\n", __func__));
+                        return -ENOMEM;
+                }
+                memcpy(tmp_buf, cis, length);
+                for (tmp_ptr = tmp_buf, ptr = cis; ptr < (cis + length - 4);
+                     tmp_ptr++) {
+                        ptr += sprintf((char *)ptr, "%.2x ", *tmp_ptr & 0xff);
+                        if ((((tmp_ptr - tmp_buf) + 1) & 0xf) == 0)
+                                ptr += sprintf((char *)ptr, "\n");
+                }
+                kfree(tmp_buf);
+        }
+
+        return status;
+}
+
+static int
+brcmf_sdcard_set_sbaddr_window(struct brcmf_sdio_card *card, u32 address)
+{
+        int err = 0;
+        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+                         (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+        if (!err)
+                brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_SBADDRMID,
+                                       (address >> 16) & SBSDIO_SBADDRMID_MASK,
+                                       &err);
+        if (!err)
+                brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_SBADDRHIGH,
+                                       (address >> 24) & SBSDIO_SBADDRHIGH_MASK,
+                                       &err);
+
+        return err;
+}
+
+u32 brcmf_sdcard_reg_read(struct brcmf_sdio_card *card, u32 addr, uint size)
+{
+        int status;
+        u32 word = 0;
+        uint bar0 = addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+
+        BRCMF_SD_INFO(("%s:fun = 1, addr = 0x%x, ", __func__, addr));
+
+        if (!card)
+                card = l_card;
+
+        if (bar0 != card->sbwad) {
+                if (brcmf_sdcard_set_sbaddr_window(card, bar0))
+                        return 0xFFFFFFFF;
+
+                card->sbwad = bar0;
+        }
+
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+        if (size == 4)
+                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+        status = brcmf_sdioh_request_word(card->sdioh, SDIOH_CMD_TYPE_NORMAL,
+                                    SDIOH_READ, SDIO_FUNC_1, addr, &word, size);
+
+        card->regfail = (status != 0);
+
+        BRCMF_SD_INFO(("u32data = 0x%x\n", word));
+
+        /* if ok, return appropriately masked word */
+        if (status == 0) {
+                switch (size) {
+                case sizeof(u8):
+                        return word & 0xff;
+                case sizeof(u16):
+                        return word & 0xffff;
+                case sizeof(u32):
+                        return word;
+                default:
+                        card->regfail = true;
+
+                }
+        }
+
+        /* otherwise, bad sdio access or invalid size */
+        BRCMF_SD_ERROR(("%s: error reading addr 0x%04x size %d\n", __func__,
+                      addr, size));
+        return 0xFFFFFFFF;
+}
+
+u32 brcmf_sdcard_reg_write(struct brcmf_sdio_card *card, u32 addr, uint size,
+                           u32 data)
+{
+        int status;
+        uint bar0 = addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+        int err = 0;
+
+        BRCMF_SD_INFO(("%s:fun = 1, addr = 0x%x, uint%ddata = 0x%x\n",
+                     __func__, addr, size * 8, data));
+
+        if (!card)
+                card = l_card;
+
+        if (bar0 != card->sbwad) {
+                err = brcmf_sdcard_set_sbaddr_window(card, bar0);
+                if (err)
+                        return err;
+
+                card->sbwad = bar0;
+        }
+
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+        if (size == 4)
+                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+        status =
+            brcmf_sdioh_request_word(card->sdioh, SDIOH_CMD_TYPE_NORMAL,
+                               SDIOH_WRITE, SDIO_FUNC_1, addr, &data, size);
+        card->regfail = (status != 0);
+
+        if (status == 0)
+                return 0;
+
+        BRCMF_SD_ERROR(("%s: error writing 0x%08x to addr 0x%04x size %d\n",
+                      __func__, data, addr, size));
+        return 0xFFFFFFFF;
+}
+
+bool brcmf_sdcard_regfail(struct brcmf_sdio_card *card)
+{
+        return card->regfail;
+}
+
+int
+brcmf_sdcard_recv_buf(struct brcmf_sdio_card *card, u32 addr, uint fn,
+                      uint flags,
+                      u8 *buf, uint nbytes, struct sk_buff *pkt,
+                      void (*complete)(void *handle, int status,
+                                       bool sync_waiting),
+                      void *handle)
+{
+        int status;
+        uint incr_fix;
+        uint width;
+        uint bar0 = addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+        int err = 0;
+
+        BRCMF_SD_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+                     __func__, fn, addr, nbytes));
+
+        /* Async not implemented yet */
+        if (flags & SDIO_REQ_ASYNC)
+                return -ENOTSUPP;
+
+        if (bar0 != card->sbwad) {
+                err = brcmf_sdcard_set_sbaddr_window(card, bar0);
+                if (err)
+                        return err;
+
+                card->sbwad = bar0;
+        }
+
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+        incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+        width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+        if (width == 4)
+                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+        status = brcmf_sdioh_request_buffer(card->sdioh, SDIOH_DATA_PIO,
+                incr_fix, SDIOH_READ, fn, addr, width, nbytes, buf, pkt);
+
+        return status;
+}
+
+int
+brcmf_sdcard_send_buf(struct brcmf_sdio_card *card, u32 addr, uint fn,
+                      uint flags, u8 *buf, uint nbytes, void *pkt,
+                      void (*complete)(void *handle, int status,
+                                       bool sync_waiting),
+                      void *handle)
+{
+        uint incr_fix;
+        uint width;
+        uint bar0 = addr & ~SBSDIO_SB_OFT_ADDR_MASK;
+        int err = 0;
+
+        BRCMF_SD_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+                     __func__, fn, addr, nbytes));
+
+        /* Async not implemented yet */
+        if (flags & SDIO_REQ_ASYNC)
+                return -ENOTSUPP;
+
+        if (bar0 != card->sbwad) {
+                err = brcmf_sdcard_set_sbaddr_window(card, bar0);
+                if (err)
+                        return err;
+
+                card->sbwad = bar0;
+        }
+
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+        incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+        width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+        if (width == 4)
+                addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+        return brcmf_sdioh_request_buffer(card->sdioh, SDIOH_DATA_PIO,
+                incr_fix, SDIOH_WRITE, fn, addr, width, nbytes, buf, pkt);
+}
+
+int brcmf_sdcard_rwdata(struct brcmf_sdio_card *card, uint rw, u32 addr,
+                        u8 *buf, uint nbytes)
+{
+        addr &= SBSDIO_SB_OFT_ADDR_MASK;
+        addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+        return brcmf_sdioh_request_buffer(card->sdioh, SDIOH_DATA_PIO,
+                SDIOH_DATA_INC, (rw ? SDIOH_WRITE : SDIOH_READ), SDIO_FUNC_1,
+                addr, 4, nbytes, buf, NULL);
+}
+
+int brcmf_sdcard_abort(struct brcmf_sdio_card *card, uint fn)
+{
+        return brcmf_sdioh_abort(card->sdioh, fn);
+}
+
+int brcmf_sdcard_query_device(struct brcmf_sdio_card *card)
+{
+        card->vendevid = (PCI_VENDOR_ID_BROADCOM << 16) | 0;
+        return card->vendevid;
+}
+
+u32 brcmf_sdcard_cur_sbwad(struct brcmf_sdio_card *card)
+{
+        if (!card)
+                card = l_card;
+
+        return card->sbwad;
+}
+
+int brcmf_sdio_probe(struct device *dev)
+{
+        struct sdio_hc *sdhc = NULL;
+        u32 regs = 0;
+        struct brcmf_sdio_card *card = NULL;
+        int irq = 0;
+        u32 vendevid;
+        unsigned long irq_flags = 0;
+
+        /* allocate SDIO Host Controller state info */
+        sdhc = kzalloc(sizeof(struct sdio_hc), GFP_ATOMIC);
+        if (!sdhc) {
+                SDLX_MSG(("%s: out of memory\n", __func__));
+                goto err;
+        }
+        sdhc->dev = (void *)dev;
+
+        card = brcmf_sdcard_attach((void *)0, &regs, irq);
+        if (!card) {
+                SDLX_MSG(("%s: attach failed\n", __func__));
+                goto err;
+        }
+
+        sdhc->card = card;
+        sdhc->oob_irq = irq;
+        sdhc->oob_flags = irq_flags;
+        sdhc->oob_irq_registered = false;       /* to make sure.. */
+
+        /* chain SDIO Host Controller info together */
+        sdhc->next = sdhcinfo;
+        sdhcinfo = sdhc;
+        /* Read the vendor/device ID from the CIS */
+        vendevid = brcmf_sdcard_query_device(card);
+
+        /* try to attach to the target device */
+        sdhc->ch = drvinfo.attach((vendevid >> 16), (vendevid & 0xFFFF),
+                                  0, 0, 0, 0, regs, card);
+        if (!sdhc->ch) {
+                SDLX_MSG(("%s: device attach failed\n", __func__));
+                goto err;
+        }
+
+        return 0;
+
+        /* error handling */
+err:
+        if (sdhc) {
+                if (sdhc->card)
+                        brcmf_sdcard_detach(sdhc->card);
+                kfree(sdhc);
+        }
+
+        return -ENODEV;
+}
+
+int brcmf_sdio_remove(struct device *dev)
+{
+        struct sdio_hc *sdhc, *prev;
+
+        sdhc = sdhcinfo;
+        drvinfo.detach(sdhc->ch);
+        brcmf_sdcard_detach(sdhc->card);
+        /* find the SDIO Host Controller state for this pdev
+                 and take it out from the list */
+        for (sdhc = sdhcinfo, prev = NULL; sdhc; sdhc = sdhc->next) {
+                if (sdhc->dev == (void *)dev) {
+                        if (prev)
+                                prev->next = sdhc->next;
+                        else
+                                sdhcinfo = NULL;
+                        break;
+                }
+                prev = sdhc;
+        }
+        if (!sdhc) {
+                SDLX_MSG(("%s: failed\n", __func__));
+                return 0;
+        }
+
+        /* release SDIO Host Controller info */
+        kfree(sdhc);
+        return 0;
+}
+
+int brcmf_sdio_register(struct brcmf_sdioh_driver *driver)
+{
+        drvinfo = *driver;
+
+        SDLX_MSG(("Linux Kernel SDIO/MMC Driver\n"));
+        return brcmf_sdio_function_init();
+}
+
+void brcmf_sdio_unregister(void)
+{
+        brcmf_sdio_function_cleanup();
+}
+
+void brcmf_sdio_wdtmr_enable(bool enable)
+{
+        if (enable)
+                brcmf_sdbrcm_wd_timer(sdhcinfo->ch, brcmf_watchdog_ms);
+        else
+                brcmf_sdbrcm_wd_timer(sdhcinfo->ch, 0);
+}
diff --git a/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc.c
new file mode 100644
index 00000000000..38bd9ba3096
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -0,0 +1,1196 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <linux/types.h>
+#include <linux/netdevice.h>
+#include <linux/mmc/sdio.h>
+#include <linux/mmc/core.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/card.h>
+#include <linux/suspend.h>
+#include <linux/errno.h>
+#include <linux/sched.h>        /* request_irq() */
+#include <net/cfg80211.h>
+
+#include <defs.h>
+#include <brcm_hw_ids.h>
+#include <brcmu_utils.h>
+#include <brcmu_wifi.h>
+#include "sdio_host.h"
+#include "dhd.h"
+#include "dhd_dbg.h"
+#include "wl_cfg80211.h"
+
+#define BLOCK_SIZE_64 64
+#define BLOCK_SIZE_512 512
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* private bus modes */
+#define SDIOH_MODE_SD4          2
+
+#define CLIENT_INTR             0x100   /* Get rid of this! */
+
+#if !defined(SDIO_VENDOR_ID_BROADCOM)
+#define SDIO_VENDOR_ID_BROADCOM         0x02d0
+#endif                          /* !defined(SDIO_VENDOR_ID_BROADCOM) */
+
+#define SDIO_DEVICE_ID_BROADCOM_DEFAULT 0x0000
+
+#define DMA_ALIGN_MASK  0x03
+
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4325_SDGWB)
+#define SDIO_DEVICE_ID_BROADCOM_4325_SDGWB      0x0492  /* BCM94325SDGWB */
+#endif          /* !defined(SDIO_DEVICE_ID_BROADCOM_4325_SDGWB) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4325)
+#define SDIO_DEVICE_ID_BROADCOM_4325    0x0493
+#endif          /* !defined(SDIO_DEVICE_ID_BROADCOM_4325) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4329)
+#define SDIO_DEVICE_ID_BROADCOM_4329    0x4329
+#endif          /* !defined(SDIO_DEVICE_ID_BROADCOM_4329) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4319)
+#define SDIO_DEVICE_ID_BROADCOM_4319    0x4319
+#endif          /* !defined(SDIO_DEVICE_ID_BROADCOM_4329) */
+
+/* Common msglevel constants */
+#define SDH_ERROR_VAL           0x0001  /* Error */
+#define SDH_TRACE_VAL           0x0002  /* Trace */
+#define SDH_INFO_VAL            0x0004  /* Info */
+#define SDH_DEBUG_VAL           0x0008  /* Debug */
+#define SDH_DATA_VAL            0x0010  /* Data */
+#define SDH_CTRL_VAL            0x0020  /* Control Regs */
+#define SDH_LOG_VAL             0x0040  /* Enable bcmlog */
+#define SDH_DMA_VAL             0x0080  /* DMA */
+
+#ifdef BCMDBG
+#define sd_err(x)       \
+        do { \
+                if ((sd_msglevel & SDH_ERROR_VAL) && net_ratelimit()) \
+                        printk x; \
+        } while (0)
+#define sd_trace(x)     \
+        do { \
+                if ((sd_msglevel & SDH_TRACE_VAL) && net_ratelimit()) \
+                        printk x; \
+        } while (0)
+#define sd_info(x)      \
+        do { \
+                if ((sd_msglevel & SDH_INFO_VAL) && net_ratelimit()) \
+                        printk x; \
+        } while (0)
+#define sd_debug(x)     \
+        do { \
+                if ((sd_msglevel & SDH_DEBUG_VAL) && net_ratelimit()) \
+                        printk x; \
+        } while (0)
+#define sd_data(x)      \
+        do { \
+                if ((sd_msglevel & SDH_DATA_VAL) && net_ratelimit()) \
+                        printk x; \
+        } while (0)
+#define sd_ctrl(x)      \
+        do { \
+                if ((sd_msglevel & SDH_CTRL_VAL) && net_ratelimit()) \
+                        printk x; \
+        } while (0)
+#else
+#define sd_err(x)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+#endif
+
+struct sdos_info {
+        struct sdioh_info *sd;
+        spinlock_t lock;
+};
+
+static void brcmf_sdioh_irqhandler(struct sdio_func *func);
+static void brcmf_sdioh_irqhandler_f2(struct sdio_func *func);
+static int brcmf_sdioh_get_cisaddr(struct sdioh_info *sd, u32 regaddr);
+static int brcmf_ops_sdio_probe(struct sdio_func *func,
+                                const struct sdio_device_id *id);
+static void brcmf_ops_sdio_remove(struct sdio_func *func);
+
+#ifdef CONFIG_PM
+static int brcmf_sdio_suspend(struct device *dev);
+static int brcmf_sdio_resume(struct device *dev);
+#endif /* CONFIG_PM */
+
+uint sd_f2_blocksize = 512;     /* Default blocksize */
+
+uint sd_msglevel = 0x01;
+
+/* module param defaults */
+static int clockoverride;
+
+module_param(clockoverride, int, 0644);
+MODULE_PARM_DESC(clockoverride, "SDIO card clock override");
+
+struct brcmf_sdmmc_instance *gInstance;
+
+struct device sdmmc_dev;
+
+/* devices we support, null terminated */
+static const struct sdio_device_id brcmf_sdmmc_ids[] = {
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_DEFAULT)},
+        {SDIO_DEVICE
+         (SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4325_SDGWB)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4325)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4319)},
+        { /* end: all zeroes */ },
+};
+
+#ifdef CONFIG_PM
+static const struct dev_pm_ops brcmf_sdio_pm_ops = {
+        .suspend        = brcmf_sdio_suspend,
+        .resume         = brcmf_sdio_resume,
+};
+#endif  /* CONFIG_PM */
+
+static struct sdio_driver brcmf_sdmmc_driver = {
+        .probe = brcmf_ops_sdio_probe,
+        .remove = brcmf_ops_sdio_remove,
+        .name = "brcmfmac",
+        .id_table = brcmf_sdmmc_ids,
+#ifdef CONFIG_PM
+        .drv = {
+                .pm = &brcmf_sdio_pm_ops,
+        },
+#endif  /* CONFIG_PM */
+};
+
+MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
+
+BRCMF_PM_RESUME_WAIT_INIT(sdioh_request_byte_wait);
+BRCMF_PM_RESUME_WAIT_INIT(sdioh_request_word_wait);
+BRCMF_PM_RESUME_WAIT_INIT(sdioh_request_packet_wait);
+BRCMF_PM_RESUME_WAIT_INIT(sdioh_request_buffer_wait);
+
+static int
+brcmf_sdioh_card_regread(struct sdioh_info *sd, int func, u32 regaddr,
+                         int regsize, u32 *data);
+
+static int brcmf_sdioh_enablefuncs(struct sdioh_info *sd)
+{
+        int err_ret;
+        u32 fbraddr;
+        u8 func;
+
+        sd_trace(("%s\n", __func__));
+
+        /* Get the Card's common CIS address */
+        sd->com_cis_ptr = brcmf_sdioh_get_cisaddr(sd, SDIO_CCCR_CIS);
+        sd->func_cis_ptr[0] = sd->com_cis_ptr;
+        sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __func__,
+                 sd->com_cis_ptr));
+
+        /* Get the Card's function CIS (for each function) */
+        for (fbraddr = SDIO_FBR_BASE(1), func = 1;
+             func <= sd->num_funcs; func++, fbraddr += SDIOD_FBR_SIZE) {
+                sd->func_cis_ptr[func] =
+                    brcmf_sdioh_get_cisaddr(sd, SDIO_FBR_CIS + fbraddr);
+                sd_info(("%s: Function %d CIS Ptr = 0x%x\n", __func__, func,
+                         sd->func_cis_ptr[func]));
+        }
+
+        sd->func_cis_ptr[0] = sd->com_cis_ptr;
+        sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __func__,
+                 sd->com_cis_ptr));
+
+        /* Enable Function 1 */
+        sdio_claim_host(gInstance->func[1]);
+        err_ret = sdio_enable_func(gInstance->func[1]);
+        sdio_release_host(gInstance->func[1]);
+        if (err_ret) {
+                sd_err(("brcmf_sdioh_enablefuncs: Failed to enable F1 "
+                        "Err: 0x%08x\n", err_ret));
+        }
+
+        return false;
+}
+
+/*
+ *      Public entry points & extern's
+ */
+struct sdioh_info *brcmf_sdioh_attach(void *bar0, uint irq)
+{
+        struct sdioh_info *sd;
+        int err_ret;
+
+        sd_trace(("%s\n", __func__));
+
+        if (gInstance == NULL) {
+                sd_err(("%s: SDIO Device not present\n", __func__));
+                return NULL;
+        }
+
+        sd = kzalloc(sizeof(struct sdioh_info), GFP_ATOMIC);
+        if (sd == NULL) {
+                sd_err(("sdioh_attach: out of memory\n"));
+                return NULL;
+        }
+        if (brcmf_sdioh_osinit(sd) != 0) {
+                sd_err(("%s:sdioh_sdmmc_osinit() failed\n", __func__));
+                kfree(sd);
+                return NULL;
+        }
+
+        sd->num_funcs = 2;
+        sd->use_client_ints = true;
+        sd->client_block_size[0] = 64;
+
+        gInstance->sd = sd;
+
+        /* Claim host controller */
+        sdio_claim_host(gInstance->func[1]);
+
+        sd->client_block_size[1] = 64;
+        err_ret = sdio_set_block_size(gInstance->func[1], 64);
+        if (err_ret)
+                sd_err(("brcmf_sdioh_attach: Failed to set F1 blocksize\n"));
+
+        /* Release host controller F1 */
+        sdio_release_host(gInstance->func[1]);
+
+        if (gInstance->func[2]) {
+                /* Claim host controller F2 */
+                sdio_claim_host(gInstance->func[2]);
+
+                sd->client_block_size[2] = sd_f2_blocksize;
+                err_ret =
+                    sdio_set_block_size(gInstance->func[2], sd_f2_blocksize);
+                if (err_ret)
+                        sd_err(("brcmf_sdioh_attach: Failed to set F2 blocksize"
+                                " to %d\n", sd_f2_blocksize));
+
+                /* Release host controller F2 */
+                sdio_release_host(gInstance->func[2]);
+        }
+
+        brcmf_sdioh_enablefuncs(sd);
+
+        sd_trace(("%s: Done\n", __func__));
+        return sd;
+}
+
+extern int brcmf_sdioh_detach(struct sdioh_info *sd)
+{
+        sd_trace(("%s\n", __func__));
+
+        if (sd) {
+
+                /* Disable Function 2 */
+                sdio_claim_host(gInstance->func[2]);
+                sdio_disable_func(gInstance->func[2]);
+                sdio_release_host(gInstance->func[2]);
+
+                /* Disable Function 1 */
+                sdio_claim_host(gInstance->func[1]);
+                sdio_disable_func(gInstance->func[1]);
+                sdio_release_host(gInstance->func[1]);
+
+                /* deregister irq */
+                brcmf_sdioh_osfree(sd);
+
+                kfree(sd);
+        }
+        return 0;
+}
+
+/* Configure callback to client when we receive client interrupt */
+extern int
+brcmf_sdioh_interrupt_register(struct sdioh_info *sd, void (*fn)(void *),
+                               void *argh)
+{
+        sd_trace(("%s: Entering\n", __func__));
+        if (fn == NULL) {
+                sd_err(("%s: interrupt handler is NULL, not registering\n",
+                        __func__));
+                return -EINVAL;
+        }
+
+        sd->intr_handler = fn;
+        sd->intr_handler_arg = argh;
+        sd->intr_handler_valid = true;
+
+        /* register and unmask irq */
+        if (gInstance->func[2]) {
+                sdio_claim_host(gInstance->func[2]);
+                sdio_claim_irq(gInstance->func[2], brcmf_sdioh_irqhandler_f2);
+                sdio_release_host(gInstance->func[2]);
+        }
+
+        if (gInstance->func[1]) {
+                sdio_claim_host(gInstance->func[1]);
+                sdio_claim_irq(gInstance->func[1], brcmf_sdioh_irqhandler);
+                sdio_release_host(gInstance->func[1]);
+        }
+
+        return 0;
+}
+
+extern int brcmf_sdioh_interrupt_deregister(struct sdioh_info *sd)
+{
+        sd_trace(("%s: Entering\n", __func__));
+
+        if (gInstance->func[1]) {
+                /* register and unmask irq */
+                sdio_claim_host(gInstance->func[1]);
+                sdio_release_irq(gInstance->func[1]);
+                sdio_release_host(gInstance->func[1]);
+        }
+
+        if (gInstance->func[2]) {
+                /* Claim host controller F2 */
+                sdio_claim_host(gInstance->func[2]);
+                sdio_release_irq(gInstance->func[2]);
+                /* Release host controller F2 */
+                sdio_release_host(gInstance->func[2]);
+        }
+
+        sd->intr_handler_valid = false;
+        sd->intr_handler = NULL;
+        sd->intr_handler_arg = NULL;
+
+        return 0;
+}
+
+/* IOVar table */
+enum {
+        IOV_MSGLEVEL = 1,
+        IOV_BLOCKSIZE,
+        IOV_USEINTS,
+        IOV_NUMINTS,
+        IOV_DEVREG,
+        IOV_HCIREGS,
+        IOV_RXCHAIN
+};
+
+const struct brcmu_iovar sdioh_iovars[] = {
+        {"sd_msglevel", IOV_MSGLEVEL, 0, IOVT_UINT32, 0},
+        {"sd_blocksize", IOV_BLOCKSIZE, 0, IOVT_UINT32, 0},/* ((fn << 16) |
+                                                                 size) */
+        {"sd_ints", IOV_USEINTS, 0, IOVT_BOOL, 0},
+        {"sd_numints", IOV_NUMINTS, 0, IOVT_UINT32, 0},
+        {"sd_devreg", IOV_DEVREG, 0, IOVT_BUFFER, sizeof(struct brcmf_sdreg)}
+        ,
+        {"sd_rxchain", IOV_RXCHAIN, 0, IOVT_BOOL, 0}
+        ,
+        {NULL, 0, 0, 0, 0}
+};
+
+int
+brcmf_sdioh_iovar_op(struct sdioh_info *si, const char *name,
+                     void *params, int plen, void *arg, int len, bool set)
+{
+        const struct brcmu_iovar *vi = NULL;
+        int bcmerror = 0;
+        int val_size;
+        s32 int_val = 0;
+        bool bool_val;
+        u32 actionid;
+
+        if (name == NULL || len <= 0)
+                return -EINVAL;
+
+        /* Set does not take qualifiers */
+        if (set && (params || plen))
+                return -EINVAL;
+
+        /* Get must have return space;*/
+        if (!set && !(arg && len))
+                return -EINVAL;
+
+        sd_trace(("%s: Enter (%s %s)\n", __func__, (set ? "set" : "get"),
+                  name));
+
+        vi = brcmu_iovar_lookup(sdioh_iovars, name);
+        if (vi == NULL) {
+                bcmerror = -ENOTSUPP;
+                goto exit;
+        }
+
+        bcmerror = brcmu_iovar_lencheck(vi, arg, len, set);
+        if (bcmerror != 0)
+                goto exit;
+
+        /* Set up params so get and set can share the convenience variables */
+        if (params == NULL) {
+                params = arg;
+                plen = len;
+        }
+
+        if (vi->type == IOVT_VOID)
+                val_size = 0;
+        else if (vi->type == IOVT_BUFFER)
+                val_size = len;
+        else
+                val_size = sizeof(int);
+
+        if (plen >= (int)sizeof(int_val))
+                memcpy(&int_val, params, sizeof(int_val));
+
+        bool_val = (int_val != 0) ? true : false;
+
+        actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+        switch (actionid) {
+        case IOV_GVAL(IOV_MSGLEVEL):
+                int_val = (s32) sd_msglevel;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_MSGLEVEL):
+                sd_msglevel = int_val;
+                break;
+
+        case IOV_GVAL(IOV_BLOCKSIZE):
+                if ((u32) int_val > si->num_funcs) {
+                        bcmerror = -EINVAL;
+                        break;
+                }
+                int_val = (s32) si->client_block_size[int_val];
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_BLOCKSIZE):
+                {
+                        uint func = ((u32) int_val >> 16);
+                        uint blksize = (u16) int_val;
+                        uint maxsize;
+
+                        if (func > si->num_funcs) {
+                                bcmerror = -EINVAL;
+                                break;
+                        }
+
+                        switch (func) {
+                        case 0:
+                                maxsize = 32;
+                                break;
+                        case 1:
+                                maxsize = BLOCK_SIZE_4318;
+                                break;
+                        case 2:
+                                maxsize = BLOCK_SIZE_4328;
+                                break;
+                        default:
+                                maxsize = 0;
+                        }
+                        if (blksize > maxsize) {
+                                bcmerror = -EINVAL;
+                                break;
+                        }
+                        if (!blksize)
+                                blksize = maxsize;
+
+                        /* Now set it */
+                        si->client_block_size[func] = blksize;
+
+                        break;
+                }
+
+        case IOV_GVAL(IOV_RXCHAIN):
+                int_val = false;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_GVAL(IOV_USEINTS):
+                int_val = (s32) si->use_client_ints;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_USEINTS):
+                si->use_client_ints = (bool) int_val;
+                if (si->use_client_ints)
+                        si->intmask |= CLIENT_INTR;
+                else
+                        si->intmask &= ~CLIENT_INTR;
+
+                break;
+
+        case IOV_GVAL(IOV_NUMINTS):
+                int_val = (s32) si->intrcount;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_GVAL(IOV_DEVREG):
+                {
+                        struct brcmf_sdreg *sd_ptr =
+                                        (struct brcmf_sdreg *) params;
+                        u8 data = 0;
+
+                        if (brcmf_sdioh_cfg_read
+                            (si, sd_ptr->func, sd_ptr->offset, &data)) {
+                                bcmerror = -EIO;
+                                break;
+                        }
+
+                        int_val = (int)data;
+                        memcpy(arg, &int_val, sizeof(int_val));
+                        break;
+                }
+
+        case IOV_SVAL(IOV_DEVREG):
+                {
+                        struct brcmf_sdreg *sd_ptr =
+                                        (struct brcmf_sdreg *) params;
+                        u8 data = (u8) sd_ptr->value;
+
+                        if (brcmf_sdioh_cfg_write
+                            (si, sd_ptr->func, sd_ptr->offset, &data)) {
+                                bcmerror = -EIO;
+                                break;
+                        }
+                        break;
+                }
+
+        default:
+                bcmerror = -ENOTSUPP;
+                break;
+        }
+exit:
+
+        return bcmerror;
+}
+
+extern int
+brcmf_sdioh_cfg_read(struct sdioh_info *sd, uint fnc_num, u32 addr, u8 *data)
+{
+        int status;
+        /* No lock needed since brcmf_sdioh_request_byte does locking */
+        status = brcmf_sdioh_request_byte(sd, SDIOH_READ, fnc_num, addr, data);
+        return status;
+}
+
+extern int
+brcmf_sdioh_cfg_write(struct sdioh_info *sd, uint fnc_num, u32 addr, u8 *data)
+{
+        /* No lock needed since brcmf_sdioh_request_byte does locking */
+        int status;
+        status = brcmf_sdioh_request_byte(sd, SDIOH_WRITE, fnc_num, addr, data);
+        return status;
+}
+
+static int brcmf_sdioh_get_cisaddr(struct sdioh_info *sd, u32 regaddr)
+{
+        /* read 24 bits and return valid 17 bit addr */
+        int i;
+        u32 scratch, regdata;
+        u8 *ptr = (u8 *)&scratch;
+        for (i = 0; i < 3; i++) {
+                if ((brcmf_sdioh_card_regread(sd, 0, regaddr, 1, &regdata)) !=
+                    SUCCESS)
+                        sd_err(("%s: Can't read!\n", __func__));
+
+                *ptr++ = (u8) regdata;
+                regaddr++;
+        }
+
+        /* Only the lower 17-bits are valid */
+        scratch = le32_to_cpu(scratch);
+        scratch &= 0x0001FFFF;
+        return scratch;
+}
+
+extern int
+brcmf_sdioh_cis_read(struct sdioh_info *sd, uint func, u8 *cisd, u32 length)
+{
+        u32 count;
+        int offset;
+        u32 foo;
+        u8 *cis = cisd;
+
+        sd_trace(("%s: Func = %d\n", __func__, func));
+
+        if (!sd->func_cis_ptr[func]) {
+                memset(cis, 0, length);
+                sd_err(("%s: no func_cis_ptr[%d]\n", __func__, func));
+                return -ENOTSUPP;
+        }
+
+        sd_err(("%s: func_cis_ptr[%d]=0x%04x\n", __func__, func,
+                sd->func_cis_ptr[func]));
+
+        for (count = 0; count < length; count++) {
+                offset = sd->func_cis_ptr[func] + count;
+                if (brcmf_sdioh_card_regread(sd, 0, offset, 1, &foo) < 0) {
+                        sd_err(("%s: regread failed: Can't read CIS\n",
+                                __func__));
+                        return -EIO;
+                }
+
+                *cis = (u8) (foo & 0xff);
+                cis++;
+        }
+
+        return 0;
+}
+
+extern int
+brcmf_sdioh_request_byte(struct sdioh_info *sd, uint rw, uint func,
+                         uint regaddr, u8 *byte)
+{
+        int err_ret;
+
+        sd_info(("%s: rw=%d, func=%d, addr=0x%05x\n", __func__, rw, func,
+                 regaddr));
+
+        BRCMF_PM_RESUME_WAIT(sdioh_request_byte_wait);
+        BRCMF_PM_RESUME_RETURN_ERROR(-EIO);
+        if (rw) {               /* CMD52 Write */
+                if (func == 0) {
+                        /* Can only directly write to some F0 registers.
+                         * Handle F2 enable
+                         * as a special case.
+                         */
+                        if (regaddr == SDIO_CCCR_IOEx) {
+                                if (gInstance->func[2]) {
+                                        sdio_claim_host(gInstance->func[2]);
+                                        if (*byte & SDIO_FUNC_ENABLE_2) {
+                                                /* Enable Function 2 */
+                                                err_ret =
+                                                    sdio_enable_func
+                                                    (gInstance->func[2]);
+                                                if (err_ret)
+                                                        sd_err(("request_byte: "
+                                                                "enable F2 "
+                                                                "failed:%d\n",
+                                                                 err_ret));
+                                        } else {
+                                                /* Disable Function 2 */
+                                                err_ret =
+                                                    sdio_disable_func
+                                                    (gInstance->func[2]);
+                                                if (err_ret)
+                                                        sd_err(("request_byte: "
+                                                                "Disab F2 "
+                                                                "failed:%d\n",
+                                                                 err_ret));
+                                        }
+                                        sdio_release_host(gInstance->func[2]);
+                                }
+                        }
+                        /* to allow abort command through F1 */
+                        else if (regaddr == SDIO_CCCR_ABORT) {
+                                sdio_claim_host(gInstance->func[func]);
+                                /*
+                                 * this sdio_f0_writeb() can be replaced
+                                 * with another api
+                                 * depending upon MMC driver change.
+                                 * As of this time, this is temporaray one
+                                 */
+                                sdio_writeb(gInstance->func[func], *byte,
+                                            regaddr, &err_ret);
+                                sdio_release_host(gInstance->func[func]);
+                        } else if (regaddr < 0xF0) {
+                                sd_err(("brcmf: F0 Wr:0x%02x: write "
+                                        "disallowed\n", regaddr));
+                        } else {
+                                /* Claim host controller, perform F0 write,
+                                 and release */
+                                sdio_claim_host(gInstance->func[func]);
+                                sdio_f0_writeb(gInstance->func[func], *byte,
+                                               regaddr, &err_ret);
+                                sdio_release_host(gInstance->func[func]);
+                        }
+                } else {
+                        /* Claim host controller, perform Fn write,
+                         and release */
+                        sdio_claim_host(gInstance->func[func]);
+                        sdio_writeb(gInstance->func[func], *byte, regaddr,
+                                    &err_ret);
+                        sdio_release_host(gInstance->func[func]);
+                }
+        } else {                /* CMD52 Read */
+                /* Claim host controller, perform Fn read, and release */
+                sdio_claim_host(gInstance->func[func]);
+
+                if (func == 0) {
+                        *byte =
+                            sdio_f0_readb(gInstance->func[func], regaddr,
+                                          &err_ret);
+                } else {
+                        *byte =
+                            sdio_readb(gInstance->func[func], regaddr,
+                                       &err_ret);
+                }
+
+                sdio_release_host(gInstance->func[func]);
+        }
+
+        if (err_ret)
+                sd_err(("brcmf: Failed to %s byte F%d:@0x%05x=%02x, "
+                        "Err: %d\n", rw ? "Write" : "Read", func, regaddr,
+                        *byte, err_ret));
+
+        return err_ret;
+}
+
+extern int
+brcmf_sdioh_request_word(struct sdioh_info *sd, uint cmd_type, uint rw,
+                         uint func, uint addr, u32 *word, uint nbytes)
+{
+        int err_ret = -EIO;
+
+        if (func == 0) {
+                sd_err(("%s: Only CMD52 allowed to F0.\n", __func__));
+                return -EINVAL;
+        }
+
+        sd_info(("%s: cmd_type=%d, rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+                 __func__, cmd_type, rw, func, addr, nbytes));
+
+        BRCMF_PM_RESUME_WAIT(sdioh_request_word_wait);
+        BRCMF_PM_RESUME_RETURN_ERROR(-EIO);
+        /* Claim host controller */
+        sdio_claim_host(gInstance->func[func]);
+
+        if (rw) {               /* CMD52 Write */
+                if (nbytes == 4) {
+                        sdio_writel(gInstance->func[func], *word, addr,
+                                    &err_ret);
+                } else if (nbytes == 2) {
+                        sdio_writew(gInstance->func[func], (*word & 0xFFFF),
+                                    addr, &err_ret);
+                } else {
+                        sd_err(("%s: Invalid nbytes: %d\n", __func__, nbytes));
+                }
+        } else {                /* CMD52 Read */
+                if (nbytes == 4) {
+                        *word =
+                            sdio_readl(gInstance->func[func], addr, &err_ret);
+                } else if (nbytes == 2) {
+                        *word =
+                            sdio_readw(gInstance->func[func], addr,
+                                       &err_ret) & 0xFFFF;
+                } else {
+                        sd_err(("%s: Invalid nbytes: %d\n", __func__, nbytes));
+                }
+        }
+
+        /* Release host controller */
+        sdio_release_host(gInstance->func[func]);
+
+        if (err_ret) {
+                sd_err(("brcmf: Failed to %s word, Err: 0x%08x\n",
+                        rw ? "Write" : "Read", err_ret));
+        }
+
+        return err_ret;
+}
+
+static int
+brcmf_sdioh_request_packet(struct sdioh_info *sd, uint fix_inc, uint write,
+                           uint func, uint addr, struct sk_buff *pkt)
+{
+        bool fifo = (fix_inc == SDIOH_DATA_FIX);
+        u32 SGCount = 0;
+        int err_ret = 0;
+
+        struct sk_buff *pnext;
+
+        sd_trace(("%s: Enter\n", __func__));
+
+        BRCMF_PM_RESUME_WAIT(sdioh_request_packet_wait);
+        BRCMF_PM_RESUME_RETURN_ERROR(-EIO);
+
+        /* Claim host controller */
+        sdio_claim_host(gInstance->func[func]);
+        for (pnext = pkt; pnext; pnext = pnext->next) {
+                uint pkt_len = pnext->len;
+                pkt_len += 3;
+                pkt_len &= 0xFFFFFFFC;
+
+                if ((write) && (!fifo)) {
+                        err_ret = sdio_memcpy_toio(gInstance->func[func], addr,
+                                                   ((u8 *) (pnext->data)),
+                                                   pkt_len);
+                } else if (write) {
+                        err_ret = sdio_memcpy_toio(gInstance->func[func], addr,
+                                                   ((u8 *) (pnext->data)),
+                                                   pkt_len);
+                } else if (fifo) {
+                        err_ret = sdio_readsb(gInstance->func[func],
+                                              ((u8 *) (pnext->data)),
+                                              addr, pkt_len);
+                } else {
+                        err_ret = sdio_memcpy_fromio(gInstance->func[func],
+                                                     ((u8 *) (pnext->data)),
+                                                     addr, pkt_len);
+                }
+
+                if (err_ret) {
+                        sd_err(("%s: %s FAILED %p[%d], addr=0x%05x, pkt_len=%d,"
+                                 "ERR=0x%08x\n", __func__,
+                                 (write) ? "TX" : "RX",
+                                 pnext, SGCount, addr, pkt_len, err_ret));
+                } else {
+                        sd_trace(("%s: %s xfr'd %p[%d], addr=0x%05x, len=%d\n",
+                                  __func__,
+                                  (write) ? "TX" : "RX",
+                                  pnext, SGCount, addr, pkt_len));
+                }
+
+                if (!fifo)
+                        addr += pkt_len;
+                SGCount++;
+
+        }
+
+        /* Release host controller */
+        sdio_release_host(gInstance->func[func]);
+
+        sd_trace(("%s: Exit\n", __func__));
+        return err_ret;
+}
+
+/*
+ * This function takes a buffer or packet, and fixes everything up
+ * so that in the end, a DMA-able packet is created.
+ *
+ * A buffer does not have an associated packet pointer,
+ * and may or may not be aligned.
+ * A packet may consist of a single packet, or a packet chain.
+ * If it is a packet chain, then all the packets in the chain
+ * must be properly aligned.
+ *
+ * If the packet data is not aligned, then there may only be
+ * one packet, and in this case,  it is copied to a new
+ * aligned packet.
+ *
+ */
+extern int
+brcmf_sdioh_request_buffer(struct sdioh_info *sd, uint pio_dma, uint fix_inc,
+                           uint write, uint func, uint addr, uint reg_width,
+                           uint buflen_u, u8 *buffer, struct sk_buff *pkt)
+{
+        int Status;
+        struct sk_buff *mypkt = NULL;
+
+        sd_trace(("%s: Enter\n", __func__));
+
+        BRCMF_PM_RESUME_WAIT(sdioh_request_buffer_wait);
+        BRCMF_PM_RESUME_RETURN_ERROR(-EIO);
+        /* Case 1: we don't have a packet. */
+        if (pkt == NULL) {
+                sd_data(("%s: Creating new %s Packet, len=%d\n",
+                         __func__, write ? "TX" : "RX", buflen_u));
+                mypkt = brcmu_pkt_buf_get_skb(buflen_u);
+                if (!mypkt) {
+                        sd_err(("%s: brcmu_pkt_buf_get_skb failed: len %d\n",
+                                __func__, buflen_u));
+                        return -EIO;
+                }
+
+                /* For a write, copy the buffer data into the packet. */
+                if (write)
+                        memcpy(mypkt->data, buffer, buflen_u);
+
+                Status = brcmf_sdioh_request_packet(sd, fix_inc, write, func,
+                                                    addr, mypkt);
+
+                /* For a read, copy the packet data back to the buffer. */
+                if (!write)
+                        memcpy(buffer, mypkt->data, buflen_u);
+
+                brcmu_pkt_buf_free_skb(mypkt);
+        } else if (((ulong) (pkt->data) & DMA_ALIGN_MASK) != 0) {
+                /*
+                 * Case 2: We have a packet, but it is unaligned.
+                 * In this case, we cannot have a chain (pkt->next == NULL)
+                 */
+                sd_data(("%s: Creating aligned %s Packet, len=%d\n",
+                         __func__, write ? "TX" : "RX", pkt->len));
+                mypkt = brcmu_pkt_buf_get_skb(pkt->len);
+                if (!mypkt) {
+                        sd_err(("%s: brcmu_pkt_buf_get_skb failed: len %d\n",
+                                __func__, pkt->len));
+                        return -EIO;
+                }
+
+                /* For a write, copy the buffer data into the packet. */
+                if (write)
+                        memcpy(mypkt->data, pkt->data, pkt->len);
+
+                Status = brcmf_sdioh_request_packet(sd, fix_inc, write, func,
+                                                    addr, mypkt);
+
+                /* For a read, copy the packet data back to the buffer. */
+                if (!write)
+                        memcpy(pkt->data, mypkt->data, mypkt->len);
+
+                brcmu_pkt_buf_free_skb(mypkt);
+        } else {                /* case 3: We have a packet and
+                                 it is aligned. */
+                sd_data(("%s: Aligned %s Packet, direct DMA\n",
+                         __func__, write ? "Tx" : "Rx"));
+                Status = brcmf_sdioh_request_packet(sd, fix_inc, write, func,
+                                                    addr, pkt);
+        }
+
+        return Status;
+}
+
+/* this function performs "abort" for both of host & device */
+extern int brcmf_sdioh_abort(struct sdioh_info *sd, uint func)
+{
+        char t_func = (char)func;
+        sd_trace(("%s: Enter\n", __func__));
+
+        /* issue abort cmd52 command through F0 */
+        brcmf_sdioh_request_byte(sd, SDIOH_WRITE, SDIO_FUNC_0, SDIO_CCCR_ABORT,
+                           &t_func);
+
+        sd_trace(("%s: Exit\n", __func__));
+        return 0;
+}
+
+/* Disable device interrupt */
+void brcmf_sdioh_dev_intr_off(struct sdioh_info *sd)
+{
+        sd_trace(("%s: %d\n", __func__, sd->use_client_ints));
+        sd->intmask &= ~CLIENT_INTR;
+}
+
+/* Enable device interrupt */
+void brcmf_sdioh_dev_intr_on(struct sdioh_info *sd)
+{
+        sd_trace(("%s: %d\n", __func__, sd->use_client_ints));
+        sd->intmask |= CLIENT_INTR;
+}
+
+/* Read client card reg */
+int
+brcmf_sdioh_card_regread(struct sdioh_info *sd, int func, u32 regaddr,
+                         int regsize, u32 *data)
+{
+
+        if ((func == 0) || (regsize == 1)) {
+                u8 temp = 0;
+
+                brcmf_sdioh_request_byte(sd, SDIOH_READ, func, regaddr, &temp);
+                *data = temp;
+                *data &= 0xff;
+                sd_data(("%s: byte read data=0x%02x\n", __func__, *data));
+        } else {
+                brcmf_sdioh_request_word(sd, 0, SDIOH_READ, func, regaddr, data,
+                                   regsize);
+                if (regsize == 2)
+                        *data &= 0xffff;
+
+                sd_data(("%s: word read data=0x%08x\n", __func__, *data));
+        }
+
+        return SUCCESS;
+}
+
+static void brcmf_sdioh_irqhandler(struct sdio_func *func)
+{
+        struct sdioh_info *sd;
+
+        sd_trace(("brcmf: ***IRQHandler\n"));
+        sd = gInstance->sd;
+
+        sdio_release_host(gInstance->func[0]);
+
+        if (sd->use_client_ints) {
+                sd->intrcount++;
+                (sd->intr_handler) (sd->intr_handler_arg);
+        } else {
+                sd_err(("brcmf: ***IRQHandler\n"));
+
+                sd_err(("%s: Not ready for intr: enabled %d, handler %p\n",
+                        __func__, sd->client_intr_enabled, sd->intr_handler));
+        }
+
+        sdio_claim_host(gInstance->func[0]);
+}
+
+/* interrupt handler for F2 (dummy handler) */
+static void brcmf_sdioh_irqhandler_f2(struct sdio_func *func)
+{
+        struct sdioh_info *sd;
+
+        sd_trace(("brcmf: ***IRQHandlerF2\n"));
+
+        sd = gInstance->sd;
+}
+
+static int brcmf_ops_sdio_probe(struct sdio_func *func,
+                              const struct sdio_device_id *id)
+{
+        int ret = 0;
+        static struct sdio_func sdio_func_0;
+        sd_trace(("sdio_probe: %s Enter\n", __func__));
+        sd_trace(("sdio_probe: func->class=%x\n", func->class));
+        sd_trace(("sdio_vendor: 0x%04x\n", func->vendor));
+        sd_trace(("sdio_device: 0x%04x\n", func->device));
+        sd_trace(("Function#: 0x%04x\n", func->num));
+
+        if (func->num == 1) {
+                sdio_func_0.num = 0;
+                sdio_func_0.card = func->card;
+                gInstance->func[0] = &sdio_func_0;
+                if (func->device == 0x4) {      /* 4318 */
+                        gInstance->func[2] = NULL;
+                        sd_trace(("NIC found, calling brcmf_sdio_probe...\n"));
+                        ret = brcmf_sdio_probe(&sdmmc_dev);
+                }
+        }
+
+        gInstance->func[func->num] = func;
+
+        if (func->num == 2) {
+                brcmf_cfg80211_sdio_func(func);
+                sd_trace(("F2 found, calling brcmf_sdio_probe...\n"));
+                ret = brcmf_sdio_probe(&sdmmc_dev);
+        }
+
+        return ret;
+}
+
+static void brcmf_ops_sdio_remove(struct sdio_func *func)
+{
+        sd_trace(("%s Enter\n", __func__));
+        sd_info(("func->class=%x\n", func->class));
+        sd_info(("sdio_vendor: 0x%04x\n", func->vendor));
+        sd_info(("sdio_device: 0x%04x\n", func->device));
+        sd_info(("Function#: 0x%04x\n", func->num));
+
+        if (func->num == 2) {
+                sd_trace(("F2 found, calling brcmf_sdio_remove...\n"));
+                brcmf_sdio_remove(&sdmmc_dev);
+        }
+}
+
+
+#ifdef CONFIG_PM
+static int brcmf_sdio_suspend(struct device *dev)
+{
+        mmc_pm_flag_t sdio_flags;
+        int ret = 0;
+
+        sd_trace(("%s\n", __func__));
+
+        sdio_flags = sdio_get_host_pm_caps(gInstance->func[1]);
+        if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
+                sd_err(("Host can't keep power while suspended\n"));
+                return -EINVAL;
+        }
+
+        ret = sdio_set_host_pm_flags(gInstance->func[1], MMC_PM_KEEP_POWER);
+        if (ret) {
+                sd_err(("Failed to set pm_flags\n"));
+                return ret;
+        }
+
+        brcmf_sdio_wdtmr_enable(false);
+
+        return ret;
+}
+
+static int brcmf_sdio_resume(struct device *dev)
+{
+        brcmf_sdio_wdtmr_enable(true);
+        return 0;
+}
+#endif          /* CONFIG_PM */
+
+int brcmf_sdioh_osinit(struct sdioh_info *sd)
+{
+        struct sdos_info *sdos;
+
+        sdos = kmalloc(sizeof(struct sdos_info), GFP_ATOMIC);
+        sd->sdos_info = (void *)sdos;
+        if (sdos == NULL)
+                return -ENOMEM;
+
+        sdos->sd = sd;
+        spin_lock_init(&sdos->lock);
+        return 0;
+}
+
+void brcmf_sdioh_osfree(struct sdioh_info *sd)
+{
+        struct sdos_info *sdos;
+
+        sdos = (struct sdos_info *)sd->sdos_info;
+        kfree(sdos);
+}
+
+/* Interrupt enable/disable */
+int brcmf_sdioh_interrupt_set(struct sdioh_info *sd, bool enable)
+{
+        unsigned long flags;
+        struct sdos_info *sdos;
+
+        sd_trace(("%s: %s\n", __func__, enable ? "Enabling" : "Disabling"));
+
+        sdos = (struct sdos_info *)sd->sdos_info;
+
+        if (enable && !(sd->intr_handler && sd->intr_handler_arg)) {
+                sd_err(("%s: no handler registered, will not enable\n",
+                        __func__));
+                return -EINVAL;
+        }
+
+        /* Ensure atomicity for enable/disable calls */
+        spin_lock_irqsave(&sdos->lock, flags);
+
+        sd->client_intr_enabled = enable;
+        if (enable)
+                brcmf_sdioh_dev_intr_on(sd);
+        else
+                brcmf_sdioh_dev_intr_off(sd);
+
+        spin_unlock_irqrestore(&sdos->lock, flags);
+
+        return 0;
+}
+
+/*
+ * module init
+*/
+int brcmf_sdio_function_init(void)
+{
+        int error = 0;
+        sd_trace(("brcmf_sdio_function_init: %s Enter\n", __func__));
+
+        gInstance = kzalloc(sizeof(struct brcmf_sdmmc_instance), GFP_KERNEL);
+        if (!gInstance)
+                return -ENOMEM;
+
+        memset(&sdmmc_dev, 0, sizeof(sdmmc_dev));
+        error = sdio_register_driver(&brcmf_sdmmc_driver);
+
+        return error;
+}
+
+/*
+ * module cleanup
+*/
+void brcmf_sdio_function_cleanup(void)
+{
+        sd_trace(("%s Enter\n", __func__));
+
+        sdio_unregister_driver(&brcmf_sdmmc_driver);
+
+        kfree(gInstance);
+}
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd.h b/drivers/staging/brcm80211/brcmfmac/dhd.h
new file mode 100644
index 00000000000..82bf04df16d
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/dhd.h
@@ -0,0 +1,904 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/****************
+ * Common types *
+ */
+
+#ifndef _BRCMF_H_
+#define _BRCMF_H_
+
+#define BRCMF_VERSION_STR               "4.218.248.5"
+
+#define BRCMF_C_IOCTL_SMLEN     256     /* "small" ioctl buffer required */
+#define BRCMF_C_IOCTL_MEDLEN    1536    /* "med" ioctl buffer required */
+#define BRCMF_C_IOCTL_MAXLEN    8192
+
+#define BRCMF_C_UP                              2
+#define BRCMF_C_SET_PROMISC                     10
+#define BRCMF_C_GET_RATE                        12
+#define BRCMF_C_GET_INFRA                       19
+#define BRCMF_C_SET_INFRA                       20
+#define BRCMF_C_GET_AUTH                        21
+#define BRCMF_C_SET_AUTH                        22
+#define BRCMF_C_GET_BSSID                       23
+#define BRCMF_C_GET_SSID                        25
+#define BRCMF_C_SET_SSID                        26
+#define BRCMF_C_GET_CHANNEL                     29
+#define BRCMF_C_GET_SRL                         31
+#define BRCMF_C_GET_LRL                         33
+#define BRCMF_C_GET_RADIO                       37
+#define BRCMF_C_SET_RADIO                       38
+#define BRCMF_C_GET_PHYTYPE                     39
+#define BRCMF_C_SET_KEY                         45
+#define BRCMF_C_SET_PASSIVE_SCAN                49
+#define BRCMF_C_SCAN                            50
+#define BRCMF_C_SCAN_RESULTS                    51
+#define BRCMF_C_DISASSOC                        52
+#define BRCMF_C_REASSOC                         53
+#define BRCMF_C_SET_ROAM_TRIGGER                55
+#define BRCMF_C_SET_ROAM_DELTA                  57
+#define BRCMF_C_GET_DTIMPRD                     77
+#define BRCMF_C_SET_COUNTRY                     84
+#define BRCMF_C_GET_PM                          85
+#define BRCMF_C_SET_PM                          86
+#define BRCMF_C_GET_AP                          117
+#define BRCMF_C_SET_AP                          118
+#define BRCMF_C_GET_RSSI                        127
+#define BRCMF_C_GET_WSEC                        133
+#define BRCMF_C_SET_WSEC                        134
+#define BRCMF_C_GET_PHY_NOISE                   135
+#define BRCMF_C_GET_BSS_INFO                    136
+#define BRCMF_C_SET_SCAN_CHANNEL_TIME           185
+#define BRCMF_C_SET_SCAN_UNASSOC_TIME           187
+#define BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON   201
+#define BRCMF_C_GET_VALID_CHANNELS              217
+#define BRCMF_C_GET_KEY_PRIMARY                 235
+#define BRCMF_C_SET_KEY_PRIMARY                 236
+#define BRCMF_C_SET_SCAN_PASSIVE_TIME           258
+#define BRCMF_C_GET_VAR                         262
+#define BRCMF_C_SET_VAR                         263
+
+/* phy types (returned by WLC_GET_PHYTPE) */
+#define WLC_PHY_TYPE_A          0
+#define WLC_PHY_TYPE_B          1
+#define WLC_PHY_TYPE_G          2
+#define WLC_PHY_TYPE_N          4
+#define WLC_PHY_TYPE_LP         5
+#define WLC_PHY_TYPE_SSN        6
+#define WLC_PHY_TYPE_HT         7
+#define WLC_PHY_TYPE_LCN        8
+#define WLC_PHY_TYPE_NULL       0xf
+
+#define BRCMF_PKT_FILTER_FIXED_LEN      offsetof(struct brcmf_pkt_filter, u)
+#define BRCMF_PKT_FILTER_PATTERN_FIXED_LEN      \
+        offsetof(struct brcmf_pkt_filter_pattern, mask_and_pattern)
+
+#define BRCMF_EVENTING_MASK_LEN 16
+
+#define TOE_TX_CSUM_OL          0x00000001
+#define TOE_RX_CSUM_OL          0x00000002
+
+/* maximum channels returned by the get valid channels iovar */
+#define WL_NUMCHANNELS          64
+
+#define BRCMF_BSS_INFO_VERSION  108 /* current ver of brcmf_bss_info struct */
+
+/* size of brcmf_scan_params not including variable length array */
+#define BRCMF_SCAN_PARAMS_FIXED_SIZE 64
+
+/* masks for channel and ssid count */
+#define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff
+#define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16
+
+#define BRCMF_SCAN_ACTION_START      1
+#define BRCMF_SCAN_ACTION_CONTINUE   2
+#define WL_SCAN_ACTION_ABORT      3
+
+#define BRCMF_ISCAN_REQ_VERSION 1
+
+/* brcmf_iscan_results status values */
+#define BRCMF_SCAN_RESULTS_SUCCESS      0
+#define BRCMF_SCAN_RESULTS_PARTIAL      1
+#define BRCMF_SCAN_RESULTS_PENDING      2
+#define BRCMF_SCAN_RESULTS_ABORTED      3
+#define BRCMF_SCAN_RESULTS_NO_MEM       4
+
+#define WL_SOFT_KEY     (1 << 0)        /* Indicates this key is using soft encrypt */
+#define BRCMF_PRIMARY_KEY       (1 << 1)        /* primary (ie tx) key */
+#define WL_KF_RES_4     (1 << 4)        /* Reserved for backward compat */
+#define WL_KF_RES_5     (1 << 5)        /* Reserved for backward compat */
+#define WL_IBSS_PEER_GROUP_KEY  (1 << 6)        /* Indicates a group key for a IBSS PEER */
+
+/* For supporting multiple interfaces */
+#define BRCMF_MAX_IFS   16
+#define BRCMF_DEL_IF    -0xe
+#define BRCMF_BAD_IF    -0xf
+
+#define DOT11_BSSTYPE_ANY                       2
+#define DOT11_MAX_DEFAULT_KEYS  4
+
+#define BRCMF_EVENT_MSG_LINK            0x01
+#define BRCMF_EVENT_MSG_FLUSHTXQ        0x02
+#define BRCMF_EVENT_MSG_GROUP           0x04
+
+struct brcmf_event_msg {
+        u16 version;
+        u16 flags;
+        u32 event_type;
+        u32 status;
+        u32 reason;
+        u32 auth_type;
+        u32 datalen;
+        u8 addr[ETH_ALEN];
+        char ifname[IFNAMSIZ];
+} __packed;
+
+struct brcm_ethhdr {
+        u16 subtype;
+        u16 length;
+        u8 version;
+        u8 oui[3];
+        u16 usr_subtype;
+} __packed;
+
+struct brcmf_event {
+        struct ethhdr eth;
+        struct brcm_ethhdr hdr;
+        struct brcmf_event_msg msg;
+} __packed;
+
+struct dngl_stats {
+        unsigned long rx_packets;       /* total packets received */
+        unsigned long tx_packets;       /* total packets transmitted */
+        unsigned long rx_bytes; /* total bytes received */
+        unsigned long tx_bytes; /* total bytes transmitted */
+        unsigned long rx_errors;        /* bad packets received */
+        unsigned long tx_errors;        /* packet transmit problems */
+        unsigned long rx_dropped;       /* packets dropped by dongle */
+        unsigned long tx_dropped;       /* packets dropped by dongle */
+        unsigned long multicast;        /* multicast packets received */
+};
+
+#define BRCMF_E_SET_SSID                        0
+#define BRCMF_E_JOIN                            1
+#define BRCMF_E_START                           2
+#define BRCMF_E_AUTH                            3
+#define BRCMF_E_AUTH_IND                        4
+#define BRCMF_E_DEAUTH                          5
+#define BRCMF_E_DEAUTH_IND                      6
+#define BRCMF_E_ASSOC                           7
+#define BRCMF_E_ASSOC_IND                       8
+#define BRCMF_E_REASSOC                         9
+#define BRCMF_E_REASSOC_IND                     10
+#define BRCMF_E_DISASSOC                        11
+#define BRCMF_E_DISASSOC_IND                    12
+#define BRCMF_E_QUIET_START                     13
+#define BRCMF_E_QUIET_END                       14
+#define BRCMF_E_BEACON_RX                       15
+#define BRCMF_E_LINK                            16
+#define BRCMF_E_MIC_ERROR                       17
+#define BRCMF_E_NDIS_LINK                       18
+#define BRCMF_E_ROAM                            19
+#define BRCMF_E_TXFAIL                          20
+#define BRCMF_E_PMKID_CACHE                     21
+#define BRCMF_E_RETROGRADE_TSF                  22
+#define BRCMF_E_PRUNE                           23
+#define BRCMF_E_AUTOAUTH                        24
+#define BRCMF_E_EAPOL_MSG                       25
+#define BRCMF_E_SCAN_COMPLETE                   26
+#define BRCMF_E_ADDTS_IND                       27
+#define BRCMF_E_DELTS_IND                       28
+#define BRCMF_E_BCNSENT_IND                     29
+#define BRCMF_E_BCNRX_MSG                       30
+#define BRCMF_E_BCNLOST_MSG                     31
+#define BRCMF_E_ROAM_PREP                       32
+#define BRCMF_E_PFN_NET_FOUND                   33
+#define BRCMF_E_PFN_NET_LOST                    34
+#define BRCMF_E_RESET_COMPLETE                  35
+#define BRCMF_E_JOIN_START                      36
+#define BRCMF_E_ROAM_START                      37
+#define BRCMF_E_ASSOC_START                     38
+#define BRCMF_E_IBSS_ASSOC                      39
+#define BRCMF_E_RADIO                           40
+#define BRCMF_E_PSM_WATCHDOG                    41
+#define BRCMF_E_PROBREQ_MSG                     44
+#define BRCMF_E_SCAN_CONFIRM_IND                45
+#define BRCMF_E_PSK_SUP                         46
+#define BRCMF_E_COUNTRY_CODE_CHANGED            47
+#define BRCMF_E_EXCEEDED_MEDIUM_TIME            48
+#define BRCMF_E_ICV_ERROR                       49
+#define BRCMF_E_UNICAST_DECODE_ERROR            50
+#define BRCMF_E_MULTICAST_DECODE_ERROR          51
+#define BRCMF_E_TRACE                           52
+#define BRCMF_E_IF                              54
+#define BRCMF_E_RSSI                            56
+#define BRCMF_E_PFN_SCAN_COMPLETE               57
+#define BRCMF_E_EXTLOG_MSG                      58
+#define BRCMF_E_ACTION_FRAME                    59
+#define BRCMF_E_ACTION_FRAME_COMPLETE           60
+#define BRCMF_E_PRE_ASSOC_IND                   61
+#define BRCMF_E_PRE_REASSOC_IND                 62
+#define BRCMF_E_CHANNEL_ADOPTED                 63
+#define BRCMF_E_AP_STARTED                      64
+#define BRCMF_E_DFS_AP_STOP                     65
+#define BRCMF_E_DFS_AP_RESUME                   66
+#define BRCMF_E_RESERVED1                       67
+#define BRCMF_E_RESERVED2                       68
+#define BRCMF_E_ESCAN_RESULT                    69
+#define BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE  70
+#define BRCMF_E_DCS_REQUEST                     73
+
+#define BRCMF_E_FIFO_CREDIT_MAP                 74
+
+#define BRCMF_E_LAST                            75
+
+#define BRCMF_E_STATUS_SUCCESS                  0
+#define BRCMF_E_STATUS_FAIL                     1
+#define BRCMF_E_STATUS_TIMEOUT                  2
+#define BRCMF_E_STATUS_NO_NETWORKS              3
+#define BRCMF_E_STATUS_ABORT                    4
+#define BRCMF_E_STATUS_NO_ACK                   5
+#define BRCMF_E_STATUS_UNSOLICITED              6
+#define BRCMF_E_STATUS_ATTEMPT                  7
+#define BRCMF_E_STATUS_PARTIAL                  8
+#define BRCMF_E_STATUS_NEWSCAN                  9
+#define BRCMF_E_STATUS_NEWASSOC                 10
+#define BRCMF_E_STATUS_11HQUIET                 11
+#define BRCMF_E_STATUS_SUPPRESS                 12
+#define BRCMF_E_STATUS_NOCHANS                  13
+#define BRCMF_E_STATUS_CS_ABORT                 15
+#define BRCMF_E_STATUS_ERROR                    16
+
+#define BRCMF_E_REASON_INITIAL_ASSOC            0
+#define BRCMF_E_REASON_LOW_RSSI                 1
+#define BRCMF_E_REASON_DEAUTH                   2
+#define BRCMF_E_REASON_DISASSOC                 3
+#define BRCMF_E_REASON_BCNS_LOST                4
+#define BRCMF_E_REASON_MINTXRATE                9
+#define BRCMF_E_REASON_TXFAIL                   10
+
+#define BRCMF_E_REASON_FAST_ROAM_FAILED         5
+#define BRCMF_E_REASON_DIRECTED_ROAM            6
+#define BRCMF_E_REASON_TSPEC_REJECTED           7
+#define BRCMF_E_REASON_BETTER_AP                8
+
+#define BRCMF_E_PRUNE_ENCR_MISMATCH             1
+#define BRCMF_E_PRUNE_BCAST_BSSID               2
+#define BRCMF_E_PRUNE_MAC_DENY                  3
+#define BRCMF_E_PRUNE_MAC_NA                    4
+#define BRCMF_E_PRUNE_REG_PASSV                 5
+#define BRCMF_E_PRUNE_SPCT_MGMT                 6
+#define BRCMF_E_PRUNE_RADAR                     7
+#define BRCMF_E_RSN_MISMATCH                    8
+#define BRCMF_E_PRUNE_NO_COMMON_RATES           9
+#define BRCMF_E_PRUNE_BASIC_RATES               10
+#define BRCMF_E_PRUNE_CIPHER_NA                 12
+#define BRCMF_E_PRUNE_KNOWN_STA                 13
+#define BRCMF_E_PRUNE_WDS_PEER                  15
+#define BRCMF_E_PRUNE_QBSS_LOAD                 16
+#define BRCMF_E_PRUNE_HOME_AP                   17
+
+#define BRCMF_E_SUP_OTHER                       0
+#define BRCMF_E_SUP_DECRYPT_KEY_DATA            1
+#define BRCMF_E_SUP_BAD_UCAST_WEP128            2
+#define BRCMF_E_SUP_BAD_UCAST_WEP40             3
+#define BRCMF_E_SUP_UNSUP_KEY_LEN               4
+#define BRCMF_E_SUP_PW_KEY_CIPHER               5
+#define BRCMF_E_SUP_MSG3_TOO_MANY_IE            6
+#define BRCMF_E_SUP_MSG3_IE_MISMATCH            7
+#define BRCMF_E_SUP_NO_INSTALL_FLAG             8
+#define BRCMF_E_SUP_MSG3_NO_GTK                 9
+#define BRCMF_E_SUP_GRP_KEY_CIPHER              10
+#define BRCMF_E_SUP_GRP_MSG1_NO_GTK             11
+#define BRCMF_E_SUP_GTK_DECRYPT_FAIL            12
+#define BRCMF_E_SUP_SEND_FAIL                   13
+#define BRCMF_E_SUP_DEAUTH                      14
+
+#define BRCMF_E_IF_ADD                          1
+#define BRCMF_E_IF_DEL                          2
+#define BRCMF_E_IF_CHANGE                       3
+
+#define BRCMF_E_IF_ROLE_STA                     0
+#define BRCMF_E_IF_ROLE_AP                      1
+#define BRCMF_E_IF_ROLE_WDS                     2
+
+#define BRCMF_E_LINK_BCN_LOSS                   1
+#define BRCMF_E_LINK_DISASSOC                   2
+#define BRCMF_E_LINK_ASSOC_REC                  3
+#define BRCMF_E_LINK_BSSCFG_DIS                 4
+
+/* The level of bus communication with the dongle */
+enum brcmf_bus_state {
+        BRCMF_BUS_DOWN,         /* Not ready for frame transfers */
+        BRCMF_BUS_LOAD,         /* Download access only (CPU reset) */
+        BRCMF_BUS_DATA          /* Ready for frame transfers */
+};
+
+/* Pattern matching filter. Specifies an offset within received packets to
+ * start matching, the pattern to match, the size of the pattern, and a bitmask
+ * that indicates which bits within the pattern should be matched.
+ */
+struct brcmf_pkt_filter_pattern {
+        u32 offset;             /* Offset within received packet to start pattern matching.
+                                 * Offset '0' is the first byte of the ethernet header.
+                                 */
+        u32 size_bytes; /* Size of the pattern.  Bitmask must be the same size. */
+        u8 mask_and_pattern[1]; /* Variable length mask and pattern data.  mask starts
+                                         * at offset 0.  Pattern immediately follows mask.
+                                         */
+};
+
+/* IOVAR "pkt_filter_add" parameter. Used to install packet filters. */
+struct brcmf_pkt_filter {
+        u32 id;         /* Unique filter id, specified by app. */
+        u32 type;               /* Filter type (WL_PKT_FILTER_TYPE_xxx). */
+        u32 negate_match;       /* Negate the result of filter matches */
+        union {                 /* Filter definitions */
+                struct brcmf_pkt_filter_pattern pattern; /* Filter pattern */
+        } u;
+};
+
+/* IOVAR "pkt_filter_enable" parameter. */
+struct brcmf_pkt_filter_enable {
+        u32 id;         /* Unique filter id */
+        u32 enable;             /* Enable/disable bool */
+};
+
+/* BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in struct brcmf_scan_results)
+ */
+struct brcmf_bss_info {
+        u32 version;            /* version field */
+        u32 length;             /* byte length of data in this record,
+                                 * starting at version and including IEs
+                                 */
+        u8 BSSID[ETH_ALEN];
+        u16 beacon_period;      /* units are Kusec */
+        u16 capability; /* Capability information */
+        u8 SSID_len;
+        u8 SSID[32];
+        struct {
+                uint count;     /* # rates in this set */
+                u8 rates[16];   /* rates in 500kbps units w/hi bit set if basic */
+        } rateset;              /* supported rates */
+        chanspec_t chanspec;    /* chanspec for bss */
+        u16 atim_window;        /* units are Kusec */
+        u8 dtim_period; /* DTIM period */
+        s16 RSSI;               /* receive signal strength (in dBm) */
+        s8 phy_noise;           /* noise (in dBm) */
+
+        u8 n_cap;               /* BSS is 802.11N Capable */
+        u32 nbss_cap;   /* 802.11N BSS Capabilities (based on HT_CAP_*) */
+        u8 ctl_ch;              /* 802.11N BSS control channel number */
+        u32 reserved32[1];      /* Reserved for expansion of BSS properties */
+        u8 flags;               /* flags */
+        u8 reserved[3]; /* Reserved for expansion of BSS properties */
+        u8 basic_mcs[MCSSET_LEN];       /* 802.11N BSS required MCS set */
+
+        u16 ie_offset;  /* offset at which IEs start, from beginning */
+        u32 ie_length;  /* byte length of Information Elements */
+        s16 SNR;                /* average SNR of during frame reception */
+        /* Add new fields here */
+        /* variable length Information Elements */
+};
+
+struct brcmf_ssid {
+        u32 SSID_len;
+        unsigned char SSID[32];
+};
+
+struct brcmf_scan_params {
+        struct brcmf_ssid ssid; /* default: {0, ""} */
+        u8 bssid[ETH_ALEN];     /* default: bcast */
+        s8 bss_type;            /* default: any,
+                                 * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
+                                 */
+        u8 scan_type;   /* flags, 0 use default */
+        s32 nprobes;            /* -1 use default, number of probes per channel */
+        s32 active_time;        /* -1 use default, dwell time per channel for
+                                 * active scanning
+                                 */
+        s32 passive_time;       /* -1 use default, dwell time per channel
+                                 * for passive scanning
+                                 */
+        s32 home_time;  /* -1 use default, dwell time for the home channel
+                                 * between channel scans
+                                 */
+        s32 channel_num;        /* count of channels and ssids that follow
+                                 *
+                                 * low half is count of channels in
+                                 * channel_list, 0 means default (use all
+                                 * available channels)
+                                 *
+                                 * high half is entries in struct brcmf_ssid
+                                 * array that follows channel_list, aligned for
+                                 * s32 (4 bytes) meaning an odd channel count
+                                 * implies a 2-byte pad between end of
+                                 * channel_list and first ssid
+                                 *
+                                 * if ssid count is zero, single ssid in the
+                                 * fixed parameter portion is assumed, otherwise
+                                 * ssid in the fixed portion is ignored
+                                 */
+        u16 channel_list[1];    /* list of chanspecs */
+};
+
+/* incremental scan struct */
+struct brcmf_iscan_params {
+        u32 version;
+        u16 action;
+        u16 scan_duration;
+        struct brcmf_scan_params params;
+};
+
+/* 3 fields + size of brcmf_scan_params, not including variable length array */
+#define BRCMF_ISCAN_PARAMS_FIXED_SIZE \
+        (offsetof(struct brcmf_iscan_params, params) + \
+         sizeof(struct brcmf_ssid))
+
+struct brcmf_scan_results {
+        u32 buflen;
+        u32 version;
+        u32 count;
+        struct brcmf_bss_info bss_info[1];
+};
+
+/* used for association with a specific BSSID and chanspec list */
+struct brcmf_assoc_params {
+        u8 bssid[ETH_ALEN];     /* 00:00:00:00:00:00: broadcast scan */
+        s32 chanspec_num;       /* 0: all available channels,
+                                 * otherwise count of chanspecs in chanspec_list
+                                 */
+        chanspec_t chanspec_list[1];    /* list of chanspecs */
+};
+#define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
+        (sizeof(struct brcmf_assoc_params) - sizeof(chanspec_t))
+
+/* used for join with or without a specific bssid and channel list */
+struct brcmf_join_params {
+        struct brcmf_ssid ssid;
+        struct brcmf_assoc_params params;
+};
+
+/* size of brcmf_scan_results not including variable length array */
+#define BRCMF_SCAN_RESULTS_FIXED_SIZE \
+        (sizeof(struct brcmf_scan_results) - sizeof(struct brcmf_bss_info))
+
+/* incremental scan results struct */
+struct brcmf_iscan_results {
+        u32 status;
+        struct brcmf_scan_results results;
+};
+
+/* size of brcmf_iscan_results not including variable length array */
+#define BRCMF_ISCAN_RESULTS_FIXED_SIZE \
+        (BRCMF_SCAN_RESULTS_FIXED_SIZE + \
+         offsetof(struct brcmf_iscan_results, results))
+
+struct brcmf_wsec_key {
+        u32 index;              /* key index */
+        u32 len;                /* key length */
+        u8 data[WLAN_MAX_KEY_LEN];      /* key data */
+        u32 pad_1[18];
+        u32 algo;               /* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+        u32 flags;              /* misc flags */
+        u32 pad_2[2];
+        int pad_3;
+        int iv_initialized;     /* has IV been initialized already? */
+        int pad_4;
+        /* Rx IV */
+        struct {
+                u32 hi; /* upper 32 bits of IV */
+                u16 lo; /* lower 16 bits of IV */
+        } rxiv;
+        u32 pad_5[2];
+        u8 ea[ETH_ALEN];        /* per station */
+};
+
+/* Used to get specific STA parameters */
+struct brcmf_scb_val {
+        u32 val;
+        u8 ea[ETH_ALEN];
+};
+
+/* channel encoding */
+struct brcmf_channel_info {
+        int hw_channel;
+        int target_channel;
+        int scan_channel;
+};
+
+/* Linux network driver ioctl encoding */
+struct brcmf_ioctl {
+        uint cmd;               /* common ioctl definition */
+        void *buf;              /* pointer to user buffer */
+        uint len;               /* length of user buffer */
+        u8 set;         /* get or set request (optional) */
+        uint used;              /* bytes read or written (optional) */
+        uint needed;            /* bytes needed (optional) */
+};
+
+/* Forward decls for struct brcmf_pub (see below) */
+struct brcmf_bus;               /* device bus info */
+struct brcmf_proto;     /* device communication protocol info */
+struct brcmf_info;      /* device driver info */
+
+/* Common structure for module and instance linkage */
+struct brcmf_pub {
+        /* Linkage ponters */
+        struct brcmf_bus *bus;
+        struct brcmf_proto *prot;
+        struct brcmf_info *info;
+
+        /* Internal brcmf items */
+        bool up;                /* Driver up/down (to OS) */
+        bool txoff;             /* Transmit flow-controlled */
+        bool dongle_reset;      /* true = DEVRESET put dongle into reset */
+        enum brcmf_bus_state busstate;
+        uint hdrlen;            /* Total BRCMF header length (proto + bus) */
+        uint maxctl;            /* Max size rxctl request from proto to bus */
+        uint rxsz;              /* Rx buffer size bus module should use */
+        u8 wme_dp;              /* wme discard priority */
+
+        /* Dongle media info */
+        bool iswl;              /* Dongle-resident driver is wl */
+        unsigned long drv_version;      /* Version of dongle-resident driver */
+        u8 mac[ETH_ALEN];                       /* MAC address obtained from dongle */
+        struct dngl_stats dstats;       /* Stats for dongle-based data */
+
+        /* Additional stats for the bus level */
+        unsigned long tx_packets;       /* Data packets sent to dongle */
+        unsigned long tx_multicast;     /* Multicast data packets sent to dongle */
+        unsigned long tx_errors;        /* Errors in sending data to dongle */
+        unsigned long tx_ctlpkts;       /* Control packets sent to dongle */
+        unsigned long tx_ctlerrs;       /* Errors sending control frames to dongle */
+        unsigned long rx_packets;       /* Packets sent up the network interface */
+        unsigned long rx_multicast;     /* Multicast packets sent up the network
+                                         interface */
+        unsigned long rx_errors;        /* Errors processing rx data packets */
+        unsigned long rx_ctlpkts;       /* Control frames processed from dongle */
+        unsigned long rx_ctlerrs;       /* Errors in processing rx control frames */
+        unsigned long rx_dropped;       /* Packets dropped locally (no memory) */
+        unsigned long rx_flushed;       /* Packets flushed due to
+                                unscheduled sendup thread */
+        unsigned long wd_dpc_sched;     /* Number of times dpc scheduled by
+                                         watchdog timer */
+
+        unsigned long rx_readahead_cnt; /* Number of packets where header read-ahead
+                                         was used. */
+        unsigned long tx_realloc;       /* Number of tx packets we had to realloc for
+                                         headroom */
+        unsigned long fc_packets;       /* Number of flow control pkts recvd */
+
+        /* Last error return */
+        int bcmerror;
+        uint tickcnt;
+
+        /* Last error from dongle */
+        int dongle_error;
+
+        /* Suspend disable flag  flag */
+        int suspend_disable_flag;       /* "1" to disable all extra powersaving
+                                         during suspend */
+        int in_suspend;         /* flag set to 1 when early suspend called */
+        int dtim_skip;          /* dtim skip , default 0 means wake each dtim */
+
+        /* Pkt filter defination */
+        char *pktfilter[100];
+        int pktfilter_count;
+
+        u8 country_code[BRCM_CNTRY_BUF_SZ];
+        char eventmask[BRCMF_EVENTING_MASK_LEN];
+
+};
+
+struct brcmf_if_event {
+        u8 ifidx;
+        u8 action;
+        u8 flags;
+        u8 bssidx;
+};
+
+struct brcmf_timeout {
+        u32 limit;              /* Expiration time (usec) */
+        u32 increment;  /* Current expiration increment (usec) */
+        u32 elapsed;            /* Current elapsed time (usec) */
+        u32 tick;               /* O/S tick time (usec) */
+};
+
+struct bcmevent_name {
+        uint event;
+        const char *name;
+};
+
+#if defined(CONFIG_PM_SLEEP)
+extern atomic_t brcmf_mmc_suspend;
+#define BRCMF_PM_RESUME_WAIT_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+#define _BRCMF_PM_RESUME_WAIT(a, b) do { \
+                int retry = 0; \
+                while (atomic_read(&brcmf_mmc_suspend) && retry++ != b) { \
+                        wait_event_timeout(a, false, HZ/100); \
+                } \
+        }       while (0)
+#define BRCMF_PM_RESUME_WAIT(a) _BRCMF_PM_RESUME_WAIT(a, 30)
+#define BRCMF_PM_RESUME_RETURN_ERROR(a) \
+        do { if (atomic_read(&brcmf_mmc_suspend)) return a; } while (0)
+
+#define BRCMF_SPINWAIT_SLEEP_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+#define BRCMF_SPINWAIT_SLEEP(a, exp, us) do { \
+                uint countdown = (us) + 9999; \
+                while ((exp) && (countdown >= 10000)) { \
+                        wait_event_timeout(a, false, HZ/100); \
+                        countdown -= 10000; \
+                } \
+        } while (0)
+
+#else
+
+#define BRCMF_PM_RESUME_WAIT_INIT(a)
+#define BRCMF_PM_RESUME_WAIT(a)
+#define BRCMF_PM_RESUME_RETURN_ERROR(a)
+
+#define BRCMF_SPINWAIT_SLEEP_INIT(a)
+#define BRCMF_SPINWAIT_SLEEP(a, exp, us)  do { \
+                uint countdown = (us) + 9; \
+                while ((exp) && (countdown >= 10)) { \
+                        udelay(10);  \
+                        countdown -= 10;  \
+                } \
+        } while (0)
+
+#endif  /* defined(CONFIG_PM_SLEEP) */
+
+/*
+ * Insmod parameters for debug/test
+ */
+
+/* Use interrupts */
+extern uint brcmf_intr;
+
+/* Use polling */
+extern uint brcmf_poll;
+
+/* ARP offload agent mode */
+extern uint brcmf_arp_mode;
+
+/* ARP offload enable */
+extern uint brcmf_arp_enable;
+
+/* Pkt filte enable control */
+extern uint brcmf_pkt_filter_enable;
+
+/*  Pkt filter init setup */
+extern uint brcmf_pkt_filter_init;
+
+/* Pkt filter mode control */
+extern uint brcmf_master_mode;
+
+/* Roaming mode control */
+extern uint brcmf_roam;
+
+/* Roaming mode control */
+extern uint brcmf_radio_up;
+
+/* Initial idletime ticks (may be -1 for immediate idle, 0 for no idle) */
+extern int brcmf_idletime;
+#define BRCMF_IDLETIME_TICKS 1
+
+/* SDIO Drive Strength */
+extern uint brcmf_sdiod_drive_strength;
+
+/* Override to force tx queueing all the time */
+extern uint brcmf_force_tx_queueing;
+
+#ifdef SDTEST
+/* Echo packet generator (SDIO), pkts/s */
+extern uint brcmf_pktgen;
+
+/* Echo packet len (0 => sawtooth, max 1800) */
+extern uint brcmf_pktgen_len;
+#define BRCMF_MAX_PKTGEN_LEN 1800
+#endif
+
+extern const struct bcmevent_name bcmevent_names[];
+extern const int bcmevent_names_size;
+
+
+static inline void MUTEX_LOCK_INIT(struct brcmf_pub *drvr)
+{
+}
+
+static inline void MUTEX_LOCK(struct brcmf_pub *drvr)
+{
+}
+
+static inline void MUTEX_UNLOCK(struct brcmf_pub *drvr)
+{
+}
+
+static inline void MUTEX_LOCK_SOFTAP_SET_INIT(struct brcmf_pub *drvr)
+{
+}
+
+static inline void MUTEX_LOCK_SOFTAP_SET(struct brcmf_pub *drvr)
+{
+}
+
+static inline void MUTEX_UNLOCK_SOFTAP_SET(struct brcmf_pub *drvr)
+{
+}
+
+static inline void MUTEX_LOCK_WL_SCAN_SET_INIT(void)
+{
+}
+
+static inline void MUTEX_LOCK_WL_SCAN_SET(void)
+{
+}
+
+static inline void MUTEX_UNLOCK_WL_SCAN_SET(void)
+{
+}
+
+/* Indication from bus module regarding presence/insertion of dongle.
+ * Return struct brcmf_pub pointer, used as handle to OS module in later calls.
+ * Returned structure should have bus and prot pointers filled in.
+ * bus_hdrlen specifies required headroom for bus module header.
+ */
+extern struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus,
+                                      uint bus_hdrlen);
+extern int brcmf_net_attach(struct brcmf_pub *drvr, int idx);
+extern int brcmf_netdev_wait_pend8021x(struct net_device *dev);
+
+/* Indication from bus module regarding removal/absence of dongle */
+extern void brcmf_detach(struct brcmf_pub *drvr);
+
+/* Indication from bus module to change flow-control state */
+extern void brcmf_txflowcontrol(struct brcmf_pub *drvr, int ifidx, bool on);
+
+extern bool brcmf_c_prec_enq(struct brcmf_pub *drvr, struct pktq *q,
+                         struct sk_buff *pkt, int prec);
+
+/* Receive frame for delivery to OS.  Callee disposes of rxp. */
+extern void brcmf_rx_frame(struct brcmf_pub *drvr, int ifidx,
+                         struct sk_buff *rxp, int numpkt);
+
+/* Return pointer to interface name */
+extern char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
+
+/* Notify tx completion */
+extern void brcmf_txcomplete(struct brcmf_pub *drvr, struct sk_buff *txp,
+                             bool success);
+
+/* Query ioctl */
+extern int brcmf_proto_cdc_query_ioctl(struct brcmf_pub *drvr, int ifidx,
+                                       uint cmd, void *buf, uint len);
+
+/* OS independent layer functions */
+extern int brcmf_os_proto_block(struct brcmf_pub *drvr);
+extern int brcmf_os_proto_unblock(struct brcmf_pub *drvr);
+extern int brcmf_os_ioctl_resp_wait(struct brcmf_pub *drvr, uint *condition,
+                                  bool *pending);
+extern int brcmf_os_ioctl_resp_wake(struct brcmf_pub *drvr);
+extern unsigned int brcmf_os_get_ioctl_resp_timeout(void);
+extern void brcmf_os_set_ioctl_resp_timeout(unsigned int timeout_msec);
+#ifdef BCMDBG
+extern int brcmf_write_to_file(struct brcmf_pub *drvr, u8 *buf, int size);
+#endif                          /* BCMDBG */
+
+extern void brcmf_timeout_start(struct brcmf_timeout *tmo, uint usec);
+extern int brcmf_timeout_expired(struct brcmf_timeout *tmo);
+
+extern int brcmf_ifname2idx(struct brcmf_info *drvr_priv, char *name);
+extern int brcmf_c_host_event(struct brcmf_info *drvr_priv, int *idx,
+                              void *pktdata, struct brcmf_event_msg *,
+                              void **data_ptr);
+
+extern void brcmf_c_init(void);
+
+extern int brcmf_add_if(struct brcmf_info *drvr_priv, int ifidx, void *handle,
+                      char *name, u8 *mac_addr, u32 flags, u8 bssidx);
+extern void brcmf_del_if(struct brcmf_info *drvr_priv, int ifidx);
+
+/* Send packet to dongle via data channel */
+extern int brcmf_sendpkt(struct brcmf_pub *drvr, int ifidx,\
+                         struct sk_buff *pkt);
+
+extern int brcmf_bus_devreset(struct brcmf_pub *drvr, u8 flag);
+extern int brcmf_bus_start(struct brcmf_pub *drvr);
+
+extern void brcmf_c_pktfilter_offload_set(struct brcmf_pub *drvr, char *arg);
+extern void brcmf_c_pktfilter_offload_enable(struct brcmf_pub *drvr, char *arg,
+                                             int enable, int master_mode);
+
+/* Linux network driver ioctl encoding */
+struct brcmf_c_ioctl {
+        uint cmd;               /* common ioctl definition */
+        void *buf;              /* pointer to user buffer */
+        uint len;               /* length of user buffer */
+        bool set;               /* get or set request (optional) */
+        uint used;              /* bytes read or written (optional) */
+        uint needed;            /* bytes needed (optional) */
+        uint driver;            /* to identify target driver */
+};
+
+/* per-driver magic numbers */
+#define BRCMF_IOCTL_MAGIC               0x00444944
+
+/* bump this number if you change the ioctl interface */
+#define BRCMF_IOCTL_VERSION     1
+#define BRCMF_IOCTL_MAXLEN      8192    /* max length ioctl buffer required */
+
+/* common ioctl definitions */
+#define BRCMF_GET_MAGIC                         0
+#define BRCMF_GET_VERSION                               1
+#define BRCMF_GET_VAR                           2
+#define BRCMF_SET_VAR                           3
+
+/* message levels */
+#define BRCMF_ERROR_VAL 0x0001
+#define BRCMF_TRACE_VAL 0x0002
+#define BRCMF_INFO_VAL  0x0004
+#define BRCMF_DATA_VAL  0x0008
+#define BRCMF_CTL_VAL   0x0010
+#define BRCMF_TIMER_VAL 0x0020
+#define BRCMF_HDRS_VAL  0x0040
+#define BRCMF_BYTES_VAL 0x0080
+#define BRCMF_INTR_VAL  0x0100
+#define BRCMF_GLOM_VAL  0x0400
+#define BRCMF_EVENT_VAL 0x0800
+#define BRCMF_BTA_VAL   0x1000
+#define BRCMF_ISCAN_VAL 0x2000
+
+#ifdef SDTEST
+/* For pktgen iovar */
+struct brcmf_pktgen {
+        uint version;           /* To allow structure change tracking */
+        uint freq;              /* Max ticks between tx/rx attempts */
+        uint count;             /* Test packets to send/rcv each attempt */
+        uint print;             /* Print counts every <print> attempts */
+        uint total;             /* Total packets (or bursts) */
+        uint minlen;            /* Minimum length of packets to send */
+        uint maxlen;            /* Maximum length of packets to send */
+        uint numsent;           /* Count of test packets sent */
+        uint numrcvd;           /* Count of test packets received */
+        uint numfail;           /* Count of test send failures */
+        uint mode;              /* Test mode (type of test packets) */
+        uint stop;              /* Stop after this many tx failures */
+};
+
+/* Version in case structure changes */
+#define BRCMF_PKTGEN_VERSION    2
+
+/* Type of test packets to use */
+#define BRCMF_PKTGEN_ECHO       1       /* Send echo requests */
+#define BRCMF_PKTGEN_SEND       2       /* Send discard packets */
+#define BRCMF_PKTGEN_RXBURST    3       /* Request dongle send N packets */
+#define BRCMF_PKTGEN_RECV               4       /* Continuous rx from continuous
+                                         tx dongle */
+#endif                          /* SDTEST */
+
+/* Enter idle immediately (no timeout) */
+#define BRCMF_IDLE_IMMEDIATE    (-1)
+
+/* Values for idleclock iovar: other values are the sd_divisor to use
+         when idle */
+#define BRCMF_IDLE_ACTIVE       0       /* Do not request any SD clock change
+                                 when idle */
+
+#endif                          /* _BRCMF_H_ */
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_bus.h b/drivers/staging/brcm80211/brcmfmac/dhd_bus.h
new file mode 100644
index 00000000000..653cf0daa0e
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_bus.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _BRCMF_BUS_H_
+#define _BRCMF_BUS_H_
+
+/* Packet alignment for most efficient SDIO (can change based on platform) */
+#ifndef BRCMF_SDALIGN
+#define BRCMF_SDALIGN   32
+#endif
+#if !ISPOWEROF2(BRCMF_SDALIGN)
+#error BRCMF_SDALIGN is not a power of 2!
+#endif
+
+/*
+ * Exported from brcmf bus module (brcmf_usb, brcmf_sdio)
+ */
+
+/* dongle ram module parameter */
+extern int brcmf_dongle_memsize;
+
+/* Tx/Rx bounds module parameters */
+extern uint brcmf_txbound;
+extern uint brcmf_rxbound;
+
+/* Watchdog timer interval */
+extern uint brcmf_watchdog_ms;
+
+/* Indicate (dis)interest in finding dongles. */
+extern int brcmf_bus_register(void);
+extern void brcmf_bus_unregister(void);
+
+/* Stop bus module: clear pending frames, disable data flow */
+extern void brcmf_sdbrcm_bus_stop(struct brcmf_bus *bus, bool enforce_mutex);
+
+/* Initialize bus module: prepare for communication w/dongle */
+extern int brcmf_sdbrcm_bus_init(struct brcmf_pub *drvr, bool enforce_mutex);
+
+/* Send a data frame to the dongle.  Callee disposes of txp. */
+extern int brcmf_sdbrcm_bus_txdata(struct brcmf_bus *bus, struct sk_buff *txp);
+
+/* Send/receive a control message to/from the dongle.
+ * Expects caller to enforce a single outstanding transaction.
+ */
+extern int
+brcmf_sdbrcm_bus_txctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen);
+
+extern int
+brcmf_sdbrcm_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen);
+
+/* Check for and handle local prot-specific iovar commands */
+extern int brcmf_sdbrcm_bus_iovar_op(struct brcmf_pub *drvr, const char *name,
+                            void *params, int plen, void *arg, int len,
+                            bool set);
+
+/* Add bus dump output to a buffer */
+extern void brcmf_sdbrcm_bus_dump(struct brcmf_pub *drvr,
+                                  struct brcmu_strbuf *strbuf);
+
+/* Clear any bus counters */
+extern void brcmf_bus_clearcounts(struct brcmf_pub *drvr);
+
+extern void brcmf_sdbrcm_wd_timer(struct brcmf_bus *bus, uint wdtick);
+
+#endif                          /* _BRCMF_BUS_H_ */
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_cdc.c b/drivers/staging/brcm80211/brcmfmac/dhd_cdc.c
new file mode 100644
index 00000000000..345acabe935
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_cdc.c
@@ -0,0 +1,502 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/types.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <defs.h>
+
+#include <brcmu_utils.h>
+#include <brcmu_wifi.h>
+
+#include "dhd.h"
+#include "dhd_proto.h"
+#include "dhd_bus.h"
+#include "dhd_dbg.h"
+
+struct brcmf_proto_cdc_ioctl {
+        u32 cmd;        /* ioctl command value */
+        u32 len;        /* lower 16: output buflen;
+                         * upper 16: input buflen (excludes header) */
+        u32 flags;      /* flag defns given below */
+        u32 status;     /* status code returned from the device */
+};
+
+/* Max valid buffer size that can be sent to the dongle */
+#define CDC_MAX_MSG_SIZE        (ETH_FRAME_LEN+ETH_FCS_LEN)
+
+/* CDC flag definitions */
+#define CDCF_IOC_ERROR          0x01            /* 1=ioctl cmd failed */
+#define CDCF_IOC_SET            0x02            /* 0=get, 1=set cmd */
+#define CDCF_IOC_IF_MASK        0xF000          /* I/F index */
+#define CDCF_IOC_IF_SHIFT       12
+#define CDCF_IOC_ID_MASK        0xFFFF0000      /* id an ioctl pairing */
+#define CDCF_IOC_ID_SHIFT       16              /* ID Mask shift bits */
+#define CDC_IOC_ID(flags)       \
+        (((flags) & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT)
+#define CDC_SET_IF_IDX(hdr, idx) \
+        ((hdr)->flags = (((hdr)->flags & ~CDCF_IOC_IF_MASK) | \
+        ((idx) << CDCF_IOC_IF_SHIFT)))
+
+/*
+ * BDC header - Broadcom specific extension of CDC.
+ * Used on data packets to convey priority across USB.
+ */
+#define BDC_HEADER_LEN          4
+#define BDC_PROTO_VER           1       /* Protocol version */
+#define BDC_FLAG_VER_MASK       0xf0    /* Protocol version mask */
+#define BDC_FLAG_VER_SHIFT      4       /* Protocol version shift */
+#define BDC_FLAG_SUM_GOOD       0x04    /* Good RX checksums */
+#define BDC_FLAG_SUM_NEEDED     0x08    /* Dongle needs to do TX checksums */
+#define BDC_PRIORITY_MASK       0x7
+#define BDC_FLAG2_IF_MASK       0x0f    /* packet rx interface in APSTA */
+#define BDC_FLAG2_IF_SHIFT      0
+
+#define BDC_GET_IF_IDX(hdr) \
+        ((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
+#define BDC_SET_IF_IDX(hdr, idx) \
+        ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | \
+        ((idx) << BDC_FLAG2_IF_SHIFT)))
+
+struct brcmf_proto_bdc_header {
+        u8 flags;
+        u8 priority;    /* 802.1d Priority, 4:7 flow control info for usb */
+        u8 flags2;
+        u8 rssi;
+};
+
+
+#define RETRIES 2       /* # of retries to retrieve matching ioctl response */
+#define BUS_HEADER_LEN  (16+BRCMF_SDALIGN) /* Must be atleast SDPCM_RESERVE
+                                         * (amount of header tha might be added)
+                                         * plus any space that might be needed
+                                         * for alignment padding.
+                                         */
+#define ROUND_UP_MARGIN 2048    /* Biggest SDIO block size possible for
+                                 * round off at the end of buffer
+                                 */
+
+struct brcmf_proto {
+        u16 reqid;
+        u8 pending;
+        u32 lastcmd;
+        u8 bus_header[BUS_HEADER_LEN];
+        struct brcmf_proto_cdc_ioctl msg;
+        unsigned char buf[BRCMF_C_IOCTL_MAXLEN + ROUND_UP_MARGIN];
+};
+
+static int brcmf_proto_cdc_msg(struct brcmf_pub *drvr)
+{
+        struct brcmf_proto *prot = drvr->prot;
+        int len = le32_to_cpu(prot->msg.len) +
+                        sizeof(struct brcmf_proto_cdc_ioctl);
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* NOTE : cdc->msg.len holds the desired length of the buffer to be
+         *        returned. Only up to CDC_MAX_MSG_SIZE of this buffer area
+         *        is actually sent to the dongle
+         */
+        if (len > CDC_MAX_MSG_SIZE)
+                len = CDC_MAX_MSG_SIZE;
+
+        /* Send request */
+        return brcmf_sdbrcm_bus_txctl(drvr->bus, (unsigned char *)&prot->msg,
+                                      len);
+}
+
+static int brcmf_proto_cdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len)
+{
+        int ret;
+        struct brcmf_proto *prot = drvr->prot;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        do {
+                ret = brcmf_sdbrcm_bus_rxctl(drvr->bus,
+                                (unsigned char *)&prot->msg,
+                                len + sizeof(struct brcmf_proto_cdc_ioctl));
+                if (ret < 0)
+                        break;
+        } while (CDC_IOC_ID(le32_to_cpu(prot->msg.flags)) != id);
+
+        return ret;
+}
+
+int
+brcmf_proto_cdc_query_ioctl(struct brcmf_pub *drvr, int ifidx, uint cmd,
+                            void *buf, uint len)
+{
+        struct brcmf_proto *prot = drvr->prot;
+        struct brcmf_proto_cdc_ioctl *msg = &prot->msg;
+        void *info;
+        int ret = 0, retries = 0;
+        u32 id, flags = 0;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+        BRCMF_CTL(("%s: cmd %d len %d\n", __func__, cmd, len));
+
+        /* Respond "bcmerror" and "bcmerrorstr" with local cache */
+        if (cmd == BRCMF_C_GET_VAR && buf) {
+                if (!strcmp((char *)buf, "bcmerrorstr")) {
+                        strncpy((char *)buf, "bcm_error",
+                                BCME_STRLEN);
+                        goto done;
+                } else if (!strcmp((char *)buf, "bcmerror")) {
+                        *(int *)buf = drvr->dongle_error;
+                        goto done;
+                }
+        }
+
+        memset(msg, 0, sizeof(struct brcmf_proto_cdc_ioctl));
+
+        msg->cmd = cpu_to_le32(cmd);
+        msg->len = cpu_to_le32(len);
+        msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT);
+        CDC_SET_IF_IDX(msg, ifidx);
+        msg->flags = cpu_to_le32(msg->flags);
+
+        if (buf)
+                memcpy(prot->buf, buf, len);
+
+        ret = brcmf_proto_cdc_msg(drvr);
+        if (ret < 0) {
+                BRCMF_ERROR(("brcmf_proto_cdc_query_ioctl: brcmf_proto_cdc_msg "
+                             "failed w/status %d\n", ret));
+                goto done;
+        }
+
+retry:
+        /* wait for interrupt and get first fragment */
+        ret = brcmf_proto_cdc_cmplt(drvr, prot->reqid, len);
+        if (ret < 0)
+                goto done;
+
+        flags = le32_to_cpu(msg->flags);
+        id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+        if ((id < prot->reqid) && (++retries < RETRIES))
+                goto retry;
+        if (id != prot->reqid) {
+                BRCMF_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+                             brcmf_ifname(drvr, ifidx), __func__, id,
+                             prot->reqid));
+                ret = -EINVAL;
+                goto done;
+        }
+
+        /* Check info buffer */
+        info = (void *)&msg[1];
+
+        /* Copy info buffer */
+        if (buf) {
+                if (ret < (int)len)
+                        len = ret;
+                memcpy(buf, info, len);
+        }
+
+        /* Check the ERROR flag */
+        if (flags & CDCF_IOC_ERROR) {
+                ret = le32_to_cpu(msg->status);
+                /* Cache error from dongle */
+                drvr->dongle_error = ret;
+        }
+
+done:
+        return ret;
+}
+
+int brcmf_proto_cdc_set_ioctl(struct brcmf_pub *drvr, int ifidx, uint cmd,
+                              void *buf, uint len)
+{
+        struct brcmf_proto *prot = drvr->prot;
+        struct brcmf_proto_cdc_ioctl *msg = &prot->msg;
+        int ret = 0;
+        u32 flags, id;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+        BRCMF_CTL(("%s: cmd %d len %d\n", __func__, cmd, len));
+
+        memset(msg, 0, sizeof(struct brcmf_proto_cdc_ioctl));
+
+        msg->cmd = cpu_to_le32(cmd);
+        msg->len = cpu_to_le32(len);
+        msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT) | CDCF_IOC_SET;
+        CDC_SET_IF_IDX(msg, ifidx);
+        msg->flags = cpu_to_le32(msg->flags);
+
+        if (buf)
+                memcpy(prot->buf, buf, len);
+
+        ret = brcmf_proto_cdc_msg(drvr);
+        if (ret < 0)
+                goto done;
+
+        ret = brcmf_proto_cdc_cmplt(drvr, prot->reqid, len);
+        if (ret < 0)
+                goto done;
+
+        flags = le32_to_cpu(msg->flags);
+        id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+        if (id != prot->reqid) {
+                BRCMF_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+                             brcmf_ifname(drvr, ifidx), __func__, id,
+                             prot->reqid));
+                ret = -EINVAL;
+                goto done;
+        }
+
+        /* Check the ERROR flag */
+        if (flags & CDCF_IOC_ERROR) {
+                ret = le32_to_cpu(msg->status);
+                /* Cache error from dongle */
+                drvr->dongle_error = ret;
+        }
+
+done:
+        return ret;
+}
+
+int
+brcmf_proto_ioctl(struct brcmf_pub *drvr, int ifidx, struct brcmf_ioctl *ioc,
+                  void *buf, int len)
+{
+        struct brcmf_proto *prot = drvr->prot;
+        int ret = -1;
+
+        if (drvr->busstate == BRCMF_BUS_DOWN) {
+                BRCMF_ERROR(("%s : bus is down. we have nothing to do\n",
+                             __func__));
+                return ret;
+        }
+        brcmf_os_proto_block(drvr);
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (len > BRCMF_C_IOCTL_MAXLEN)
+                goto done;
+
+        if (prot->pending == true) {
+                BRCMF_TRACE(("CDC packet is pending!!!! cmd=0x%x (%lu) "
+                             "lastcmd=0x%x (%lu)\n",
+                             ioc->cmd, (unsigned long)ioc->cmd, prot->lastcmd,
+                             (unsigned long)prot->lastcmd));
+                if ((ioc->cmd == BRCMF_C_SET_VAR) ||
+                    (ioc->cmd == BRCMF_C_GET_VAR))
+                        BRCMF_TRACE(("iovar cmd=%s\n", (char *)buf));
+
+                goto done;
+        }
+
+        prot->pending = true;
+        prot->lastcmd = ioc->cmd;
+        if (ioc->set)
+                ret = brcmf_proto_cdc_set_ioctl(drvr, ifidx, ioc->cmd,
+                                                buf, len);
+        else {
+                ret = brcmf_proto_cdc_query_ioctl(drvr, ifidx, ioc->cmd,
+                                                  buf, len);
+                if (ret > 0)
+                        ioc->used = ret - sizeof(struct brcmf_proto_cdc_ioctl);
+        }
+
+        /* Too many programs assume ioctl() returns 0 on success */
+        if (ret >= 0)
+                ret = 0;
+        else {
+                struct brcmf_proto_cdc_ioctl *msg = &prot->msg;
+                /* len == needed when set/query fails from dongle */
+                ioc->needed = le32_to_cpu(msg->len);
+        }
+
+        /* Intercept the wme_dp ioctl here */
+        if (!ret && ioc->cmd == BRCMF_C_SET_VAR &&
+            !strcmp(buf, "wme_dp")) {
+                int slen, val = 0;
+
+                slen = strlen("wme_dp") + 1;
+                if (len >= (int)(slen + sizeof(int)))
+                        memcpy(&val, (char *)buf + slen, sizeof(int));
+                drvr->wme_dp = (u8) le32_to_cpu(val);
+        }
+
+        prot->pending = false;
+
+done:
+        brcmf_os_proto_unblock(drvr);
+
+        return ret;
+}
+
+#define PKTSUMNEEDED(skb) \
+                (((struct sk_buff *)(skb))->ip_summed == CHECKSUM_PARTIAL)
+#define PKTSETSUMGOOD(skb, x) \
+                (((struct sk_buff *)(skb))->ip_summed = \
+                ((x) ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE))
+
+void brcmf_proto_dump(struct brcmf_pub *drvr, struct brcmu_strbuf *strbuf)
+{
+        brcmu_bprintf(strbuf, "Protocol CDC: reqid %d\n", drvr->prot->reqid);
+}
+
+void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
+                         struct sk_buff *pktbuf)
+{
+        struct brcmf_proto_bdc_header *h;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Push BDC header used to convey priority for buses that don't */
+
+        skb_push(pktbuf, BDC_HEADER_LEN);
+
+        h = (struct brcmf_proto_bdc_header *)(pktbuf->data);
+
+        h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
+        if (PKTSUMNEEDED(pktbuf))
+                h->flags |= BDC_FLAG_SUM_NEEDED;
+
+        h->priority = (pktbuf->priority & BDC_PRIORITY_MASK);
+        h->flags2 = 0;
+        h->rssi = 0;
+        BDC_SET_IF_IDX(h, ifidx);
+}
+
+int brcmf_proto_hdrpull(struct brcmf_pub *drvr, int *ifidx,
+                        struct sk_buff *pktbuf)
+{
+        struct brcmf_proto_bdc_header *h;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Pop BDC header used to convey priority for buses that don't */
+
+        if (pktbuf->len < BDC_HEADER_LEN) {
+                BRCMF_ERROR(("%s: rx data too short (%d < %d)\n", __func__,
+                             pktbuf->len, BDC_HEADER_LEN));
+                return -EBADE;
+        }
+
+        h = (struct brcmf_proto_bdc_header *)(pktbuf->data);
+
+        *ifidx = BDC_GET_IF_IDX(h);
+        if (*ifidx >= BRCMF_MAX_IFS) {
+                BRCMF_ERROR(("%s: rx data ifnum out of range (%d)\n",
+                             __func__, *ifidx));
+                return -EBADE;
+        }
+
+        if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) !=
+            BDC_PROTO_VER) {
+                BRCMF_ERROR(("%s: non-BDC packet received, flags 0x%x\n",
+                             brcmf_ifname(drvr, *ifidx), h->flags));
+                return -EBADE;
+        }
+
+        if (h->flags & BDC_FLAG_SUM_GOOD) {
+                BRCMF_INFO(("%s: BDC packet received with good rx-csum, "
+                            "flags 0x%x\n",
+                            brcmf_ifname(drvr, *ifidx), h->flags));
+                PKTSETSUMGOOD(pktbuf, true);
+        }
+
+        pktbuf->priority = h->priority & BDC_PRIORITY_MASK;
+
+        skb_pull(pktbuf, BDC_HEADER_LEN);
+
+        return 0;
+}
+
+int brcmf_proto_attach(struct brcmf_pub *drvr)
+{
+        struct brcmf_proto *cdc;
+
+        cdc = kzalloc(sizeof(struct brcmf_proto), GFP_ATOMIC);
+        if (!cdc) {
+                BRCMF_ERROR(("%s: kmalloc failed\n", __func__));
+                goto fail;
+        }
+
+        /* ensure that the msg buf directly follows the cdc msg struct */
+        if ((unsigned long)(&cdc->msg + 1) != (unsigned long)cdc->buf) {
+                BRCMF_ERROR(("struct brcmf_proto is not correctly defined\n"));
+                goto fail;
+        }
+
+        drvr->prot = cdc;
+        drvr->hdrlen += BDC_HEADER_LEN;
+        drvr->maxctl = BRCMF_C_IOCTL_MAXLEN +
+                        sizeof(struct brcmf_proto_cdc_ioctl) + ROUND_UP_MARGIN;
+        return 0;
+
+fail:
+        kfree(cdc);
+        return -ENOMEM;
+}
+
+/* ~NOTE~ What if another thread is waiting on the semaphore?  Holding it? */
+void brcmf_proto_detach(struct brcmf_pub *drvr)
+{
+        kfree(drvr->prot);
+        drvr->prot = NULL;
+}
+
+void brcmf_proto_dstats(struct brcmf_pub *drvr)
+{
+        /* No stats from dongle added yet, copy bus stats */
+        drvr->dstats.tx_packets = drvr->tx_packets;
+        drvr->dstats.tx_errors = drvr->tx_errors;
+        drvr->dstats.rx_packets = drvr->rx_packets;
+        drvr->dstats.rx_errors = drvr->rx_errors;
+        drvr->dstats.rx_dropped = drvr->rx_dropped;
+        drvr->dstats.multicast = drvr->rx_multicast;
+        return;
+}
+
+int brcmf_proto_init(struct brcmf_pub *drvr)
+{
+        int ret = 0;
+        char buf[128];
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        brcmf_os_proto_block(drvr);
+
+        /* Get the device MAC address */
+        strcpy(buf, "cur_etheraddr");
+        ret = brcmf_proto_cdc_query_ioctl(drvr, 0, BRCMF_C_GET_VAR,
+                                          buf, sizeof(buf));
+        if (ret < 0) {
+                brcmf_os_proto_unblock(drvr);
+                return ret;
+        }
+        memcpy(drvr->mac, buf, ETH_ALEN);
+
+        brcmf_os_proto_unblock(drvr);
+
+        ret = brcmf_c_preinit_ioctls(drvr);
+
+        /* Always assumes wl for now */
+        drvr->iswl = true;
+
+        return ret;
+}
+
+void brcmf_proto_stop(struct brcmf_pub *drvr)
+{
+        /* Nothing to do for CDC */
+}
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_common.c b/drivers/staging/brcm80211/brcmfmac/dhd_common.c
new file mode 100644
index 00000000000..fdec4683c42
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_common.c
@@ -0,0 +1,1196 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/sched.h>
+#include <linux/netdevice.h>
+#include <asm/unaligned.h>
+#include <defs.h>
+#include <brcmu_wifi.h>
+#include <brcmu_utils.h>
+#include "dhd.h"
+#include "dhd_bus.h"
+#include "dhd_proto.h"
+#include "dhd_dbg.h"
+
+#define BRCM_OUI                        "\x00\x10\x18"
+#define DOT11_OUI_LEN                   3
+#define BCMILCP_BCM_SUBTYPE_EVENT       1
+#define PKTFILTER_BUF_SIZE              2048
+
+int brcmf_msg_level;
+
+#define MSGTRACE_VERSION        1
+
+#ifdef BCMDBG
+const char brcmf_version[] =
+"Dongle Host Driver, version " BRCMF_VERSION_STR "\nCompiled on " __DATE__
+" at " __TIME__;
+#else
+const char brcmf_version[] = "Dongle Host Driver, version " BRCMF_VERSION_STR;
+#endif
+
+/* IOVar table */
+enum {
+        IOV_VERSION = 1,
+        IOV_MSGLEVEL,
+        IOV_BCMERRORSTR,
+        IOV_BCMERROR,
+        IOV_DUMP,
+        IOV_CLEARCOUNTS,
+        IOV_LOGDUMP,
+        IOV_LOGCAL,
+        IOV_LOGSTAMP,
+        IOV_GPIOOB,
+        IOV_IOCTLTIMEOUT,
+        IOV_LAST
+};
+
+const struct brcmu_iovar brcmf_iovars[] = {
+        {"version", IOV_VERSION, 0, IOVT_BUFFER, sizeof(brcmf_version)}
+        ,
+#ifdef BCMDBG
+        {"msglevel", IOV_MSGLEVEL, 0, IOVT_UINT32, 0}
+        ,
+#endif                          /* BCMDBG */
+        {"bcmerrorstr", IOV_BCMERRORSTR, 0, IOVT_BUFFER, BCME_STRLEN}
+        ,
+        {"bcmerror", IOV_BCMERROR, 0, IOVT_INT8, 0}
+        ,
+        {"dump", IOV_DUMP, 0, IOVT_BUFFER, BRCMF_IOCTL_MAXLEN}
+        ,
+        {"clearcounts", IOV_CLEARCOUNTS, 0, IOVT_VOID, 0}
+        ,
+        {"gpioob", IOV_GPIOOB, 0, IOVT_UINT32, 0}
+        ,
+        {"ioctl_timeout", IOV_IOCTLTIMEOUT, 0, IOVT_UINT32, 0}
+        ,
+        {NULL, 0, 0, 0, 0}
+};
+
+/* Message trace header */
+struct msgtrace_hdr {
+        u8 version;
+        u8 spare;
+        u16 len;                /* Len of the trace */
+        u32 seqnum;             /* Sequence number of message. Useful
+                                 * if the messsage has been lost
+                                 * because of DMA error or a bus reset
+                                 * (ex: SDIO Func2)
+                                 */
+        u32 discarded_bytes;    /* Number of discarded bytes because of
+                                 trace overflow  */
+        u32 discarded_printf;   /* Number of discarded printf
+                                 because of trace overflow */
+} __packed;
+
+void brcmf_c_init(void)
+{
+        /* Init global variables at run-time, not as part of the declaration.
+         * This is required to support init/de-init of the driver.
+         * Initialization
+         * of globals as part of the declaration results in non-deterministic
+         * behaviour since the value of the globals may be different on the
+         * first time that the driver is initialized vs subsequent
+         * initializations.
+         */
+        brcmf_msg_level = BRCMF_ERROR_VAL;
+}
+
+static int brcmf_c_dump(struct brcmf_pub *drvr, char *buf, int buflen)
+{
+        struct brcmu_strbuf b;
+        struct brcmu_strbuf *strbuf = &b;
+
+        brcmu_binit(strbuf, buf, buflen);
+
+        /* Base info */
+        brcmu_bprintf(strbuf, "%s\n", brcmf_version);
+        brcmu_bprintf(strbuf, "\n");
+        brcmu_bprintf(strbuf, "pub.up %d pub.txoff %d pub.busstate %d\n",
+                    drvr->up, drvr->txoff, drvr->busstate);
+        brcmu_bprintf(strbuf, "pub.hdrlen %d pub.maxctl %d pub.rxsz %d\n",
+                    drvr->hdrlen, drvr->maxctl, drvr->rxsz);
+        brcmu_bprintf(strbuf, "pub.iswl %d pub.drv_version %ld pub.mac %pM\n",
+                    drvr->iswl, drvr->drv_version, &drvr->mac);
+        brcmu_bprintf(strbuf, "pub.bcmerror %d tickcnt %d\n", drvr->bcmerror,
+                    drvr->tickcnt);
+
+        brcmu_bprintf(strbuf, "dongle stats:\n");
+        brcmu_bprintf(strbuf,
+                    "tx_packets %ld tx_bytes %ld tx_errors %ld tx_dropped %ld\n",
+                    drvr->dstats.tx_packets, drvr->dstats.tx_bytes,
+                    drvr->dstats.tx_errors, drvr->dstats.tx_dropped);
+        brcmu_bprintf(strbuf,
+                    "rx_packets %ld rx_bytes %ld rx_errors %ld rx_dropped %ld\n",
+                    drvr->dstats.rx_packets, drvr->dstats.rx_bytes,
+                    drvr->dstats.rx_errors, drvr->dstats.rx_dropped);
+        brcmu_bprintf(strbuf, "multicast %ld\n", drvr->dstats.multicast);
+
+        brcmu_bprintf(strbuf, "bus stats:\n");
+        brcmu_bprintf(strbuf, "tx_packets %ld tx_multicast %ld tx_errors %ld\n",
+                    drvr->tx_packets, drvr->tx_multicast, drvr->tx_errors);
+        brcmu_bprintf(strbuf, "tx_ctlpkts %ld tx_ctlerrs %ld\n",
+                    drvr->tx_ctlpkts, drvr->tx_ctlerrs);
+        brcmu_bprintf(strbuf, "rx_packets %ld rx_multicast %ld rx_errors %ld\n",
+                    drvr->rx_packets, drvr->rx_multicast, drvr->rx_errors);
+        brcmu_bprintf(strbuf,
+                    "rx_ctlpkts %ld rx_ctlerrs %ld rx_dropped %ld rx_flushed %ld\n",
+                    drvr->rx_ctlpkts, drvr->rx_ctlerrs, drvr->rx_dropped,
+                    drvr->rx_flushed);
+        brcmu_bprintf(strbuf,
+                    "rx_readahead_cnt %ld tx_realloc %ld fc_packets %ld\n",
+                    drvr->rx_readahead_cnt, drvr->tx_realloc, drvr->fc_packets);
+        brcmu_bprintf(strbuf, "wd_dpc_sched %ld\n", drvr->wd_dpc_sched);
+        brcmu_bprintf(strbuf, "\n");
+
+        /* Add any prot info */
+        brcmf_proto_dump(drvr, strbuf);
+        brcmu_bprintf(strbuf, "\n");
+
+        /* Add any bus info */
+        brcmf_sdbrcm_bus_dump(drvr, strbuf);
+
+        return !strbuf->size ? -EOVERFLOW : 0;
+}
+
+static int
+brcmf_c_doiovar(struct brcmf_pub *drvr, const struct brcmu_iovar *vi,
+                u32 actionid, const char *name, void *params, int plen,
+                void *arg, int len, int val_size)
+{
+        int bcmerror = 0;
+        s32 int_val = 0;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        bcmerror = brcmu_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid));
+        if (bcmerror != 0)
+                goto exit;
+
+        if (plen >= (int)sizeof(int_val))
+                memcpy(&int_val, params, sizeof(int_val));
+
+        switch (actionid) {
+        case IOV_GVAL(IOV_VERSION):
+                /* Need to have checked buffer length */
+                strncpy((char *)arg, brcmf_version, len);
+                break;
+
+        case IOV_GVAL(IOV_MSGLEVEL):
+                int_val = (s32) brcmf_msg_level;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_MSGLEVEL):
+                brcmf_msg_level = int_val;
+                break;
+
+        case IOV_GVAL(IOV_BCMERRORSTR):
+                strncpy((char *)arg, "bcm_error",
+                        BCME_STRLEN);
+                ((char *)arg)[BCME_STRLEN - 1] = 0x00;
+                break;
+
+        case IOV_GVAL(IOV_BCMERROR):
+                int_val = (s32) drvr->bcmerror;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_GVAL(IOV_DUMP):
+                bcmerror = brcmf_c_dump(drvr, arg, len);
+                break;
+
+        case IOV_SVAL(IOV_CLEARCOUNTS):
+                drvr->tx_packets = drvr->rx_packets = 0;
+                drvr->tx_errors = drvr->rx_errors = 0;
+                drvr->tx_ctlpkts = drvr->rx_ctlpkts = 0;
+                drvr->tx_ctlerrs = drvr->rx_ctlerrs = 0;
+                drvr->rx_dropped = 0;
+                drvr->rx_readahead_cnt = 0;
+                drvr->tx_realloc = 0;
+                drvr->wd_dpc_sched = 0;
+                memset(&drvr->dstats, 0, sizeof(drvr->dstats));
+                brcmf_bus_clearcounts(drvr);
+                break;
+
+        case IOV_GVAL(IOV_IOCTLTIMEOUT):{
+                        int_val = (s32) brcmf_os_get_ioctl_resp_timeout();
+                        memcpy(arg, &int_val, sizeof(int_val));
+                        break;
+                }
+
+        case IOV_SVAL(IOV_IOCTLTIMEOUT):{
+                        if (int_val <= 0)
+                                bcmerror = -EINVAL;
+                        else
+                                brcmf_os_set_ioctl_resp_timeout((unsigned int)
+                                                              int_val);
+                        break;
+                }
+
+        default:
+                bcmerror = -ENOTSUPP;
+                break;
+        }
+
+exit:
+        return bcmerror;
+}
+
+bool brcmf_c_prec_enq(struct brcmf_pub *drvr, struct pktq *q,
+                      struct sk_buff *pkt, int prec)
+{
+        struct sk_buff *p;
+        int eprec = -1;         /* precedence to evict from */
+        bool discard_oldest;
+
+        /* Fast case, precedence queue is not full and we are also not
+         * exceeding total queue length
+         */
+        if (!pktq_pfull(q, prec) && !pktq_full(q)) {
+                brcmu_pktq_penq(q, prec, pkt);
+                return true;
+        }
+
+        /* Determine precedence from which to evict packet, if any */
+        if (pktq_pfull(q, prec))
+                eprec = prec;
+        else if (pktq_full(q)) {
+                p = brcmu_pktq_peek_tail(q, &eprec);
+                if (eprec > prec)
+                        return false;
+        }
+
+        /* Evict if needed */
+        if (eprec >= 0) {
+                /* Detect queueing to unconfigured precedence */
+                discard_oldest = AC_BITMAP_TST(drvr->wme_dp, eprec);
+                if (eprec == prec && !discard_oldest)
+                        return false;   /* refuse newer (incoming) packet */
+                /* Evict packet according to discard policy */
+                p = discard_oldest ? brcmu_pktq_pdeq(q, eprec) :
+                        brcmu_pktq_pdeq_tail(q, eprec);
+                if (p == NULL) {
+                        BRCMF_ERROR(("%s: brcmu_pktq_penq() failed, oldest %d.",
+                                     __func__, discard_oldest));
+                }
+                brcmu_pkt_buf_free_skb(p);
+        }
+
+        /* Enqueue */
+        p = brcmu_pktq_penq(q, prec, pkt);
+        if (p == NULL) {
+                BRCMF_ERROR(("%s: brcmu_pktq_penq() failed.", __func__));
+        }
+
+        return p != NULL;
+}
+
+static int
+brcmf_c_iovar_op(struct brcmf_pub *drvr, const char *name,
+             void *params, int plen, void *arg, int len, bool set)
+{
+        int bcmerror = 0;
+        int val_size;
+        const struct brcmu_iovar *vi = NULL;
+        u32 actionid;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (name == NULL || len <= 0)
+                return -EINVAL;
+
+        /* Set does not take qualifiers */
+        if (set && (params || plen))
+                return -EINVAL;
+
+        /* Get must have return space;*/
+        if (!set && !(arg && len))
+                return -EINVAL;
+
+        vi = brcmu_iovar_lookup(brcmf_iovars, name);
+        if (vi == NULL) {
+                bcmerror = -ENOTSUPP;
+                goto exit;
+        }
+
+        BRCMF_CTL(("%s: %s %s, len %d plen %d\n", __func__,
+                   name, (set ? "set" : "get"), len, plen));
+
+        /* set up 'params' pointer in case this is a set command so that
+         * the convenience int and bool code can be common to set and get
+         */
+        if (params == NULL) {
+                params = arg;
+                plen = len;
+        }
+
+        if (vi->type == IOVT_VOID)
+                val_size = 0;
+        else if (vi->type == IOVT_BUFFER)
+                val_size = len;
+        else
+                /* all other types are integer sized */
+                val_size = sizeof(int);
+
+        actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+        bcmerror =
+            brcmf_c_doiovar(drvr, vi, actionid, name, params, plen, arg, len,
+                        val_size);
+
+exit:
+        return bcmerror;
+}
+
+int brcmf_c_ioctl(struct brcmf_pub *drvr, struct brcmf_c_ioctl *ioc, void *buf,
+                  uint buflen)
+{
+        int bcmerror = 0;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (!buf)
+                return -EINVAL;
+
+        switch (ioc->cmd) {
+        case BRCMF_GET_MAGIC:
+                if (buflen < sizeof(int))
+                        bcmerror = -EOVERFLOW;
+                else
+                        *(int *)buf = BRCMF_IOCTL_MAGIC;
+                break;
+
+        case BRCMF_GET_VERSION:
+                if (buflen < sizeof(int))
+                        bcmerror = -EOVERFLOW;
+                else
+                        *(int *)buf = BRCMF_IOCTL_VERSION;
+                break;
+
+        case BRCMF_GET_VAR:
+        case BRCMF_SET_VAR:{
+                        char *arg;
+                        uint arglen;
+
+                        /* scan past the name to any arguments */
+                        for (arg = buf, arglen = buflen; *arg && arglen;
+                             arg++, arglen--)
+                                ;
+
+                        if (*arg) {
+                                bcmerror = -EOVERFLOW;
+                                break;
+                        }
+
+                        /* account for the NUL terminator */
+                        arg++, arglen--;
+
+                        /* call with the appropriate arguments */
+                        if (ioc->cmd == BRCMF_GET_VAR)
+                                bcmerror = brcmf_c_iovar_op(drvr, buf, arg,
+                                                arglen, buf, buflen, IOV_GET);
+                        else
+                                bcmerror =
+                                    brcmf_c_iovar_op(drvr, buf, NULL, 0, arg,
+                                                     arglen, IOV_SET);
+                        if (bcmerror != -ENOTSUPP)
+                                break;
+
+                        /* if still not found, try bus module */
+                        if (ioc->cmd == BRCMF_GET_VAR)
+                                bcmerror = brcmf_sdbrcm_bus_iovar_op(drvr,
+                                                buf, arg, arglen, buf, buflen,
+                                                IOV_GET);
+                        else
+                                bcmerror = brcmf_sdbrcm_bus_iovar_op(drvr,
+                                                buf, NULL, 0, arg, arglen,
+                                                IOV_SET);
+
+                        break;
+                }
+
+        default:
+                bcmerror = -ENOTSUPP;
+        }
+
+        return bcmerror;
+}
+
+#ifdef SHOW_EVENTS
+static void
+brcmf_c_show_host_event(struct brcmf_event_msg *event, void *event_data)
+{
+        uint i, status, reason;
+        bool group = false, flush_txq = false, link = false;
+        char *auth_str, *event_name;
+        unsigned char *buf;
+        char err_msg[256], eabuf[ETHER_ADDR_STR_LEN];
+        static struct {
+                uint event;
+                char *event_name;
+        } event_names[] = {
+                {
+                BRCMF_E_SET_SSID, "SET_SSID"}, {
+                BRCMF_E_JOIN, "JOIN"}, {
+                BRCMF_E_START, "START"}, {
+                BRCMF_E_AUTH, "AUTH"}, {
+                BRCMF_E_AUTH_IND, "AUTH_IND"}, {
+                BRCMF_E_DEAUTH, "DEAUTH"}, {
+                BRCMF_E_DEAUTH_IND, "DEAUTH_IND"}, {
+                BRCMF_E_ASSOC, "ASSOC"}, {
+                BRCMF_E_ASSOC_IND, "ASSOC_IND"}, {
+                BRCMF_E_REASSOC, "REASSOC"}, {
+                BRCMF_E_REASSOC_IND, "REASSOC_IND"}, {
+                BRCMF_E_DISASSOC, "DISASSOC"}, {
+                BRCMF_E_DISASSOC_IND, "DISASSOC_IND"}, {
+                BRCMF_E_QUIET_START, "START_QUIET"}, {
+                BRCMF_E_QUIET_END, "END_QUIET"}, {
+                BRCMF_E_BEACON_RX, "BEACON_RX"}, {
+                BRCMF_E_LINK, "LINK"}, {
+                BRCMF_E_MIC_ERROR, "MIC_ERROR"}, {
+                BRCMF_E_NDIS_LINK, "NDIS_LINK"}, {
+                BRCMF_E_ROAM, "ROAM"}, {
+                BRCMF_E_TXFAIL, "TXFAIL"}, {
+                BRCMF_E_PMKID_CACHE, "PMKID_CACHE"}, {
+                BRCMF_E_RETROGRADE_TSF, "RETROGRADE_TSF"}, {
+                BRCMF_E_PRUNE, "PRUNE"}, {
+                BRCMF_E_AUTOAUTH, "AUTOAUTH"}, {
+                BRCMF_E_EAPOL_MSG, "EAPOL_MSG"}, {
+                BRCMF_E_SCAN_COMPLETE, "SCAN_COMPLETE"}, {
+                BRCMF_E_ADDTS_IND, "ADDTS_IND"}, {
+                BRCMF_E_DELTS_IND, "DELTS_IND"}, {
+                BRCMF_E_BCNSENT_IND, "BCNSENT_IND"}, {
+                BRCMF_E_BCNRX_MSG, "BCNRX_MSG"}, {
+                BRCMF_E_BCNLOST_MSG, "BCNLOST_MSG"}, {
+                BRCMF_E_ROAM_PREP, "ROAM_PREP"}, {
+                BRCMF_E_PFN_NET_FOUND, "PNO_NET_FOUND"}, {
+                BRCMF_E_PFN_NET_LOST, "PNO_NET_LOST"}, {
+                BRCMF_E_RESET_COMPLETE, "RESET_COMPLETE"}, {
+                BRCMF_E_JOIN_START, "JOIN_START"}, {
+                BRCMF_E_ROAM_START, "ROAM_START"}, {
+                BRCMF_E_ASSOC_START, "ASSOC_START"}, {
+                BRCMF_E_IBSS_ASSOC, "IBSS_ASSOC"}, {
+                BRCMF_E_RADIO, "RADIO"}, {
+                BRCMF_E_PSM_WATCHDOG, "PSM_WATCHDOG"}, {
+                BRCMF_E_PROBREQ_MSG, "PROBREQ_MSG"}, {
+                BRCMF_E_SCAN_CONFIRM_IND, "SCAN_CONFIRM_IND"}, {
+                BRCMF_E_PSK_SUP, "PSK_SUP"}, {
+                BRCMF_E_COUNTRY_CODE_CHANGED, "COUNTRY_CODE_CHANGED"}, {
+                BRCMF_E_EXCEEDED_MEDIUM_TIME, "EXCEEDED_MEDIUM_TIME"}, {
+                BRCMF_E_ICV_ERROR, "ICV_ERROR"}, {
+                BRCMF_E_UNICAST_DECODE_ERROR, "UNICAST_DECODE_ERROR"}, {
+                BRCMF_E_MULTICAST_DECODE_ERROR, "MULTICAST_DECODE_ERROR"}, {
+                BRCMF_E_TRACE, "TRACE"}, {
+                BRCMF_E_ACTION_FRAME, "ACTION FRAME"}, {
+                BRCMF_E_ACTION_FRAME_COMPLETE, "ACTION FRAME TX COMPLETE"}, {
+                BRCMF_E_IF, "IF"}, {
+                BRCMF_E_RSSI, "RSSI"}, {
+                BRCMF_E_PFN_SCAN_COMPLETE, "SCAN_COMPLETE"}
+        };
+        uint event_type, flags, auth_type, datalen;
+        event_type = be32_to_cpu(event->event_type);
+        flags = be16_to_cpu(event->flags);
+        status = be32_to_cpu(event->status);
+        reason = be32_to_cpu(event->reason);
+        auth_type = be32_to_cpu(event->auth_type);
+        datalen = be32_to_cpu(event->datalen);
+        /* debug dump of event messages */
+        sprintf(eabuf, "%pM", event->addr);
+
+        event_name = "UNKNOWN";
+        for (i = 0; i < ARRAY_SIZE(event_names); i++) {
+                if (event_names[i].event == event_type)
+                        event_name = event_names[i].event_name;
+        }
+
+        BRCMF_EVENT(("EVENT: %s, event ID = %d\n", event_name, event_type));
+        BRCMF_EVENT(("flags 0x%04x, status %d, reason %d, auth_type %d"
+                     " MAC %s\n", flags, status, reason, auth_type, eabuf));
+
+        if (flags & BRCMF_EVENT_MSG_LINK)
+                link = true;
+        if (flags & BRCMF_EVENT_MSG_GROUP)
+                group = true;
+        if (flags & BRCMF_EVENT_MSG_FLUSHTXQ)
+                flush_txq = true;
+
+        switch (event_type) {
+        case BRCMF_E_START:
+        case BRCMF_E_DEAUTH:
+        case BRCMF_E_DISASSOC:
+                BRCMF_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+                break;
+
+        case BRCMF_E_ASSOC_IND:
+        case BRCMF_E_REASSOC_IND:
+                BRCMF_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+                break;
+
+        case BRCMF_E_ASSOC:
+        case BRCMF_E_REASSOC:
+                if (status == BRCMF_E_STATUS_SUCCESS) {
+                        BRCMF_EVENT(("MACEVENT: %s, MAC %s, SUCCESS\n",
+                                     event_name, eabuf));
+                } else if (status == BRCMF_E_STATUS_TIMEOUT) {
+                        BRCMF_EVENT(("MACEVENT: %s, MAC %s, TIMEOUT\n",
+                                     event_name, eabuf));
+                } else if (status == BRCMF_E_STATUS_FAIL) {
+                        BRCMF_EVENT(("MACEVENT: %s, MAC %s, FAILURE,"
+                                     " reason %d\n", event_name, eabuf,
+                                     (int)reason));
+                } else {
+                        BRCMF_EVENT(("MACEVENT: %s, MAC %s, unexpected status "
+                                     "%d\n", event_name, eabuf, (int)status));
+                }
+                break;
+
+        case BRCMF_E_DEAUTH_IND:
+        case BRCMF_E_DISASSOC_IND:
+                BRCMF_EVENT(("MACEVENT: %s, MAC %s, reason %d\n", event_name,
+                             eabuf, (int)reason));
+                break;
+
+        case BRCMF_E_AUTH:
+        case BRCMF_E_AUTH_IND:
+                if (auth_type == WLAN_AUTH_OPEN)
+                        auth_str = "Open System";
+                else if (auth_type == WLAN_AUTH_SHARED_KEY)
+                        auth_str = "Shared Key";
+                else {
+                        sprintf(err_msg, "AUTH unknown: %d", (int)auth_type);
+                        auth_str = err_msg;
+                }
+                if (event_type == BRCMF_E_AUTH_IND) {
+                        BRCMF_EVENT(("MACEVENT: %s, MAC %s, %s\n", event_name,
+                                     eabuf, auth_str));
+                } else if (status == BRCMF_E_STATUS_SUCCESS) {
+                        BRCMF_EVENT(("MACEVENT: %s, MAC %s, %s, SUCCESS\n",
+                                     event_name, eabuf, auth_str));
+                } else if (status == BRCMF_E_STATUS_TIMEOUT) {
+                        BRCMF_EVENT(("MACEVENT: %s, MAC %s, %s, TIMEOUT\n",
+                                     event_name, eabuf, auth_str));
+                } else if (status == BRCMF_E_STATUS_FAIL) {
+                        BRCMF_EVENT(("MACEVENT: %s, MAC %s, %s, FAILURE, "
+                                     "reason %d\n",
+                                     event_name, eabuf, auth_str, (int)reason));
+                }
+
+                break;
+
+        case BRCMF_E_JOIN:
+        case BRCMF_E_ROAM:
+        case BRCMF_E_SET_SSID:
+                if (status == BRCMF_E_STATUS_SUCCESS) {
+                        BRCMF_EVENT(("MACEVENT: %s, MAC %s\n", event_name,
+                                     eabuf));
+                } else if (status == BRCMF_E_STATUS_FAIL) {
+                        BRCMF_EVENT(("MACEVENT: %s, failed\n", event_name));
+                } else if (status == BRCMF_E_STATUS_NO_NETWORKS) {
+                        BRCMF_EVENT(("MACEVENT: %s, no networks found\n",
+                                     event_name));
+                } else {
+                        BRCMF_EVENT(("MACEVENT: %s, unexpected status %d\n",
+                                     event_name, (int)status));
+                }
+                break;
+
+        case BRCMF_E_BEACON_RX:
+                if (status == BRCMF_E_STATUS_SUCCESS) {
+                        BRCMF_EVENT(("MACEVENT: %s, SUCCESS\n", event_name));
+                } else if (status == BRCMF_E_STATUS_FAIL) {
+                        BRCMF_EVENT(("MACEVENT: %s, FAIL\n", event_name));
+                } else {
+                        BRCMF_EVENT(("MACEVENT: %s, status %d\n", event_name,
+                                     status));
+                }
+                break;
+
+        case BRCMF_E_LINK:
+                BRCMF_EVENT(("MACEVENT: %s %s\n", event_name,
+                             link ? "UP" : "DOWN"));
+                break;
+
+        case BRCMF_E_MIC_ERROR:
+                BRCMF_EVENT(("MACEVENT: %s, MAC %s, Group %d, Flush %d\n",
+                             event_name, eabuf, group, flush_txq));
+                break;
+
+        case BRCMF_E_ICV_ERROR:
+        case BRCMF_E_UNICAST_DECODE_ERROR:
+        case BRCMF_E_MULTICAST_DECODE_ERROR:
+                BRCMF_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+                break;
+
+        case BRCMF_E_TXFAIL:
+                BRCMF_EVENT(("MACEVENT: %s, RA %s\n", event_name, eabuf));
+                break;
+
+        case BRCMF_E_SCAN_COMPLETE:
+        case BRCMF_E_PMKID_CACHE:
+                BRCMF_EVENT(("MACEVENT: %s\n", event_name));
+                break;
+
+        case BRCMF_E_PFN_NET_FOUND:
+        case BRCMF_E_PFN_NET_LOST:
+        case BRCMF_E_PFN_SCAN_COMPLETE:
+                BRCMF_EVENT(("PNOEVENT: %s\n", event_name));
+                break;
+
+        case BRCMF_E_PSK_SUP:
+        case BRCMF_E_PRUNE:
+                BRCMF_EVENT(("MACEVENT: %s, status %d, reason %d\n",
+                           event_name, (int)status, (int)reason));
+                break;
+
+        case BRCMF_E_TRACE:
+                {
+                        static u32 seqnum_prev;
+                        struct msgtrace_hdr hdr;
+                        u32 nblost;
+                        char *s, *p;
+
+                        buf = (unsigned char *) event_data;
+                        memcpy(&hdr, buf, sizeof(struct msgtrace_hdr));
+
+                        if (hdr.version != MSGTRACE_VERSION) {
+                                BRCMF_ERROR(
+                                    ("\nMACEVENT: %s [unsupported version --> "
+                                     "brcmf version:%d dongle version:%d]\n",
+                                     event_name, MSGTRACE_VERSION, hdr.version)
+                                );
+                                /* Reset datalen to avoid display below */
+                                datalen = 0;
+                                break;
+                        }
+
+                        /* There are 2 bytes available at the end of data */
+                        *(buf + sizeof(struct msgtrace_hdr)
+                                 + be16_to_cpu(hdr.len)) = '\0';
+
+                        if (be32_to_cpu(hdr.discarded_bytes)
+                            || be32_to_cpu(hdr.discarded_printf)) {
+                                BRCMF_ERROR(
+                                    ("\nWLC_E_TRACE: [Discarded traces in dongle -->"
+                                     "discarded_bytes %d discarded_printf %d]\n",
+                                     be32_to_cpu(hdr.discarded_bytes),
+                                     be32_to_cpu(hdr.discarded_printf)));
+                        }
+
+                        nblost = be32_to_cpu(hdr.seqnum) - seqnum_prev - 1;
+                        if (nblost > 0) {
+                                BRCMF_ERROR(
+                                    ("\nWLC_E_TRACE: [Event lost --> seqnum %d nblost %d\n",
+                                     be32_to_cpu(hdr.seqnum), nblost));
+                        }
+                        seqnum_prev = be32_to_cpu(hdr.seqnum);
+
+                        /* Display the trace buffer. Advance from \n to \n to
+                         * avoid display big
+                         * printf (issue with Linux printk )
+                         */
+                        p = (char *)&buf[sizeof(struct msgtrace_hdr)];
+                        while ((s = strstr(p, "\n")) != NULL) {
+                                *s = '\0';
+                                printk(KERN_DEBUG"%s\n", p);
+                                p = s + 1;
+                        }
+                        printk(KERN_DEBUG "%s\n", p);
+
+                        /* Reset datalen to avoid display below */
+                        datalen = 0;
+                }
+                break;
+
+        case BRCMF_E_RSSI:
+                BRCMF_EVENT(("MACEVENT: %s %d\n", event_name,
+                             be32_to_cpu(*((int *)event_data))));
+                break;
+
+        default:
+                BRCMF_EVENT(("MACEVENT: %s %d, MAC %s, status %d, reason %d, "
+                             "auth %d\n", event_name, event_type, eabuf,
+                             (int)status, (int)reason, (int)auth_type));
+                break;
+        }
+
+        /* show any appended data */
+        if (datalen) {
+                buf = (unsigned char *) event_data;
+                BRCMF_EVENT((" data (%d) : ", datalen));
+                for (i = 0; i < datalen; i++)
+                        BRCMF_EVENT((" 0x%02x ", *buf++));
+                BRCMF_EVENT(("\n"));
+        }
+}
+#endif                          /* SHOW_EVENTS */
+
+int
+brcmf_c_host_event(struct brcmf_info *drvr_priv, int *ifidx, void *pktdata,
+                   struct brcmf_event_msg *event, void **data_ptr)
+{
+        /* check whether packet is a BRCM event pkt */
+        struct brcmf_event *pvt_data = (struct brcmf_event *) pktdata;
+        char *event_data;
+        u32 type, status;
+        u16 flags;
+        int evlen;
+
+        if (memcmp(BRCM_OUI, &pvt_data->hdr.oui[0], DOT11_OUI_LEN)) {
+                BRCMF_ERROR(("%s: mismatched OUI, bailing\n", __func__));
+                return -EBADE;
+        }
+
+        /* BRCM event pkt may be unaligned - use xxx_ua to load user_subtype. */
+        if (get_unaligned_be16(&pvt_data->hdr.usr_subtype) !=
+            BCMILCP_BCM_SUBTYPE_EVENT) {
+                BRCMF_ERROR(("%s: mismatched subtype, bailing\n", __func__));
+                return -EBADE;
+        }
+
+        *data_ptr = &pvt_data[1];
+        event_data = *data_ptr;
+
+        /* memcpy since BRCM event pkt may be unaligned. */
+        memcpy(event, &pvt_data->msg, sizeof(struct brcmf_event_msg));
+
+        type = get_unaligned_be32(&event->event_type);
+        flags = get_unaligned_be16(&event->flags);
+        status = get_unaligned_be32(&event->status);
+        evlen = get_unaligned_be32(&event->datalen) +
+                sizeof(struct brcmf_event);
+
+        switch (type) {
+        case BRCMF_E_IF:
+                {
+                        struct brcmf_if_event *ifevent =
+                                        (struct brcmf_if_event *) event_data;
+                        BRCMF_TRACE(("%s: if event\n", __func__));
+
+                        if (ifevent->ifidx > 0 &&
+                                 ifevent->ifidx < BRCMF_MAX_IFS) {
+                                if (ifevent->action == BRCMF_E_IF_ADD)
+                                        brcmf_add_if(drvr_priv, ifevent->ifidx,
+                                                   NULL, event->ifname,
+                                                   pvt_data->eth.h_dest,
+                                                   ifevent->flags,
+                                                   ifevent->bssidx);
+                                else
+                                        brcmf_del_if(drvr_priv, ifevent->ifidx);
+                        } else {
+                                BRCMF_ERROR(("%s: Invalid ifidx %d for %s\n",
+                                             __func__, ifevent->ifidx,
+                                             event->ifname));
+                        }
+                }
+                /* send up the if event: btamp user needs it */
+                *ifidx = brcmf_ifname2idx(drvr_priv, event->ifname);
+                break;
+
+                /* These are what external supplicant/authenticator wants */
+        case BRCMF_E_LINK:
+        case BRCMF_E_ASSOC_IND:
+        case BRCMF_E_REASSOC_IND:
+        case BRCMF_E_DISASSOC_IND:
+        case BRCMF_E_MIC_ERROR:
+        default:
+                /* Fall through: this should get _everything_  */
+
+                *ifidx = brcmf_ifname2idx(drvr_priv, event->ifname);
+                BRCMF_TRACE(("%s: MAC event %d, flags %x, status %x\n",
+                             __func__, type, flags, status));
+
+                /* put it back to BRCMF_E_NDIS_LINK */
+                if (type == BRCMF_E_NDIS_LINK) {
+                        u32 temp;
+
+                        temp = get_unaligned_be32(&event->event_type);
+                        BRCMF_TRACE(("Converted to WLC_E_LINK type %d\n",
+                                     temp));
+
+                        temp = be32_to_cpu(BRCMF_E_NDIS_LINK);
+                        memcpy((void *)(&pvt_data->msg.event_type), &temp,
+                               sizeof(pvt_data->msg.event_type));
+                }
+                break;
+        }
+
+#ifdef SHOW_EVENTS
+        brcmf_c_show_host_event(event, event_data);
+#endif                          /* SHOW_EVENTS */
+
+        return 0;
+}
+
+/* Convert user's input in hex pattern to byte-size mask */
+static int brcmf_c_pattern_atoh(char *src, char *dst)
+{
+        int i;
+        if (strncmp(src, "0x", 2) != 0 && strncmp(src, "0X", 2) != 0) {
+                BRCMF_ERROR(("Mask invalid format. Needs to start with 0x\n"));
+                return -1;
+        }
+        src = src + 2;          /* Skip past 0x */
+        if (strlen(src) % 2 != 0) {
+                BRCMF_ERROR(("Mask invalid format. Length must be even.\n"));
+                return -1;
+        }
+        for (i = 0; *src != '\0'; i++) {
+                char num[3];
+                strncpy(num, src, 2);
+                num[2] = '\0';
+                dst[i] = (u8) simple_strtoul(num, NULL, 16);
+                src += 2;
+        }
+        return i;
+}
+
+void
+brcmf_c_pktfilter_offload_enable(struct brcmf_pub *drvr, char *arg, int enable,
+                             int master_mode)
+{
+        char *argv[8];
+        int i = 0;
+        const char *str;
+        int buf_len;
+        int str_len;
+        char *arg_save = 0, *arg_org = 0;
+        int rc;
+        char buf[128];
+        struct brcmf_pkt_filter_enable enable_parm;
+        struct brcmf_pkt_filter_enable *pkt_filterp;
+
+        arg_save = kmalloc(strlen(arg) + 1, GFP_ATOMIC);
+        if (!arg_save) {
+                BRCMF_ERROR(("%s: kmalloc failed\n", __func__));
+                goto fail;
+        }
+        arg_org = arg_save;
+        memcpy(arg_save, arg, strlen(arg) + 1);
+
+        argv[i] = strsep(&arg_save, " ");
+
+        i = 0;
+        if (NULL == argv[i]) {
+                BRCMF_ERROR(("No args provided\n"));
+                goto fail;
+        }
+
+        str = "pkt_filter_enable";
+        str_len = strlen(str);
+        strncpy(buf, str, str_len);
+        buf[str_len] = '\0';
+        buf_len = str_len + 1;
+
+        pkt_filterp = (struct brcmf_pkt_filter_enable *) (buf + str_len + 1);
+
+        /* Parse packet filter id. */
+        enable_parm.id = simple_strtoul(argv[i], NULL, 0);
+
+        /* Parse enable/disable value. */
+        enable_parm.enable = enable;
+
+        buf_len += sizeof(enable_parm);
+        memcpy((char *)pkt_filterp, &enable_parm, sizeof(enable_parm));
+
+        /* Enable/disable the specified filter. */
+        rc = brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR, buf, buf_len);
+        rc = rc >= 0 ? 0 : rc;
+        if (rc)
+                BRCMF_TRACE(("%s: failed to add pktfilter %s, retcode = %d\n",
+                             __func__, arg, rc));
+        else
+                BRCMF_TRACE(("%s: successfully added pktfilter %s\n",
+                             __func__, arg));
+
+        /* Contorl the master mode */
+        brcmu_mkiovar("pkt_filter_mode", (char *)&master_mode, 4, buf,
+                    sizeof(buf));
+        rc = brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR, buf,
+                                       sizeof(buf));
+        rc = rc >= 0 ? 0 : rc;
+        if (rc)
+                BRCMF_TRACE(("%s: failed to add pktfilter %s, retcode = %d\n",
+                             __func__, arg, rc));
+
+fail:
+        kfree(arg_org);
+}
+
+void brcmf_c_pktfilter_offload_set(struct brcmf_pub *drvr, char *arg)
+{
+        const char *str;
+        struct brcmf_pkt_filter pkt_filter;
+        struct brcmf_pkt_filter *pkt_filterp;
+        int buf_len;
+        int str_len;
+        int rc;
+        u32 mask_size;
+        u32 pattern_size;
+        char *argv[8], *buf = 0;
+        int i = 0;
+        char *arg_save = 0, *arg_org = 0;
+
+        arg_save = kmalloc(strlen(arg) + 1, GFP_ATOMIC);
+        if (!arg_save) {
+                BRCMF_ERROR(("%s: kmalloc failed\n", __func__));
+                goto fail;
+        }
+
+        arg_org = arg_save;
+
+        buf = kmalloc(PKTFILTER_BUF_SIZE, GFP_ATOMIC);
+        if (!buf) {
+                BRCMF_ERROR(("%s: kmalloc failed\n", __func__));
+                goto fail;
+        }
+
+        strcpy(arg_save, arg);
+
+        argv[i] = strsep(&arg_save, " ");
+        while (argv[i++])
+                argv[i] = strsep(&arg_save, " ");
+
+        i = 0;
+        if (NULL == argv[i]) {
+                BRCMF_ERROR(("No args provided\n"));
+                goto fail;
+        }
+
+        str = "pkt_filter_add";
+        strcpy(buf, str);
+        str_len = strlen(str);
+        buf_len = str_len + 1;
+
+        pkt_filterp = (struct brcmf_pkt_filter *) (buf + str_len + 1);
+
+        /* Parse packet filter id. */
+        pkt_filter.id = simple_strtoul(argv[i], NULL, 0);
+
+        if (NULL == argv[++i]) {
+                BRCMF_ERROR(("Polarity not provided\n"));
+                goto fail;
+        }
+
+        /* Parse filter polarity. */
+        pkt_filter.negate_match = simple_strtoul(argv[i], NULL, 0);
+
+        if (NULL == argv[++i]) {
+                BRCMF_ERROR(("Filter type not provided\n"));
+                goto fail;
+        }
+
+        /* Parse filter type. */
+        pkt_filter.type = simple_strtoul(argv[i], NULL, 0);
+
+        if (NULL == argv[++i]) {
+                BRCMF_ERROR(("Offset not provided\n"));
+                goto fail;
+        }
+
+        /* Parse pattern filter offset. */
+        pkt_filter.u.pattern.offset = simple_strtoul(argv[i], NULL, 0);
+
+        if (NULL == argv[++i]) {
+                BRCMF_ERROR(("Bitmask not provided\n"));
+                goto fail;
+        }
+
+        /* Parse pattern filter mask. */
+        mask_size =
+            brcmf_c_pattern_atoh
+                   (argv[i], (char *)pkt_filterp->u.pattern.mask_and_pattern);
+
+        if (NULL == argv[++i]) {
+                BRCMF_ERROR(("Pattern not provided\n"));
+                goto fail;
+        }
+
+        /* Parse pattern filter pattern. */
+        pattern_size =
+            brcmf_c_pattern_atoh(argv[i],
+                                   (char *)&pkt_filterp->u.pattern.
+                                   mask_and_pattern[mask_size]);
+
+        if (mask_size != pattern_size) {
+                BRCMF_ERROR(("Mask and pattern not the same size\n"));
+                goto fail;
+        }
+
+        pkt_filter.u.pattern.size_bytes = mask_size;
+        buf_len += BRCMF_PKT_FILTER_FIXED_LEN;
+        buf_len += (BRCMF_PKT_FILTER_PATTERN_FIXED_LEN + 2 * mask_size);
+
+        /* Keep-alive attributes are set in local
+         * variable (keep_alive_pkt), and
+         ** then memcpy'ed into buffer (keep_alive_pktp) since there is no
+         ** guarantee that the buffer is properly aligned.
+         */
+        memcpy((char *)pkt_filterp,
+               &pkt_filter,
+               BRCMF_PKT_FILTER_FIXED_LEN + BRCMF_PKT_FILTER_PATTERN_FIXED_LEN);
+
+        rc = brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR, buf, buf_len);
+        rc = rc >= 0 ? 0 : rc;
+
+        if (rc)
+                BRCMF_TRACE(("%s: failed to add pktfilter %s, retcode = %d\n",
+                             __func__, arg, rc));
+        else
+                BRCMF_TRACE(("%s: successfully added pktfilter %s\n",
+                             __func__, arg));
+
+fail:
+        kfree(arg_org);
+
+        kfree(buf);
+}
+
+void brcmf_c_arp_offload_set(struct brcmf_pub *drvr, int arp_mode)
+{
+        char iovbuf[32];
+        int retcode;
+
+        brcmu_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
+        retcode = brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR,
+                                   iovbuf, sizeof(iovbuf));
+        retcode = retcode >= 0 ? 0 : retcode;
+        if (retcode)
+                BRCMF_TRACE(("%s: failed to set ARP offload mode to 0x%x, "
+                             "retcode = %d\n", __func__, arp_mode, retcode));
+        else
+                BRCMF_TRACE(("%s: successfully set ARP offload mode to 0x%x\n",
+                             __func__, arp_mode));
+}
+
+void brcmf_c_arp_offload_enable(struct brcmf_pub *drvr, int arp_enable)
+{
+        char iovbuf[32];
+        int retcode;
+
+        brcmu_mkiovar("arpoe", (char *)&arp_enable, 4, iovbuf, sizeof(iovbuf));
+        retcode = brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR,
+                                   iovbuf, sizeof(iovbuf));
+        retcode = retcode >= 0 ? 0 : retcode;
+        if (retcode)
+                BRCMF_TRACE(("%s: failed to enabe ARP offload to %d, "
+                             "retcode = %d\n", __func__, arp_enable, retcode));
+        else
+                BRCMF_TRACE(("%s: successfully enabed ARP offload to %d\n",
+                             __func__, arp_enable));
+}
+
+int brcmf_c_preinit_ioctls(struct brcmf_pub *drvr)
+{
+        char iovbuf[BRCMF_EVENTING_MASK_LEN + 12];      /*  Room for
+                                 "event_msgs" + '\0' + bitvec  */
+        uint up = 0;
+        char buf[128], *ptr;
+        uint power_mode = PM_FAST;
+        u32 dongle_align = BRCMF_SDALIGN;
+        u32 glom = 0;
+        uint bcn_timeout = 3;
+        int scan_assoc_time = 40;
+        int scan_unassoc_time = 40;
+        int i;
+
+        brcmf_os_proto_block(drvr);
+
+        /* Set Country code */
+        if (drvr->country_code[0] != 0) {
+                if (brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_COUNTRY,
+                                     drvr->country_code,
+                                     sizeof(drvr->country_code)) < 0) {
+                        BRCMF_ERROR(("%s: country code setting failed\n",
+                                     __func__));
+                }
+        }
+
+        /* query for 'ver' to get version info from firmware */
+        memset(buf, 0, sizeof(buf));
+        ptr = buf;
+        brcmu_mkiovar("ver", 0, 0, buf, sizeof(buf));
+        brcmf_proto_cdc_query_ioctl(drvr, 0, BRCMF_C_GET_VAR, buf, sizeof(buf));
+        strsep(&ptr, "\n");
+        /* Print fw version info */
+        BRCMF_ERROR(("Firmware version = %s\n", buf));
+
+        /* Set PowerSave mode */
+        brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_PM, (char *)&power_mode,
+                         sizeof(power_mode));
+
+        /* Match Host and Dongle rx alignment */
+        brcmu_mkiovar("bus:txglomalign", (char *)&dongle_align, 4, iovbuf,
+                    sizeof(iovbuf));
+        brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
+                                  sizeof(iovbuf));
+
+        /* disable glom option per default */
+        brcmu_mkiovar("bus:txglom", (char *)&glom, 4, iovbuf, sizeof(iovbuf));
+        brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
+                                  sizeof(iovbuf));
+
+        /* Setup timeout if Beacons are lost and roam is off to report
+                 link down */
+        brcmu_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf,
+                    sizeof(iovbuf));
+        brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
+                                  sizeof(iovbuf));
+
+        /* Enable/Disable build-in roaming to allowed ext supplicant to take
+                 of romaing */
+        brcmu_mkiovar("roam_off", (char *)&brcmf_roam, 4,
+                      iovbuf, sizeof(iovbuf));
+        brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
+                                  sizeof(iovbuf));
+
+        /* Force STA UP */
+        if (brcmf_radio_up)
+                brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_UP, (char *)&up,
+                                          sizeof(up));
+
+        /* Setup event_msgs */
+        brcmu_mkiovar("event_msgs", drvr->eventmask, BRCMF_EVENTING_MASK_LEN,
+                      iovbuf, sizeof(iovbuf));
+        brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
+                                  sizeof(iovbuf));
+
+        brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+                         (char *)&scan_assoc_time, sizeof(scan_assoc_time));
+        brcmf_proto_cdc_set_ioctl(drvr, 0, BRCMF_C_SET_SCAN_UNASSOC_TIME,
+                         (char *)&scan_unassoc_time, sizeof(scan_unassoc_time));
+
+        /* Set and enable ARP offload feature */
+        if (brcmf_arp_enable)
+                brcmf_c_arp_offload_set(drvr, brcmf_arp_mode);
+        brcmf_c_arp_offload_enable(drvr, brcmf_arp_enable);
+
+        /* Set up pkt filter */
+        if (brcmf_pkt_filter_enable) {
+                for (i = 0; i < drvr->pktfilter_count; i++) {
+                        brcmf_c_pktfilter_offload_set(drvr,
+                                                  drvr->pktfilter[i]);
+                        brcmf_c_pktfilter_offload_enable(drvr,
+                             drvr->pktfilter[i],
+                             brcmf_pkt_filter_init,
+                             brcmf_master_mode);
+                }
+        }
+
+        brcmf_os_proto_unblock(drvr);
+
+        return 0;
+}
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_dbg.h b/drivers/staging/brcm80211/brcmfmac/dhd_dbg.h
new file mode 100644
index 00000000000..5be4d7a609c
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_dbg.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _BRCMF_DBG_H_
+#define _BRCMF_DBG_H_
+
+#if defined(BCMDBG)
+
+#define BRCMF_ERROR(args) \
+        do {if ((brcmf_msg_level & BRCMF_ERROR_VAL) && (net_ratelimit())) \
+                printk args; } while (0)
+#define BRCMF_TRACE(args)       do {if (brcmf_msg_level & BRCMF_TRACE_VAL) \
+                                        printk args; } while (0)
+#define BRCMF_INFO(args)        do {if (brcmf_msg_level & BRCMF_INFO_VAL) \
+                                        printk args; } while (0)
+#define BRCMF_DATA(args)        do {if (brcmf_msg_level & BRCMF_DATA_VAL) \
+                                        printk args; } while (0)
+#define BRCMF_CTL(args)         do {if (brcmf_msg_level & BRCMF_CTL_VAL) \
+                                        printk args; } while (0)
+#define BRCMF_TIMER(args)       do {if (brcmf_msg_level & BRCMF_TIMER_VAL) \
+                                        printk args; } while (0)
+#define BRCMF_INTR(args)        do {if (brcmf_msg_level & BRCMF_INTR_VAL) \
+                                        printk args; } while (0)
+#define BRCMF_GLOM(args)        do {if (brcmf_msg_level & BRCMF_GLOM_VAL) \
+                                        printk args; } while (0)
+#define BRCMF_EVENT(args)       do {if (brcmf_msg_level & BRCMF_EVENT_VAL) \
+                                        printk args; } while (0)
+
+#define BRCMF_DATA_ON()         (brcmf_msg_level & BRCMF_DATA_VAL)
+#define BRCMF_CTL_ON()          (brcmf_msg_level & BRCMF_CTL_VAL)
+#define BRCMF_HDRS_ON()         (brcmf_msg_level & BRCMF_HDRS_VAL)
+#define BRCMF_BYTES_ON()        (brcmf_msg_level & BRCMF_BYTES_VAL)
+#define BRCMF_GLOM_ON()         (brcmf_msg_level & BRCMF_GLOM_VAL)
+
+#else   /* (defined BCMDBG) || (defined BCMDBG) */
+
+#define BRCMF_ERROR(args)  do {if (net_ratelimit()) printk args; } while (0)
+#define BRCMF_TRACE(args)
+#define BRCMF_INFO(args)
+#define BRCMF_DATA(args)
+#define BRCMF_CTL(args)
+#define BRCMF_TIMER(args)
+#define BRCMF_INTR(args)
+#define BRCMF_GLOM(args)
+#define BRCMF_EVENT(args)
+
+#define BRCMF_DATA_ON()         0
+#define BRCMF_CTL_ON()          0
+#define BRCMF_HDRS_ON()         0
+#define BRCMF_BYTES_ON()                0
+#define BRCMF_GLOM_ON()         0
+
+#endif                          /* defined(BCMDBG) */
+
+extern int brcmf_msg_level;
+
+#endif                          /* _BRCMF_DBG_H_ */
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_linux.c b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
new file mode 100644
index 00000000000..05dada98eb6
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
@@ -0,0 +1,1736 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/uaccess.h>
+#include <linux/interrupt.h>
+#include <linux/hardirq.h>
+#include <net/cfg80211.h>
+#include <defs.h>
+#include <brcmu_utils.h>
+#include <brcmu_wifi.h>
+
+#include "dhd.h"
+#include "dhd_bus.h"
+#include "dhd_proto.h"
+#include "dhd_dbg.h"
+#include "wl_cfg80211.h"
+#include "bcmchip.h"
+
+#if defined(CONFIG_PM_SLEEP)
+#include <linux/suspend.h>
+atomic_t brcmf_mmc_suspend;
+#endif  /*  defined(CONFIG_PM_SLEEP) */
+
+MODULE_AUTHOR("Broadcom Corporation");
+MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac driver.");
+MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac cards");
+MODULE_LICENSE("Dual BSD/GPL");
+
+
+/* Interface control information */
+struct brcmf_if {
+        struct brcmf_info *info;        /* back pointer to brcmf_info */
+        /* OS/stack specifics */
+        struct net_device *net;
+        struct net_device_stats stats;
+        int idx;                /* iface idx in dongle */
+        int state;              /* interface state */
+        uint subunit;           /* subunit */
+        u8 mac_addr[ETH_ALEN];  /* assigned MAC address */
+        bool attached;          /* Delayed attachment when unset */
+        bool txflowcontrol;     /* Per interface flow control indicator */
+        char name[IFNAMSIZ];    /* linux interface name */
+};
+
+/* Local private structure (extension of pub) */
+struct brcmf_info {
+        struct brcmf_pub pub;
+
+        /* OS/stack specifics */
+        struct brcmf_if *iflist[BRCMF_MAX_IFS];
+
+        struct semaphore proto_sem;
+        wait_queue_head_t ioctl_resp_wait;
+
+        /* Thread to issue ioctl for multicast */
+        struct task_struct *sysioc_tsk;
+        struct semaphore sysioc_sem;
+        bool set_multicast;
+        bool set_macaddress;
+        u8 macvalue[ETH_ALEN];
+        atomic_t pend_8021x_cnt;
+};
+
+/* Error bits */
+module_param(brcmf_msg_level, int, 0);
+
+/* Spawn a thread for system ioctls (set mac, set mcast) */
+uint brcmf_sysioc = true;
+module_param(brcmf_sysioc, uint, 0);
+
+/* ARP offload agent mode : Enable ARP Host Auto-Reply
+and ARP Peer Auto-Reply */
+uint brcmf_arp_mode = 0xb;
+module_param(brcmf_arp_mode, uint, 0);
+
+/* ARP offload enable */
+uint brcmf_arp_enable = true;
+module_param(brcmf_arp_enable, uint, 0);
+
+/* Global Pkt filter enable control */
+uint brcmf_pkt_filter_enable = true;
+module_param(brcmf_pkt_filter_enable, uint, 0);
+
+/*  Pkt filter init setup */
+uint brcmf_pkt_filter_init;
+module_param(brcmf_pkt_filter_init, uint, 0);
+
+/* Pkt filter mode control */
+uint brcmf_master_mode = true;
+module_param(brcmf_master_mode, uint, 0);
+
+module_param(brcmf_dongle_memsize, int, 0);
+
+/* Contorl fw roaming */
+uint brcmf_roam = 1;
+
+/* Control radio state */
+uint brcmf_radio_up = 1;
+
+/* Network inteface name */
+char iface_name[IFNAMSIZ] = "wlan";
+module_param_string(iface_name, iface_name, IFNAMSIZ, 0);
+
+/* The following are specific to the SDIO dongle */
+
+/* IOCTL response timeout */
+int brcmf_ioctl_timeout_msec = IOCTL_RESP_TIMEOUT;
+
+/* Idle timeout for backplane clock */
+int brcmf_idletime = BRCMF_IDLETIME_TICKS;
+module_param(brcmf_idletime, int, 0);
+
+/* Use polling */
+uint brcmf_poll;
+module_param(brcmf_poll, uint, 0);
+
+/* Use interrupts */
+uint brcmf_intr = true;
+module_param(brcmf_intr, uint, 0);
+
+/* SDIO Drive Strength (in milliamps) */
+uint brcmf_sdiod_drive_strength = 6;
+module_param(brcmf_sdiod_drive_strength, uint, 0);
+
+/* Tx/Rx bounds */
+module_param(brcmf_txbound, uint, 0);
+module_param(brcmf_rxbound, uint, 0);
+
+#ifdef SDTEST
+/* Echo packet generator (pkts/s) */
+uint brcmf_pktgen;
+module_param(brcmf_pktgen, uint, 0);
+
+/* Echo packet len (0 => sawtooth, max 2040) */
+uint brcmf_pktgen_len;
+module_param(brcmf_pktgen_len, uint, 0);
+#endif
+
+static int brcmf_toe_get(struct brcmf_info *drvr_priv, int idx, u32 *toe_ol);
+static int brcmf_toe_set(struct brcmf_info *drvr_priv, int idx, u32 toe_ol);
+static int brcmf_host_event(struct brcmf_info *drvr_priv, int *ifidx, void *pktdata,
+                            struct brcmf_event_msg *event_ptr,
+                            void **data_ptr);
+
+/*
+ * Generalized timeout mechanism.  Uses spin sleep with exponential
+ * back-off until
+ * the sleep time reaches one jiffy, then switches over to task delay.  Usage:
+ *
+ *      brcmf_timeout_start(&tmo, usec);
+ *      while (!brcmf_timeout_expired(&tmo))
+ *              if (poll_something())
+ *                      break;
+ *      if (brcmf_timeout_expired(&tmo))
+ *              fatal();
+ */
+
+void brcmf_timeout_start(struct brcmf_timeout *tmo, uint usec)
+{
+        tmo->limit = usec;
+        tmo->increment = 0;
+        tmo->elapsed = 0;
+        tmo->tick = 1000000 / HZ;
+}
+
+int brcmf_timeout_expired(struct brcmf_timeout *tmo)
+{
+        /* Does nothing the first call */
+        if (tmo->increment == 0) {
+                tmo->increment = 1;
+                return 0;
+        }
+
+        if (tmo->elapsed >= tmo->limit)
+                return 1;
+
+        /* Add the delay that's about to take place */
+        tmo->elapsed += tmo->increment;
+
+        if (tmo->increment < tmo->tick) {
+                udelay(tmo->increment);
+                tmo->increment *= 2;
+                if (tmo->increment > tmo->tick)
+                        tmo->increment = tmo->tick;
+        } else {
+                wait_queue_head_t delay_wait;
+                DECLARE_WAITQUEUE(wait, current);
+                int pending;
+                init_waitqueue_head(&delay_wait);
+                add_wait_queue(&delay_wait, &wait);
+                set_current_state(TASK_INTERRUPTIBLE);
+                schedule_timeout(1);
+                pending = signal_pending(current);
+                remove_wait_queue(&delay_wait, &wait);
+                set_current_state(TASK_RUNNING);
+                if (pending)
+                        return 1;       /* Interrupted */
+        }
+
+        return 0;
+}
+
+static int brcmf_net2idx(struct brcmf_info *drvr_priv, struct net_device *net)
+{
+        int i = 0;
+
+        while (i < BRCMF_MAX_IFS) {
+                if (drvr_priv->iflist[i] && (drvr_priv->iflist[i]->net == net))
+                        return i;
+                i++;
+        }
+
+        return BRCMF_BAD_IF;
+}
+
+int brcmf_ifname2idx(struct brcmf_info *drvr_priv, char *name)
+{
+        int i = BRCMF_MAX_IFS;
+
+        if (name == NULL || *name == '\0')
+                return 0;
+
+        while (--i > 0)
+                if (drvr_priv->iflist[i]
+                    && !strncmp(drvr_priv->iflist[i]->name, name, IFNAMSIZ))
+                        break;
+
+        BRCMF_TRACE(("%s: return idx %d for \"%s\"\n", __func__, i, name));
+
+        return i;               /* default - the primary interface */
+}
+
+char *brcmf_ifname(struct brcmf_pub *drvr, int ifidx)
+{
+        struct brcmf_info *drvr_priv = drvr->info;
+
+        if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
+                BRCMF_ERROR(("%s: ifidx %d out of range\n", __func__, ifidx));
+                return "<if_bad>";
+        }
+
+        if (drvr_priv->iflist[ifidx] == NULL) {
+                BRCMF_ERROR(("%s: null i/f %d\n", __func__, ifidx));
+                return "<if_null>";
+        }
+
+        if (drvr_priv->iflist[ifidx]->net)
+                return drvr_priv->iflist[ifidx]->net->name;
+
+        return "<if_none>";
+}
+
+static void _brcmf_set_multicast_list(struct brcmf_info *drvr_priv, int ifidx)
+{
+        struct net_device *dev;
+        struct netdev_hw_addr *ha;
+        u32 allmulti, cnt;
+
+        struct brcmf_ioctl ioc;
+        char *buf, *bufp;
+        uint buflen;
+        int ret;
+
+        dev = drvr_priv->iflist[ifidx]->net;
+        cnt = netdev_mc_count(dev);
+
+        /* Determine initial value of allmulti flag */
+        allmulti = (dev->flags & IFF_ALLMULTI) ? true : false;
+
+        /* Send down the multicast list first. */
+
+        buflen = sizeof("mcast_list") + sizeof(cnt) + (cnt * ETH_ALEN);
+        bufp = buf = kmalloc(buflen, GFP_ATOMIC);
+        if (!bufp) {
+                BRCMF_ERROR(("%s: out of memory for mcast_list, cnt %d\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx), cnt));
+                return;
+        }
+
+        strcpy(bufp, "mcast_list");
+        bufp += strlen("mcast_list") + 1;
+
+        cnt = cpu_to_le32(cnt);
+        memcpy(bufp, &cnt, sizeof(cnt));
+        bufp += sizeof(cnt);
+
+        netdev_for_each_mc_addr(ha, dev) {
+                if (!cnt)
+                        break;
+                memcpy(bufp, ha->addr, ETH_ALEN);
+                bufp += ETH_ALEN;
+                cnt--;
+        }
+
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = BRCMF_C_SET_VAR;
+        ioc.buf = buf;
+        ioc.len = buflen;
+        ioc.set = true;
+
+        ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                BRCMF_ERROR(("%s: set mcast_list failed, cnt %d\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx), cnt));
+                allmulti = cnt ? true : allmulti;
+        }
+
+        kfree(buf);
+
+        /* Now send the allmulti setting.  This is based on the setting in the
+         * net_device flags, but might be modified above to be turned on if we
+         * were trying to set some addresses and dongle rejected it...
+         */
+
+        buflen = sizeof("allmulti") + sizeof(allmulti);
+        buf = kmalloc(buflen, GFP_ATOMIC);
+        if (!buf) {
+                BRCMF_ERROR(("%s: out of memory for allmulti\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx)));
+                return;
+        }
+        allmulti = cpu_to_le32(allmulti);
+
+        if (!brcmu_mkiovar
+            ("allmulti", (void *)&allmulti, sizeof(allmulti), buf, buflen)) {
+                BRCMF_ERROR(("%s: mkiovar failed for allmulti, datalen %d "
+                             "buflen %u\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx),
+                             (int)sizeof(allmulti), buflen));
+                kfree(buf);
+                return;
+        }
+
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = BRCMF_C_SET_VAR;
+        ioc.buf = buf;
+        ioc.len = buflen;
+        ioc.set = true;
+
+        ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                BRCMF_ERROR(("%s: set allmulti %d failed\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx),
+                             le32_to_cpu(allmulti)));
+        }
+
+        kfree(buf);
+
+        /* Finally, pick up the PROMISC flag as well, like the NIC
+                 driver does */
+
+        allmulti = (dev->flags & IFF_PROMISC) ? true : false;
+        allmulti = cpu_to_le32(allmulti);
+
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = BRCMF_C_SET_PROMISC;
+        ioc.buf = &allmulti;
+        ioc.len = sizeof(allmulti);
+        ioc.set = true;
+
+        ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                BRCMF_ERROR(("%s: set promisc %d failed\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx),
+                             le32_to_cpu(allmulti)));
+        }
+}
+
+static int _brcmf_set_mac_address(struct brcmf_info *drvr_priv, int ifidx, u8 *addr)
+{
+        char buf[32];
+        struct brcmf_ioctl ioc;
+        int ret;
+
+        BRCMF_TRACE(("%s enter\n", __func__));
+        if (!brcmu_mkiovar
+            ("cur_etheraddr", (char *)addr, ETH_ALEN, buf, 32)) {
+                BRCMF_ERROR(("%s: mkiovar failed for cur_etheraddr\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx)));
+                return -1;
+        }
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = BRCMF_C_SET_VAR;
+        ioc.buf = buf;
+        ioc.len = 32;
+        ioc.set = true;
+
+        ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                BRCMF_ERROR(("%s: set cur_etheraddr failed\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx)));
+        } else {
+                memcpy(drvr_priv->iflist[ifidx]->net->dev_addr, addr, ETH_ALEN);
+        }
+
+        return ret;
+}
+
+#ifdef SOFTAP
+extern struct net_device *ap_net_dev;
+#endif
+
+/* Virtual interfaces only ((ifp && ifp->info && ifp->idx == true) */
+static void brcmf_op_if(struct brcmf_if *ifp)
+{
+        struct brcmf_info *drvr_priv;
+        int ret = 0, err = 0;
+
+        drvr_priv = ifp->info;
+
+        BRCMF_TRACE(("%s: idx %d, state %d\n", __func__, ifp->idx, ifp->state));
+
+        switch (ifp->state) {
+        case BRCMF_E_IF_ADD:
+                /*
+                 * Delete the existing interface before overwriting it
+                 * in case we missed the BRCMF_E_IF_DEL event.
+                 */
+                if (ifp->net != NULL) {
+                        BRCMF_ERROR(("%s: ERROR: netdev:%s already exists, "
+                                     "try free & unregister\n",
+                                     __func__, ifp->net->name));
+                        netif_stop_queue(ifp->net);
+                        unregister_netdev(ifp->net);
+                        free_netdev(ifp->net);
+                }
+                /* Allocate etherdev, including space for private structure */
+                ifp->net = alloc_etherdev(sizeof(drvr_priv));
+                if (!ifp->net) {
+                        BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
+                        ret = -ENOMEM;
+                }
+                if (ret == 0) {
+                        strcpy(ifp->net->name, ifp->name);
+                        memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(drvr_priv));
+                        err = brcmf_net_attach(&drvr_priv->pub, ifp->idx);
+                        if (err != 0) {
+                                BRCMF_ERROR(("%s: brcmf_net_attach failed, "
+                                             "err %d\n",
+                                             __func__, err));
+                                ret = -EOPNOTSUPP;
+                        } else {
+#ifdef SOFTAP
+                                /* semaphore that the soft AP CODE
+                                         waits on */
+                                extern struct semaphore ap_eth_sema;
+
+                                /* save ptr to wl0.1 netdev for use
+                                         in wl_iw.c  */
+                                ap_net_dev = ifp->net;
+                                /* signal to the SOFTAP 'sleeper' thread,
+                                         wl0.1 is ready */
+                                up(&ap_eth_sema);
+#endif
+                                BRCMF_TRACE(("\n ==== pid:%x, net_device for "
+                                             "if:%s created ===\n\n",
+                                             current->pid, ifp->net->name));
+                                ifp->state = 0;
+                        }
+                }
+                break;
+        case BRCMF_E_IF_DEL:
+                if (ifp->net != NULL) {
+                        BRCMF_TRACE(("\n%s: got 'WLC_E_IF_DEL' state\n",
+                                     __func__));
+                        netif_stop_queue(ifp->net);
+                        unregister_netdev(ifp->net);
+                        ret = BRCMF_DEL_IF;     /* Make sure the free_netdev()
+                                                         is called */
+                }
+                break;
+        default:
+                BRCMF_ERROR(("%s: bad op %d\n", __func__, ifp->state));
+                break;
+        }
+
+        if (ret < 0) {
+                if (ifp->net)
+                        free_netdev(ifp->net);
+
+                drvr_priv->iflist[ifp->idx] = NULL;
+                kfree(ifp);
+#ifdef SOFTAP
+                if (ifp->net == ap_net_dev)
+                        ap_net_dev = NULL;      /*  NULL  SOFTAP global
+                                                         wl0.1 as well */
+#endif                          /*  SOFTAP */
+        }
+}
+
+static int _brcmf_sysioc_thread(void *data)
+{
+        struct brcmf_info *drvr_priv = (struct brcmf_info *) data;
+        int i;
+#ifdef SOFTAP
+        bool in_ap = false;
+#endif
+
+        allow_signal(SIGTERM);
+
+        while (down_interruptible(&drvr_priv->sysioc_sem) == 0) {
+                if (kthread_should_stop())
+                        break;
+                for (i = 0; i < BRCMF_MAX_IFS; i++) {
+                        struct brcmf_if *ifentry = drvr_priv->iflist[i];
+                        if (ifentry) {
+#ifdef SOFTAP
+                                in_ap = (ap_net_dev != NULL);
+#endif                          /* SOFTAP */
+                                if (ifentry->state)
+                                        brcmf_op_if(ifentry);
+#ifdef SOFTAP
+                                if (drvr_priv->iflist[i] == NULL) {
+                                        BRCMF_TRACE(("\n\n %s: interface %d "
+                                                     "removed!\n", __func__,
+                                                     i));
+                                        continue;
+                                }
+
+                                if (in_ap && drvr_priv->set_macaddress) {
+                                        BRCMF_TRACE(("attempt to set MAC for"
+                                                     " %s in AP Mode,"
+                                                     " blocked.\n",
+                                                     ifentry->net->name));
+                                        drvr_priv->set_macaddress = false;
+                                        continue;
+                                }
+
+                                if (in_ap && drvr_priv->set_multicast) {
+                                        BRCMF_TRACE(("attempt to set MULTICAST "
+                                                     "list for %s in AP Mode, "
+                                                     "blocked.\n",
+                                                     ifentry->net->name));
+                                        drvr_priv->set_multicast = false;
+                                        continue;
+                                }
+#endif                          /* SOFTAP */
+                                if (drvr_priv->set_multicast) {
+                                        drvr_priv->set_multicast = false;
+                                        _brcmf_set_multicast_list(drvr_priv, i);
+                                }
+                                if (drvr_priv->set_macaddress) {
+                                        drvr_priv->set_macaddress = false;
+                                        _brcmf_set_mac_address(drvr_priv, i,
+                                                drvr_priv->macvalue);
+                                }
+                        }
+                }
+        }
+        return 0;
+}
+
+static int brcmf_netdev_set_mac_address(struct net_device *dev, void *addr)
+{
+        int ret = 0;
+
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(dev);
+        struct sockaddr *sa = (struct sockaddr *)addr;
+        int ifidx;
+
+        ifidx = brcmf_net2idx(drvr_priv, dev);
+        if (ifidx == BRCMF_BAD_IF)
+                return -1;
+
+        memcpy(&drvr_priv->macvalue, sa->sa_data, ETH_ALEN);
+        drvr_priv->set_macaddress = true;
+        up(&drvr_priv->sysioc_sem);
+
+        return ret;
+}
+
+static void brcmf_netdev_set_multicast_list(struct net_device *dev)
+{
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(dev);
+        int ifidx;
+
+        ifidx = brcmf_net2idx(drvr_priv, dev);
+        if (ifidx == BRCMF_BAD_IF)
+                return;
+
+        drvr_priv->set_multicast = true;
+        up(&drvr_priv->sysioc_sem);
+}
+
+int brcmf_sendpkt(struct brcmf_pub *drvr, int ifidx, struct sk_buff *pktbuf)
+{
+        struct brcmf_info *drvr_priv = drvr->info;
+
+        /* Reject if down */
+        if (!drvr->up || (drvr->busstate == BRCMF_BUS_DOWN))
+                return -ENODEV;
+
+        /* Update multicast statistic */
+        if (pktbuf->len >= ETH_ALEN) {
+                u8 *pktdata = (u8 *) (pktbuf->data);
+                struct ethhdr *eh = (struct ethhdr *)pktdata;
+
+                if (is_multicast_ether_addr(eh->h_dest))
+                        drvr->tx_multicast++;
+                if (ntohs(eh->h_proto) == ETH_P_PAE)
+                        atomic_inc(&drvr_priv->pend_8021x_cnt);
+        }
+
+        /* If the protocol uses a data header, apply it */
+        brcmf_proto_hdrpush(drvr, ifidx, pktbuf);
+
+        /* Use bus module to send data frame */
+        return brcmf_sdbrcm_bus_txdata(drvr->bus, pktbuf);
+}
+
+static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *net)
+{
+        int ret;
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
+        int ifidx;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Reject if down */
+        if (!drvr_priv->pub.up || (drvr_priv->pub.busstate == BRCMF_BUS_DOWN)) {
+                BRCMF_ERROR(("%s: xmit rejected pub.up=%d busstate=%d\n",
+                             __func__, drvr_priv->pub.up,
+                             drvr_priv->pub.busstate));
+                netif_stop_queue(net);
+                return -ENODEV;
+        }
+
+        ifidx = brcmf_net2idx(drvr_priv, net);
+        if (ifidx == BRCMF_BAD_IF) {
+                BRCMF_ERROR(("%s: bad ifidx %d\n", __func__, ifidx));
+                netif_stop_queue(net);
+                return -ENODEV;
+        }
+
+        /* Make sure there's enough room for any header */
+        if (skb_headroom(skb) < drvr_priv->pub.hdrlen) {
+                struct sk_buff *skb2;
+
+                BRCMF_INFO(("%s: insufficient headroom\n",
+                            brcmf_ifname(&drvr_priv->pub, ifidx)));
+                drvr_priv->pub.tx_realloc++;
+                skb2 = skb_realloc_headroom(skb, drvr_priv->pub.hdrlen);
+                dev_kfree_skb(skb);
+                skb = skb2;
+                if (skb == NULL) {
+                        BRCMF_ERROR(("%s: skb_realloc_headroom failed\n",
+                                     brcmf_ifname(&drvr_priv->pub, ifidx)));
+                        ret = -ENOMEM;
+                        goto done;
+                }
+        }
+
+        ret = brcmf_sendpkt(&drvr_priv->pub, ifidx, skb);
+
+done:
+        if (ret)
+                drvr_priv->pub.dstats.tx_dropped++;
+        else
+                drvr_priv->pub.tx_packets++;
+
+        /* Return ok: we always eat the packet */
+        return 0;
+}
+
+void brcmf_txflowcontrol(struct brcmf_pub *drvr, int ifidx, bool state)
+{
+        struct net_device *net;
+        struct brcmf_info *drvr_priv = drvr->info;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        drvr->txoff = state;
+        net = drvr_priv->iflist[ifidx]->net;
+        if (state == ON)
+                netif_stop_queue(net);
+        else
+                netif_wake_queue(net);
+}
+
+void brcmf_rx_frame(struct brcmf_pub *drvr, int ifidx, struct sk_buff *skb,
+                  int numpkt)
+{
+        struct brcmf_info *drvr_priv = drvr->info;
+        unsigned char *eth;
+        uint len;
+        void *data;
+        struct sk_buff *pnext, *save_pktbuf;
+        int i;
+        struct brcmf_if *ifp;
+        struct brcmf_event_msg event;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        save_pktbuf = skb;
+
+        for (i = 0; skb && i < numpkt; i++, skb = pnext) {
+
+                pnext = skb->next;
+                skb->next = NULL;
+
+                /* Get the protocol, maintain skb around eth_type_trans()
+                 * The main reason for this hack is for the limitation of
+                 * Linux 2.4 where 'eth_type_trans' uses the
+                 * 'net->hard_header_len'
+                 * to perform skb_pull inside vs ETH_HLEN. Since to avoid
+                 * coping of the packet coming from the network stack to add
+                 * BDC, Hardware header etc, during network interface
+                 * registration
+                 * we set the 'net->hard_header_len' to ETH_HLEN + extra space
+                 * required
+                 * for BDC, Hardware header etc. and not just the ETH_HLEN
+                 */
+                eth = skb->data;
+                len = skb->len;
+
+                ifp = drvr_priv->iflist[ifidx];
+                if (ifp == NULL)
+                        ifp = drvr_priv->iflist[0];
+
+                skb->dev = ifp->net;
+                skb->protocol = eth_type_trans(skb, skb->dev);
+
+                if (skb->pkt_type == PACKET_MULTICAST)
+                        drvr_priv->pub.rx_multicast++;
+
+                skb->data = eth;
+                skb->len = len;
+
+                /* Strip header, count, deliver upward */
+                skb_pull(skb, ETH_HLEN);
+
+                /* Process special event packets and then discard them */
+                if (ntohs(skb->protocol) == ETH_P_LINK_CTL)
+                        brcmf_host_event(drvr_priv, &ifidx,
+                                          skb_mac_header(skb),
+                                          &event, &data);
+
+                if (drvr_priv->iflist[ifidx] &&
+                    !drvr_priv->iflist[ifidx]->state)
+                        ifp = drvr_priv->iflist[ifidx];
+
+                if (ifp->net)
+                        ifp->net->last_rx = jiffies;
+
+                drvr->dstats.rx_bytes += skb->len;
+                drvr->rx_packets++;     /* Local count */
+
+                if (in_interrupt()) {
+                        netif_rx(skb);
+                } else {
+                        /* If the receive is not processed inside an ISR,
+                         * the softirqd must be woken explicitly to service
+                         * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
+                         * by netif_rx_ni(), but in earlier kernels, we need
+                         * to do it manually.
+                         */
+                        netif_rx_ni(skb);
+                }
+        }
+}
+
+void brcmf_txcomplete(struct brcmf_pub *drvr, struct sk_buff *txp, bool success)
+{
+        uint ifidx;
+        struct brcmf_info *drvr_priv = drvr->info;
+        struct ethhdr *eh;
+        u16 type;
+
+        brcmf_proto_hdrpull(drvr, &ifidx, txp);
+
+        eh = (struct ethhdr *)(txp->data);
+        type = ntohs(eh->h_proto);
+
+        if (type == ETH_P_PAE)
+                atomic_dec(&drvr_priv->pend_8021x_cnt);
+
+}
+
+static struct net_device_stats *brcmf_netdev_get_stats(struct net_device *net)
+{
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
+        struct brcmf_if *ifp;
+        int ifidx;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        ifidx = brcmf_net2idx(drvr_priv, net);
+        if (ifidx == BRCMF_BAD_IF)
+                return NULL;
+
+        ifp = drvr_priv->iflist[ifidx];
+
+        if (drvr_priv->pub.up) {
+                /* Use the protocol to get dongle stats */
+                brcmf_proto_dstats(&drvr_priv->pub);
+        }
+
+        /* Copy dongle stats to net device stats */
+        ifp->stats.rx_packets = drvr_priv->pub.dstats.rx_packets;
+        ifp->stats.tx_packets = drvr_priv->pub.dstats.tx_packets;
+        ifp->stats.rx_bytes = drvr_priv->pub.dstats.rx_bytes;
+        ifp->stats.tx_bytes = drvr_priv->pub.dstats.tx_bytes;
+        ifp->stats.rx_errors = drvr_priv->pub.dstats.rx_errors;
+        ifp->stats.tx_errors = drvr_priv->pub.dstats.tx_errors;
+        ifp->stats.rx_dropped = drvr_priv->pub.dstats.rx_dropped;
+        ifp->stats.tx_dropped = drvr_priv->pub.dstats.tx_dropped;
+        ifp->stats.multicast = drvr_priv->pub.dstats.multicast;
+
+        return &ifp->stats;
+}
+
+/* Retrieve current toe component enables, which are kept
+         as a bitmap in toe_ol iovar */
+static int brcmf_toe_get(struct brcmf_info *drvr_priv, int ifidx, u32 *toe_ol)
+{
+        struct brcmf_ioctl ioc;
+        char buf[32];
+        int ret;
+
+        memset(&ioc, 0, sizeof(ioc));
+
+        ioc.cmd = BRCMF_C_GET_VAR;
+        ioc.buf = buf;
+        ioc.len = (uint) sizeof(buf);
+        ioc.set = false;
+
+        strcpy(buf, "toe_ol");
+        ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                /* Check for older dongle image that doesn't support toe_ol */
+                if (ret == -EIO) {
+                        BRCMF_ERROR(("%s: toe not supported by device\n",
+                                     brcmf_ifname(&drvr_priv->pub, ifidx)));
+                        return -EOPNOTSUPP;
+                }
+
+                BRCMF_INFO(("%s: could not get toe_ol: ret=%d\n",
+                            brcmf_ifname(&drvr_priv->pub, ifidx), ret));
+                return ret;
+        }
+
+        memcpy(toe_ol, buf, sizeof(u32));
+        return 0;
+}
+
+/* Set current toe component enables in toe_ol iovar,
+         and set toe global enable iovar */
+static int brcmf_toe_set(struct brcmf_info *drvr_priv, int ifidx, u32 toe_ol)
+{
+        struct brcmf_ioctl ioc;
+        char buf[32];
+        int toe, ret;
+
+        memset(&ioc, 0, sizeof(ioc));
+
+        ioc.cmd = BRCMF_C_SET_VAR;
+        ioc.buf = buf;
+        ioc.len = (uint) sizeof(buf);
+        ioc.set = true;
+
+        /* Set toe_ol as requested */
+
+        strcpy(buf, "toe_ol");
+        memcpy(&buf[sizeof("toe_ol")], &toe_ol, sizeof(u32));
+
+        ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                BRCMF_ERROR(("%s: could not set toe_ol: ret=%d\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx), ret));
+                return ret;
+        }
+
+        /* Enable toe globally only if any components are enabled. */
+
+        toe = (toe_ol != 0);
+
+        strcpy(buf, "toe");
+        memcpy(&buf[sizeof("toe")], &toe, sizeof(u32));
+
+        ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
+        if (ret < 0) {
+                BRCMF_ERROR(("%s: could not set toe: ret=%d\n",
+                             brcmf_ifname(&drvr_priv->pub, ifidx), ret));
+                return ret;
+        }
+
+        return 0;
+}
+
+static void brcmf_ethtool_get_drvinfo(struct net_device *net,
+                                    struct ethtool_drvinfo *info)
+{
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
+
+        sprintf(info->driver, KBUILD_MODNAME);
+        sprintf(info->version, "%lu", drvr_priv->pub.drv_version);
+        sprintf(info->fw_version, "%s", BCM4329_FW_NAME);
+        sprintf(info->bus_info, "%s",
+                dev_name(&brcmf_cfg80211_get_sdio_func()->dev));
+}
+
+struct ethtool_ops brcmf_ethtool_ops = {
+        .get_drvinfo = brcmf_ethtool_get_drvinfo
+};
+
+static int brcmf_ethtool(struct brcmf_info *drvr_priv, void *uaddr)
+{
+        struct ethtool_drvinfo info;
+        char drvname[sizeof(info.driver)];
+        u32 cmd;
+        struct ethtool_value edata;
+        u32 toe_cmpnt, csum_dir;
+        int ret;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* all ethtool calls start with a cmd word */
+        if (copy_from_user(&cmd, uaddr, sizeof(u32)))
+                return -EFAULT;
+
+        switch (cmd) {
+        case ETHTOOL_GDRVINFO:
+                /* Copy out any request driver name */
+                if (copy_from_user(&info, uaddr, sizeof(info)))
+                        return -EFAULT;
+                strncpy(drvname, info.driver, sizeof(info.driver));
+                drvname[sizeof(info.driver) - 1] = '\0';
+
+                /* clear struct for return */
+                memset(&info, 0, sizeof(info));
+                info.cmd = cmd;
+
+                /* if requested, identify ourselves */
+                if (strcmp(drvname, "?dhd") == 0) {
+                        sprintf(info.driver, "dhd");
+                        strcpy(info.version, BRCMF_VERSION_STR);
+                }
+
+                /* otherwise, require dongle to be up */
+                else if (!drvr_priv->pub.up) {
+                        BRCMF_ERROR(("%s: dongle is not up\n", __func__));
+                        return -ENODEV;
+                }
+
+                /* finally, report dongle driver type */
+                else if (drvr_priv->pub.iswl)
+                        sprintf(info.driver, "wl");
+                else
+                        sprintf(info.driver, "xx");
+
+                sprintf(info.version, "%lu", drvr_priv->pub.drv_version);
+                if (copy_to_user(uaddr, &info, sizeof(info)))
+                        return -EFAULT;
+                BRCMF_CTL(("%s: given %*s, returning %s\n", __func__,
+                           (int)sizeof(drvname), drvname, info.driver));
+                break;
+
+                /* Get toe offload components from dongle */
+        case ETHTOOL_GRXCSUM:
+        case ETHTOOL_GTXCSUM:
+                ret = brcmf_toe_get(drvr_priv, 0, &toe_cmpnt);
+                if (ret < 0)
+                        return ret;
+
+                csum_dir =
+                    (cmd == ETHTOOL_GTXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+                edata.cmd = cmd;
+                edata.data = (toe_cmpnt & csum_dir) ? 1 : 0;
+
+                if (copy_to_user(uaddr, &edata, sizeof(edata)))
+                        return -EFAULT;
+                break;
+
+                /* Set toe offload components in dongle */
+        case ETHTOOL_SRXCSUM:
+        case ETHTOOL_STXCSUM:
+                if (copy_from_user(&edata, uaddr, sizeof(edata)))
+                        return -EFAULT;
+
+                /* Read the current settings, update and write back */
+                ret = brcmf_toe_get(drvr_priv, 0, &toe_cmpnt);
+                if (ret < 0)
+                        return ret;
+
+                csum_dir =
+                    (cmd == ETHTOOL_STXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+                if (edata.data != 0)
+                        toe_cmpnt |= csum_dir;
+                else
+                        toe_cmpnt &= ~csum_dir;
+
+                ret = brcmf_toe_set(drvr_priv, 0, toe_cmpnt);
+                if (ret < 0)
+                        return ret;
+
+                /* If setting TX checksum mode, tell Linux the new mode */
+                if (cmd == ETHTOOL_STXCSUM) {
+                        if (edata.data)
+                                drvr_priv->iflist[0]->net->features |=
+                                    NETIF_F_IP_CSUM;
+                        else
+                                drvr_priv->iflist[0]->net->features &=
+                                    ~NETIF_F_IP_CSUM;
+                }
+
+                break;
+
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        return 0;
+}
+
+static int brcmf_netdev_ioctl_entry(struct net_device *net, struct ifreq *ifr,
+                                    int cmd)
+{
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
+        struct brcmf_c_ioctl ioc;
+        int bcmerror = 0;
+        int buflen = 0;
+        void *buf = NULL;
+        uint driver = 0;
+        int ifidx;
+        bool is_set_key_cmd;
+
+        ifidx = brcmf_net2idx(drvr_priv, net);
+        BRCMF_TRACE(("%s: ifidx %d, cmd 0x%04x\n", __func__, ifidx, cmd));
+
+        if (ifidx == BRCMF_BAD_IF)
+                return -1;
+
+        if (cmd == SIOCETHTOOL)
+                return brcmf_ethtool(drvr_priv, (void *)ifr->ifr_data);
+
+        if (cmd != SIOCDEVPRIVATE)
+                return -EOPNOTSUPP;
+
+        memset(&ioc, 0, sizeof(ioc));
+
+        /* Copy the ioc control structure part of ioctl request */
+        if (copy_from_user(&ioc, ifr->ifr_data, sizeof(struct brcmf_ioctl))) {
+                bcmerror = -EINVAL;
+                goto done;
+        }
+
+        /* Copy out any buffer passed */
+        if (ioc.buf) {
+                buflen = min_t(int, ioc.len, BRCMF_IOCTL_MAXLEN);
+                /* optimization for direct ioctl calls from kernel */
+                /*
+                   if (segment_eq(get_fs(), KERNEL_DS)) {
+                   buf = ioc.buf;
+                   } else {
+                 */
+                {
+                        buf = kmalloc(buflen, GFP_ATOMIC);
+                        if (!buf) {
+                                bcmerror = -ENOMEM;
+                                goto done;
+                        }
+                        if (copy_from_user(buf, ioc.buf, buflen)) {
+                                bcmerror = -EINVAL;
+                                goto done;
+                        }
+                }
+        }
+
+        /* To differentiate read 4 more byes */
+        if ((copy_from_user(&driver, (char *)ifr->ifr_data +
+                            sizeof(struct brcmf_ioctl), sizeof(uint)) != 0)) {
+                bcmerror = -EINVAL;
+                goto done;
+        }
+
+        if (!capable(CAP_NET_ADMIN)) {
+                bcmerror = -EPERM;
+                goto done;
+        }
+
+        /* check for local brcmf ioctl and handle it */
+        if (driver == BRCMF_IOCTL_MAGIC) {
+                bcmerror = brcmf_c_ioctl((void *)&drvr_priv->pub, &ioc, buf, buflen);
+                if (bcmerror)
+                        drvr_priv->pub.bcmerror = bcmerror;
+                goto done;
+        }
+
+        /* send to dongle (must be up, and wl) */
+        if ((drvr_priv->pub.busstate != BRCMF_BUS_DATA)) {
+                BRCMF_ERROR(("%s DONGLE_DOWN,__func__\n", __func__));
+                bcmerror = -EIO;
+                goto done;
+        }
+
+        if (!drvr_priv->pub.iswl) {
+                bcmerror = -EIO;
+                goto done;
+        }
+
+        /*
+         * Intercept BRCMF_C_SET_KEY IOCTL - serialize M4 send and
+         * set key IOCTL to prevent M4 encryption.
+         */
+        is_set_key_cmd = ((ioc.cmd == BRCMF_C_SET_KEY) ||
+                          ((ioc.cmd == BRCMF_C_SET_VAR) &&
+                           !(strncmp("wsec_key", ioc.buf, 9))) ||
+                          ((ioc.cmd == BRCMF_C_SET_VAR) &&
+                           !(strncmp("bsscfg:wsec_key", ioc.buf, 15))));
+        if (is_set_key_cmd)
+                brcmf_netdev_wait_pend8021x(net);
+
+        bcmerror =
+            brcmf_proto_ioctl(&drvr_priv->pub, ifidx, (struct brcmf_ioctl *)&ioc,
+                              buf, buflen);
+
+done:
+        if (!bcmerror && buf && ioc.buf) {
+                if (copy_to_user(ioc.buf, buf, buflen))
+                        bcmerror = -EFAULT;
+        }
+
+        kfree(buf);
+
+        if (bcmerror > 0)
+                bcmerror = 0;
+
+        return bcmerror;
+}
+
+static int brcmf_netdev_stop(struct net_device *net)
+{
+#if !defined(IGNORE_ETH0_DOWN)
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+        brcmf_cfg80211_down();
+        if (drvr_priv->pub.up == 0)
+                return 0;
+
+        /* Set state and stop OS transmissions */
+        drvr_priv->pub.up = 0;
+        netif_stop_queue(net);
+#else
+        BRCMF_ERROR(("BYPASS %s:due to BRCM compilation: under investigation\n",
+                     __func__));
+#endif                          /* !defined(IGNORE_ETH0_DOWN) */
+
+        return 0;
+}
+
+static int brcmf_netdev_open(struct net_device *net)
+{
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
+        u32 toe_ol;
+        int ifidx = brcmf_net2idx(drvr_priv, net);
+        s32 ret = 0;
+
+        BRCMF_TRACE(("%s: ifidx %d\n", __func__, ifidx));
+
+        if (ifidx == 0) {       /* do it only for primary eth0 */
+
+                /* try to bring up bus */
+                ret = brcmf_bus_start(&drvr_priv->pub);
+                if (ret != 0) {
+                        BRCMF_ERROR(("%s: failed with code %d\n",
+                                     __func__, ret));
+                        return -1;
+                }
+                atomic_set(&drvr_priv->pend_8021x_cnt, 0);
+
+                memcpy(net->dev_addr, drvr_priv->pub.mac, ETH_ALEN);
+
+                /* Get current TOE mode from dongle */
+                if (brcmf_toe_get(drvr_priv, ifidx, &toe_ol) >= 0
+                    && (toe_ol & TOE_TX_CSUM_OL) != 0)
+                        drvr_priv->iflist[ifidx]->net->features |=
+                                NETIF_F_IP_CSUM;
+                else
+                        drvr_priv->iflist[ifidx]->net->features &=
+                                ~NETIF_F_IP_CSUM;
+        }
+        /* Allow transmit calls */
+        netif_start_queue(net);
+        drvr_priv->pub.up = 1;
+        if (unlikely(brcmf_cfg80211_up())) {
+                BRCMF_ERROR(("%s: failed to bring up cfg80211\n",
+                             __func__));
+                return -1;
+        }
+
+        return ret;
+}
+
+int
+brcmf_add_if(struct brcmf_info *drvr_priv, int ifidx, void *handle, char *name,
+           u8 *mac_addr, u32 flags, u8 bssidx)
+{
+        struct brcmf_if *ifp;
+
+        BRCMF_TRACE(("%s: idx %d, handle->%p\n", __func__, ifidx, handle));
+
+        ifp = drvr_priv->iflist[ifidx];
+        if (!ifp) {
+                ifp = kmalloc(sizeof(struct brcmf_if), GFP_ATOMIC);
+                if (!ifp) {
+                        BRCMF_ERROR(("%s: OOM - struct brcmf_if\n", __func__));
+                        return -ENOMEM;
+                }
+        }
+
+        memset(ifp, 0, sizeof(struct brcmf_if));
+        ifp->info = drvr_priv;
+        drvr_priv->iflist[ifidx] = ifp;
+        strlcpy(ifp->name, name, IFNAMSIZ);
+        if (mac_addr != NULL)
+                memcpy(&ifp->mac_addr, mac_addr, ETH_ALEN);
+
+        if (handle == NULL) {
+                ifp->state = BRCMF_E_IF_ADD;
+                ifp->idx = ifidx;
+                up(&drvr_priv->sysioc_sem);
+        } else
+                ifp->net = (struct net_device *)handle;
+
+        return 0;
+}
+
+void brcmf_del_if(struct brcmf_info *drvr_priv, int ifidx)
+{
+        struct brcmf_if *ifp;
+
+        BRCMF_TRACE(("%s: idx %d\n", __func__, ifidx));
+
+        ifp = drvr_priv->iflist[ifidx];
+        if (!ifp) {
+                BRCMF_ERROR(("%s: Null interface\n", __func__));
+                return;
+        }
+
+        ifp->state = BRCMF_E_IF_DEL;
+        ifp->idx = ifidx;
+        up(&drvr_priv->sysioc_sem);
+}
+
+struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
+{
+        struct brcmf_info *drvr_priv = NULL;
+        struct net_device *net;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Allocate etherdev, including space for private structure */
+        net = alloc_etherdev(sizeof(drvr_priv));
+        if (!net) {
+                BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
+                goto fail;
+        }
+
+        /* Allocate primary brcmf_info */
+        drvr_priv = kzalloc(sizeof(struct brcmf_info), GFP_ATOMIC);
+        if (!drvr_priv) {
+                BRCMF_ERROR(("%s: OOM - alloc brcmf_info\n", __func__));
+                goto fail;
+        }
+
+        /*
+         * Save the brcmf_info into the priv
+         */
+        memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
+
+        /* Set network interface name if it was provided as module parameter */
+        if (iface_name[0]) {
+                int len;
+                char ch;
+                strncpy(net->name, iface_name, IFNAMSIZ);
+                net->name[IFNAMSIZ - 1] = 0;
+                len = strlen(net->name);
+                ch = net->name[len - 1];
+                if ((ch > '9' || ch < '0') && (len < IFNAMSIZ - 2))
+                        strcat(net->name, "%d");
+        }
+
+        if (brcmf_add_if(drvr_priv, 0, (void *)net, net->name, NULL, 0, 0) ==
+            BRCMF_BAD_IF)
+                goto fail;
+
+        net->netdev_ops = NULL;
+        sema_init(&drvr_priv->proto_sem, 1);
+        /* Initialize other structure content */
+        init_waitqueue_head(&drvr_priv->ioctl_resp_wait);
+
+        /* Link to info module */
+        drvr_priv->pub.info = drvr_priv;
+
+        /* Link to bus module */
+        drvr_priv->pub.bus = bus;
+        drvr_priv->pub.hdrlen = bus_hdrlen;
+
+        /* Attach and link in the protocol */
+        if (brcmf_proto_attach(&drvr_priv->pub) != 0) {
+                BRCMF_ERROR(("brcmf_prot_attach failed\n"));
+                goto fail;
+        }
+
+        /* Attach and link in the cfg80211 */
+        if (unlikely(brcmf_cfg80211_attach(net, &drvr_priv->pub))) {
+                BRCMF_ERROR(("wl_cfg80211_attach failed\n"));
+                goto fail;
+        }
+
+        if (brcmf_sysioc) {
+                sema_init(&drvr_priv->sysioc_sem, 0);
+                drvr_priv->sysioc_tsk = kthread_run(_brcmf_sysioc_thread, drvr_priv,
+                                                "_brcmf_sysioc");
+                if (IS_ERR(drvr_priv->sysioc_tsk)) {
+                        printk(KERN_WARNING
+                                "_brcmf_sysioc thread failed to start\n");
+                        drvr_priv->sysioc_tsk = NULL;
+                }
+        } else
+                drvr_priv->sysioc_tsk = NULL;
+
+        /*
+         * Save the brcmf_info into the priv
+         */
+        memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
+
+#if defined(CONFIG_PM_SLEEP)
+        atomic_set(&brcmf_mmc_suspend, false);
+#endif  /* defined(CONFIG_PM_SLEEP) */
+        return &drvr_priv->pub;
+
+fail:
+        if (net)
+                free_netdev(net);
+        if (drvr_priv)
+                brcmf_detach(&drvr_priv->pub);
+
+        return NULL;
+}
+
+int brcmf_bus_start(struct brcmf_pub *drvr)
+{
+        int ret = -1;
+        struct brcmf_info *drvr_priv = drvr->info;
+        /* Room for "event_msgs" + '\0' + bitvec */
+        char iovbuf[BRCMF_EVENTING_MASK_LEN + 12];
+
+        BRCMF_TRACE(("%s:\n", __func__));
+
+        /* Bring up the bus */
+        ret = brcmf_sdbrcm_bus_init(&drvr_priv->pub, true);
+        if (ret != 0) {
+                BRCMF_ERROR(("%s, brcmf_sdbrcm_bus_init failed %d\n", __func__,
+                             ret));
+                return ret;
+        }
+
+        /* If bus is not ready, can't come up */
+        if (drvr_priv->pub.busstate != BRCMF_BUS_DATA) {
+                BRCMF_ERROR(("%s failed bus is not ready\n", __func__));
+                return -ENODEV;
+        }
+
+        brcmu_mkiovar("event_msgs", drvr->eventmask, BRCMF_EVENTING_MASK_LEN,
+                      iovbuf, sizeof(iovbuf));
+        brcmf_proto_cdc_query_ioctl(drvr, 0, BRCMF_C_GET_VAR, iovbuf,
+                                    sizeof(iovbuf));
+        memcpy(drvr->eventmask, iovbuf, BRCMF_EVENTING_MASK_LEN);
+
+        setbit(drvr->eventmask, BRCMF_E_SET_SSID);
+        setbit(drvr->eventmask, BRCMF_E_PRUNE);
+        setbit(drvr->eventmask, BRCMF_E_AUTH);
+        setbit(drvr->eventmask, BRCMF_E_REASSOC);
+        setbit(drvr->eventmask, BRCMF_E_REASSOC_IND);
+        setbit(drvr->eventmask, BRCMF_E_DEAUTH_IND);
+        setbit(drvr->eventmask, BRCMF_E_DISASSOC_IND);
+        setbit(drvr->eventmask, BRCMF_E_DISASSOC);
+        setbit(drvr->eventmask, BRCMF_E_JOIN);
+        setbit(drvr->eventmask, BRCMF_E_ASSOC_IND);
+        setbit(drvr->eventmask, BRCMF_E_PSK_SUP);
+        setbit(drvr->eventmask, BRCMF_E_LINK);
+        setbit(drvr->eventmask, BRCMF_E_NDIS_LINK);
+        setbit(drvr->eventmask, BRCMF_E_MIC_ERROR);
+        setbit(drvr->eventmask, BRCMF_E_PMKID_CACHE);
+        setbit(drvr->eventmask, BRCMF_E_TXFAIL);
+        setbit(drvr->eventmask, BRCMF_E_JOIN_START);
+        setbit(drvr->eventmask, BRCMF_E_SCAN_COMPLETE);
+
+/* enable dongle roaming event */
+
+        drvr->pktfilter_count = 1;
+        /* Setup filter to allow only unicast */
+        drvr->pktfilter[0] = "100 0 0 0 0x01 0x00";
+
+        /* Bus is ready, do any protocol initialization */
+        ret = brcmf_proto_init(&drvr_priv->pub);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static struct net_device_ops brcmf_netdev_ops_pri = {
+        .ndo_open = brcmf_netdev_open,
+        .ndo_stop = brcmf_netdev_stop,
+        .ndo_get_stats = brcmf_netdev_get_stats,
+        .ndo_do_ioctl = brcmf_netdev_ioctl_entry,
+        .ndo_start_xmit = brcmf_netdev_start_xmit,
+        .ndo_set_mac_address = brcmf_netdev_set_mac_address,
+        .ndo_set_multicast_list = brcmf_netdev_set_multicast_list
+};
+
+int brcmf_net_attach(struct brcmf_pub *drvr, int ifidx)
+{
+        struct brcmf_info *drvr_priv = drvr->info;
+        struct net_device *net;
+        u8 temp_addr[ETH_ALEN] = {
+                0x00, 0x90, 0x4c, 0x11, 0x22, 0x33};
+
+        BRCMF_TRACE(("%s: ifidx %d\n", __func__, ifidx));
+
+        net = drvr_priv->iflist[ifidx]->net;
+        net->netdev_ops = &brcmf_netdev_ops_pri;
+
+        /*
+         * We have to use the primary MAC for virtual interfaces
+         */
+        if (ifidx != 0) {
+                /* for virtual interfaces use the primary MAC  */
+                memcpy(temp_addr, drvr_priv->pub.mac, ETH_ALEN);
+
+        }
+
+        if (ifidx == 1) {
+                BRCMF_TRACE(("%s ACCESS POINT MAC:\n", __func__));
+                /*  ACCESSPOINT INTERFACE CASE */
+                temp_addr[0] |= 0X02;   /* set bit 2 ,
+                         - Locally Administered address  */
+
+        }
+        net->hard_header_len = ETH_HLEN + drvr_priv->pub.hdrlen;
+        net->ethtool_ops = &brcmf_ethtool_ops;
+
+        drvr_priv->pub.rxsz = net->mtu + net->hard_header_len +
+                                drvr_priv->pub.hdrlen;
+
+        memcpy(net->dev_addr, temp_addr, ETH_ALEN);
+
+        if (register_netdev(net) != 0) {
+                BRCMF_ERROR(("%s: couldn't register the net device\n",
+                             __func__));
+                goto fail;
+        }
+
+        BRCMF_INFO(("%s: Broadcom Dongle Host Driver\n", net->name));
+
+        return 0;
+
+fail:
+        net->netdev_ops = NULL;
+        return -EBADE;
+}
+
+static void brcmf_bus_detach(struct brcmf_pub *drvr)
+{
+        struct brcmf_info *drvr_priv;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (drvr) {
+                drvr_priv = drvr->info;
+                if (drvr_priv) {
+                        /* Stop the protocol module */
+                        brcmf_proto_stop(&drvr_priv->pub);
+
+                        /* Stop the bus module */
+                        brcmf_sdbrcm_bus_stop(drvr_priv->pub.bus, true);
+                }
+        }
+}
+
+void brcmf_detach(struct brcmf_pub *drvr)
+{
+        struct brcmf_info *drvr_priv;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (drvr) {
+                drvr_priv = drvr->info;
+                if (drvr_priv) {
+                        struct brcmf_if *ifp;
+                        int i;
+
+                        for (i = 1; i < BRCMF_MAX_IFS; i++)
+                                if (drvr_priv->iflist[i])
+                                        brcmf_del_if(drvr_priv, i);
+
+                        ifp = drvr_priv->iflist[0];
+                        if (ifp->net->netdev_ops == &brcmf_netdev_ops_pri) {
+                                brcmf_netdev_stop(ifp->net);
+                                unregister_netdev(ifp->net);
+                        }
+
+                        if (drvr_priv->sysioc_tsk) {
+                                send_sig(SIGTERM, drvr_priv->sysioc_tsk, 1);
+                                kthread_stop(drvr_priv->sysioc_tsk);
+                                drvr_priv->sysioc_tsk = NULL;
+                        }
+
+                        brcmf_bus_detach(drvr);
+
+                        if (drvr->prot)
+                                brcmf_proto_detach(drvr);
+
+                        brcmf_cfg80211_detach();
+
+                        free_netdev(ifp->net);
+                        kfree(ifp);
+                        kfree(drvr_priv);
+                }
+        }
+}
+
+static void __exit brcmf_module_cleanup(void)
+{
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        brcmf_bus_unregister();
+}
+
+static int __init brcmf_module_init(void)
+{
+        int error;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        error = brcmf_bus_register();
+
+        if (error) {
+                BRCMF_ERROR(("%s: brcmf_bus_register failed\n", __func__));
+                goto failed;
+        }
+        return 0;
+
+failed:
+        return -EINVAL;
+}
+
+module_init(brcmf_module_init);
+module_exit(brcmf_module_cleanup);
+
+int brcmf_os_proto_block(struct brcmf_pub *drvr)
+{
+        struct brcmf_info *drvr_priv = drvr->info;
+
+        if (drvr_priv) {
+                down(&drvr_priv->proto_sem);
+                return 1;
+        }
+        return 0;
+}
+
+int brcmf_os_proto_unblock(struct brcmf_pub *drvr)
+{
+        struct brcmf_info *drvr_priv = drvr->info;
+
+        if (drvr_priv) {
+                up(&drvr_priv->proto_sem);
+                return 1;
+        }
+
+        return 0;
+}
+
+unsigned int brcmf_os_get_ioctl_resp_timeout(void)
+{
+        return (unsigned int)brcmf_ioctl_timeout_msec;
+}
+
+void brcmf_os_set_ioctl_resp_timeout(unsigned int timeout_msec)
+{
+        brcmf_ioctl_timeout_msec = (int)timeout_msec;
+}
+
+int brcmf_os_ioctl_resp_wait(struct brcmf_pub *drvr, uint *condition,
+                             bool *pending)
+{
+        struct brcmf_info *drvr_priv = drvr->info;
+        DECLARE_WAITQUEUE(wait, current);
+        int timeout = brcmf_ioctl_timeout_msec;
+
+        /* Convert timeout in millsecond to jiffies */
+        timeout = timeout * HZ / 1000;
+
+        /* Wait until control frame is available */
+        add_wait_queue(&drvr_priv->ioctl_resp_wait, &wait);
+        set_current_state(TASK_INTERRUPTIBLE);
+
+        while (!(*condition) && (!signal_pending(current) && timeout))
+                timeout = schedule_timeout(timeout);
+
+        if (signal_pending(current))
+                *pending = true;
+
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(&drvr_priv->ioctl_resp_wait, &wait);
+
+        return timeout;
+}
+
+int brcmf_os_ioctl_resp_wake(struct brcmf_pub *drvr)
+{
+        struct brcmf_info *drvr_priv = drvr->info;
+
+        if (waitqueue_active(&drvr_priv->ioctl_resp_wait))
+                wake_up_interruptible(&drvr_priv->ioctl_resp_wait);
+
+        return 0;
+}
+
+static int brcmf_host_event(struct brcmf_info *drvr_priv, int *ifidx, void *pktdata,
+                            struct brcmf_event_msg *event, void **data)
+{
+        int bcmerror = 0;
+
+        bcmerror = brcmf_c_host_event(drvr_priv, ifidx, pktdata, event, data);
+        if (bcmerror != 0)
+                return bcmerror;
+
+        if (drvr_priv->iflist[*ifidx]->net)
+                brcmf_cfg80211_event(drvr_priv->iflist[*ifidx]->net,
+                                     event, *data);
+
+        return bcmerror;
+}
+
+int brcmf_netdev_reset(struct net_device *dev, u8 flag)
+{
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **)netdev_priv(dev);
+
+        brcmf_bus_devreset(&drvr_priv->pub, flag);
+
+        return 1;
+}
+
+static int brcmf_get_pend_8021x_cnt(struct brcmf_info *drvr_priv)
+{
+        return atomic_read(&drvr_priv->pend_8021x_cnt);
+}
+
+#define MAX_WAIT_FOR_8021X_TX   10
+
+int brcmf_netdev_wait_pend8021x(struct net_device *dev)
+{
+        struct brcmf_info *drvr_priv = *(struct brcmf_info **)netdev_priv(dev);
+        int timeout = 10 * HZ / 1000;
+        int ntimes = MAX_WAIT_FOR_8021X_TX;
+        int pend = brcmf_get_pend_8021x_cnt(drvr_priv);
+
+        while (ntimes && pend) {
+                if (pend) {
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        schedule_timeout(timeout);
+                        set_current_state(TASK_RUNNING);
+                        ntimes--;
+                }
+                pend = brcmf_get_pend_8021x_cnt(drvr_priv);
+        }
+        return pend;
+}
+
+#ifdef BCMDBG
+int brcmf_write_to_file(struct brcmf_pub *drvr, u8 *buf, int size)
+{
+        int ret = 0;
+        struct file *fp;
+        mm_segment_t old_fs;
+        loff_t pos = 0;
+
+        /* change to KERNEL_DS address limit */
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+
+        /* open file to write */
+        fp = filp_open("/tmp/mem_dump", O_WRONLY | O_CREAT, 0640);
+        if (!fp) {
+                BRCMF_ERROR(("%s: open file error\n", __func__));
+                ret = -1;
+                goto exit;
+        }
+
+        /* Write buf to file */
+        fp->f_op->write(fp, buf, size, &pos);
+
+exit:
+        /* free buf before return */
+        kfree(buf);
+        /* close file before return */
+        if (fp)
+                filp_close(fp, current->files);
+        /* restore previous address limit */
+        set_fs(old_fs);
+
+        return ret;
+}
+#endif                          /* BCMDBG */
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_proto.h b/drivers/staging/brcm80211/brcmfmac/dhd_proto.h
new file mode 100644
index 00000000000..ff788b37afd
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_proto.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _BRCMF_PROTO_H_
+#define _BRCMF_PROTO_H_
+
+#ifndef IOCTL_RESP_TIMEOUT
+#define IOCTL_RESP_TIMEOUT  2000        /* In milli second */
+#endif
+
+#ifndef IOCTL_CHIP_ACTIVE_TIMEOUT
+#define IOCTL_CHIP_ACTIVE_TIMEOUT  10   /* In milli second */
+#endif
+
+/*
+ * Exported from the brcmf protocol module (brcmf_cdc)
+ */
+
+/* Linkage, sets prot link and updates hdrlen in pub */
+extern int brcmf_proto_attach(struct brcmf_pub *drvr);
+
+/* Unlink, frees allocated protocol memory (including brcmf_proto) */
+extern void brcmf_proto_detach(struct brcmf_pub *drvr);
+
+/* Initialize protocol: sync w/dongle state.
+ * Sets dongle media info (iswl, drv_version, mac address).
+ */
+extern int brcmf_proto_init(struct brcmf_pub *drvr);
+
+/* Stop protocol: sync w/dongle state. */
+extern void brcmf_proto_stop(struct brcmf_pub *drvr);
+
+/* Add any protocol-specific data header.
+ * Caller must reserve prot_hdrlen prepend space.
+ */
+extern void brcmf_proto_hdrpush(struct brcmf_pub *, int ifidx,
+                                struct sk_buff *txp);
+
+/* Remove any protocol-specific data header. */
+extern int brcmf_proto_hdrpull(struct brcmf_pub *, int *ifidx,
+                               struct sk_buff *rxp);
+
+/* Use protocol to issue ioctl to dongle */
+extern int brcmf_proto_ioctl(struct brcmf_pub *drvr, int ifidx,
+                             struct brcmf_ioctl *ioc, void *buf, int len);
+
+/* Add prot dump output to a buffer */
+extern void brcmf_proto_dump(struct brcmf_pub *drvr,
+                             struct brcmu_strbuf *strbuf);
+
+/* Update local copy of dongle statistics */
+extern void brcmf_proto_dstats(struct brcmf_pub *drvr);
+
+extern int brcmf_c_ioctl(struct brcmf_pub *drvr, struct brcmf_c_ioctl *ioc,
+                         void *buf, uint buflen);
+
+extern int brcmf_c_preinit_ioctls(struct brcmf_pub *drvr);
+
+extern int brcmf_proto_cdc_set_ioctl(struct brcmf_pub *drvr, int ifidx,
+                                     uint cmd, void *buf, uint len);
+
+#endif                          /* _BRCMF_PROTO_H_ */
diff --git a/drivers/staging/brcm80211/brcmfmac/dhd_sdio.c b/drivers/staging/brcm80211/brcmfmac/dhd_sdio.c
new file mode 100644
index 00000000000..7fa95b6213c
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/dhd_sdio.c
@@ -0,0 +1,6772 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/printk.h>
+#include <linux/pci_ids.h>
+#include <linux/netdevice.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/mmc/sdio.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/semaphore.h>
+#include <linux/firmware.h>
+#include <asm/unaligned.h>
+#include <defs.h>
+#include <brcmu_wifi.h>
+#include <brcmu_utils.h>
+#include <brcm_hw_ids.h>
+#include <soc.h>
+#include "sdio_host.h"
+
+/* register access macros */
+#ifndef __BIG_ENDIAN
+#ifndef __mips__
+#define R_REG(r, typ) \
+        brcmf_sdcard_reg_read(NULL, (r), sizeof(typ))
+#else                           /* __mips__ */
+#define R_REG(r, typ) \
+        ({ \
+                __typeof(*(r)) __osl_v; \
+                __asm__ __volatile__("sync"); \
+                __osl_v = brcmf_sdcard_reg_read(NULL, (r),\
+                                          sizeof(typ)); \
+                __asm__ __volatile__("sync"); \
+                __osl_v; \
+        })
+#endif                          /* __mips__ */
+
+#else                           /* __BIG_ENDIAN */
+#define R_REG(r, typ) \
+        brcmf_sdcard_reg_read(NULL, (r), sizeof(typ))
+#endif                          /* __BIG_ENDIAN */
+
+#define OR_REG(r, v, typ) \
+        brcmf_sdcard_reg_write(NULL, (r), sizeof(typ), R_REG(r, typ) | (v))
+
+#ifdef BCMDBG
+
+/* ARM trap handling */
+
+/* Trap types defined by ARM (see arminc.h) */
+
+#if defined(__ARM_ARCH_4T__)
+#define MAX_TRAP_TYPE   (TR_FIQ + 1)
+#elif defined(__ARM_ARCH_7M__)
+#define MAX_TRAP_TYPE   (TR_ISR + ARMCM3_NUMINTS)
+#endif                          /* __ARM_ARCH_7M__ */
+
+/* The trap structure is defined here as offsets for assembly */
+#define TR_TYPE         0x00
+#define TR_EPC          0x04
+#define TR_CPSR         0x08
+#define TR_SPSR         0x0c
+#define TR_REGS         0x10
+#define TR_REG(n)       (TR_REGS + (n) * 4)
+#define TR_SP           TR_REG(13)
+#define TR_LR           TR_REG(14)
+#define TR_PC           TR_REG(15)
+
+#define TRAP_T_SIZE     80
+
+struct brcmf_trap {
+        u32 type;
+        u32 epc;
+        u32 cpsr;
+        u32 spsr;
+        u32 r0;
+        u32 r1;
+        u32 r2;
+        u32 r3;
+        u32 r4;
+        u32 r5;
+        u32 r6;
+        u32 r7;
+        u32 r8;
+        u32 r9;
+        u32 r10;
+        u32 r11;
+        u32 r12;
+        u32 r13;
+        u32 r14;
+        u32 pc;
+};
+
+#define CBUF_LEN        (128)
+
+struct rte_log {
+        u32 buf;                /* Can't be pointer on (64-bit) hosts */
+        uint buf_size;
+        uint idx;
+        char *_buf_compat;      /* Redundant pointer for backward compat. */
+};
+
+struct rte_console {
+        /* Virtual UART
+         * When there is no UART (e.g. Quickturn),
+         * the host should write a complete
+         * input line directly into cbuf and then write
+         * the length into vcons_in.
+         * This may also be used when there is a real UART
+         * (at risk of conflicting with
+         * the real UART).  vcons_out is currently unused.
+         */
+        volatile uint vcons_in;
+        volatile uint vcons_out;
+
+        /* Output (logging) buffer
+         * Console output is written to a ring buffer log_buf at index log_idx.
+         * The host may read the output when it sees log_idx advance.
+         * Output will be lost if the output wraps around faster than the host
+         * polls.
+         */
+        struct rte_log log;
+
+        /* Console input line buffer
+         * Characters are read one at a time into cbuf
+         * until <CR> is received, then
+         * the buffer is processed as a command line.
+         * Also used for virtual UART.
+         */
+        uint cbuf_idx;
+        char cbuf[CBUF_LEN];
+};
+
+#endif                          /* BCMDBG */
+#include <chipcommon.h>
+
+#include "dhd.h"
+#include "dhd_bus.h"
+#include "dhd_proto.h"
+#include "dhd_dbg.h"
+#include <bcmchip.h>
+
+#define TXQLEN          2048    /* bulk tx queue length */
+#define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
+#define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
+#define PRIOMASK        7
+
+#define TXRETRIES       2       /* # of retries for tx frames */
+
+#define BRCMF_RXBOUND   50      /* Default for max rx frames in
+                                 one scheduling */
+
+#define BRCMF_TXBOUND   20      /* Default for max tx frames in
+                                 one scheduling */
+
+#define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
+
+#define MEMBLOCK        2048    /* Block size used for downloading
+                                 of dongle image */
+#define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
+                                 biggest possible glom */
+
+#ifndef BRCMF_FIRSTREAD
+#define BRCMF_FIRSTREAD 32
+#endif
+
+#if !ISPOWEROF2(BRCMF_FIRSTREAD)
+#error BRCMF_FIRSTREAD is not a power of 2!
+#endif
+
+/* SBSDIO_DEVICE_CTL */
+#define SBSDIO_DEVCTL_SETBUSY           0x01    /* 1: device will assert busy signal when
+                                                 * receiving CMD53
+                                                 */
+#define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02    /* 1: assertion of sdio interrupt is
+                                                 * synchronous to the sdio clock
+                                                 */
+#define SBSDIO_DEVCTL_CA_INT_ONLY       0x04    /* 1: mask all interrupts to host
+                                                 * except the chipActive (rev 8)
+                                                 */
+#define SBSDIO_DEVCTL_PADS_ISO          0x08    /* 1: isolate internal sdio signals, put
+                                                 * external pads in tri-state; requires
+                                                 * sdio bus power cycle to clear (rev 9)
+                                                 */
+#define SBSDIO_DEVCTL_SB_RST_CTL        0x30    /* Force SD->SB reset mapping (rev 11) */
+#define SBSDIO_DEVCTL_RST_CORECTL       0x00    /*   Determined by CoreControl bit */
+#define SBSDIO_DEVCTL_RST_BPRESET       0x10    /*   Force backplane reset */
+#define SBSDIO_DEVCTL_RST_NOBPRESET     0x20    /*   Force no backplane reset */
+
+/* SBSDIO_FUNC1_CHIPCLKCSR */
+#define SBSDIO_FORCE_ALP                0x01    /* Force ALP request to backplane */
+#define SBSDIO_FORCE_HT                 0x02    /* Force HT request to backplane */
+#define SBSDIO_FORCE_ILP                0x04    /* Force ILP request to backplane */
+#define SBSDIO_ALP_AVAIL_REQ            0x08    /* Make ALP ready (power up xtal) */
+#define SBSDIO_HT_AVAIL_REQ             0x10    /* Make HT ready (power up PLL) */
+#define SBSDIO_FORCE_HW_CLKREQ_OFF      0x20    /* Squelch clock requests from HW */
+#define SBSDIO_ALP_AVAIL                0x40    /* Status: ALP is ready */
+#define SBSDIO_HT_AVAIL                 0x80    /* Status: HT is ready */
+
+#define SBSDIO_AVBITS                   (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
+#define SBSDIO_ALPAV(regval)            ((regval) & SBSDIO_AVBITS)
+#define SBSDIO_HTAV(regval)             (((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
+#define SBSDIO_ALPONLY(regval)          (SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
+#define SBSDIO_CLKAV(regval, alponly)   (SBSDIO_ALPAV(regval) && \
+                                        (alponly ? 1 : SBSDIO_HTAV(regval)))
+/* direct(mapped) cis space */
+#define SBSDIO_CIS_BASE_COMMON          0x1000  /* MAPPED common CIS address */
+#define SBSDIO_CIS_SIZE_LIMIT           0x200   /* maximum bytes in one CIS */
+#define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF /* cis offset addr is < 17 bits */
+
+#define SBSDIO_CIS_MANFID_TUPLE_LEN     6       /* manfid tuple length, include tuple,
+                                                 * link bytes
+                                                 */
+
+/* intstatus */
+#define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
+#define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
+#define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
+#define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
+#define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
+#define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
+#define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
+#define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
+#define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
+#define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
+#define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
+#define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
+#define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
+#define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
+#define I_PC            (1 << 10)       /* descriptor error */
+#define I_PD            (1 << 11)       /* data error */
+#define I_DE            (1 << 12)       /* Descriptor protocol Error */
+#define I_RU            (1 << 13)       /* Receive descriptor Underflow */
+#define I_RO            (1 << 14)       /* Receive fifo Overflow */
+#define I_XU            (1 << 15)       /* Transmit fifo Underflow */
+#define I_RI            (1 << 16)       /* Receive Interrupt */
+#define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
+#define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
+#define I_XI            (1 << 24)       /* Transmit Interrupt */
+#define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
+#define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
+#define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
+#define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
+#define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
+#define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
+#define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
+#define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
+#define I_DMA           (I_RI | I_XI | I_ERRORS)
+
+/* corecontrol */
+#define CC_CISRDY               (1 << 0)        /* CIS Ready */
+#define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
+#define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
+#define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
+#define CC_XMTDATAAVAIL_MODE    (1 << 4)
+#define CC_XMTDATAAVAIL_CTRL    (1 << 5)
+
+/* SDA_FRAMECTRL */
+#define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
+#define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
+#define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
+#define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
+
+/* HW frame tag */
+#define SDPCM_FRAMETAG_LEN      4       /* 2 bytes len, 2 bytes check val */
+
+/* Total length of frame header for dongle protocol */
+#define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
+#ifdef SDTEST
+#define SDPCM_RESERVE   (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + BRCMF_SDALIGN)
+#else
+#define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
+#endif
+
+/*
+ * Software allocation of To SB Mailbox resources
+ */
+
+/* tosbmailbox bits corresponding to intstatus bits */
+#define SMB_NAK         (1 << 0)        /* Frame NAK */
+#define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
+#define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
+#define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
+
+/* tosbmailboxdata */
+#define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
+
+/*
+ * Software allocation of To Host Mailbox resources
+ */
+
+/* intstatus bits */
+#define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
+#define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
+#define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
+#define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
+
+/* tohostmailboxdata */
+#define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
+#define HMB_DATA_DEVREADY       2       /* talk to host after enable */
+#define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
+#define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
+
+#define HMB_DATA_FCDATA_MASK    0xff000000
+#define HMB_DATA_FCDATA_SHIFT   24
+
+#define HMB_DATA_VERSION_MASK   0x00ff0000
+#define HMB_DATA_VERSION_SHIFT  16
+
+/*
+ * Software-defined protocol header
+ */
+
+/* Current protocol version */
+#define SDPCM_PROT_VERSION      4
+
+/* SW frame header */
+#define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
+
+#define SDPCM_CHANNEL_MASK              0x00000f00
+#define SDPCM_CHANNEL_SHIFT             8
+#define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
+
+#define SDPCM_NEXTLEN_OFFSET            2
+
+/* Data Offset from SOF (HW Tag, SW Tag, Pad) */
+#define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
+#define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
+#define SDPCM_DOFFSET_MASK              0xff000000
+#define SDPCM_DOFFSET_SHIFT             24
+#define SDPCM_FCMASK_OFFSET             4       /* Flow control */
+#define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
+#define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
+#define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
+
+#define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
+
+/* logical channel numbers */
+#define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
+#define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
+#define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
+#define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
+#define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
+
+#define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
+
+#define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
+
+/* For TEST_CHANNEL packets, define another 4-byte header */
+#define SDPCM_TEST_HDRLEN       4       /*
+                                         * Generally: Cmd(1), Ext(1), Len(2);
+                                         * Semantics of Ext byte depend on
+                                         * command. Len is current or requested
+                                         * frame length, not including test
+                                         * header; sent little-endian.
+                                         */
+#define SDPCM_TEST_DISCARD      0x01    /* Receiver discards. Ext:pattern id. */
+#define SDPCM_TEST_ECHOREQ      0x02    /* Echo request. Ext:pattern id. */
+#define SDPCM_TEST_ECHORSP      0x03    /* Echo response. Ext:pattern id. */
+#define SDPCM_TEST_BURST        0x04    /*
+                                         * Receiver to send a burst.
+                                         * Ext is a frame count
+                                         */
+#define SDPCM_TEST_SEND         0x05    /*
+                                         * Receiver sets send mode.
+                                         * Ext is boolean on/off
+                                         */
+
+/* Handy macro for filling in datagen packets with a pattern */
+#define SDPCM_TEST_FILL(byteno, id)     ((u8)(id + byteno))
+
+/*
+ * Shared structure between dongle and the host.
+ * The structure contains pointers to trap or assert information.
+ */
+#define SDPCM_SHARED_VERSION       0x0002
+#define SDPCM_SHARED_VERSION_MASK  0x00FF
+#define SDPCM_SHARED_ASSERT_BUILT  0x0100
+#define SDPCM_SHARED_ASSERT        0x0200
+#define SDPCM_SHARED_TRAP          0x0400
+
+
+/* Space for header read, limit for data packets */
+#ifndef MAX_HDR_READ
+#define MAX_HDR_READ    32
+#endif
+#if !ISPOWEROF2(MAX_HDR_READ)
+#error MAX_HDR_READ is not a power of 2!
+#endif
+
+#define MAX_RX_DATASZ   2048
+
+/* Maximum milliseconds to wait for F2 to come up */
+#define BRCMF_WAIT_F2RDY        3000
+
+/* Bump up limit on waiting for HT to account for first startup;
+ * if the image is doing a CRC calculation before programming the PMU
+ * for HT availability, it could take a couple hundred ms more, so
+ * max out at a 1 second (1000000us).
+ */
+#if (PMU_MAX_TRANSITION_DLY <= 1000000)
+#undef PMU_MAX_TRANSITION_DLY
+#define PMU_MAX_TRANSITION_DLY 1000000
+#endif
+
+/* Value for ChipClockCSR during initial setup */
+#define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
+                                        SBSDIO_ALP_AVAIL_REQ)
+
+/* Flags for SDH calls */
+#define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
+
+/* sbimstate */
+#define SBIM_IBE                0x20000 /* inbanderror */
+#define SBIM_TO                 0x40000 /* timeout */
+#define SBIM_BY                 0x01800000      /* busy (sonics >= 2.3) */
+#define SBIM_RJ                 0x02000000      /* reject (sonics >= 2.3) */
+
+/* sbtmstatelow */
+#define SBTML_RESET             0x0001  /* reset */
+#define SBTML_REJ_MASK          0x0006  /* reject field */
+#define SBTML_REJ               0x0002  /* reject */
+#define SBTML_TMPREJ            0x0004  /* temporary reject, for error recovery */
+
+#define SBTML_SICF_SHIFT        16      /* Shift to locate the SI control flags in sbtml */
+
+/* sbtmstatehigh */
+#define SBTMH_SERR              0x0001  /* serror */
+#define SBTMH_INT               0x0002  /* interrupt */
+#define SBTMH_BUSY              0x0004  /* busy */
+#define SBTMH_TO                0x0020  /* timeout (sonics >= 2.3) */
+
+#define SBTMH_SISF_SHIFT        16      /* Shift to locate the SI status flags in sbtmh */
+
+/* sbidlow */
+#define SBIDL_INIT              0x80    /* initiator */
+
+/* sbidhigh */
+#define SBIDH_RC_MASK           0x000f  /* revision code */
+#define SBIDH_RCE_MASK          0x7000  /* revision code extension field */
+#define SBIDH_RCE_SHIFT         8
+#define SBCOREREV(sbidh) \
+        ((((sbidh) & SBIDH_RCE_MASK) >> SBIDH_RCE_SHIFT) | ((sbidh) & SBIDH_RC_MASK))
+#define SBIDH_CC_MASK           0x8ff0  /* core code */
+#define SBIDH_CC_SHIFT          4
+#define SBIDH_VC_MASK           0xffff0000      /* vendor code */
+#define SBIDH_VC_SHIFT          16
+
+/*
+ * Conversion of 802.1D priority to precedence level
+ */
+#define PRIO2PREC(prio) \
+        (((prio) == PRIO_8021D_NONE || (prio) == PRIO_8021D_BE) ? \
+        ((prio^2)) : (prio))
+
+BRCMF_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
+
+/*
+ * Core reg address translation.
+ * Both macro's returns a 32 bits byte address on the backplane bus.
+ */
+#define CORE_CC_REG(base, field)        (base + offsetof(chipcregs_t, field))
+#define CORE_BUS_REG(base, field) \
+                (base + offsetof(struct sdpcmd_regs, field))
+#define CORE_SB(base, field) \
+                (base + SBCONFIGOFF + offsetof(struct sbconfig, field))
+
+/* core registers */
+struct sdpcmd_regs {
+        u32 corecontrol;                /* 0x00, rev8 */
+        u32 corestatus;                 /* rev8 */
+        u32 PAD[1];
+        u32 biststatus;                 /* rev8 */
+
+        /* PCMCIA access */
+        u16 pcmciamesportaladdr;        /* 0x010, rev8 */
+        u16 PAD[1];
+        u16 pcmciamesportalmask;        /* rev8 */
+        u16 PAD[1];
+        u16 pcmciawrframebc;            /* rev8 */
+        u16 PAD[1];
+        u16 pcmciaunderflowtimer;       /* rev8 */
+        u16 PAD[1];
+
+        /* interrupt */
+        u32 intstatus;                  /* 0x020, rev8 */
+        u32 hostintmask;                /* rev8 */
+        u32 intmask;                    /* rev8 */
+        u32 sbintstatus;                /* rev8 */
+        u32 sbintmask;                  /* rev8 */
+        u32 funcintmask;                /* rev4 */
+        u32 PAD[2];
+        u32 tosbmailbox;                /* 0x040, rev8 */
+        u32 tohostmailbox;              /* rev8 */
+        u32 tosbmailboxdata;            /* rev8 */
+        u32 tohostmailboxdata;          /* rev8 */
+
+        /* synchronized access to registers in SDIO clock domain */
+        u32 sdioaccess;                 /* 0x050, rev8 */
+        u32 PAD[3];
+
+        /* PCMCIA frame control */
+        u8 pcmciaframectrl;             /* 0x060, rev8 */
+        u8 PAD[3];
+        u8 pcmciawatermark;             /* rev8 */
+        u8 PAD[155];
+
+        /* interrupt batching control */
+        u32 intrcvlazy;                 /* 0x100, rev8 */
+        u32 PAD[3];
+
+        /* counters */
+        u32 cmd52rd;                    /* 0x110, rev8 */
+        u32 cmd52wr;                    /* rev8 */
+        u32 cmd53rd;                    /* rev8 */
+        u32 cmd53wr;                    /* rev8 */
+        u32 abort;                      /* rev8 */
+        u32 datacrcerror;               /* rev8 */
+        u32 rdoutofsync;                /* rev8 */
+        u32 wroutofsync;                /* rev8 */
+        u32 writebusy;                  /* rev8 */
+        u32 readwait;                   /* rev8 */
+        u32 readterm;                   /* rev8 */
+        u32 writeterm;                  /* rev8 */
+        u32 PAD[40];
+        u32 clockctlstatus;             /* rev8 */
+        u32 PAD[7];
+
+        u32 PAD[128];                   /* DMA engines */
+
+        /* SDIO/PCMCIA CIS region */
+        char cis[512];                  /* 0x400-0x5ff, rev6 */
+
+        /* PCMCIA function control registers */
+        char pcmciafcr[256];            /* 0x600-6ff, rev6 */
+        u16 PAD[55];
+
+        /* PCMCIA backplane access */
+        u16 backplanecsr;               /* 0x76E, rev6 */
+        u16 backplaneaddr0;             /* rev6 */
+        u16 backplaneaddr1;             /* rev6 */
+        u16 backplaneaddr2;             /* rev6 */
+        u16 backplaneaddr3;             /* rev6 */
+        u16 backplanedata0;             /* rev6 */
+        u16 backplanedata1;             /* rev6 */
+        u16 backplanedata2;             /* rev6 */
+        u16 backplanedata3;             /* rev6 */
+        u16 PAD[31];
+
+        /* sprom "size" & "blank" info */
+        u16 spromstatus;                /* 0x7BE, rev2 */
+        u32 PAD[464];
+
+        u16 PAD[0x80];
+};
+
+#ifdef BCMDBG
+/* Device console log buffer state */
+struct brcmf_console {
+        uint count;             /* Poll interval msec counter */
+        uint log_addr;          /* Log struct address (fixed) */
+        struct rte_log log;     /* Log struct (host copy) */
+        uint bufsize;           /* Size of log buffer */
+        u8 *buf;                /* Log buffer (host copy) */
+        uint last;              /* Last buffer read index */
+};
+#endif                          /* BCMDBG */
+
+struct sdpcm_shared {
+        u32 flags;
+        u32 trap_addr;
+        u32 assert_exp_addr;
+        u32 assert_file_addr;
+        u32 assert_line;
+        u32 console_addr;       /* Address of struct rte_console */
+        u32 msgtrace_addr;
+        u8 tag[32];
+};
+
+
+/* misc chip info needed by some of the routines */
+struct chip_info {
+        u32 chip;
+        u32 chiprev;
+        u32 cccorebase;
+        u32 ccrev;
+        u32 cccaps;
+        u32 buscorebase; /* 32 bits backplane bus address */
+        u32 buscorerev;
+        u32 buscoretype;
+        u32 ramcorebase;
+        u32 armcorebase;
+        u32 pmurev;
+        u32 ramsize;
+};
+
+/* Private data for SDIO bus interaction */
+struct brcmf_bus {
+        struct brcmf_pub *drvr;
+
+        struct brcmf_sdio_card *card;   /* Handle for sdio card calls */
+        struct chip_info *ci;   /* Chip info struct */
+        char *vars;             /* Variables (from CIS and/or other) */
+        uint varsz;             /* Size of variables buffer */
+
+        u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
+        u32 orig_ramsize;       /* Size of RAM in SOCRAM (bytes) */
+
+        u32 bus;                /* gSPI or SDIO bus */
+        u32 hostintmask;        /* Copy of Host Interrupt Mask */
+        u32 intstatus;  /* Intstatus bits (events) pending */
+        bool dpc_sched;         /* Indicates DPC schedule (intrpt rcvd) */
+        bool fcstate;           /* State of dongle flow-control */
+
+        u16 cl_devid;   /* cached devid for brcmf_sdio_probe_attach() */
+
+        uint blocksize;         /* Block size of SDIO transfers */
+        uint roundup;           /* Max roundup limit */
+
+        struct pktq txq;        /* Queue length used for flow-control */
+        u8 flowcontrol; /* per prio flow control bitmask */
+        u8 tx_seq;              /* Transmit sequence number (next) */
+        u8 tx_max;              /* Maximum transmit sequence allowed */
+
+        u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
+        u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
+        u16 nextlen;            /* Next Read Len from last header */
+        u8 rx_seq;              /* Receive sequence number (expected) */
+        bool rxskip;            /* Skip receive (awaiting NAK ACK) */
+
+        struct sk_buff *glomd;  /* Packet containing glomming descriptor */
+        struct sk_buff *glom;   /* Packet chain for glommed superframe */
+        uint glomerr;           /* Glom packet read errors */
+
+        u8 *rxbuf;              /* Buffer for receiving control packets */
+        uint rxblen;            /* Allocated length of rxbuf */
+        u8 *rxctl;              /* Aligned pointer into rxbuf */
+        u8 *databuf;            /* Buffer for receiving big glom packet */
+        u8 *dataptr;            /* Aligned pointer into databuf */
+        uint rxlen;             /* Length of valid data in buffer */
+
+        u8 sdpcm_ver;   /* Bus protocol reported by dongle */
+
+        bool intr;              /* Use interrupts */
+        bool poll;              /* Use polling */
+        bool ipend;             /* Device interrupt is pending */
+        bool intdis;            /* Interrupts disabled by isr */
+        uint intrcount;         /* Count of device interrupt callbacks */
+        uint lastintrs;         /* Count as of last watchdog timer */
+        uint spurious;          /* Count of spurious interrupts */
+        uint pollrate;          /* Ticks between device polls */
+        uint polltick;          /* Tick counter */
+        uint pollcnt;           /* Count of active polls */
+
+#ifdef BCMDBG
+        struct brcmf_console console;   /* Console output polling support */
+        uint console_addr;      /* Console address from shared struct */
+#endif                          /* BCMDBG */
+
+        uint regfails;          /* Count of R_REG failures */
+
+        uint clkstate;          /* State of sd and backplane clock(s) */
+        bool activity;          /* Activity flag for clock down */
+        s32 idletime;           /* Control for activity timeout */
+        s32 idlecount;  /* Activity timeout counter */
+        s32 idleclock;  /* How to set bus driver when idle */
+        s32 sd_rxchain;
+        bool use_rxchain;       /* If brcmf should use PKT chains */
+        bool sleeping;          /* Is SDIO bus sleeping? */
+        bool rxflow_mode;       /* Rx flow control mode */
+        bool rxflow;            /* Is rx flow control on */
+        bool alp_only;          /* Don't use HT clock (ALP only) */
+/* Field to decide if rx of control frames happen in rxbuf or lb-pool */
+        bool usebufpool;
+
+#ifdef SDTEST
+        /* external loopback */
+        bool ext_loop;
+        u8 loopid;
+
+        /* pktgen configuration */
+        uint pktgen_freq;       /* Ticks between bursts */
+        uint pktgen_count;      /* Packets to send each burst */
+        uint pktgen_print;      /* Bursts between count displays */
+        uint pktgen_total;      /* Stop after this many */
+        uint pktgen_minlen;     /* Minimum packet data len */
+        uint pktgen_maxlen;     /* Maximum packet data len */
+        uint pktgen_mode;       /* Configured mode: tx, rx, or echo */
+        uint pktgen_stop;       /* Number of tx failures causing stop */
+
+        /* active pktgen fields */
+        uint pktgen_tick;       /* Tick counter for bursts */
+        uint pktgen_ptick;      /* Burst counter for printing */
+        uint pktgen_sent;       /* Number of test packets generated */
+        uint pktgen_rcvd;       /* Number of test packets received */
+        uint pktgen_fail;       /* Number of failed send attempts */
+        u16 pktgen_len; /* Length of next packet to send */
+#endif                          /* SDTEST */
+
+        /* Some additional counters */
+        uint tx_sderrs;         /* Count of tx attempts with sd errors */
+        uint fcqueued;          /* Tx packets that got queued */
+        uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
+        uint rx_toolong;        /* Receive frames too long to receive */
+        uint rxc_errors;        /* SDIO errors when reading control frames */
+        uint rx_hdrfail;        /* SDIO errors on header reads */
+        uint rx_badhdr;         /* Bad received headers (roosync?) */
+        uint rx_badseq;         /* Mismatched rx sequence number */
+        uint fc_rcvd;           /* Number of flow-control events received */
+        uint fc_xoff;           /* Number which turned on flow-control */
+        uint fc_xon;            /* Number which turned off flow-control */
+        uint rxglomfail;        /* Failed deglom attempts */
+        uint rxglomframes;      /* Number of glom frames (superframes) */
+        uint rxglompkts;        /* Number of packets from glom frames */
+        uint f2rxhdrs;          /* Number of header reads */
+        uint f2rxdata;          /* Number of frame data reads */
+        uint f2txdata;          /* Number of f2 frame writes */
+        uint f1regdata;         /* Number of f1 register accesses */
+
+        u8 *ctrl_frame_buf;
+        u32 ctrl_frame_len;
+        bool ctrl_frame_stat;
+
+        spinlock_t txqlock;
+        wait_queue_head_t ctrl_wait;
+
+        struct timer_list timer;
+        struct completion watchdog_wait;
+        struct task_struct *watchdog_tsk;
+        bool wd_timer_valid;
+
+        struct tasklet_struct tasklet;
+        struct task_struct *dpc_tsk;
+        struct completion dpc_wait;
+
+        bool threads_only;
+        struct semaphore sdsem;
+        spinlock_t sdlock;
+
+        const char *fw_name;
+        const struct firmware *firmware;
+        const char *nv_name;
+        u32 fw_ptr;
+};
+
+struct sbconfig {
+        u32 PAD[2];
+        u32 sbipsflag;  /* initiator port ocp slave flag */
+        u32 PAD[3];
+        u32 sbtpsflag;  /* target port ocp slave flag */
+        u32 PAD[11];
+        u32 sbtmerrloga;        /* (sonics >= 2.3) */
+        u32 PAD;
+        u32 sbtmerrlog; /* (sonics >= 2.3) */
+        u32 PAD[3];
+        u32 sbadmatch3; /* address match3 */
+        u32 PAD;
+        u32 sbadmatch2; /* address match2 */
+        u32 PAD;
+        u32 sbadmatch1; /* address match1 */
+        u32 PAD[7];
+        u32 sbimstate;  /* initiator agent state */
+        u32 sbintvec;   /* interrupt mask */
+        u32 sbtmstatelow;       /* target state */
+        u32 sbtmstatehigh;      /* target state */
+        u32 sbbwa0;             /* bandwidth allocation table0 */
+        u32 PAD;
+        u32 sbimconfiglow;      /* initiator configuration */
+        u32 sbimconfighigh;     /* initiator configuration */
+        u32 sbadmatch0; /* address match0 */
+        u32 PAD;
+        u32 sbtmconfiglow;      /* target configuration */
+        u32 sbtmconfighigh;     /* target configuration */
+        u32 sbbconfig;  /* broadcast configuration */
+        u32 PAD;
+        u32 sbbstate;   /* broadcast state */
+        u32 PAD[3];
+        u32 sbactcnfg;  /* activate configuration */
+        u32 PAD[3];
+        u32 sbflagst;   /* current sbflags */
+        u32 PAD[3];
+        u32 sbidlow;            /* identification */
+        u32 sbidhigh;   /* identification */
+};
+
+/* clkstate */
+#define CLK_NONE        0
+#define CLK_SDONLY      1
+#define CLK_PENDING     2       /* Not used yet */
+#define CLK_AVAIL       3
+
+#define BRCMF_NOPMU(brcmf)      (false)
+
+#ifdef BCMDBG
+static int qcount[NUMPRIO];
+static int tx_packets[NUMPRIO];
+#endif                          /* BCMDBG */
+
+/* Deferred transmit */
+uint brcmf_deferred_tx = 1;
+module_param(brcmf_deferred_tx, uint, 0);
+
+/* Watchdog thread priority, -1 to use kernel timer */
+int brcmf_watchdog_prio = 97;
+module_param(brcmf_watchdog_prio, int, 0);
+
+/* Watchdog interval */
+uint brcmf_watchdog_ms = 10;
+module_param(brcmf_watchdog_ms, uint, 0);
+
+/* DPC thread priority, -1 to use tasklet */
+int brcmf_dpc_prio = 98;
+module_param(brcmf_dpc_prio, int, 0);
+
+#ifdef BCMDBG
+/* Console poll interval */
+uint brcmf_console_ms;
+module_param(brcmf_console_ms, uint, 0);
+#endif          /* BCMDBG */
+
+/* Tx/Rx bounds */
+uint brcmf_txbound;
+uint brcmf_rxbound;
+uint brcmf_txminmax;
+
+/* override the RAM size if possible */
+#define DONGLE_MIN_MEMSIZE (128 * 1024)
+int brcmf_dongle_memsize;
+
+static bool brcmf_alignctl;
+
+static bool sd1idle;
+
+static bool retrydata;
+#define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
+
+static const uint watermark = 8;
+static const uint firstread = BRCMF_FIRSTREAD;
+
+/* Retry count for register access failures */
+static const uint retry_limit = 2;
+
+/* Force even SD lengths (some host controllers mess up on odd bytes) */
+static bool forcealign;
+
+#define ALIGNMENT  4
+
+#define PKTALIGN(_p, _len, _align)                              \
+        do {                                                            \
+                uint datalign;                                          \
+                datalign = (unsigned long)((_p)->data);                 \
+                datalign = roundup(datalign, (_align)) - datalign;      \
+                if (datalign)                                           \
+                        skb_pull((_p), datalign);                       \
+                __skb_trim((_p), (_len));                               \
+        } while (0)
+
+/* Limit on rounding up frames */
+static const uint max_roundup = 512;
+
+/* Try doing readahead */
+static bool brcmf_readahead;
+
+/* To check if there's window offered */
+#define DATAOK(bus) \
+        (((u8)(bus->tx_max - bus->tx_seq) != 0) && \
+        (((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
+
+/*
+ * Reads a register in the SDIO hardware block. This block occupies a series of
+ * adresses on the 32 bit backplane bus.
+ */
+static void
+r_sdreg32(struct brcmf_bus *bus, u32 *regvar, u32 reg_offset, u32 *retryvar)
+{
+        *retryvar = 0;
+        do {
+                *regvar = R_REG(bus->ci->buscorebase + reg_offset, u32);
+        } while (brcmf_sdcard_regfail(bus->card) &&
+                 (++(*retryvar) <= retry_limit));
+        if (*retryvar) {
+                bus->regfails += (*retryvar-1);
+                if (*retryvar > retry_limit) {
+                        BRCMF_ERROR(("FAILED READ %Xh\n", reg_offset));
+                        *regvar = 0;
+                }
+        }
+}
+
+static void
+w_sdreg32(struct brcmf_bus *bus, u32 regval, u32 reg_offset, u32 *retryvar)
+{
+        *retryvar = 0;
+        do {
+                brcmf_sdcard_reg_write(NULL, bus->ci->buscorebase + reg_offset,
+                                       sizeof(u32), regval);
+        } while (brcmf_sdcard_regfail(bus->card) &&
+                 (++(*retryvar) <= retry_limit));
+        if (*retryvar) {
+                bus->regfails += (*retryvar-1);
+                if (*retryvar > retry_limit)
+                        BRCMF_ERROR(("FAILED REGISTER WRITE"
+                                     " %Xh\n", reg_offset));
+        }
+}
+
+#define BRCMF_BUS                       SDIO_BUS
+
+#define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
+
+#define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
+
+#ifdef SDTEST
+static void brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, void *pkt, uint seq);
+static void brcmf_sdbrcm_sdtest_set(struct brcmf_bus *bus, bool start);
+#endif
+
+#ifdef BCMDBG
+static int brcmf_sdbrcm_bus_console_in(struct brcmf_pub *drvr,
+                                       unsigned char *msg, uint msglen);
+static int brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, u8 *data, uint size);
+static int brcmf_sdbrcm_mem_dump(struct brcmf_bus *bus);
+#endif                          /* BCMDBG  */
+static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter);
+
+static void brcmf_sdbrcm_release(struct brcmf_bus *bus);
+static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus);
+static void brcmf_sdbrcm_disconnect(void *ptr);
+static bool brcmf_sdbrcm_chipmatch(u16 chipid);
+static bool brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, void *card,
+                                      u32 regsva, u16 devid);
+static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus, void *card);
+static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus, void *card);
+static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus);
+
+static uint brcmf_process_nvram_vars(char *varbuf, uint len);
+
+static void brcmf_sdbrcm_setmemsize(struct brcmf_bus *bus, int mem_size);
+static int brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn,
+                               uint flags, u8 *buf, uint nbytes,
+                               struct sk_buff *pkt,
+                               void (*complete)(void *handle, int status,
+                                                      bool sync_waiting),
+                               void *handle);
+
+static bool brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus, void *card);
+static int  _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus);
+
+static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus);
+static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus);
+
+static void
+brcmf_sdbrcm_chip_disablecore(struct brcmf_sdio_card *card, u32 corebase);
+
+static int brcmf_sdbrcm_chip_attach(struct brcmf_bus *bus, u32 regs);
+
+static void
+brcmf_sdbrcm_chip_resetcore(struct brcmf_sdio_card *card, u32 corebase);
+
+static void brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus,
+                                        u32 drivestrength);
+static void brcmf_sdbrcm_chip_detach(struct brcmf_bus *bus);
+static void brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar);
+static void brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus);
+static void brcmf_sdbrcm_watchdog(unsigned long data);
+static int brcmf_sdbrcm_watchdog_thread(void *data);
+static int brcmf_sdbrcm_dpc_thread(void *data);
+static void brcmf_sdbrcm_dpc_tasklet(unsigned long data);
+static void brcmf_sdbrcm_sched_dpc(struct brcmf_bus *bus);
+static void brcmf_sdbrcm_sdlock(struct brcmf_bus *bus);
+static void brcmf_sdbrcm_sdunlock(struct brcmf_bus *bus);
+static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus);
+
+/* Packet free applicable unconditionally for sdio and sdspi.
+ * Conditional if bufpool was present for gspi bus.
+ */
+static void brcmf_sdbrcm_pktfree2(struct brcmf_bus *bus, struct sk_buff *pkt)
+{
+        if ((bus->bus != SPI_BUS) || bus->usebufpool)
+                brcmu_pkt_buf_free_skb(pkt);
+}
+
+static void brcmf_sdbrcm_setmemsize(struct brcmf_bus *bus, int mem_size)
+{
+        s32 min_size = DONGLE_MIN_MEMSIZE;
+        /* Restrict the memsize to user specified limit */
+        BRCMF_ERROR(("user: Restrict the dongle ram size to %d, min %d\n",
+                     brcmf_dongle_memsize, min_size));
+        if ((brcmf_dongle_memsize > min_size) &&
+            (brcmf_dongle_memsize < (s32) bus->orig_ramsize))
+                bus->ramsize = brcmf_dongle_memsize;
+}
+
+static int brcmf_sdbrcm_set_siaddr_window(struct brcmf_bus *bus, u32 address)
+{
+        int err = 0;
+        brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+                         (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+        if (!err)
+                brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
+                                 SBSDIO_FUNC1_SBADDRMID,
+                                 (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
+        if (!err)
+                brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_SBADDRHIGH,
+                                       (address >> 24) & SBSDIO_SBADDRHIGH_MASK,
+                                       &err);
+        return err;
+}
+
+/* Turn backplane clock on or off */
+static int brcmf_sdbrcm_htclk(struct brcmf_bus *bus, bool on, bool pendok)
+{
+        int err;
+        u8 clkctl, clkreq, devctl;
+        struct brcmf_sdio_card *card;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        clkctl = 0;
+        card = bus->card;
+
+        if (on) {
+                /* Request HT Avail */
+                clkreq =
+                    bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
+
+                if ((bus->ci->chip == BCM4329_CHIP_ID)
+                    && (bus->ci->chiprev == 0))
+                        clkreq |= SBSDIO_FORCE_ALP;
+
+                brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+                if (err) {
+                        BRCMF_ERROR(("%s: HT Avail request error: %d\n",
+                                     __func__, err));
+                        return -EBADE;
+                }
+
+                if (pendok && ((bus->ci->buscoretype == PCMCIA_CORE_ID)
+                               && (bus->ci->buscorerev == 9))) {
+                        u32 dummy, retries;
+                        r_sdreg32(bus, &dummy,
+                                  offsetof(struct sdpcmd_regs, clockctlstatus),
+                                  &retries);
+                }
+
+                /* Check current status */
+                clkctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                               SBSDIO_FUNC1_CHIPCLKCSR, &err);
+                if (err) {
+                        BRCMF_ERROR(("%s: HT Avail read error: %d\n",
+                                     __func__, err));
+                        return -EBADE;
+                }
+
+                /* Go to pending and await interrupt if appropriate */
+                if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
+                        /* Allow only clock-available interrupt */
+                        devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                        SBSDIO_DEVICE_CTL, &err);
+                        if (err) {
+                                BRCMF_ERROR(("%s: Devctl error setting CA:"
+                                             " %d\n", __func__, err));
+                                return -EBADE;
+                        }
+
+                        devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
+                        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                               SBSDIO_DEVICE_CTL, devctl, &err);
+                        BRCMF_INFO(("CLKCTL: set PENDING\n"));
+                        bus->clkstate = CLK_PENDING;
+
+                        return 0;
+                } else if (bus->clkstate == CLK_PENDING) {
+                        /* Cancel CA-only interrupt filter */
+                        devctl =
+                            brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                                  SBSDIO_DEVICE_CTL, &err);
+                        devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                SBSDIO_DEVICE_CTL, devctl, &err);
+                }
+
+                /* Otherwise, wait here (polling) for HT Avail */
+                if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+                        BRCMF_SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+                               ((clkctl =
+                                 brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                         SBSDIO_FUNC1_CHIPCLKCSR,
+                                                 &err)),
+                                !SBSDIO_CLKAV(clkctl, bus->alp_only)),
+                               PMU_MAX_TRANSITION_DLY);
+                }
+                if (err) {
+                        BRCMF_ERROR(("%s: HT Avail request error: %d\n",
+                                     __func__, err));
+                        return -EBADE;
+                }
+                if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+                        BRCMF_ERROR(("%s: HT Avail timeout (%d): "
+                                     "clkctl 0x%02x\n", __func__,
+                                     PMU_MAX_TRANSITION_DLY, clkctl));
+                        return -EBADE;
+                }
+
+                /* Mark clock available */
+                bus->clkstate = CLK_AVAIL;
+                BRCMF_INFO(("CLKCTL: turned ON\n"));
+
+#if defined(BCMDBG)
+                if (bus->alp_only != true) {
+                        if (SBSDIO_ALPONLY(clkctl)) {
+                                BRCMF_ERROR(("%s: HT Clock should be on.\n",
+                                             __func__));
+                        }
+                }
+#endif                          /* defined (BCMDBG) */
+
+                bus->activity = true;
+        } else {
+                clkreq = 0;
+
+                if (bus->clkstate == CLK_PENDING) {
+                        /* Cancel CA-only interrupt filter */
+                        devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                        SBSDIO_DEVICE_CTL, &err);
+                        devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                SBSDIO_DEVICE_CTL, devctl, &err);
+                }
+
+                bus->clkstate = CLK_SDONLY;
+                brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                        SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+                BRCMF_INFO(("CLKCTL: turned OFF\n"));
+                if (err) {
+                        BRCMF_ERROR(("%s: Failed access turning clock off:"
+                                     " %d\n", __func__, err));
+                        return -EBADE;
+                }
+        }
+        return 0;
+}
+
+/* Change idle/active SD state */
+static int brcmf_sdbrcm_sdclk(struct brcmf_bus *bus, bool on)
+{
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (on)
+                bus->clkstate = CLK_SDONLY;
+        else
+                bus->clkstate = CLK_NONE;
+
+        return 0;
+}
+
+/* Transition SD and backplane clock readiness */
+static int brcmf_sdbrcm_clkctl(struct brcmf_bus *bus, uint target, bool pendok)
+{
+#ifdef BCMDBG
+        uint oldstate = bus->clkstate;
+#endif                          /* BCMDBG */
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Early exit if we're already there */
+        if (bus->clkstate == target) {
+                if (target == CLK_AVAIL) {
+                        brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
+                        bus->activity = true;
+                }
+                return 0;
+        }
+
+        switch (target) {
+        case CLK_AVAIL:
+                /* Make sure SD clock is available */
+                if (bus->clkstate == CLK_NONE)
+                        brcmf_sdbrcm_sdclk(bus, true);
+                /* Now request HT Avail on the backplane */
+                brcmf_sdbrcm_htclk(bus, true, pendok);
+                brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
+                bus->activity = true;
+                break;
+
+        case CLK_SDONLY:
+                /* Remove HT request, or bring up SD clock */
+                if (bus->clkstate == CLK_NONE)
+                        brcmf_sdbrcm_sdclk(bus, true);
+                else if (bus->clkstate == CLK_AVAIL)
+                        brcmf_sdbrcm_htclk(bus, false, false);
+                else
+                        BRCMF_ERROR(("brcmf_sdbrcm_clkctl: request for %d -> %d"
+                                     "\n", bus->clkstate, target));
+                brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
+                break;
+
+        case CLK_NONE:
+                /* Make sure to remove HT request */
+                if (bus->clkstate == CLK_AVAIL)
+                        brcmf_sdbrcm_htclk(bus, false, false);
+                /* Now remove the SD clock */
+                brcmf_sdbrcm_sdclk(bus, false);
+                brcmf_sdbrcm_wd_timer(bus, 0);
+                break;
+        }
+#ifdef BCMDBG
+        BRCMF_INFO(("brcmf_sdbrcm_clkctl: %d -> %d\n",
+                    oldstate, bus->clkstate));
+#endif                          /* BCMDBG */
+
+        return 0;
+}
+
+int brcmf_sdbrcm_bussleep(struct brcmf_bus *bus, bool sleep)
+{
+        struct brcmf_sdio_card *card = bus->card;
+        uint retries = 0;
+
+        BRCMF_INFO(("brcmf_sdbrcm_bussleep: request %s (currently %s)\n",
+                    (sleep ? "SLEEP" : "WAKE"),
+                    (bus->sleeping ? "SLEEP" : "WAKE")));
+
+        /* Done if we're already in the requested state */
+        if (sleep == bus->sleeping)
+                return 0;
+
+        /* Going to sleep: set the alarm and turn off the lights... */
+        if (sleep) {
+                /* Don't sleep if something is pending */
+                if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
+                        return -EBUSY;
+
+                /* Disable SDIO interrupts (no longer interested) */
+                brcmf_sdcard_intr_disable(bus->card);
+
+                /* Make sure the controller has the bus up */
+                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+
+                /* Tell device to start using OOB wakeup */
+                w_sdreg32(bus, SMB_USE_OOB,
+                          offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
+                if (retries > retry_limit)
+                        BRCMF_ERROR(("CANNOT SIGNAL CHIP, "
+                                     "WILL NOT WAKE UP!!\n"));
+
+                /* Turn off our contribution to the HT clock request */
+                brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
+
+                brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                        SBSDIO_FUNC1_CHIPCLKCSR,
+                        SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
+
+                /* Isolate the bus */
+                if (bus->ci->chip != BCM4329_CHIP_ID
+                    && bus->ci->chip != BCM4319_CHIP_ID) {
+                        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                SBSDIO_DEVICE_CTL,
+                                SBSDIO_DEVCTL_PADS_ISO, NULL);
+                }
+
+                /* Change state */
+                bus->sleeping = true;
+
+        } else {
+                /* Waking up: bus power up is ok, set local state */
+
+                brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                        SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+
+                /* Force pad isolation off if possible
+                         (in case power never toggled) */
+                if ((bus->ci->buscoretype == PCMCIA_CORE_ID)
+                    && (bus->ci->buscorerev >= 10))
+                        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                SBSDIO_DEVICE_CTL, 0, NULL);
+
+                /* Make sure the controller has the bus up */
+                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+
+                /* Send misc interrupt to indicate OOB not needed */
+                w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, tosbmailboxdata),
+                          &retries);
+                if (retries <= retry_limit)
+                        w_sdreg32(bus, SMB_DEV_INT,
+                                  offsetof(struct sdpcmd_regs, tosbmailbox),
+                                  &retries);
+
+                if (retries > retry_limit)
+                        BRCMF_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
+
+                /* Make sure we have SD bus access */
+                brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
+
+                /* Change state */
+                bus->sleeping = false;
+
+                /* Enable interrupts again */
+                if (bus->intr && (bus->drvr->busstate == BRCMF_BUS_DATA)) {
+                        bus->intdis = false;
+                        brcmf_sdcard_intr_enable(bus->card);
+                }
+        }
+
+        return 0;
+}
+
+#define BUS_WAKE(bus) \
+        do { \
+                if ((bus)->sleeping) \
+                        brcmf_sdbrcm_bussleep((bus), false); \
+        } while (0);
+
+/* Writes a HW/SW header into the packet and sends it. */
+/* Assumes: (a) header space already there, (b) caller holds lock */
+static int brcmf_sdbrcm_txpkt(struct brcmf_bus *bus, struct sk_buff *pkt, uint chan,
+                         bool free_pkt)
+{
+        int ret;
+        u8 *frame;
+        u16 len, pad = 0;
+        u32 swheader;
+        uint retries = 0;
+        struct brcmf_sdio_card *card;
+        struct sk_buff *new;
+        int i;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        card = bus->card;
+
+        if (bus->drvr->dongle_reset) {
+                ret = -EPERM;
+                goto done;
+        }
+
+        frame = (u8 *) (pkt->data);
+
+        /* Add alignment padding, allocate new packet if needed */
+        pad = ((unsigned long)frame % BRCMF_SDALIGN);
+        if (pad) {
+                if (skb_headroom(pkt) < pad) {
+                        BRCMF_INFO(("%s: insufficient headroom %d for %d pad\n",
+                                    __func__, skb_headroom(pkt), pad));
+                        bus->drvr->tx_realloc++;
+                        new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
+                        if (!new) {
+                                BRCMF_ERROR(("%s: couldn't allocate new "
+                                             "%d-byte packet\n", __func__,
+                                             pkt->len + BRCMF_SDALIGN));
+                                ret = -ENOMEM;
+                                goto done;
+                        }
+
+                        PKTALIGN(new, pkt->len, BRCMF_SDALIGN);
+                        memcpy(new->data, pkt->data, pkt->len);
+                        if (free_pkt)
+                                brcmu_pkt_buf_free_skb(pkt);
+                        /* free the pkt if canned one is not used */
+                        free_pkt = true;
+                        pkt = new;
+                        frame = (u8 *) (pkt->data);
+                        /* precondition: (frame % BRCMF_SDALIGN) == 0) */
+                        pad = 0;
+                } else {
+                        skb_push(pkt, pad);
+                        frame = (u8 *) (pkt->data);
+                        /* precondition: pad + SDPCM_HDRLEN <= pkt->len */
+                        memset(frame, 0, pad + SDPCM_HDRLEN);
+                }
+        }
+        /* precondition: pad < BRCMF_SDALIGN */
+
+        /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
+        len = (u16) (pkt->len);
+        *(u16 *) frame = cpu_to_le16(len);
+        *(((u16 *) frame) + 1) = cpu_to_le16(~len);
+
+        /* Software tag: channel, sequence number, data offset */
+        swheader =
+            ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
+            (((pad +
+               SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+
+        put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
+        put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
+
+#ifdef BCMDBG
+        tx_packets[pkt->priority]++;
+        if (BRCMF_BYTES_ON() &&
+            (((BRCMF_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
+              (BRCMF_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
+                printk(KERN_DEBUG "Tx Frame:\n");
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, frame, len);
+        } else if (BRCMF_HDRS_ON()) {
+                printk(KERN_DEBUG "TxHdr:\n");
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                     frame, min_t(u16, len, 16));
+        }
+#endif
+
+        /* Raise len to next SDIO block to eliminate tail command */
+        if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
+                u16 pad = bus->blocksize - (len % bus->blocksize);
+                if ((pad <= bus->roundup) && (pad < bus->blocksize))
+                                len += pad;
+        } else if (len % BRCMF_SDALIGN) {
+                len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
+        }
+
+        /* Some controllers have trouble with odd bytes -- round to even */
+        if (forcealign && (len & (ALIGNMENT - 1))) {
+                        len = roundup(len, ALIGNMENT);
+        }
+
+        do {
+                ret = brcmf_sdbrcm_send_buf(bus, brcmf_sdcard_cur_sbwad(card),
+                        SDIO_FUNC_2, F2SYNC, frame, len, pkt, NULL, NULL);
+                bus->f2txdata++;
+
+                if (ret < 0) {
+                        /* On failure, abort the command
+                         and terminate the frame */
+                        BRCMF_INFO(("%s: sdio error %d, abort command and "
+                                    "terminate frame.\n", __func__, ret));
+                        bus->tx_sderrs++;
+
+                        brcmf_sdcard_abort(card, SDIO_FUNC_2);
+                        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                         SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
+                                         NULL);
+                        bus->f1regdata++;
+
+                        for (i = 0; i < 3; i++) {
+                                u8 hi, lo;
+                                hi = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                                     SBSDIO_FUNC1_WFRAMEBCHI,
+                                                     NULL);
+                                lo = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                                     SBSDIO_FUNC1_WFRAMEBCLO,
+                                                     NULL);
+                                bus->f1regdata += 2;
+                                if ((hi == 0) && (lo == 0))
+                                        break;
+                        }
+
+                }
+                if (ret == 0)
+                        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+
+        } while ((ret < 0) && retrydata && retries++ < TXRETRIES);
+
+done:
+        /* restore pkt buffer pointer before calling tx complete routine */
+        skb_pull(pkt, SDPCM_HDRLEN + pad);
+        brcmf_sdbrcm_sdunlock(bus);
+        brcmf_txcomplete(bus->drvr, pkt, ret != 0);
+        brcmf_sdbrcm_sdlock(bus);
+
+        if (free_pkt)
+                brcmu_pkt_buf_free_skb(pkt);
+
+        return ret;
+}
+
+int brcmf_sdbrcm_bus_txdata(struct brcmf_bus *bus, struct sk_buff *pkt)
+{
+        int ret = -EBADE;
+        uint datalen, prec;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        datalen = pkt->len;
+
+#ifdef SDTEST
+        /* Push the test header if doing loopback */
+        if (bus->ext_loop) {
+                u8 *data;
+                skb_push(pkt, SDPCM_TEST_HDRLEN);
+                data = pkt->data;
+                *data++ = SDPCM_TEST_ECHOREQ;
+                *data++ = (u8) bus->loopid++;
+                *data++ = (datalen >> 0);
+                *data++ = (datalen >> 8);
+                datalen += SDPCM_TEST_HDRLEN;
+        }
+#endif                          /* SDTEST */
+
+        /* Add space for the header */
+        skb_push(pkt, SDPCM_HDRLEN);
+        /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
+
+        prec = PRIO2PREC((pkt->priority & PRIOMASK));
+
+        /* Check for existing queue, current flow-control,
+                         pending event, or pending clock */
+        if (brcmf_deferred_tx || bus->fcstate || pktq_len(&bus->txq)
+            || bus->dpc_sched || (!DATAOK(bus))
+            || (bus->flowcontrol & NBITVAL(prec))
+            || (bus->clkstate != CLK_AVAIL)) {
+                BRCMF_TRACE(("%s: deferring pktq len %d\n", __func__,
+                             pktq_len(&bus->txq)));
+                bus->fcqueued++;
+
+                /* Priority based enq */
+                spin_lock_bh(&bus->txqlock);
+                if (brcmf_c_prec_enq(bus->drvr, &bus->txq, pkt, prec) == false) {
+                        skb_pull(pkt, SDPCM_HDRLEN);
+                        brcmf_txcomplete(bus->drvr, pkt, false);
+                        brcmu_pkt_buf_free_skb(pkt);
+                        BRCMF_ERROR(("%s: out of bus->txq !!!\n", __func__));
+                        ret = -ENOSR;
+                } else {
+                        ret = 0;
+                }
+                spin_unlock_bh(&bus->txqlock);
+
+                if (pktq_len(&bus->txq) >= TXHI)
+                        brcmf_txflowcontrol(bus->drvr, 0, ON);
+
+#ifdef BCMDBG
+                if (pktq_plen(&bus->txq, prec) > qcount[prec])
+                        qcount[prec] = pktq_plen(&bus->txq, prec);
+#endif
+                /* Schedule DPC if needed to send queued packet(s) */
+                if (brcmf_deferred_tx && !bus->dpc_sched) {
+                        bus->dpc_sched = true;
+                        brcmf_sdbrcm_sched_dpc(bus);
+                }
+        } else {
+                /* Lock: we're about to use shared data/code (and SDIO) */
+                brcmf_sdbrcm_sdlock(bus);
+
+                /* Otherwise, send it now */
+                BUS_WAKE(bus);
+                /* Make sure back plane ht clk is on, no pending allowed */
+                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
+
+#ifndef SDTEST
+                BRCMF_TRACE(("%s: calling txpkt\n", __func__));
+                ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
+#else
+                ret = brcmf_sdbrcm_txpkt(bus, pkt,
+                                    (bus->ext_loop ? SDPCM_TEST_CHANNEL :
+                                     SDPCM_DATA_CHANNEL), true);
+#endif
+                if (ret)
+                        bus->drvr->tx_errors++;
+                else
+                        bus->drvr->dstats.tx_bytes += datalen;
+
+                if (bus->idletime == BRCMF_IDLE_IMMEDIATE &&
+                    !bus->dpc_sched) {
+                        bus->activity = false;
+                        brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
+                }
+
+                brcmf_sdbrcm_sdunlock(bus);
+        }
+
+        return ret;
+}
+
+static uint brcmf_sdbrcm_sendfromq(struct brcmf_bus *bus, uint maxframes)
+{
+        struct sk_buff *pkt;
+        u32 intstatus = 0;
+        uint retries = 0;
+        int ret = 0, prec_out;
+        uint cnt = 0;
+        uint datalen;
+        u8 tx_prec_map;
+
+        struct brcmf_pub *drvr = bus->drvr;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        tx_prec_map = ~bus->flowcontrol;
+
+        /* Send frames until the limit or some other event */
+        for (cnt = 0; (cnt < maxframes) && DATAOK(bus); cnt++) {
+                spin_lock_bh(&bus->txqlock);
+                pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
+                if (pkt == NULL) {
+                        spin_unlock_bh(&bus->txqlock);
+                        break;
+                }
+                spin_unlock_bh(&bus->txqlock);
+                datalen = pkt->len - SDPCM_HDRLEN;
+
+#ifndef SDTEST
+                ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
+#else
+                ret = brcmf_sdbrcm_txpkt(bus, pkt,
+                                    (bus->ext_loop ? SDPCM_TEST_CHANNEL :
+                                     SDPCM_DATA_CHANNEL), true);
+#endif
+                if (ret)
+                        bus->drvr->tx_errors++;
+                else
+                        bus->drvr->dstats.tx_bytes += datalen;
+
+                /* In poll mode, need to check for other events */
+                if (!bus->intr && cnt) {
+                        /* Check device status, signal pending interrupt */
+                        r_sdreg32(bus, &intstatus,
+                                  offsetof(struct sdpcmd_regs, intstatus),
+                                  &retries);
+                        bus->f2txdata++;
+                        if (brcmf_sdcard_regfail(bus->card))
+                                break;
+                        if (intstatus & bus->hostintmask)
+                                bus->ipend = true;
+                }
+        }
+
+        /* Deflow-control stack if needed */
+        if (drvr->up && (drvr->busstate == BRCMF_BUS_DATA) &&
+            drvr->txoff && (pktq_len(&bus->txq) < TXLOW))
+                brcmf_txflowcontrol(drvr, 0, OFF);
+
+        return cnt;
+}
+
+int
+brcmf_sdbrcm_bus_txctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
+{
+        u8 *frame;
+        u16 len;
+        u32 swheader;
+        uint retries = 0;
+        struct brcmf_sdio_card *card = bus->card;
+        u8 doff = 0;
+        int ret = -1;
+        int i;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (bus->drvr->dongle_reset)
+                return -EIO;
+
+        /* Back the pointer to make a room for bus header */
+        frame = msg - SDPCM_HDRLEN;
+        len = (msglen += SDPCM_HDRLEN);
+
+        /* Add alignment padding (optional for ctl frames) */
+        if (brcmf_alignctl) {
+                doff = ((unsigned long)frame % BRCMF_SDALIGN);
+                if (doff) {
+                        frame -= doff;
+                        len += doff;
+                        msglen += doff;
+                        memset(frame, 0, doff + SDPCM_HDRLEN);
+                }
+                /* precondition: doff < BRCMF_SDALIGN */
+        }
+        doff += SDPCM_HDRLEN;
+
+        /* Round send length to next SDIO block */
+        if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
+                u16 pad = bus->blocksize - (len % bus->blocksize);
+                if ((pad <= bus->roundup) && (pad < bus->blocksize))
+                        len += pad;
+        } else if (len % BRCMF_SDALIGN) {
+                len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
+        }
+
+        /* Satisfy length-alignment requirements */
+        if (forcealign && (len & (ALIGNMENT - 1)))
+                len = roundup(len, ALIGNMENT);
+
+        /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
+
+        /* Need to lock here to protect txseq and SDIO tx calls */
+        brcmf_sdbrcm_sdlock(bus);
+
+        BUS_WAKE(bus);
+
+        /* Make sure backplane clock is on */
+        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+
+        /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
+        *(u16 *) frame = cpu_to_le16((u16) msglen);
+        *(((u16 *) frame) + 1) = cpu_to_le16(~msglen);
+
+        /* Software tag: channel, sequence number, data offset */
+        swheader =
+            ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
+             SDPCM_CHANNEL_MASK)
+            | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
+                             SDPCM_DOFFSET_MASK);
+        put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
+        put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
+
+        if (!DATAOK(bus)) {
+                BRCMF_INFO(("%s: No bus credit bus->tx_max %d,"
+                            " bus->tx_seq %d\n", __func__,
+                            bus->tx_max, bus->tx_seq));
+                bus->ctrl_frame_stat = true;
+                /* Send from dpc */
+                bus->ctrl_frame_buf = frame;
+                bus->ctrl_frame_len = len;
+
+                brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
+
+                if (bus->ctrl_frame_stat == false) {
+                        BRCMF_INFO(("%s: ctrl_frame_stat == false\n",
+                                    __func__));
+                        ret = 0;
+                } else {
+                        BRCMF_INFO(("%s: ctrl_frame_stat == true\n", __func__));
+                        ret = -1;
+                }
+        }
+
+        if (ret == -1) {
+#ifdef BCMDBG
+                if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
+                        printk(KERN_DEBUG "Tx Frame:\n");
+                        print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                             frame, len);
+                } else if (BRCMF_HDRS_ON()) {
+                        printk(KERN_DEBUG "TxHdr:\n");
+                        print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                             frame, min_t(u16, len, 16));
+                }
+#endif
+
+                do {
+                        bus->ctrl_frame_stat = false;
+                        ret = brcmf_sdbrcm_send_buf(bus,
+                                brcmf_sdcard_cur_sbwad(card), SDIO_FUNC_2,
+                                F2SYNC, frame, len, NULL, NULL, NULL);
+
+                        if (ret < 0) {
+                                /* On failure, abort the command and
+                                 terminate the frame */
+                                BRCMF_INFO(("%s: sdio error %d, abort command "
+                                            "and terminate frame.\n",
+                                            __func__, ret));
+                                bus->tx_sderrs++;
+
+                                brcmf_sdcard_abort(card, SDIO_FUNC_2);
+
+                                brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                                 SBSDIO_FUNC1_FRAMECTRL,
+                                                 SFC_WF_TERM, NULL);
+                                bus->f1regdata++;
+
+                                for (i = 0; i < 3; i++) {
+                                        u8 hi, lo;
+                                        hi = brcmf_sdcard_cfg_read(card,
+                                             SDIO_FUNC_1,
+                                             SBSDIO_FUNC1_WFRAMEBCHI,
+                                             NULL);
+                                        lo = brcmf_sdcard_cfg_read(card,
+                                             SDIO_FUNC_1,
+                                             SBSDIO_FUNC1_WFRAMEBCLO,
+                                             NULL);
+                                        bus->f1regdata += 2;
+                                        if ((hi == 0) && (lo == 0))
+                                                break;
+                                }
+
+                        }
+                        if (ret == 0) {
+                                bus->tx_seq =
+                                    (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+                        }
+                } while ((ret < 0) && retries++ < TXRETRIES);
+        }
+
+        if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                bus->activity = false;
+                brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
+        }
+
+        brcmf_sdbrcm_sdunlock(bus);
+
+        if (ret)
+                bus->drvr->tx_ctlerrs++;
+        else
+                bus->drvr->tx_ctlpkts++;
+
+        return ret ? -EIO : 0;
+}
+
+int brcmf_sdbrcm_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint msglen)
+{
+        int timeleft;
+        uint rxlen = 0;
+        bool pending;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (bus->drvr->dongle_reset)
+                return -EIO;
+
+        /* Wait until control frame is available */
+        timeleft = brcmf_os_ioctl_resp_wait(bus->drvr, &bus->rxlen, &pending);
+
+        brcmf_sdbrcm_sdlock(bus);
+        rxlen = bus->rxlen;
+        memcpy(msg, bus->rxctl, min(msglen, rxlen));
+        bus->rxlen = 0;
+        brcmf_sdbrcm_sdunlock(bus);
+
+        if (rxlen) {
+                BRCMF_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
+                           __func__, rxlen, msglen));
+        } else if (timeleft == 0) {
+                BRCMF_ERROR(("%s: resumed on timeout\n", __func__));
+#ifdef BCMDBG
+                brcmf_sdbrcm_sdlock(bus);
+                brcmf_sdbrcm_checkdied(bus, NULL, 0);
+                brcmf_sdbrcm_sdunlock(bus);
+#endif                          /* BCMDBG */
+        } else if (pending == true) {
+                BRCMF_CTL(("%s: cancelled\n", __func__));
+                return -ERESTARTSYS;
+        } else {
+                BRCMF_CTL(("%s: resumed for unknown reason?\n", __func__));
+#ifdef BCMDBG
+                brcmf_sdbrcm_sdlock(bus);
+                brcmf_sdbrcm_checkdied(bus, NULL, 0);
+                brcmf_sdbrcm_sdunlock(bus);
+#endif                          /* BCMDBG */
+        }
+
+        if (rxlen)
+                bus->drvr->rx_ctlpkts++;
+        else
+                bus->drvr->rx_ctlerrs++;
+
+        return rxlen ? (int)rxlen : -ETIMEDOUT;
+}
+
+/* IOVar table */
+enum {
+        IOV_INTR = 1,
+        IOV_POLLRATE,
+        IOV_SDREG,
+        IOV_SBREG,
+        IOV_SDCIS,
+        IOV_MEMBYTES,
+        IOV_MEMSIZE,
+#ifdef BCMDBG
+        IOV_CHECKDIED,
+        IOV_CONS,
+        IOV_DCONSOLE_POLL,
+#endif
+        IOV_DOWNLOAD,
+        IOV_FORCEEVEN,
+        IOV_SDIOD_DRIVE,
+        IOV_READAHEAD,
+        IOV_SDRXCHAIN,
+        IOV_ALIGNCTL,
+        IOV_SDALIGN,
+        IOV_DEVRESET,
+        IOV_CPU,
+#ifdef SDTEST
+        IOV_PKTGEN,
+        IOV_EXTLOOP,
+#endif                          /* SDTEST */
+        IOV_SPROM,
+        IOV_TXBOUND,
+        IOV_RXBOUND,
+        IOV_TXMINMAX,
+        IOV_IDLETIME,
+        IOV_IDLECLOCK,
+        IOV_SD1IDLE,
+        IOV_SLEEP,
+        IOV_WDTICK,
+        IOV_VARS
+};
+
+const struct brcmu_iovar brcmf_sdio_iovars[] = {
+        {"intr", IOV_INTR, 0, IOVT_BOOL, 0},
+        {"sleep", IOV_SLEEP, 0, IOVT_BOOL, 0},
+        {"pollrate", IOV_POLLRATE, 0, IOVT_UINT32, 0},
+        {"idletime", IOV_IDLETIME, 0, IOVT_INT32, 0},
+        {"idleclock", IOV_IDLECLOCK, 0, IOVT_INT32, 0},
+        {"sd1idle", IOV_SD1IDLE, 0, IOVT_BOOL, 0},
+        {"membytes", IOV_MEMBYTES, 0, IOVT_BUFFER, 2 * sizeof(int)},
+        {"memsize", IOV_MEMSIZE, 0, IOVT_UINT32, 0},
+        {"download", IOV_DOWNLOAD, 0, IOVT_BOOL, 0},
+        {"vars", IOV_VARS, 0, IOVT_BUFFER, 0},
+        {"sdiod_drive", IOV_SDIOD_DRIVE, 0, IOVT_UINT32, 0},
+        {"readahead", IOV_READAHEAD, 0, IOVT_BOOL, 0},
+        {"sdrxchain", IOV_SDRXCHAIN, 0, IOVT_BOOL, 0},
+        {"alignctl", IOV_ALIGNCTL, 0, IOVT_BOOL, 0},
+        {"sdalign", IOV_SDALIGN, 0, IOVT_BOOL, 0},
+        {"devreset", IOV_DEVRESET, 0, IOVT_BOOL, 0},
+        {"wdtick", IOV_WDTICK, 0, IOVT_UINT32, 0},
+#ifdef BCMDBG
+        {"cons", IOV_CONS, 0, IOVT_BUFFER, 0}
+        ,
+        {"dconpoll", IOV_DCONSOLE_POLL, 0, IOVT_UINT32, 0}
+        ,
+        {"sdreg", IOV_SDREG, 0, IOVT_BUFFER, sizeof(struct brcmf_sdreg)}
+        ,
+        {"sbreg", IOV_SBREG, 0, IOVT_BUFFER, sizeof(struct brcmf_sdreg)}
+        ,
+        {"sd_cis", IOV_SDCIS, 0, IOVT_BUFFER, BRCMF_IOCTL_MAXLEN}
+        ,
+        {"forcealign", IOV_FORCEEVEN, 0, IOVT_BOOL, 0}
+        ,
+        {"txbound", IOV_TXBOUND, 0, IOVT_UINT32, 0}
+        ,
+        {"rxbound", IOV_RXBOUND, 0, IOVT_UINT32, 0}
+        ,
+        {"txminmax", IOV_TXMINMAX, 0, IOVT_UINT32, 0}
+        ,
+        {"cpu", IOV_CPU, 0, IOVT_BOOL, 0}
+        ,
+        {"checkdied", IOV_CHECKDIED, 0, IOVT_BUFFER, 0}
+        ,
+#endif                          /* BCMDBG */
+#ifdef SDTEST
+        {"extloop", IOV_EXTLOOP, 0, IOVT_BOOL, 0}
+        ,
+        {"pktgen", IOV_PKTGEN, 0, IOVT_BUFFER, sizeof(struct brcmf_pktgen)}
+        ,
+#endif                          /* SDTEST */
+
+        {NULL, 0, 0, 0, 0}
+};
+
+static void
+brcmf_dump_pct(struct brcmu_strbuf *strbuf, char *desc, uint num, uint div)
+{
+        uint q1, q2;
+
+        if (!div) {
+                brcmu_bprintf(strbuf, "%s N/A", desc);
+        } else {
+                q1 = num / div;
+                q2 = (100 * (num - (q1 * div))) / div;
+                brcmu_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
+        }
+}
+
+void brcmf_sdbrcm_bus_dump(struct brcmf_pub *drvr, struct brcmu_strbuf *strbuf)
+{
+        struct brcmf_bus *bus = drvr->bus;
+
+        brcmu_bprintf(strbuf, "Bus SDIO structure:\n");
+        brcmu_bprintf(strbuf,
+                    "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
+                    bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
+        brcmu_bprintf(strbuf,
+                    "fcstate %d qlen %d tx_seq %d, max %d, rxskip %d rxlen %d rx_seq %d\n",
+                    bus->fcstate, pktq_len(&bus->txq), bus->tx_seq, bus->tx_max,
+                    bus->rxskip, bus->rxlen, bus->rx_seq);
+        brcmu_bprintf(strbuf, "intr %d intrcount %d lastintrs %d spurious %d\n",
+                    bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
+        brcmu_bprintf(strbuf, "pollrate %d pollcnt %d regfails %d\n",
+                    bus->pollrate, bus->pollcnt, bus->regfails);
+
+        brcmu_bprintf(strbuf, "\nAdditional counters:\n");
+        brcmu_bprintf(strbuf,
+                    "tx_sderrs %d fcqueued %d rxrtx %d rx_toolong %d rxc_errors %d\n",
+                    bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
+                    bus->rxc_errors);
+        brcmu_bprintf(strbuf, "rx_hdrfail %d badhdr %d badseq %d\n",
+                    bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
+        brcmu_bprintf(strbuf, "fc_rcvd %d, fc_xoff %d, fc_xon %d\n",
+                      bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
+        brcmu_bprintf(strbuf, "rxglomfail %d, rxglomframes %d, rxglompkts %d\n",
+                    bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
+        brcmu_bprintf(strbuf, "f2rx (hdrs/data) %d (%d/%d), f2tx %d f1regs"
+                      " %d\n",
+                      (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs,
+                      bus->f2rxdata, bus->f2txdata, bus->f1regdata);
+        {
+                brcmf_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->drvr->rx_packets,
+                             (bus->f2rxhdrs + bus->f2rxdata));
+                brcmf_dump_pct(strbuf, ", pkts/f1sd", bus->drvr->rx_packets,
+                             bus->f1regdata);
+                brcmf_dump_pct(strbuf, ", pkts/sd", bus->drvr->rx_packets,
+                             (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
+                brcmf_dump_pct(strbuf, ", pkts/int", bus->drvr->rx_packets,
+                             bus->intrcount);
+                brcmu_bprintf(strbuf, "\n");
+
+                brcmf_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
+                             bus->drvr->rx_packets);
+                brcmf_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts,
+                             bus->rxglomframes);
+                brcmu_bprintf(strbuf, "\n");
+
+                brcmf_dump_pct(strbuf, "Tx: pkts/f2wr", bus->drvr->tx_packets,
+                             bus->f2txdata);
+                brcmf_dump_pct(strbuf, ", pkts/f1sd", bus->drvr->tx_packets,
+                             bus->f1regdata);
+                brcmf_dump_pct(strbuf, ", pkts/sd", bus->drvr->tx_packets,
+                             (bus->f2txdata + bus->f1regdata));
+                brcmf_dump_pct(strbuf, ", pkts/int", bus->drvr->tx_packets,
+                             bus->intrcount);
+                brcmu_bprintf(strbuf, "\n");
+
+                brcmf_dump_pct(strbuf, "Total: pkts/f2rw",
+                             (bus->drvr->tx_packets + bus->drvr->rx_packets),
+                             (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
+                brcmf_dump_pct(strbuf, ", pkts/f1sd",
+                             (bus->drvr->tx_packets + bus->drvr->rx_packets),
+                             bus->f1regdata);
+                brcmf_dump_pct(strbuf, ", pkts/sd",
+                             (bus->drvr->tx_packets + bus->drvr->rx_packets),
+                             (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata +
+                              bus->f1regdata));
+                brcmf_dump_pct(strbuf, ", pkts/int",
+                             (bus->drvr->tx_packets + bus->drvr->rx_packets),
+                             bus->intrcount);
+                brcmu_bprintf(strbuf, "\n\n");
+        }
+
+#ifdef SDTEST
+        if (bus->pktgen_count) {
+                brcmu_bprintf(strbuf, "pktgen config and count:\n");
+                brcmu_bprintf(strbuf,
+                            "freq %d count %d print %d total %d min %d len %d\n",
+                            bus->pktgen_freq, bus->pktgen_count,
+                            bus->pktgen_print, bus->pktgen_total,
+                            bus->pktgen_minlen, bus->pktgen_maxlen);
+                brcmu_bprintf(strbuf, "send attempts %d rcvd %d fail %d\n",
+                            bus->pktgen_sent, bus->pktgen_rcvd,
+                            bus->pktgen_fail);
+        }
+#endif                          /* SDTEST */
+#ifdef BCMDBG
+        brcmu_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
+                      bus->dpc_sched, " not ");
+        brcmu_bprintf(strbuf, "blocksize %d roundup %d\n", bus->blocksize,
+                    bus->roundup);
+#endif                          /* BCMDBG */
+        brcmu_bprintf(strbuf,
+                    "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
+                    bus->clkstate, bus->activity, bus->idletime, bus->idlecount,
+                    bus->sleeping);
+}
+
+void brcmf_bus_clearcounts(struct brcmf_pub *drvr)
+{
+        struct brcmf_bus *bus = (struct brcmf_bus *) drvr->bus;
+
+        bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
+        bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
+        bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
+        bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
+        bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
+        bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
+}
+
+#ifdef SDTEST
+static int brcmf_sdbrcm_pktgen_get(struct brcmf_bus *bus, u8 *arg)
+{
+        struct brcmf_pktgen pktgen;
+
+        pktgen.version = BRCMF_PKTGEN_VERSION;
+        pktgen.freq = bus->pktgen_freq;
+        pktgen.count = bus->pktgen_count;
+        pktgen.print = bus->pktgen_print;
+        pktgen.total = bus->pktgen_total;
+        pktgen.minlen = bus->pktgen_minlen;
+        pktgen.maxlen = bus->pktgen_maxlen;
+        pktgen.numsent = bus->pktgen_sent;
+        pktgen.numrcvd = bus->pktgen_rcvd;
+        pktgen.numfail = bus->pktgen_fail;
+        pktgen.mode = bus->pktgen_mode;
+        pktgen.stop = bus->pktgen_stop;
+
+        memcpy(arg, &pktgen, sizeof(pktgen));
+
+        return 0;
+}
+
+static int brcmf_sdbrcm_pktgen_set(struct brcmf_bus *bus, u8 *arg)
+{
+        struct brcmf_pktgen pktgen;
+        uint oldcnt, oldmode;
+
+        memcpy(&pktgen, arg, sizeof(pktgen));
+        if (pktgen.version != BRCMF_PKTGEN_VERSION)
+                return -EINVAL;
+
+        oldcnt = bus->pktgen_count;
+        oldmode = bus->pktgen_mode;
+
+        bus->pktgen_freq = pktgen.freq;
+        bus->pktgen_count = pktgen.count;
+        bus->pktgen_print = pktgen.print;
+        bus->pktgen_total = pktgen.total;
+        bus->pktgen_minlen = pktgen.minlen;
+        bus->pktgen_maxlen = pktgen.maxlen;
+        bus->pktgen_mode = pktgen.mode;
+        bus->pktgen_stop = pktgen.stop;
+
+        bus->pktgen_tick = bus->pktgen_ptick = 0;
+        bus->pktgen_len = max(bus->pktgen_len, bus->pktgen_minlen);
+        bus->pktgen_len = min(bus->pktgen_len, bus->pktgen_maxlen);
+
+        /* Clear counts for a new pktgen (mode change, or was stopped) */
+        if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode))
+                bus->pktgen_sent = bus->pktgen_rcvd = bus->pktgen_fail = 0;
+
+        return 0;
+}
+#endif                          /* SDTEST */
+
+static int
+brcmf_sdbrcm_membytes(struct brcmf_bus *bus, bool write, u32 address, u8 *data,
+                 uint size)
+{
+        int bcmerror = 0;
+        u32 sdaddr;
+        uint dsize;
+
+        /* Determine initial transfer parameters */
+        sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
+        if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
+                dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
+        else
+                dsize = size;
+
+        /* Set the backplane window to include the start address */
+        bcmerror = brcmf_sdbrcm_set_siaddr_window(bus, address);
+        if (bcmerror) {
+                BRCMF_ERROR(("%s: window change failed\n", __func__));
+                goto xfer_done;
+        }
+
+        /* Do the transfer(s) */
+        while (size) {
+                BRCMF_INFO(("%s: %s %d bytes at offset 0x%08x in window"
+                            " 0x%08x\n", __func__, (write ? "write" : "read"),
+                            dsize, sdaddr, (address & SBSDIO_SBWINDOW_MASK)));
+                bcmerror =
+                     brcmf_sdcard_rwdata(bus->card, write, sdaddr, data, dsize);
+                if (bcmerror) {
+                        BRCMF_ERROR(("%s: membytes transfer failed\n",
+                                     __func__));
+                        break;
+                }
+
+                /* Adjust for next transfer (if any) */
+                size -= dsize;
+                if (size) {
+                        data += dsize;
+                        address += dsize;
+                        bcmerror = brcmf_sdbrcm_set_siaddr_window(bus, address);
+                        if (bcmerror) {
+                                BRCMF_ERROR(("%s: window change failed\n",
+                                             __func__));
+                                break;
+                        }
+                        sdaddr = 0;
+                        dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
+                }
+        }
+
+xfer_done:
+        /* Return the window to backplane enumeration space for core access */
+        if (brcmf_sdbrcm_set_siaddr_window(bus,
+                                           brcmf_sdcard_cur_sbwad(bus->card))) {
+                BRCMF_ERROR(("%s: FAILED to set window back to 0x%x\n",
+                             __func__, brcmf_sdcard_cur_sbwad(bus->card)));
+        }
+
+        return bcmerror;
+}
+
+#ifdef BCMDBG
+static int brcmf_sdbrcm_readshared(struct brcmf_bus *bus, struct sdpcm_shared *sh)
+{
+        u32 addr;
+        int rv;
+
+        /* Read last word in memory to determine address of
+                         sdpcm_shared structure */
+        rv = brcmf_sdbrcm_membytes(bus, false, bus->ramsize - 4, (u8 *)&addr,
+                                   4);
+        if (rv < 0)
+                return rv;
+
+        addr = le32_to_cpu(addr);
+
+        BRCMF_INFO(("sdpcm_shared address 0x%08X\n", addr));
+
+        /*
+         * Check if addr is valid.
+         * NVRAM length at the end of memory should have been overwritten.
+         */
+        if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
+                BRCMF_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n",
+                             __func__, addr));
+                return -EBADE;
+        }
+
+        /* Read rte_shared structure */
+        rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *) sh,
+                              sizeof(struct sdpcm_shared));
+        if (rv < 0)
+                return rv;
+
+        /* Endianness */
+        sh->flags = le32_to_cpu(sh->flags);
+        sh->trap_addr = le32_to_cpu(sh->trap_addr);
+        sh->assert_exp_addr = le32_to_cpu(sh->assert_exp_addr);
+        sh->assert_file_addr = le32_to_cpu(sh->assert_file_addr);
+        sh->assert_line = le32_to_cpu(sh->assert_line);
+        sh->console_addr = le32_to_cpu(sh->console_addr);
+        sh->msgtrace_addr = le32_to_cpu(sh->msgtrace_addr);
+
+        if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
+                BRCMF_ERROR(("%s: sdpcm_shared version %d in brcmf "
+                             "is different than sdpcm_shared version %d in dongle\n",
+                             __func__, SDPCM_SHARED_VERSION,
+                             sh->flags & SDPCM_SHARED_VERSION_MASK));
+                return -EBADE;
+        }
+
+        return 0;
+}
+
+static int brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, u8 *data, uint size)
+{
+        int bcmerror = 0;
+        uint msize = 512;
+        char *mbuffer = NULL;
+        uint maxstrlen = 256;
+        char *str = NULL;
+        struct brcmf_trap tr;
+        struct sdpcm_shared sdpcm_shared;
+        struct brcmu_strbuf strbuf;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (data == NULL) {
+                /*
+                 * Called after a rx ctrl timeout. "data" is NULL.
+                 * allocate memory to trace the trap or assert.
+                 */
+                size = msize;
+                mbuffer = data = kmalloc(msize, GFP_ATOMIC);
+                if (mbuffer == NULL) {
+                        BRCMF_ERROR(("%s: kmalloc(%d) failed\n", __func__,
+                                     msize));
+                        bcmerror = -ENOMEM;
+                        goto done;
+                }
+        }
+
+        str = kmalloc(maxstrlen, GFP_ATOMIC);
+        if (str == NULL) {
+                BRCMF_ERROR(("%s: kmalloc(%d) failed\n", __func__, maxstrlen));
+                bcmerror = -ENOMEM;
+                goto done;
+        }
+
+        bcmerror = brcmf_sdbrcm_readshared(bus, &sdpcm_shared);
+        if (bcmerror < 0)
+                goto done;
+
+        brcmu_binit(&strbuf, data, size);
+
+        brcmu_bprintf(&strbuf,
+                    "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
+                    sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
+
+        if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
+                /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                 * (Avoids conflict with real asserts for programmatic
+                 * parsing of output.)
+                 */
+                brcmu_bprintf(&strbuf, "Assrt not built in dongle\n");
+        }
+
+        if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) ==
+            0) {
+                /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                 * (Avoids conflict with real asserts for programmatic
+                 * parsing of output.)
+                 */
+                brcmu_bprintf(&strbuf, "No trap%s in dongle",
+                            (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
+                            ? "/assrt" : "");
+        } else {
+                if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
+                        /* Download assert */
+                        brcmu_bprintf(&strbuf, "Dongle assert");
+                        if (sdpcm_shared.assert_exp_addr != 0) {
+                                str[0] = '\0';
+                                bcmerror = brcmf_sdbrcm_membytes(bus, false,
+                                                sdpcm_shared.assert_exp_addr,
+                                                (u8 *) str, maxstrlen);
+                                if (bcmerror < 0)
+                                        goto done;
+
+                                str[maxstrlen - 1] = '\0';
+                                brcmu_bprintf(&strbuf, " expr \"%s\"", str);
+                        }
+
+                        if (sdpcm_shared.assert_file_addr != 0) {
+                                str[0] = '\0';
+                                bcmerror = brcmf_sdbrcm_membytes(bus, false,
+                                                sdpcm_shared.assert_file_addr,
+                                                (u8 *) str, maxstrlen);
+                                if (bcmerror < 0)
+                                        goto done;
+
+                                str[maxstrlen - 1] = '\0';
+                                brcmu_bprintf(&strbuf, " file \"%s\"", str);
+                        }
+
+                        brcmu_bprintf(&strbuf, " line %d ",
+                                    sdpcm_shared.assert_line);
+                }
+
+                if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
+                        bcmerror = brcmf_sdbrcm_membytes(bus, false,
+                                        sdpcm_shared.trap_addr, (u8 *)&tr,
+                                        sizeof(struct brcmf_trap));
+                        if (bcmerror < 0)
+                                goto done;
+
+                        brcmu_bprintf(&strbuf,
+                                    "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
+                                    "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
+                                    "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n",
+                                    tr.type, tr.epc, tr.cpsr, tr.spsr, tr.r13,
+                                    tr.r14, tr.pc, sdpcm_shared.trap_addr,
+                                    tr.r0, tr.r1, tr.r2, tr.r3, tr.r4, tr.r5,
+                                    tr.r6, tr.r7);
+                }
+        }
+
+        if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP))
+                BRCMF_ERROR(("%s: %s\n", __func__, strbuf.origbuf));
+
+#ifdef BCMDBG
+        if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
+                /* Mem dump to a file on device */
+                brcmf_sdbrcm_mem_dump(bus);
+        }
+#endif                          /* BCMDBG */
+
+done:
+        kfree(mbuffer);
+        kfree(str);
+
+        return bcmerror;
+}
+
+static int brcmf_sdbrcm_mem_dump(struct brcmf_bus *bus)
+{
+        int ret = 0;
+        int size;               /* Full mem size */
+        int start = 0;          /* Start address */
+        int read_size = 0;      /* Read size of each iteration */
+        u8 *buf = NULL, *databuf = NULL;
+
+        /* Get full mem size */
+        size = bus->ramsize;
+        buf = kmalloc(size, GFP_ATOMIC);
+        if (!buf) {
+                BRCMF_ERROR(("%s: Out of memory (%d bytes)\n", __func__, size));
+                return -1;
+        }
+
+        /* Read mem content */
+        printk(KERN_DEBUG "Dump dongle memory");
+        databuf = buf;
+        while (size) {
+                read_size = min(MEMBLOCK, size);
+                ret = brcmf_sdbrcm_membytes(bus, false, start, databuf,
+                                          read_size);
+                if (ret) {
+                        BRCMF_ERROR(("%s: Error membytes %d\n", __func__, ret));
+                        kfree(buf);
+                        return -1;
+                }
+                printk(".");
+
+                /* Decrement size and increment start address */
+                size -= read_size;
+                start += read_size;
+                databuf += read_size;
+        }
+        printk(KERN_DEBUG "Done\n");
+
+        /* free buf before return !!! */
+        if (brcmf_write_to_file(bus->drvr, buf, bus->ramsize)) {
+                BRCMF_ERROR(("%s: Error writing to files\n", __func__));
+                return -1;
+        }
+
+        /* buf free handled in brcmf_write_to_file, not here */
+        return 0;
+}
+
+#define CONSOLE_LINE_MAX        192
+
+static int brcmf_sdbrcm_readconsole(struct brcmf_bus *bus)
+{
+        struct brcmf_console *c = &bus->console;
+        u8 line[CONSOLE_LINE_MAX], ch;
+        u32 n, idx, addr;
+        int rv;
+
+        /* Don't do anything until FWREADY updates console address */
+        if (bus->console_addr == 0)
+                return 0;
+
+        /* Read console log struct */
+        addr = bus->console_addr + offsetof(struct rte_console, log);
+        rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log,
+                                sizeof(c->log));
+        if (rv < 0)
+                return rv;
+
+        /* Allocate console buffer (one time only) */
+        if (c->buf == NULL) {
+                c->bufsize = le32_to_cpu(c->log.buf_size);
+                c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
+                if (c->buf == NULL)
+                        return -ENOMEM;
+        }
+
+        idx = le32_to_cpu(c->log.idx);
+
+        /* Protect against corrupt value */
+        if (idx > c->bufsize)
+                return -EBADE;
+
+        /* Skip reading the console buffer if the index pointer
+         has not moved */
+        if (idx == c->last)
+                return 0;
+
+        /* Read the console buffer */
+        addr = le32_to_cpu(c->log.buf);
+        rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
+        if (rv < 0)
+                return rv;
+
+        while (c->last != idx) {
+                for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                        if (c->last == idx) {
+                                /* This would output a partial line.
+                                 * Instead, back up
+                                 * the buffer pointer and output this
+                                 * line next time around.
+                                 */
+                                if (c->last >= n)
+                                        c->last -= n;
+                                else
+                                        c->last = c->bufsize - n;
+                                goto break2;
+                        }
+                        ch = c->buf[c->last];
+                        c->last = (c->last + 1) % c->bufsize;
+                        if (ch == '\n')
+                                break;
+                        line[n] = ch;
+                }
+
+                if (n > 0) {
+                        if (line[n - 1] == '\r')
+                                n--;
+                        line[n] = 0;
+                        printk(KERN_DEBUG "CONSOLE: %s\n", line);
+                }
+        }
+break2:
+
+        return 0;
+}
+#endif                          /* BCMDBG */
+
+int brcmf_sdbrcm_downloadvars(struct brcmf_bus *bus, void *arg, int len)
+{
+        int bcmerror = 0;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Basic sanity checks */
+        if (bus->drvr->up) {
+                bcmerror = -EISCONN;
+                goto err;
+        }
+        if (!len) {
+                bcmerror = -EOVERFLOW;
+                goto err;
+        }
+
+        /* Free the old ones and replace with passed variables */
+        kfree(bus->vars);
+
+        bus->vars = kmalloc(len, GFP_ATOMIC);
+        bus->varsz = bus->vars ? len : 0;
+        if (bus->vars == NULL) {
+                bcmerror = -ENOMEM;
+                goto err;
+        }
+
+        /* Copy the passed variables, which should include the
+                 terminating double-null */
+        memcpy(bus->vars, arg, bus->varsz);
+err:
+        return bcmerror;
+}
+
+static int
+brcmf_sdbrcm_doiovar(struct brcmf_bus *bus, const struct brcmu_iovar *vi, u32 actionid,
+                const char *name, void *params, int plen, void *arg, int len,
+                int val_size)
+{
+        int bcmerror = 0;
+        s32 int_val = 0;
+        bool bool_val = 0;
+
+        BRCMF_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p "
+                     "len %d val_size %d\n", __func__, actionid, name, params,
+                     plen, arg, len, val_size));
+
+        bcmerror = brcmu_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid));
+        if (bcmerror != 0)
+                goto exit;
+
+        if (plen >= (int)sizeof(int_val))
+                memcpy(&int_val, params, sizeof(int_val));
+
+        bool_val = (int_val != 0) ? true : false;
+
+        /* Some ioctls use the bus */
+        brcmf_sdbrcm_sdlock(bus);
+
+        /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
+        if (bus->drvr->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
+                                        actionid == IOV_GVAL(IOV_DEVRESET))) {
+                bcmerror = -EPERM;
+                goto exit;
+        }
+
+        /* Handle sleep stuff before any clock mucking */
+        if (vi->varid == IOV_SLEEP) {
+                if (IOV_ISSET(actionid)) {
+                        bcmerror = brcmf_sdbrcm_bussleep(bus, bool_val);
+                } else {
+                        int_val = (s32) bus->sleeping;
+                        memcpy(arg, &int_val, val_size);
+                }
+                goto exit;
+        }
+
+        /* Request clock to allow SDIO accesses */
+        if (!bus->drvr->dongle_reset) {
+                BUS_WAKE(bus);
+                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+        }
+
+        switch (actionid) {
+        case IOV_GVAL(IOV_INTR):
+                int_val = (s32) bus->intr;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_INTR):
+                bus->intr = bool_val;
+                bus->intdis = false;
+                if (bus->drvr->up) {
+                        BRCMF_INTR(("%s: %s SDIO interrupts\n", __func__,
+                                    bus->intr ? "enable" : "disable"));
+                        if (bus->intr) {
+                                brcmf_sdcard_intr_enable(bus->card);
+                        } else {
+                                brcmf_sdcard_intr_disable(bus->card);
+                        }
+                }
+                break;
+
+        case IOV_GVAL(IOV_POLLRATE):
+                int_val = (s32) bus->pollrate;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_POLLRATE):
+                bus->pollrate = (uint) int_val;
+                bus->poll = (bus->pollrate != 0);
+                break;
+
+        case IOV_GVAL(IOV_IDLETIME):
+                int_val = bus->idletime;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_IDLETIME):
+                if ((int_val < 0) && (int_val != BRCMF_IDLE_IMMEDIATE))
+                        bcmerror = -EINVAL;
+                else
+                        bus->idletime = int_val;
+                break;
+
+        case IOV_GVAL(IOV_IDLECLOCK):
+                int_val = (s32) bus->idleclock;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_IDLECLOCK):
+                bus->idleclock = int_val;
+                break;
+
+        case IOV_GVAL(IOV_SD1IDLE):
+                int_val = (s32) sd1idle;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_SD1IDLE):
+                sd1idle = bool_val;
+                break;
+
+        case IOV_SVAL(IOV_MEMBYTES):
+        case IOV_GVAL(IOV_MEMBYTES):
+                {
+                        u32 address;
+                        uint size, dsize;
+                        u8 *data;
+
+                        bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
+
+                        address = (u32) int_val;
+                        memcpy(&int_val, (char *)params + sizeof(int_val),
+                               sizeof(int_val));
+                        size = (uint) int_val;
+
+                        /* Do some validation */
+                        dsize = set ? plen - (2 * sizeof(int)) : len;
+                        if (dsize < size) {
+                                BRCMF_ERROR(("%s: error on %s membytes, addr "
+                                             "0x%08x size %d dsize %d\n",
+                                             __func__, (set ? "set" : "get"),
+                                             address, size, dsize));
+                                bcmerror = -EINVAL;
+                                break;
+                        }
+
+                        BRCMF_INFO(("%s: Request to %s %d bytes at address "
+                                    "0x%08x\n", __func__,
+                                    (set ? "write" : "read"), size, address));
+
+                        /* If we know about SOCRAM, check for a fit */
+                        if ((bus->orig_ramsize) &&
+                            ((address > bus->orig_ramsize)
+                             || (address + size > bus->orig_ramsize))) {
+                                BRCMF_ERROR(("%s: ramsize 0x%08x doesn't have"
+                                             " %d bytes at 0x%08x\n", __func__,
+                                             bus->orig_ramsize, size, address));
+                                bcmerror = -EINVAL;
+                                break;
+                        }
+
+                        /* Generate the actual data pointer */
+                        data =
+                            set ? (u8 *) params +
+                            2 * sizeof(int) : (u8 *) arg;
+
+                        /* Call to do the transfer */
+                        bcmerror = brcmf_sdbrcm_membytes(bus, set, address,
+                                                         data, size);
+
+                        break;
+                }
+
+        case IOV_GVAL(IOV_MEMSIZE):
+                int_val = (s32) bus->ramsize;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_GVAL(IOV_SDIOD_DRIVE):
+                int_val = (s32) brcmf_sdiod_drive_strength;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_SDIOD_DRIVE):
+                brcmf_sdiod_drive_strength = int_val;
+                brcmf_sdbrcm_sdiod_drive_strength_init(bus,
+                                             brcmf_sdiod_drive_strength);
+                break;
+
+        case IOV_SVAL(IOV_DOWNLOAD):
+                bcmerror = brcmf_sdbrcm_download_state(bus, bool_val);
+                break;
+
+        case IOV_SVAL(IOV_VARS):
+                bcmerror = brcmf_sdbrcm_downloadvars(bus, arg, len);
+                break;
+
+        case IOV_GVAL(IOV_READAHEAD):
+                int_val = (s32) brcmf_readahead;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_READAHEAD):
+                if (bool_val && !brcmf_readahead)
+                        bus->nextlen = 0;
+                brcmf_readahead = bool_val;
+                break;
+
+        case IOV_GVAL(IOV_SDRXCHAIN):
+                int_val = (s32) bus->use_rxchain;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_SDRXCHAIN):
+                if (bool_val && !bus->sd_rxchain)
+                        bcmerror = -ENOTSUPP;
+                else
+                        bus->use_rxchain = bool_val;
+                break;
+        case IOV_GVAL(IOV_ALIGNCTL):
+                int_val = (s32) brcmf_alignctl;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_ALIGNCTL):
+                brcmf_alignctl = bool_val;
+                break;
+
+        case IOV_GVAL(IOV_SDALIGN):
+                int_val = BRCMF_SDALIGN;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+#ifdef BCMDBG
+        case IOV_GVAL(IOV_VARS):
+                if (bus->varsz < (uint) len)
+                        memcpy(arg, bus->vars, bus->varsz);
+                else
+                        bcmerror = -EOVERFLOW;
+                break;
+#endif                          /* BCMDBG */
+
+#ifdef BCMDBG
+        case IOV_GVAL(IOV_DCONSOLE_POLL):
+                int_val = (s32) brcmf_console_ms;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_DCONSOLE_POLL):
+                brcmf_console_ms = (uint) int_val;
+                break;
+
+        case IOV_SVAL(IOV_CONS):
+                if (len > 0)
+                        bcmerror = brcmf_sdbrcm_bus_console_in(bus->drvr,
+                                                               arg, len - 1);
+                break;
+
+        case IOV_GVAL(IOV_SDREG):
+                {
+                        struct brcmf_sdreg *sd_ptr;
+                        u32 addr, size;
+
+                        sd_ptr = (struct brcmf_sdreg *) params;
+
+                        addr = bus->ci->buscorebase + sd_ptr->offset;
+                        size = sd_ptr->func;
+                        int_val = (s32) brcmf_sdcard_reg_read(bus->card, addr,
+                                                              size);
+                        if (brcmf_sdcard_regfail(bus->card))
+                                bcmerror = -EIO;
+                        memcpy(arg, &int_val, sizeof(s32));
+                        break;
+                }
+
+        case IOV_SVAL(IOV_SDREG):
+                {
+                        struct brcmf_sdreg *sd_ptr;
+                        u32 addr, size;
+
+                        sd_ptr = (struct brcmf_sdreg *) params;
+
+                        addr = bus->ci->buscorebase + sd_ptr->offset;
+                        size = sd_ptr->func;
+                        brcmf_sdcard_reg_write(bus->card, addr, size,
+                                               sd_ptr->value);
+                        if (brcmf_sdcard_regfail(bus->card))
+                                bcmerror = -EIO;
+                        break;
+                }
+
+                /* Same as above, but offset is not backplane
+                 (not SDIO core) */
+        case IOV_GVAL(IOV_SBREG):
+                {
+                        struct brcmf_sdreg sdreg;
+                        u32 addr, size;
+
+                        memcpy(&sdreg, params, sizeof(sdreg));
+
+                        addr = SI_ENUM_BASE + sdreg.offset;
+                        size = sdreg.func;
+                        int_val = (s32) brcmf_sdcard_reg_read(bus->card, addr,
+                                                              size);
+                        if (brcmf_sdcard_regfail(bus->card))
+                                bcmerror = -EIO;
+                        memcpy(arg, &int_val, sizeof(s32));
+                        break;
+                }
+
+        case IOV_SVAL(IOV_SBREG):
+                {
+                        struct brcmf_sdreg sdreg;
+                        u32 addr, size;
+
+                        memcpy(&sdreg, params, sizeof(sdreg));
+
+                        addr = SI_ENUM_BASE + sdreg.offset;
+                        size = sdreg.func;
+                        brcmf_sdcard_reg_write(bus->card, addr, size,
+                                               sdreg.value);
+                        if (brcmf_sdcard_regfail(bus->card))
+                                bcmerror = -EIO;
+                        break;
+                }
+
+        case IOV_GVAL(IOV_SDCIS):
+                {
+                        *(char *)arg = 0;
+
+                        strcat(arg, "\nFunc 0\n");
+                        brcmf_sdcard_cis_read(bus->card, 0x10,
+                                        (u8 *) arg + strlen(arg),
+                                        SBSDIO_CIS_SIZE_LIMIT);
+                        strcat(arg, "\nFunc 1\n");
+                        brcmf_sdcard_cis_read(bus->card, 0x11,
+                                        (u8 *) arg + strlen(arg),
+                                        SBSDIO_CIS_SIZE_LIMIT);
+                        strcat(arg, "\nFunc 2\n");
+                        brcmf_sdcard_cis_read(bus->card, 0x12,
+                                        (u8 *) arg + strlen(arg),
+                                        SBSDIO_CIS_SIZE_LIMIT);
+                        break;
+                }
+
+        case IOV_GVAL(IOV_FORCEEVEN):
+                int_val = (s32) forcealign;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_FORCEEVEN):
+                forcealign = bool_val;
+                break;
+
+        case IOV_GVAL(IOV_TXBOUND):
+                int_val = (s32) brcmf_txbound;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_TXBOUND):
+                brcmf_txbound = (uint) int_val;
+                break;
+
+        case IOV_GVAL(IOV_RXBOUND):
+                int_val = (s32) brcmf_rxbound;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_RXBOUND):
+                brcmf_rxbound = (uint) int_val;
+                break;
+
+        case IOV_GVAL(IOV_TXMINMAX):
+                int_val = (s32) brcmf_txminmax;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_TXMINMAX):
+                brcmf_txminmax = (uint) int_val;
+                break;
+#endif                          /* BCMDBG */
+
+#ifdef SDTEST
+        case IOV_GVAL(IOV_EXTLOOP):
+                int_val = (s32) bus->ext_loop;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_EXTLOOP):
+                bus->ext_loop = bool_val;
+                break;
+
+        case IOV_GVAL(IOV_PKTGEN):
+                bcmerror = brcmf_sdbrcm_pktgen_get(bus, arg);
+                break;
+
+        case IOV_SVAL(IOV_PKTGEN):
+                bcmerror = brcmf_sdbrcm_pktgen_set(bus, arg);
+                break;
+#endif                          /* SDTEST */
+
+        case IOV_SVAL(IOV_DEVRESET):
+                BRCMF_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d "
+                             "busstate=%d\n",
+                             __func__, bool_val, bus->drvr->dongle_reset,
+                             bus->drvr->busstate));
+
+                brcmf_bus_devreset(bus->drvr, (u8) bool_val);
+
+                break;
+
+        case IOV_GVAL(IOV_DEVRESET):
+                BRCMF_TRACE(("%s: Called get IOV_DEVRESET\n", __func__));
+
+                /* Get its status */
+                int_val = (bool) bus->drvr->dongle_reset;
+                memcpy(arg, &int_val, val_size);
+
+                break;
+
+        case IOV_GVAL(IOV_WDTICK):
+                int_val = (s32) brcmf_watchdog_ms;
+                memcpy(arg, &int_val, val_size);
+                break;
+
+        case IOV_SVAL(IOV_WDTICK):
+                if (!bus->drvr->up) {
+                        bcmerror = -ENOLINK;
+                        break;
+                }
+                brcmf_sdbrcm_wd_timer(bus, (uint) int_val);
+                break;
+
+        default:
+                bcmerror = -ENOTSUPP;
+                break;
+        }
+
+exit:
+        if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                bus->activity = false;
+                brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
+        }
+
+        brcmf_sdbrcm_sdunlock(bus);
+
+        if (actionid == IOV_SVAL(IOV_DEVRESET) && bool_val == false)
+                brcmf_c_preinit_ioctls(bus->drvr);
+
+        return bcmerror;
+}
+
+static int brcmf_sdbrcm_write_vars(struct brcmf_bus *bus)
+{
+        int bcmerror = 0;
+        u32 varsize;
+        u32 varaddr;
+        u8 *vbuffer;
+        u32 varsizew;
+#ifdef BCMDBG
+        char *nvram_ularray;
+#endif                          /* BCMDBG */
+
+        /* Even if there are no vars are to be written, we still
+                 need to set the ramsize. */
+        varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
+        varaddr = (bus->ramsize - 4) - varsize;
+
+        if (bus->vars) {
+                vbuffer = kzalloc(varsize, GFP_ATOMIC);
+                if (!vbuffer)
+                        return -ENOMEM;
+
+                memcpy(vbuffer, bus->vars, bus->varsz);
+
+                /* Write the vars list */
+                bcmerror =
+                    brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
+#ifdef BCMDBG
+                /* Verify NVRAM bytes */
+                BRCMF_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
+                nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
+                if (!nvram_ularray)
+                        return -ENOMEM;
+
+                /* Upload image to verify downloaded contents. */
+                memset(nvram_ularray, 0xaa, varsize);
+
+                /* Read the vars list to temp buffer for comparison */
+                bcmerror =
+                    brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
+                                     varsize);
+                if (bcmerror) {
+                        BRCMF_ERROR(("%s: error %d on reading %d nvram bytes"
+                                     " at 0x%08x\n", __func__, bcmerror,
+                                     varsize, varaddr));
+                }
+                /* Compare the org NVRAM with the one read from RAM */
+                if (memcmp(vbuffer, nvram_ularray, varsize)) {
+                        BRCMF_ERROR(("%s: Downloaded NVRAM image is "
+                                     "corrupted.\n", __func__));
+                } else
+                        BRCMF_ERROR(("%s: Download/Upload/Compare of"
+                                     " NVRAM ok.\n", __func__));
+
+                kfree(nvram_ularray);
+#endif                          /* BCMDBG */
+
+                kfree(vbuffer);
+        }
+
+        /* adjust to the user specified RAM */
+        BRCMF_INFO(("Physical memory size: %d, usable memory size: %d\n",
+                    bus->orig_ramsize, bus->ramsize));
+        BRCMF_INFO(("Vars are at %d, orig varsize is %d\n", varaddr, varsize));
+        varsize = ((bus->orig_ramsize - 4) - varaddr);
+
+        /*
+         * Determine the length token:
+         * Varsize, converted to words, in lower 16-bits, checksum
+         * in upper 16-bits.
+         */
+        if (bcmerror) {
+                varsizew = 0;
+        } else {
+                varsizew = varsize / 4;
+                varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
+                varsizew = cpu_to_le32(varsizew);
+        }
+
+        BRCMF_INFO(("New varsize is %d, length token=0x%08x\n", varsize,
+                    varsizew));
+
+        /* Write the length token to the last word */
+        bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->orig_ramsize - 4),
+                                    (u8 *)&varsizew, 4);
+
+        return bcmerror;
+}
+
+static int brcmf_sdbrcm_download_state(struct brcmf_bus *bus, bool enter)
+{
+        uint retries;
+        u32 regdata;
+        int bcmerror = 0;
+
+        /* To enter download state, disable ARM and reset SOCRAM.
+         * To exit download state, simply reset ARM (default is RAM boot).
+         */
+        if (enter) {
+                bus->alp_only = true;
+
+                brcmf_sdbrcm_chip_disablecore(bus->card, bus->ci->armcorebase);
+
+                brcmf_sdbrcm_chip_resetcore(bus->card, bus->ci->ramcorebase);
+
+                /* Clear the top bit of memory */
+                if (bus->ramsize) {
+                        u32 zeros = 0;
+                        brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
+                                         (u8 *)&zeros, 4);
+                }
+        } else {
+                regdata = brcmf_sdcard_reg_read(bus->card,
+                        CORE_SB(bus->ci->ramcorebase, sbtmstatelow), 4);
+                regdata &= (SBTML_RESET | SBTML_REJ_MASK |
+                        (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
+                if ((SICF_CLOCK_EN << SBTML_SICF_SHIFT) != regdata) {
+                        BRCMF_ERROR(("%s: SOCRAM core is down after reset?\n",
+                                     __func__));
+                        bcmerror = -EBADE;
+                        goto fail;
+                }
+
+                bcmerror = brcmf_sdbrcm_write_vars(bus);
+                if (bcmerror) {
+                        BRCMF_ERROR(("%s: no vars written to RAM\n", __func__));
+                        bcmerror = 0;
+                }
+
+                w_sdreg32(bus, 0xFFFFFFFF,
+                          offsetof(struct sdpcmd_regs, intstatus), &retries);
+
+                brcmf_sdbrcm_chip_resetcore(bus->card, bus->ci->armcorebase);
+
+                /* Allow HT Clock now that the ARM is running. */
+                bus->alp_only = false;
+
+                bus->drvr->busstate = BRCMF_BUS_LOAD;
+        }
+fail:
+        return bcmerror;
+}
+
+int
+brcmf_sdbrcm_bus_iovar_op(struct brcmf_pub *drvr, const char *name,
+                          void *params, int plen, void *arg, int len, bool set)
+{
+        struct brcmf_bus *bus = drvr->bus;
+        const struct brcmu_iovar *vi = NULL;
+        int bcmerror = 0;
+        int val_size;
+        u32 actionid;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (name == NULL || len <= 0)
+                return -EINVAL;
+
+        /* Set does not take qualifiers */
+        if (set && (params || plen))
+                return -EINVAL;
+
+        /* Get must have return space;*/
+        if (!set && !(arg && len))
+                return -EINVAL;
+
+        /* Look up var locally; if not found pass to host driver */
+        vi = brcmu_iovar_lookup(brcmf_sdio_iovars, name);
+        if (vi == NULL) {
+                brcmf_sdbrcm_sdlock(bus);
+
+                BUS_WAKE(bus);
+
+                /* Turn on clock in case SD command needs backplane */
+                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+
+                bcmerror = brcmf_sdcard_iovar_op(bus->card, name, params, plen,
+                                                 arg, len, set);
+
+                /* Similar check for blocksize change */
+                if (set && strcmp(name, "sd_blocksize") == 0) {
+                        s32 fnum = 2;
+                        if (brcmf_sdcard_iovar_op
+                            (bus->card, "sd_blocksize", &fnum, sizeof(s32),
+                             &bus->blocksize, sizeof(s32),
+                             false) != 0) {
+                                bus->blocksize = 0;
+                                BRCMF_ERROR(("%s: fail on %s get\n", __func__,
+                                             "sd_blocksize"));
+                        } else {
+                                BRCMF_INFO(("%s: noted sd_blocksize update,"
+                                            " value now %d\n", __func__,
+                                            bus->blocksize));
+                        }
+                }
+                bus->roundup = min(max_roundup, bus->blocksize);
+
+                if (bus->idletime == BRCMF_IDLE_IMMEDIATE &&
+                    !bus->dpc_sched) {
+                        bus->activity = false;
+                        brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
+                }
+
+                brcmf_sdbrcm_sdunlock(bus);
+                goto exit;
+        }
+
+        BRCMF_CTL(("%s: %s %s, len %d plen %d\n", __func__,
+                   name, (set ? "set" : "get"), len, plen));
+
+        /* set up 'params' pointer in case this is a set command so that
+         * the convenience int and bool code can be common to set and get
+         */
+        if (params == NULL) {
+                params = arg;
+                plen = len;
+        }
+
+        if (vi->type == IOVT_VOID)
+                val_size = 0;
+        else if (vi->type == IOVT_BUFFER)
+                val_size = len;
+        else
+                /* all other types are integer sized */
+                val_size = sizeof(int);
+
+        actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+        bcmerror = brcmf_sdbrcm_doiovar(bus, vi, actionid, name, params, plen,
+                                        arg, len, val_size);
+
+exit:
+        return bcmerror;
+}
+
+void brcmf_sdbrcm_bus_stop(struct brcmf_bus *bus, bool enforce_mutex)
+{
+        u32 local_hostintmask;
+        u8 saveclk;
+        uint retries;
+        int err;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (enforce_mutex)
+                brcmf_sdbrcm_sdlock(bus);
+
+        BUS_WAKE(bus);
+
+        /* Enable clock for device interrupts */
+        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+
+        if (bus->watchdog_tsk) {
+                send_sig(SIGTERM, bus->watchdog_tsk, 1);
+                kthread_stop(bus->watchdog_tsk);
+                bus->watchdog_tsk = NULL;
+        }
+
+        if (bus->dpc_tsk) {
+                send_sig(SIGTERM, bus->dpc_tsk, 1);
+                kthread_stop(bus->dpc_tsk);
+                bus->dpc_tsk = NULL;
+        } else
+                tasklet_kill(&bus->tasklet);
+
+        /* Disable and clear interrupts at the chip level also */
+        w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask), &retries);
+        local_hostintmask = bus->hostintmask;
+        bus->hostintmask = 0;
+
+        /* Change our idea of bus state */
+        bus->drvr->busstate = BRCMF_BUS_DOWN;
+
+        /* Force clocks on backplane to be sure F2 interrupt propagates */
+        saveclk = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
+                                        SBSDIO_FUNC1_CHIPCLKCSR, &err);
+        if (!err) {
+                brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_CHIPCLKCSR,
+                                       (saveclk | SBSDIO_FORCE_HT), &err);
+        }
+        if (err) {
+                BRCMF_ERROR(("%s: Failed to force clock for F2: err %d\n",
+                             __func__, err));
+        }
+
+        /* Turn off the bus (F2), free any pending packets */
+        BRCMF_INTR(("%s: disable SDIO interrupts\n", __func__));
+        brcmf_sdcard_intr_disable(bus->card);
+        brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
+                         SDIO_FUNC_ENABLE_1, NULL);
+
+        /* Clear any pending interrupts now that F2 is disabled */
+        w_sdreg32(bus, local_hostintmask,
+                  offsetof(struct sdpcmd_regs, intstatus), &retries);
+
+        /* Turn off the backplane clock (only) */
+        brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
+
+        /* Clear the data packet queues */
+        brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
+
+        /* Clear any held glomming stuff */
+        if (bus->glomd)
+                brcmu_pkt_buf_free_skb(bus->glomd);
+
+        if (bus->glom)
+                brcmu_pkt_buf_free_skb(bus->glom);
+
+        bus->glom = bus->glomd = NULL;
+
+        /* Clear rx control and wake any waiters */
+        bus->rxlen = 0;
+        brcmf_os_ioctl_resp_wake(bus->drvr);
+
+        /* Reset some F2 state stuff */
+        bus->rxskip = false;
+        bus->tx_seq = bus->rx_seq = 0;
+
+        if (enforce_mutex)
+                brcmf_sdbrcm_sdunlock(bus);
+}
+
+int brcmf_sdbrcm_bus_init(struct brcmf_pub *drvr, bool enforce_mutex)
+{
+        struct brcmf_bus *bus = drvr->bus;
+        struct brcmf_timeout tmo;
+        uint retries = 0;
+        u8 ready, enable;
+        int err, ret = 0;
+        u8 saveclk;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* try to download image and nvram to the dongle */
+        if (drvr->busstate == BRCMF_BUS_DOWN) {
+                if (!(brcmf_sdbrcm_download_firmware(bus, bus->card)))
+                        return -1;
+        }
+
+        if (!bus->drvr)
+                return 0;
+
+        /* Start the watchdog timer */
+        bus->drvr->tickcnt = 0;
+        brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
+
+        if (enforce_mutex)
+                brcmf_sdbrcm_sdlock(bus);
+
+        /* Make sure backplane clock is on, needed to generate F2 interrupt */
+        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+        if (bus->clkstate != CLK_AVAIL)
+                goto exit;
+
+        /* Force clocks on backplane to be sure F2 interrupt propagates */
+        saveclk =
+            brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
+                                  SBSDIO_FUNC1_CHIPCLKCSR, &err);
+        if (!err) {
+                brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_CHIPCLKCSR,
+                                       (saveclk | SBSDIO_FORCE_HT), &err);
+        }
+        if (err) {
+                BRCMF_ERROR(("%s: Failed to force clock for F2: err %d\n",
+                             __func__, err));
+                goto exit;
+        }
+
+        /* Enable function 2 (frame transfers) */
+        w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
+                  offsetof(struct sdpcmd_regs, tosbmailboxdata), &retries);
+        enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
+
+        brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx, enable,
+                               NULL);
+
+        /* Give the dongle some time to do its thing and set IOR2 */
+        brcmf_timeout_start(&tmo, BRCMF_WAIT_F2RDY * 1000);
+
+        ready = 0;
+        while (ready != enable && !brcmf_timeout_expired(&tmo))
+                ready = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_0,
+                                              SDIO_CCCR_IORx, NULL);
+
+        BRCMF_INFO(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
+                    __func__, enable, ready, tmo.elapsed));
+
+        /* If F2 successfully enabled, set core and enable interrupts */
+        if (ready == enable) {
+                /* Set up the interrupt mask and enable interrupts */
+                bus->hostintmask = HOSTINTMASK;
+                w_sdreg32(bus, bus->hostintmask,
+                          offsetof(struct sdpcmd_regs, hostintmask), &retries);
+
+                brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_WATERMARK,
+                                 (u8) watermark, &err);
+
+                /* Set bus state according to enable result */
+                drvr->busstate = BRCMF_BUS_DATA;
+
+                bus->intdis = false;
+                if (bus->intr) {
+                        BRCMF_INTR(("%s: enable SDIO device interrupts\n",
+                                    __func__));
+                        brcmf_sdcard_intr_enable(bus->card);
+                } else {
+                        BRCMF_INTR(("%s: disable SDIO interrupts\n", __func__));
+                        brcmf_sdcard_intr_disable(bus->card);
+                }
+
+        }
+
+        else {
+                /* Disable F2 again */
+                enable = SDIO_FUNC_ENABLE_1;
+                brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
+                                       enable, NULL);
+        }
+
+        /* Restore previous clock setting */
+        brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                         saveclk, &err);
+
+#if defined(OOB_INTR_ONLY)
+        /* Host registration for OOB interrupt */
+        if (brcmf_sdio_register_oob_intr(bus->dhd)) {
+                brcmf_sdbrcm_wd_timer(bus, 0);
+                BRCMF_ERROR(("%s Host failed to resgister for OOB\n",
+                             __func__));
+                ret = -ENODEV;
+                goto exit;
+        }
+
+        /* Enable oob at firmware */
+        brcmf_sdbrcm_enable_oob_intr(bus, true);
+#endif          /* defined(OOB_INTR_ONLY) */
+
+        /* If we didn't come up, turn off backplane clock */
+        if (drvr->busstate != BRCMF_BUS_DATA)
+                brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
+
+exit:
+        if (enforce_mutex)
+                brcmf_sdbrcm_sdunlock(bus);
+
+        return ret;
+}
+
+static void brcmf_sdbrcm_rxfail(struct brcmf_bus *bus, bool abort, bool rtx)
+{
+        struct brcmf_sdio_card *card = bus->card;
+        uint retries = 0;
+        u16 lastrbc;
+        u8 hi, lo;
+        int err;
+
+        BRCMF_ERROR(("%s: %sterminate frame%s\n", __func__,
+                     (abort ? "abort command, " : ""),
+                     (rtx ? ", send NAK" : "")));
+
+        if (abort)
+                brcmf_sdcard_abort(card, SDIO_FUNC_2);
+
+        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
+                               SFC_RF_TERM, &err);
+        bus->f1regdata++;
+
+        /* Wait until the packet has been flushed (device/FIFO stable) */
+        for (lastrbc = retries = 0xffff; retries > 0; retries--) {
+                hi = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                           SBSDIO_FUNC1_RFRAMEBCHI, NULL);
+                lo = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                           SBSDIO_FUNC1_RFRAMEBCLO, NULL);
+                bus->f1regdata += 2;
+
+                if ((hi == 0) && (lo == 0))
+                        break;
+
+                if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
+                        BRCMF_ERROR(("%s: count growing: last 0x%04x now "
+                                     "0x%04x\n",
+                                     __func__, lastrbc, ((hi << 8) + lo)));
+                }
+                lastrbc = (hi << 8) + lo;
+        }
+
+        if (!retries) {
+                BRCMF_ERROR(("%s: count never zeroed: last 0x%04x\n",
+                             __func__, lastrbc));
+        } else {
+                BRCMF_INFO(("%s: flush took %d iterations\n", __func__,
+                            (0xffff - retries)));
+        }
+
+        if (rtx) {
+                bus->rxrtx++;
+                w_sdreg32(bus, SMB_NAK,
+                          offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
+
+                bus->f1regdata++;
+                if (retries <= retry_limit)
+                        bus->rxskip = true;
+        }
+
+        /* Clear partial in any case */
+        bus->nextlen = 0;
+
+        /* If we can't reach the device, signal failure */
+        if (err || brcmf_sdcard_regfail(card))
+                bus->drvr->busstate = BRCMF_BUS_DOWN;
+}
+
+static void
+brcmf_sdbrcm_read_control(struct brcmf_bus *bus, u8 *hdr, uint len, uint doff)
+{
+        struct brcmf_sdio_card *card = bus->card;
+        uint rdlen, pad;
+
+        int sdret;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Control data already received in aligned rxctl */
+        if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
+                goto gotpkt;
+
+        /* Set rxctl for frame (w/optional alignment) */
+        bus->rxctl = bus->rxbuf;
+        if (brcmf_alignctl) {
+                bus->rxctl += firstread;
+                pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
+                if (pad)
+                        bus->rxctl += (BRCMF_SDALIGN - pad);
+                bus->rxctl -= firstread;
+        }
+
+        /* Copy the already-read portion over */
+        memcpy(bus->rxctl, hdr, firstread);
+        if (len <= firstread)
+                goto gotpkt;
+
+        /* Copy the full data pkt in gSPI case and process ioctl. */
+        if (bus->bus == SPI_BUS) {
+                memcpy(bus->rxctl, hdr, len);
+                goto gotpkt;
+        }
+
+        /* Raise rdlen to next SDIO block to avoid tail command */
+        rdlen = len - firstread;
+        if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+                pad = bus->blocksize - (rdlen % bus->blocksize);
+                if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                    ((len + pad) < bus->drvr->maxctl))
+                        rdlen += pad;
+        } else if (rdlen % BRCMF_SDALIGN) {
+                rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
+        }
+
+        /* Satisfy length-alignment requirements */
+        if (forcealign && (rdlen & (ALIGNMENT - 1)))
+                rdlen = roundup(rdlen, ALIGNMENT);
+
+        /* Drop if the read is too big or it exceeds our maximum */
+        if ((rdlen + firstread) > bus->drvr->maxctl) {
+                BRCMF_ERROR(("%s: %d-byte control read exceeds %d-byte"
+                             " buffer\n", __func__, rdlen, bus->drvr->maxctl));
+                bus->drvr->rx_errors++;
+                brcmf_sdbrcm_rxfail(bus, false, false);
+                goto done;
+        }
+
+        if ((len - doff) > bus->drvr->maxctl) {
+                BRCMF_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds "
+                             "%d-byte limit\n",
+                             __func__, len, (len - doff), bus->drvr->maxctl));
+                bus->drvr->rx_errors++;
+                bus->rx_toolong++;
+                brcmf_sdbrcm_rxfail(bus, false, false);
+                goto done;
+        }
+
+        /* Read remainder of frame body into the rxctl buffer */
+        sdret = brcmf_sdcard_recv_buf(card, brcmf_sdcard_cur_sbwad(card),
+                                SDIO_FUNC_2,
+                                F2SYNC, (bus->rxctl + firstread), rdlen,
+                                NULL, NULL, NULL);
+        bus->f2rxdata++;
+
+        /* Control frame failures need retransmission */
+        if (sdret < 0) {
+                BRCMF_ERROR(("%s: read %d control bytes failed: %d\n",
+                             __func__, rdlen, sdret));
+                bus->rxc_errors++;
+                brcmf_sdbrcm_rxfail(bus, true, true);
+                goto done;
+        }
+
+gotpkt:
+
+#ifdef BCMDBG
+        if (BRCMF_BYTES_ON() && BRCMF_CTL_ON()) {
+                printk(KERN_DEBUG "RxCtrl:\n");
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, bus->rxctl, len);
+        }
+#endif
+
+        /* Point to valid data and indicate its length */
+        bus->rxctl += doff;
+        bus->rxlen = len - doff;
+
+done:
+        /* Awake any waiters */
+        brcmf_os_ioctl_resp_wake(bus->drvr);
+}
+
+static u8 brcmf_sdbrcm_rxglom(struct brcmf_bus *bus, u8 rxseq)
+{
+        u16 dlen, totlen;
+        u8 *dptr, num = 0;
+
+        u16 sublen, check;
+        struct sk_buff *pfirst, *plast, *pnext, *save_pfirst;
+
+        int errcode;
+        u8 chan, seq, doff, sfdoff;
+        u8 txmax;
+
+        int ifidx = 0;
+        bool usechain = bus->use_rxchain;
+
+        /* If packets, issue read(s) and send up packet chain */
+        /* Return sequence numbers consumed? */
+
+        BRCMF_TRACE(("brcmf_sdbrcm_rxglom: start: glomd %p glom %p\n",
+                     bus->glomd, bus->glom));
+
+        /* If there's a descriptor, generate the packet chain */
+        if (bus->glomd) {
+                pfirst = plast = pnext = NULL;
+                dlen = (u16) (bus->glomd->len);
+                dptr = bus->glomd->data;
+                if (!dlen || (dlen & 1)) {
+                        BRCMF_ERROR(("%s: bad glomd len(%d),"
+                                     " ignore descriptor\n",
+                                     __func__, dlen));
+                        dlen = 0;
+                }
+
+                for (totlen = num = 0; dlen; num++) {
+                        /* Get (and move past) next length */
+                        sublen = get_unaligned_le16(dptr);
+                        dlen -= sizeof(u16);
+                        dptr += sizeof(u16);
+                        if ((sublen < SDPCM_HDRLEN) ||
+                            ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
+                                BRCMF_ERROR(("%s: descriptor len %d bad: %d\n",
+                                             __func__, num, sublen));
+                                pnext = NULL;
+                                break;
+                        }
+                        if (sublen % BRCMF_SDALIGN) {
+                                BRCMF_ERROR(("%s: sublen %d not multiple of"
+                                             " %d\n", __func__, sublen,
+                                             BRCMF_SDALIGN));
+                                usechain = false;
+                        }
+                        totlen += sublen;
+
+                        /* For last frame, adjust read len so total
+                                 is a block multiple */
+                        if (!dlen) {
+                                sublen +=
+                                    (roundup(totlen, bus->blocksize) - totlen);
+                                totlen = roundup(totlen, bus->blocksize);
+                        }
+
+                        /* Allocate/chain packet for next subframe */
+                        pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
+                        if (pnext == NULL) {
+                                BRCMF_ERROR(("%s: bcm_pkt_buf_get_skb failed, "
+                                             "num %d len %d\n", __func__,
+                                             num, sublen));
+                                break;
+                        }
+                        if (!pfirst) {
+                                pfirst = plast = pnext;
+                        } else {
+                                plast->next = pnext;
+                                plast = pnext;
+                        }
+
+                        /* Adhere to start alignment requirements */
+                        PKTALIGN(pnext, sublen, BRCMF_SDALIGN);
+                }
+
+                /* If all allocations succeeded, save packet chain
+                         in bus structure */
+                if (pnext) {
+                        BRCMF_GLOM(("%s: allocated %d-byte packet chain for %d "
+                                    "subframes\n", __func__, totlen, num));
+                        if (BRCMF_GLOM_ON() && bus->nextlen) {
+                                if (totlen != bus->nextlen) {
+                                        BRCMF_GLOM(("%s: glomdesc mismatch: "
+                                                    "nextlen %d glomdesc %d "
+                                                    "rxseq %d\n", __func__,
+                                                    bus->nextlen,
+                                                    totlen, rxseq));
+                                }
+                        }
+                        bus->glom = pfirst;
+                        pfirst = pnext = NULL;
+                } else {
+                        if (pfirst)
+                                brcmu_pkt_buf_free_skb(pfirst);
+                        bus->glom = NULL;
+                        num = 0;
+                }
+
+                /* Done with descriptor packet */
+                brcmu_pkt_buf_free_skb(bus->glomd);
+                bus->glomd = NULL;
+                bus->nextlen = 0;
+        }
+
+        /* Ok -- either we just generated a packet chain,
+                 or had one from before */
+        if (bus->glom) {
+                if (BRCMF_GLOM_ON()) {
+                        BRCMF_GLOM(("%s: try superframe read, packet chain:\n",
+                                    __func__));
+                        for (pnext = bus->glom; pnext; pnext = pnext->next) {
+                                BRCMF_GLOM(("    %p: %p len 0x%04x (%d)\n",
+                                            pnext, (u8 *) (pnext->data),
+                                            pnext->len, pnext->len));
+                        }
+                }
+
+                pfirst = bus->glom;
+                dlen = (u16) brcmu_pkttotlen(pfirst);
+
+                /* Do an SDIO read for the superframe.  Configurable iovar to
+                 * read directly into the chained packet, or allocate a large
+                 * packet and and copy into the chain.
+                 */
+                if (usechain) {
+                        errcode = brcmf_sdcard_recv_buf(bus->card,
+                                        brcmf_sdcard_cur_sbwad(bus->card),
+                                        SDIO_FUNC_2,
+                                        F2SYNC, (u8 *) pfirst->data, dlen,
+                                        pfirst, NULL, NULL);
+                } else if (bus->dataptr) {
+                        errcode = brcmf_sdcard_recv_buf(bus->card,
+                                        brcmf_sdcard_cur_sbwad(bus->card),
+                                        SDIO_FUNC_2,
+                                        F2SYNC, bus->dataptr, dlen,
+                                        NULL, NULL, NULL);
+                        sublen = (u16) brcmu_pktfrombuf(pfirst, 0, dlen,
+                                                bus->dataptr);
+                        if (sublen != dlen) {
+                                BRCMF_ERROR(("%s: FAILED TO COPY, dlen %d "
+                                             "sublen %d\n",
+                                             __func__, dlen, sublen));
+                                errcode = -1;
+                        }
+                        pnext = NULL;
+                } else {
+                        BRCMF_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, "
+                                     "FORCE FAILURE\n", dlen));
+                        errcode = -1;
+                }
+                bus->f2rxdata++;
+
+                /* On failure, kill the superframe, allow a couple retries */
+                if (errcode < 0) {
+                        BRCMF_ERROR(("%s: glom read of %d bytes failed: %d\n",
+                                     __func__, dlen, errcode));
+                        bus->drvr->rx_errors++;
+
+                        if (bus->glomerr++ < 3) {
+                                brcmf_sdbrcm_rxfail(bus, true, true);
+                        } else {
+                                bus->glomerr = 0;
+                                brcmf_sdbrcm_rxfail(bus, true, false);
+                                brcmu_pkt_buf_free_skb(bus->glom);
+                                bus->rxglomfail++;
+                                bus->glom = NULL;
+                        }
+                        return 0;
+                }
+#ifdef BCMDBG
+                if (BRCMF_GLOM_ON()) {
+                        printk(KERN_DEBUG "SUPERFRAME:\n");
+                        print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                pfirst->data, min_t(int, pfirst->len, 48));
+                }
+#endif
+
+                /* Validate the superframe header */
+                dptr = (u8 *) (pfirst->data);
+                sublen = get_unaligned_le16(dptr);
+                check = get_unaligned_le16(dptr + sizeof(u16));
+
+                chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+                bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+                if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                        BRCMF_INFO(("%s: nextlen too large (%d) seq %d\n",
+                                    __func__, bus->nextlen, seq));
+                        bus->nextlen = 0;
+                }
+                doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+                txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+                errcode = 0;
+                if ((u16)~(sublen ^ check)) {
+                        BRCMF_ERROR(("%s (superframe): HW hdr error: len/check "
+                                     "0x%04x/0x%04x\n", __func__, sublen,
+                                     check));
+                        errcode = -1;
+                } else if (roundup(sublen, bus->blocksize) != dlen) {
+                        BRCMF_ERROR(("%s (superframe): len 0x%04x, rounded "
+                                     "0x%04x, expect 0x%04x\n",
+                                     __func__, sublen,
+                                     roundup(sublen, bus->blocksize), dlen));
+                        errcode = -1;
+                } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
+                           SDPCM_GLOM_CHANNEL) {
+                        BRCMF_ERROR(("%s (superframe): bad channel %d\n",
+                                   __func__,
+                                   SDPCM_PACKET_CHANNEL(&dptr
+                                                        [SDPCM_FRAMETAG_LEN])));
+                        errcode = -1;
+                } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
+                        BRCMF_ERROR(("%s (superframe): got 2nd descriptor?\n",
+                                     __func__));
+                        errcode = -1;
+                } else if ((doff < SDPCM_HDRLEN) ||
+                           (doff > (pfirst->len - SDPCM_HDRLEN))) {
+                        BRCMF_ERROR(("%s (superframe): Bad data offset %d: "
+                                     "HW %d pkt %d min %d\n",
+                                     __func__, doff, sublen,
+                                     pfirst->len, SDPCM_HDRLEN));
+                        errcode = -1;
+                }
+
+                /* Check sequence number of superframe SW header */
+                if (rxseq != seq) {
+                        BRCMF_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
+                                    __func__, seq, rxseq));
+                        bus->rx_badseq++;
+                        rxseq = seq;
+                }
+
+                /* Check window for sanity */
+                if ((u8) (txmax - bus->tx_seq) > 0x40) {
+                        BRCMF_ERROR(("%s: unlikely tx max %d with tx_seq %d\n",
+                                     __func__, txmax, bus->tx_seq));
+                        txmax = bus->tx_seq + 2;
+                }
+                bus->tx_max = txmax;
+
+                /* Remove superframe header, remember offset */
+                skb_pull(pfirst, doff);
+                sfdoff = doff;
+
+                /* Validate all the subframe headers */
+                for (num = 0, pnext = pfirst; pnext && !errcode;
+                     num++, pnext = pnext->next) {
+                        dptr = (u8 *) (pnext->data);
+                        dlen = (u16) (pnext->len);
+                        sublen = get_unaligned_le16(dptr);
+                        check = get_unaligned_le16(dptr + sizeof(u16));
+                        chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                        doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+#ifdef BCMDBG
+                        if (BRCMF_GLOM_ON()) {
+                                printk(KERN_DEBUG "subframe:\n");
+                                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                                     dptr, 32);
+                        }
+#endif
+
+                        if ((u16)~(sublen ^ check)) {
+                                BRCMF_ERROR(("%s (subframe %d): HW hdr error: "
+                                             "len/check 0x%04x/0x%04x\n",
+                                             __func__, num, sublen, check));
+                                errcode = -1;
+                        } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
+                                BRCMF_ERROR(("%s (subframe %d): length mismatch"
+                                             ": len 0x%04x, expect 0x%04x\n",
+                                             __func__, num, sublen, dlen));
+                                errcode = -1;
+                        } else if ((chan != SDPCM_DATA_CHANNEL) &&
+                                   (chan != SDPCM_EVENT_CHANNEL)) {
+                                BRCMF_ERROR(("%s (subframe %d): bad channel"
+                                             " %d\n", __func__, num, chan));
+                                errcode = -1;
+                        } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
+                                BRCMF_ERROR(("%s (subframe %d): Bad data offset"
+                                             " %d: HW %d min %d\n",
+                                             __func__, num, doff, sublen,
+                                             SDPCM_HDRLEN));
+                                errcode = -1;
+                        }
+                }
+
+                if (errcode) {
+                        /* Terminate frame on error, request
+                                 a couple retries */
+                        if (bus->glomerr++ < 3) {
+                                /* Restore superframe header space */
+                                skb_push(pfirst, sfdoff);
+                                brcmf_sdbrcm_rxfail(bus, true, true);
+                        } else {
+                                bus->glomerr = 0;
+                                brcmf_sdbrcm_rxfail(bus, true, false);
+                                brcmu_pkt_buf_free_skb(bus->glom);
+                                bus->rxglomfail++;
+                                bus->glom = NULL;
+                        }
+                        bus->nextlen = 0;
+                        return 0;
+                }
+
+                /* Basic SD framing looks ok - process each packet (header) */
+                save_pfirst = pfirst;
+                bus->glom = NULL;
+                plast = NULL;
+
+                for (num = 0; pfirst; rxseq++, pfirst = pnext) {
+                        pnext = pfirst->next;
+                        pfirst->next = NULL;
+
+                        dptr = (u8 *) (pfirst->data);
+                        sublen = get_unaligned_le16(dptr);
+                        chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                        seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+                        doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+                        BRCMF_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d "
+                                    "chan %d seq %d\n",
+                                    __func__, num, pfirst, pfirst->data,
+                                    pfirst->len, sublen, chan, seq));
+
+                        /* precondition: chan == SDPCM_DATA_CHANNEL ||
+                                         chan == SDPCM_EVENT_CHANNEL */
+
+                        if (rxseq != seq) {
+                                BRCMF_GLOM(("%s: rx_seq %d, expected %d\n",
+                                            __func__, seq, rxseq));
+                                bus->rx_badseq++;
+                                rxseq = seq;
+                        }
+#ifdef BCMDBG
+                        if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
+                                printk(KERN_DEBUG "Rx Subframe Data:\n");
+                                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                                     dptr, dlen);
+                        }
+#endif
+
+                        __skb_trim(pfirst, sublen);
+                        skb_pull(pfirst, doff);
+
+                        if (pfirst->len == 0) {
+                                brcmu_pkt_buf_free_skb(pfirst);
+                                if (plast) {
+                                        plast->next = pnext;
+                                } else {
+                                        save_pfirst = pnext;
+                                }
+                                continue;
+                        } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pfirst)
+                                        != 0) {
+                                BRCMF_ERROR(("%s: rx protocol error\n",
+                                             __func__));
+                                bus->drvr->rx_errors++;
+                                brcmu_pkt_buf_free_skb(pfirst);
+                                if (plast) {
+                                        plast->next = pnext;
+                                } else {
+                                        save_pfirst = pnext;
+                                }
+                                continue;
+                        }
+
+                        /* this packet will go up, link back into
+                                 chain and count it */
+                        pfirst->next = pnext;
+                        plast = pfirst;
+                        num++;
+
+#ifdef BCMDBG
+                        if (BRCMF_GLOM_ON()) {
+                                BRCMF_GLOM(("%s subframe %d to stack, %p"
+                                            "(%p/%d) nxt/lnk %p/%p\n",
+                                            __func__, num, pfirst, pfirst->data,
+                                            pfirst->len, pfirst->next,
+                                            pfirst->prev));
+                                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                                pfirst->data,
+                                                min_t(int, pfirst->len, 32));
+                        }
+#endif                          /* BCMDBG */
+                }
+                if (num) {
+                        brcmf_sdbrcm_sdunlock(bus);
+                        brcmf_rx_frame(bus->drvr, ifidx, save_pfirst, num);
+                        brcmf_sdbrcm_sdlock(bus);
+                }
+
+                bus->rxglomframes++;
+                bus->rxglompkts += num;
+        }
+        return num;
+}
+
+/* Return true if there may be more frames to read */
+static uint
+brcmf_sdbrcm_readframes(struct brcmf_bus *bus, uint maxframes, bool *finished)
+{
+        struct brcmf_sdio_card *card = bus->card;
+
+        u16 len, check; /* Extracted hardware header fields */
+        u8 chan, seq, doff;     /* Extracted software header fields */
+        u8 fcbits;              /* Extracted fcbits from software header */
+
+        struct sk_buff *pkt;            /* Packet for event or data frames */
+        u16 pad;                /* Number of pad bytes to read */
+        u16 rdlen;              /* Total number of bytes to read */
+        u8 rxseq;               /* Next sequence number to expect */
+        uint rxleft = 0;        /* Remaining number of frames allowed */
+        int sdret;              /* Return code from calls */
+        u8 txmax;               /* Maximum tx sequence offered */
+        bool len_consistent;    /* Result of comparing readahead len and
+                                         len from hw-hdr */
+        u8 *rxbuf;
+        int ifidx = 0;
+        uint rxcount = 0;       /* Total frames read */
+
+#if defined(BCMDBG) || defined(SDTEST)
+        bool sdtest = false;    /* To limit message spew from test mode */
+#endif
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+#ifdef SDTEST
+        /* Allow pktgen to override maxframes */
+        if (bus->pktgen_count && (bus->pktgen_mode == BRCMF_PKTGEN_RECV)) {
+                maxframes = bus->pktgen_count;
+                sdtest = true;
+        }
+#endif
+
+        /* Not finished unless we encounter no more frames indication */
+        *finished = false;
+
+        for (rxseq = bus->rx_seq, rxleft = maxframes;
+             !bus->rxskip && rxleft && bus->drvr->busstate != BRCMF_BUS_DOWN;
+             rxseq++, rxleft--) {
+
+                /* Handle glomming separately */
+                if (bus->glom || bus->glomd) {
+                        u8 cnt;
+                        BRCMF_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
+                                    __func__, bus->glomd, bus->glom));
+                        cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
+                        BRCMF_GLOM(("%s: rxglom returned %d\n", __func__, cnt));
+                        rxseq += cnt - 1;
+                        rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
+                        continue;
+                }
+
+                /* Try doing single read if we can */
+                if (brcmf_readahead && bus->nextlen) {
+                        u16 nextlen = bus->nextlen;
+                        bus->nextlen = 0;
+
+                        if (bus->bus == SPI_BUS) {
+                                rdlen = len = nextlen;
+                        } else {
+                                rdlen = len = nextlen << 4;
+
+                                /* Pad read to blocksize for efficiency */
+                                if (bus->roundup && bus->blocksize
+                                    && (rdlen > bus->blocksize)) {
+                                        pad =
+                                            bus->blocksize -
+                                            (rdlen % bus->blocksize);
+                                        if ((pad <= bus->roundup)
+                                            && (pad < bus->blocksize)
+                                            && ((rdlen + pad + firstread) <
+                                                MAX_RX_DATASZ))
+                                                rdlen += pad;
+                                } else if (rdlen % BRCMF_SDALIGN) {
+                                        rdlen +=
+                                            BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
+                                }
+                        }
+
+                        /* We use bus->rxctl buffer in WinXP for initial
+                         * control pkt receives.
+                         * Later we use buffer-poll for data as well
+                         * as control packets.
+                         * This is required because dhd receives full
+                         * frame in gSPI unlike SDIO.
+                         * After the frame is received we have to
+                         * distinguish whether it is data
+                         * or non-data frame.
+                         */
+                        /* Allocate a packet buffer */
+                        pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
+                        if (!pkt) {
+                                if (bus->bus == SPI_BUS) {
+                                        bus->usebufpool = false;
+                                        bus->rxctl = bus->rxbuf;
+                                        if (brcmf_alignctl) {
+                                                bus->rxctl += firstread;
+                                                pad = ((unsigned long)bus->rxctl %
+                                                      BRCMF_SDALIGN);
+                                                if (pad)
+                                                        bus->rxctl +=
+                                                            (BRCMF_SDALIGN - pad);
+                                                bus->rxctl -= firstread;
+                                        }
+                                        rxbuf = bus->rxctl;
+                                        /* Read the entire frame */
+                                        sdret = brcmf_sdcard_recv_buf(card,
+                                                   brcmf_sdcard_cur_sbwad(card),
+                                                   SDIO_FUNC_2, F2SYNC,
+                                                   rxbuf, rdlen,
+                                                   NULL, NULL, NULL);
+                                        bus->f2rxdata++;
+
+                                        /* Control frame failures need
+                                         retransmission */
+                                        if (sdret < 0) {
+                                                BRCMF_ERROR(("%s: read %d "
+                                                             "control bytes "
+                                                             "failed: %d\n",
+                                                             __func__,
+                                                             rdlen, sdret));
+                                                /* dhd.rx_ctlerrs is higher */
+                                                bus->rxc_errors++;
+                                                brcmf_sdbrcm_rxfail(bus, true,
+                                                       (bus->bus ==
+                                                        SPI_BUS) ? false
+                                                       : true);
+                                                continue;
+                                        }
+                                } else {
+                                        /* Give up on data,
+                                        request rtx of events */
+                                        BRCMF_ERROR(("%s (nextlen): "
+                                                     "brcmu_pkt_buf_get_skb "
+                                                     "failed:"
+                                                     " len %d rdlen %d expected"
+                                                     " rxseq %d\n", __func__,
+                                                     len, rdlen, rxseq));
+                                        continue;
+                                }
+                        } else {
+                                if (bus->bus == SPI_BUS)
+                                        bus->usebufpool = true;
+
+                                PKTALIGN(pkt, rdlen, BRCMF_SDALIGN);
+                                rxbuf = (u8 *) (pkt->data);
+                                /* Read the entire frame */
+                                sdret = brcmf_sdcard_recv_buf(card,
+                                                brcmf_sdcard_cur_sbwad(card),
+                                                SDIO_FUNC_2, F2SYNC,
+                                                rxbuf, rdlen,
+                                                pkt, NULL, NULL);
+                                bus->f2rxdata++;
+
+                                if (sdret < 0) {
+                                        BRCMF_ERROR(("%s (nextlen): read %d"
+                                                     " bytes failed: %d\n",
+                                                     __func__, rdlen, sdret));
+                                        brcmu_pkt_buf_free_skb(pkt);
+                                        bus->drvr->rx_errors++;
+                                        /* Force retry w/normal header read.
+                                         * Don't attempt NAK for
+                                         * gSPI
+                                         */
+                                        brcmf_sdbrcm_rxfail(bus, true,
+                                                       (bus->bus ==
+                                                        SPI_BUS) ? false :
+                                                       true);
+                                        continue;
+                                }
+                        }
+
+                        /* Now check the header */
+                        memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
+
+                        /* Extract hardware header fields */
+                        len = get_unaligned_le16(bus->rxhdr);
+                        check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
+
+                        /* All zeros means readahead info was bad */
+                        if (!(len | check)) {
+                                BRCMF_INFO(("%s (nextlen): read zeros in HW "
+                                            "header???\n", __func__));
+                                brcmf_sdbrcm_pktfree2(bus, pkt);
+                                continue;
+                        }
+
+                        /* Validate check bytes */
+                        if ((u16)~(len ^ check)) {
+                                BRCMF_ERROR(("%s (nextlen): HW hdr error:"
+                                             " nextlen/len/check"
+                                             " 0x%04x/0x%04x/0x%04x\n",
+                                             __func__, nextlen, len, check));
+                                bus->rx_badhdr++;
+                                brcmf_sdbrcm_rxfail(bus, false, false);
+                                brcmf_sdbrcm_pktfree2(bus, pkt);
+                                continue;
+                        }
+
+                        /* Validate frame length */
+                        if (len < SDPCM_HDRLEN) {
+                                BRCMF_ERROR(("%s (nextlen): HW hdr length "
+                                             "invalid: %d\n", __func__, len));
+                                brcmf_sdbrcm_pktfree2(bus, pkt);
+                                continue;
+                        }
+
+                        /* Check for consistency withreadahead info */
+                        len_consistent = (nextlen != (roundup(len, 16) >> 4));
+                        if (len_consistent) {
+                                /* Mismatch, force retry w/normal
+                                        header (may be >4K) */
+                                BRCMF_ERROR(("%s (nextlen): mismatch, "
+                                             "nextlen %d len %d rnd %d; "
+                                             "expected rxseq %d\n",
+                                             __func__, nextlen,
+                                             len, roundup(len, 16), rxseq));
+                                brcmf_sdbrcm_rxfail(bus, true,
+                                                  bus->bus != SPI_BUS);
+                                brcmf_sdbrcm_pktfree2(bus, pkt);
+                                continue;
+                        }
+
+                        /* Extract software header fields */
+                        chan = SDPCM_PACKET_CHANNEL(
+                                        &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                        seq = SDPCM_PACKET_SEQUENCE(
+                                        &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                        doff = SDPCM_DOFFSET_VALUE(
+                                        &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                        txmax = SDPCM_WINDOW_VALUE(
+                                        &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                        bus->nextlen =
+                            bus->rxhdr[SDPCM_FRAMETAG_LEN +
+                                       SDPCM_NEXTLEN_OFFSET];
+                        if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                                BRCMF_INFO(("%s (nextlen): got frame w/nextlen"
+                                            " too large (%d), seq %d\n",
+                                            __func__, bus->nextlen, seq));
+                                bus->nextlen = 0;
+                        }
+
+                        bus->drvr->rx_readahead_cnt++;
+
+                        /* Handle Flow Control */
+                        fcbits = SDPCM_FCMASK_VALUE(
+                                        &bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                        if (bus->flowcontrol != fcbits) {
+                                if (~bus->flowcontrol & fcbits)
+                                        bus->fc_xoff++;
+
+                                if (bus->flowcontrol & ~fcbits)
+                                        bus->fc_xon++;
+
+                                bus->fc_rcvd++;
+                                bus->flowcontrol = fcbits;
+                        }
+
+                        /* Check and update sequence number */
+                        if (rxseq != seq) {
+                                BRCMF_INFO(("%s (nextlen): rx_seq %d, expected "
+                                            "%d\n", __func__, seq, rxseq));
+                                bus->rx_badseq++;
+                                rxseq = seq;
+                        }
+
+                        /* Check window for sanity */
+                        if ((u8) (txmax - bus->tx_seq) > 0x40) {
+                                BRCMF_ERROR(("%s: got unlikely tx max %d with "
+                                             "tx_seq %d\n",
+                                             __func__, txmax, bus->tx_seq));
+                                txmax = bus->tx_seq + 2;
+                        }
+                        bus->tx_max = txmax;
+
+#ifdef BCMDBG
+                        if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
+                                printk(KERN_DEBUG "Rx Data:\n");
+                                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                                     rxbuf, len);
+                        } else if (BRCMF_HDRS_ON()) {
+                                printk(KERN_DEBUG "RxHdr:\n");
+                                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                                     bus->rxhdr, SDPCM_HDRLEN);
+                        }
+#endif
+
+                        if (chan == SDPCM_CONTROL_CHANNEL) {
+                                if (bus->bus == SPI_BUS) {
+                                        brcmf_sdbrcm_read_control(bus, rxbuf,
+                                                                  len, doff);
+                                } else {
+                                        BRCMF_ERROR(("%s (nextlen): readahead"
+                                                     " on control packet %d?\n",
+                                                     __func__, seq));
+                                        /* Force retry w/normal header read */
+                                        bus->nextlen = 0;
+                                        brcmf_sdbrcm_rxfail(bus, false, true);
+                                }
+                                brcmf_sdbrcm_pktfree2(bus, pkt);
+                                continue;
+                        }
+
+                        if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
+                                BRCMF_ERROR(("Received %d bytes on %d channel."
+                                             " Running out of " "rx pktbuf's or"
+                                             " not yet malloced.\n",
+                                             len, chan));
+                                continue;
+                        }
+
+                        /* Validate data offset */
+                        if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+                                BRCMF_ERROR(("%s (nextlen): bad data offset %d:"
+                                             " HW len %d min %d\n", __func__,
+                                             doff, len, SDPCM_HDRLEN));
+                                brcmf_sdbrcm_rxfail(bus, false, false);
+                                brcmf_sdbrcm_pktfree2(bus, pkt);
+                                continue;
+                        }
+
+                        /* All done with this one -- now deliver the packet */
+                        goto deliver;
+                }
+                /* gSPI frames should not be handled in fractions */
+                if (bus->bus == SPI_BUS)
+                        break;
+
+                /* Read frame header (hardware and software) */
+                sdret = brcmf_sdcard_recv_buf(card,
+                                brcmf_sdcard_cur_sbwad(card),
+                                SDIO_FUNC_2, F2SYNC, bus->rxhdr, firstread,
+                                NULL, NULL, NULL);
+                bus->f2rxhdrs++;
+
+                if (sdret < 0) {
+                        BRCMF_ERROR(("%s: RXHEADER FAILED: %d\n", __func__,
+                                     sdret));
+                        bus->rx_hdrfail++;
+                        brcmf_sdbrcm_rxfail(bus, true, true);
+                        continue;
+                }
+#ifdef BCMDBG
+                if (BRCMF_BYTES_ON() || BRCMF_HDRS_ON()) {
+                        printk(KERN_DEBUG "RxHdr:\n");
+                        print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                             bus->rxhdr, SDPCM_HDRLEN);
+                }
+#endif
+
+                /* Extract hardware header fields */
+                len = get_unaligned_le16(bus->rxhdr);
+                check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
+
+                /* All zeros means no more frames */
+                if (!(len | check)) {
+                        *finished = true;
+                        break;
+                }
+
+                /* Validate check bytes */
+                if ((u16) ~(len ^ check)) {
+                        BRCMF_ERROR(("%s: HW hdr err: len/check "
+                                     "0x%04x/0x%04x\n", __func__, len, check));
+                        bus->rx_badhdr++;
+                        brcmf_sdbrcm_rxfail(bus, false, false);
+                        continue;
+                }
+
+                /* Validate frame length */
+                if (len < SDPCM_HDRLEN) {
+                        BRCMF_ERROR(("%s: HW hdr length invalid: %d\n",
+                                     __func__, len));
+                        continue;
+                }
+
+                /* Extract software header fields */
+                chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                /* Validate data offset */
+                if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+                        BRCMF_ERROR(("%s: Bad data offset %d: HW len %d,"
+                                     " min %d seq %d\n", __func__, doff,
+                                     len, SDPCM_HDRLEN, seq));
+                        bus->rx_badhdr++;
+                        brcmf_sdbrcm_rxfail(bus, false, false);
+                        continue;
+                }
+
+                /* Save the readahead length if there is one */
+                bus->nextlen =
+                    bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+                if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                        BRCMF_INFO(("%s (nextlen): got frame w/nextlen too"
+                                    " large (%d), seq %d\n",
+                                    __func__, bus->nextlen, seq));
+                        bus->nextlen = 0;
+                }
+
+                /* Handle Flow Control */
+                fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                if (bus->flowcontrol != fcbits) {
+                        if (~bus->flowcontrol & fcbits)
+                                bus->fc_xoff++;
+
+                        if (bus->flowcontrol & ~fcbits)
+                                bus->fc_xon++;
+
+                        bus->fc_rcvd++;
+                        bus->flowcontrol = fcbits;
+                }
+
+                /* Check and update sequence number */
+                if (rxseq != seq) {
+                        BRCMF_INFO(("%s: rx_seq %d, expected %d\n", __func__,
+                                    seq, rxseq));
+                        bus->rx_badseq++;
+                        rxseq = seq;
+                }
+
+                /* Check window for sanity */
+                if ((u8) (txmax - bus->tx_seq) > 0x40) {
+                        BRCMF_ERROR(("%s: unlikely tx max %d with tx_seq %d\n",
+                                     __func__, txmax, bus->tx_seq));
+                        txmax = bus->tx_seq + 2;
+                }
+                bus->tx_max = txmax;
+
+                /* Call a separate function for control frames */
+                if (chan == SDPCM_CONTROL_CHANNEL) {
+                        brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
+                        continue;
+                }
+
+                /* precondition: chan is either SDPCM_DATA_CHANNEL,
+                   SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
+                   SDPCM_GLOM_CHANNEL */
+
+                /* Length to read */
+                rdlen = (len > firstread) ? (len - firstread) : 0;
+
+                /* May pad read to blocksize for efficiency */
+                if (bus->roundup && bus->blocksize &&
+                        (rdlen > bus->blocksize)) {
+                        pad = bus->blocksize - (rdlen % bus->blocksize);
+                        if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                            ((rdlen + pad + firstread) < MAX_RX_DATASZ))
+                                rdlen += pad;
+                } else if (rdlen % BRCMF_SDALIGN) {
+                        rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
+                }
+
+                /* Satisfy length-alignment requirements */
+                if (forcealign && (rdlen & (ALIGNMENT - 1)))
+                        rdlen = roundup(rdlen, ALIGNMENT);
+
+                if ((rdlen + firstread) > MAX_RX_DATASZ) {
+                        /* Too long -- skip this frame */
+                        BRCMF_ERROR(("%s: too long: len %d rdlen %d\n",
+                                     __func__, len, rdlen));
+                        bus->drvr->rx_errors++;
+                        bus->rx_toolong++;
+                        brcmf_sdbrcm_rxfail(bus, false, false);
+                        continue;
+                }
+
+                pkt = brcmu_pkt_buf_get_skb(rdlen + firstread + BRCMF_SDALIGN);
+                if (!pkt) {
+                        /* Give up on data, request rtx of events */
+                        BRCMF_ERROR(("%s: brcmu_pkt_buf_get_skb failed:"
+                                     " rdlen %d chan %d\n", __func__, rdlen,
+                                     chan));
+                        bus->drvr->rx_dropped++;
+                        brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
+                        continue;
+                }
+
+                /* Leave room for what we already read, and align remainder */
+                skb_pull(pkt, firstread);
+                PKTALIGN(pkt, rdlen, BRCMF_SDALIGN);
+
+                /* Read the remaining frame data */
+                sdret = brcmf_sdcard_recv_buf(card,
+                                brcmf_sdcard_cur_sbwad(card),
+                                SDIO_FUNC_2, F2SYNC, ((u8 *) (pkt->data)),
+                                rdlen, pkt, NULL, NULL);
+                bus->f2rxdata++;
+
+                if (sdret < 0) {
+                        BRCMF_ERROR(("%s: read %d %s bytes failed: %d\n",
+                                     __func__, rdlen,
+                                     ((chan == SDPCM_EVENT_CHANNEL) ? "event"
+                                     : ((chan == SDPCM_DATA_CHANNEL) ? "data"
+                                     : "test")), sdret));
+                        brcmu_pkt_buf_free_skb(pkt);
+                        bus->drvr->rx_errors++;
+                        brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
+                        continue;
+                }
+
+                /* Copy the already-read portion */
+                skb_push(pkt, firstread);
+                memcpy(pkt->data, bus->rxhdr, firstread);
+
+#ifdef BCMDBG
+                if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
+                        printk(KERN_DEBUG "Rx Data:\n");
+                        print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
+                                             pkt->data, len);
+                }
+#endif
+
+deliver:
+                /* Save superframe descriptor and allocate packet frame */
+                if (chan == SDPCM_GLOM_CHANNEL) {
+                        if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
+                                BRCMF_GLOM(("%s: glom descriptor, %d bytes:\n",
+                                            __func__, len));
+#ifdef BCMDBG
+                                if (BRCMF_GLOM_ON()) {
+                                        printk(KERN_DEBUG "Glom Data:\n");
+                                        print_hex_dump_bytes("",
+                                                             DUMP_PREFIX_OFFSET,
+                                                             pkt->data, len);
+                                }
+#endif
+                                __skb_trim(pkt, len);
+                                skb_pull(pkt, SDPCM_HDRLEN);
+                                bus->glomd = pkt;
+                        } else {
+                                BRCMF_ERROR(("%s: glom superframe w/o "
+                                             "descriptor!\n", __func__));
+                                brcmf_sdbrcm_rxfail(bus, false, false);
+                        }
+                        continue;
+                }
+
+                /* Fill in packet len and prio, deliver upward */
+                __skb_trim(pkt, len);
+                skb_pull(pkt, doff);
+
+#ifdef SDTEST
+                /* Test channel packets are processed separately */
+                if (chan == SDPCM_TEST_CHANNEL) {
+                        brcmf_sdbrcm_checkdied(bus, pkt, seq);
+                        continue;
+                }
+#endif                          /* SDTEST */
+
+                if (pkt->len == 0) {
+                        brcmu_pkt_buf_free_skb(pkt);
+                        continue;
+                } else if (brcmf_proto_hdrpull(bus->drvr, &ifidx, pkt) != 0) {
+                        BRCMF_ERROR(("%s: rx protocol error\n", __func__));
+                        brcmu_pkt_buf_free_skb(pkt);
+                        bus->drvr->rx_errors++;
+                        continue;
+                }
+
+                /* Unlock during rx call */
+                brcmf_sdbrcm_sdunlock(bus);
+                brcmf_rx_frame(bus->drvr, ifidx, pkt, 1);
+                brcmf_sdbrcm_sdlock(bus);
+        }
+        rxcount = maxframes - rxleft;
+#ifdef BCMDBG
+        /* Message if we hit the limit */
+        if (!rxleft && !sdtest)
+                BRCMF_DATA(("%s: hit rx limit of %d frames\n", __func__,
+                            maxframes));
+        else
+#endif                          /* BCMDBG */
+                BRCMF_DATA(("%s: processed %d frames\n", __func__, rxcount));
+        /* Back off rxseq if awaiting rtx, update rx_seq */
+        if (bus->rxskip)
+                rxseq--;
+        bus->rx_seq = rxseq;
+
+        return rxcount;
+}
+
+static u32 brcmf_sdbrcm_hostmail(struct brcmf_bus *bus)
+{
+        u32 intstatus = 0;
+        u32 hmb_data;
+        u8 fcbits;
+        uint retries = 0;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Read mailbox data and ack that we did so */
+        r_sdreg32(bus, &hmb_data,
+                  offsetof(struct sdpcmd_regs, tohostmailboxdata), &retries);
+
+        if (retries <= retry_limit)
+                w_sdreg32(bus, SMB_INT_ACK,
+                          offsetof(struct sdpcmd_regs, tosbmailbox), &retries);
+        bus->f1regdata += 2;
+
+        /* Dongle recomposed rx frames, accept them again */
+        if (hmb_data & HMB_DATA_NAKHANDLED) {
+                BRCMF_INFO(("Dongle reports NAK handled, expect rtx of %d\n",
+                            bus->rx_seq));
+                if (!bus->rxskip)
+                        BRCMF_ERROR(("%s: unexpected NAKHANDLED!\n", __func__));
+
+                bus->rxskip = false;
+                intstatus |= I_HMB_FRAME_IND;
+        }
+
+        /*
+         * DEVREADY does not occur with gSPI.
+         */
+        if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
+                bus->sdpcm_ver =
+                    (hmb_data & HMB_DATA_VERSION_MASK) >>
+                    HMB_DATA_VERSION_SHIFT;
+                if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
+                        BRCMF_ERROR(("Version mismatch, dongle reports %d, "
+                                     "expecting %d\n",
+                                     bus->sdpcm_ver, SDPCM_PROT_VERSION));
+                else
+                        BRCMF_INFO(("Dongle ready, protocol version %d\n",
+                                    bus->sdpcm_ver));
+        }
+
+        /*
+         * Flow Control has been moved into the RX headers and this out of band
+         * method isn't used any more.
+         * remaining backward compatible with older dongles.
+         */
+        if (hmb_data & HMB_DATA_FC) {
+                fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
+                                                        HMB_DATA_FCDATA_SHIFT;
+
+                if (fcbits & ~bus->flowcontrol)
+                        bus->fc_xoff++;
+
+                if (bus->flowcontrol & ~fcbits)
+                        bus->fc_xon++;
+
+                bus->fc_rcvd++;
+                bus->flowcontrol = fcbits;
+        }
+
+        /* Shouldn't be any others */
+        if (hmb_data & ~(HMB_DATA_DEVREADY |
+                         HMB_DATA_NAKHANDLED |
+                         HMB_DATA_FC |
+                         HMB_DATA_FWREADY |
+                         HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK)) {
+                BRCMF_ERROR(("Unknown mailbox data content: 0x%02x\n",
+                             hmb_data));
+        }
+
+        return intstatus;
+}
+
+static bool brcmf_sdbrcm_dpc(struct brcmf_bus *bus)
+{
+        struct brcmf_sdio_card *card = bus->card;
+        u32 intstatus, newstatus = 0;
+        uint retries = 0;
+        uint rxlimit = brcmf_rxbound;   /* Rx frames to read before resched */
+        uint txlimit = brcmf_txbound;   /* Tx frames to send before resched */
+        uint framecnt = 0;      /* Temporary counter of tx/rx frames */
+        bool rxdone = true;     /* Flag for no more read data */
+        bool resched = false;   /* Flag indicating resched wanted */
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Start with leftover status bits */
+        intstatus = bus->intstatus;
+
+        brcmf_sdbrcm_sdlock(bus);
+
+        /* If waiting for HTAVAIL, check status */
+        if (bus->clkstate == CLK_PENDING) {
+                int err;
+                u8 clkctl, devctl = 0;
+
+#ifdef BCMDBG
+                /* Check for inconsistent device control */
+                devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                               SBSDIO_DEVICE_CTL, &err);
+                if (err) {
+                        BRCMF_ERROR(("%s: error reading DEVCTL: %d\n",
+                                     __func__, err));
+                        bus->drvr->busstate = BRCMF_BUS_DOWN;
+                }
+#endif                          /* BCMDBG */
+
+                /* Read CSR, if clock on switch to AVAIL, else ignore */
+                clkctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                               SBSDIO_FUNC1_CHIPCLKCSR, &err);
+                if (err) {
+                        BRCMF_ERROR(("%s: error reading CSR: %d\n", __func__,
+                                     err));
+                        bus->drvr->busstate = BRCMF_BUS_DOWN;
+                }
+
+                BRCMF_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
+                            devctl, clkctl));
+
+                if (SBSDIO_HTAV(clkctl)) {
+                        devctl = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                                       SBSDIO_DEVICE_CTL, &err);
+                        if (err) {
+                                BRCMF_ERROR(("%s: error reading DEVCTL: %d\n",
+                                             __func__, err));
+                                bus->drvr->busstate = BRCMF_BUS_DOWN;
+                        }
+                        devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                SBSDIO_DEVICE_CTL, devctl, &err);
+                        if (err) {
+                                BRCMF_ERROR(("%s: error writing DEVCTL: %d\n",
+                                             __func__, err));
+                                bus->drvr->busstate = BRCMF_BUS_DOWN;
+                        }
+                        bus->clkstate = CLK_AVAIL;
+                } else {
+                        goto clkwait;
+                }
+        }
+
+        BUS_WAKE(bus);
+
+        /* Make sure backplane clock is on */
+        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
+        if (bus->clkstate == CLK_PENDING)
+                goto clkwait;
+
+        /* Pending interrupt indicates new device status */
+        if (bus->ipend) {
+                bus->ipend = false;
+                r_sdreg32(bus, &newstatus,
+                          offsetof(struct sdpcmd_regs, intstatus), &retries);
+                bus->f1regdata++;
+                if (brcmf_sdcard_regfail(bus->card))
+                        newstatus = 0;
+                newstatus &= bus->hostintmask;
+                bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
+                if (newstatus) {
+                        w_sdreg32(bus, newstatus,
+                                  offsetof(struct sdpcmd_regs, intstatus),
+                                  &retries);
+                        bus->f1regdata++;
+                }
+        }
+
+        /* Merge new bits with previous */
+        intstatus |= newstatus;
+        bus->intstatus = 0;
+
+        /* Handle flow-control change: read new state in case our ack
+         * crossed another change interrupt.  If change still set, assume
+         * FC ON for safety, let next loop through do the debounce.
+         */
+        if (intstatus & I_HMB_FC_CHANGE) {
+                intstatus &= ~I_HMB_FC_CHANGE;
+                w_sdreg32(bus, I_HMB_FC_CHANGE,
+                          offsetof(struct sdpcmd_regs, intstatus), &retries);
+
+                r_sdreg32(bus, &newstatus,
+                          offsetof(struct sdpcmd_regs, intstatus), &retries);
+                bus->f1regdata += 2;
+                bus->fcstate =
+                    !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
+                intstatus |= (newstatus & bus->hostintmask);
+        }
+
+        /* Handle host mailbox indication */
+        if (intstatus & I_HMB_HOST_INT) {
+                intstatus &= ~I_HMB_HOST_INT;
+                intstatus |= brcmf_sdbrcm_hostmail(bus);
+        }
+
+        /* Generally don't ask for these, can get CRC errors... */
+        if (intstatus & I_WR_OOSYNC) {
+                BRCMF_ERROR(("Dongle reports WR_OOSYNC\n"));
+                intstatus &= ~I_WR_OOSYNC;
+        }
+
+        if (intstatus & I_RD_OOSYNC) {
+                BRCMF_ERROR(("Dongle reports RD_OOSYNC\n"));
+                intstatus &= ~I_RD_OOSYNC;
+        }
+
+        if (intstatus & I_SBINT) {
+                BRCMF_ERROR(("Dongle reports SBINT\n"));
+                intstatus &= ~I_SBINT;
+        }
+
+        /* Would be active due to wake-wlan in gSPI */
+        if (intstatus & I_CHIPACTIVE) {
+                BRCMF_INFO(("Dongle reports CHIPACTIVE\n"));
+                intstatus &= ~I_CHIPACTIVE;
+        }
+
+        /* Ignore frame indications if rxskip is set */
+        if (bus->rxskip)
+                intstatus &= ~I_HMB_FRAME_IND;
+
+        /* On frame indication, read available frames */
+        if (PKT_AVAILABLE()) {
+                framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
+                if (rxdone || bus->rxskip)
+                        intstatus &= ~I_HMB_FRAME_IND;
+                rxlimit -= min(framecnt, rxlimit);
+        }
+
+        /* Keep still-pending events for next scheduling */
+        bus->intstatus = intstatus;
+
+clkwait:
+        /* Re-enable interrupts to detect new device events (mailbox, rx frame)
+         * or clock availability.  (Allows tx loop to check ipend if desired.)
+         * (Unless register access seems hosed, as we may not be able to ACK...)
+         */
+        if (bus->intr && bus->intdis && !brcmf_sdcard_regfail(card)) {
+                BRCMF_INTR(("%s: enable SDIO interrupts, rxdone %d"
+                            " framecnt %d\n", __func__, rxdone, framecnt));
+                bus->intdis = false;
+                brcmf_sdcard_intr_enable(card);
+        }
+
+        if (DATAOK(bus) && bus->ctrl_frame_stat &&
+                (bus->clkstate == CLK_AVAIL)) {
+                int ret, i;
+
+                ret = brcmf_sdbrcm_send_buf(bus, brcmf_sdcard_cur_sbwad(card),
+                        SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
+                        (u32) bus->ctrl_frame_len, NULL, NULL, NULL);
+
+                if (ret < 0) {
+                        /* On failure, abort the command and
+                                terminate the frame */
+                        BRCMF_INFO(("%s: sdio error %d, abort command and "
+                                    "terminate frame.\n", __func__, ret));
+                        bus->tx_sderrs++;
+
+                        brcmf_sdcard_abort(card, SDIO_FUNC_2);
+
+                        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1,
+                                         SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM,
+                                         NULL);
+                        bus->f1regdata++;
+
+                        for (i = 0; i < 3; i++) {
+                                u8 hi, lo;
+                                hi = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                                     SBSDIO_FUNC1_WFRAMEBCHI,
+                                                     NULL);
+                                lo = brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                                     SBSDIO_FUNC1_WFRAMEBCLO,
+                                                     NULL);
+                                bus->f1regdata += 2;
+                                if ((hi == 0) && (lo == 0))
+                                        break;
+                        }
+
+                }
+                if (ret == 0)
+                        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+
+                BRCMF_INFO(("Return_dpc value is : %d\n", ret));
+                bus->ctrl_frame_stat = false;
+                brcmf_sdbrcm_wait_event_wakeup(bus);
+        }
+        /* Send queued frames (limit 1 if rx may still be pending) */
+        else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
+                 brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
+                 && DATAOK(bus)) {
+                framecnt = rxdone ? txlimit : min(txlimit, brcmf_txminmax);
+                framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
+                txlimit -= framecnt;
+        }
+
+        /* Resched if events or tx frames are pending,
+                 else await next interrupt */
+        /* On failed register access, all bets are off:
+                 no resched or interrupts */
+        if ((bus->drvr->busstate == BRCMF_BUS_DOWN) ||
+            brcmf_sdcard_regfail(card)) {
+                BRCMF_ERROR(("%s: failed backplane access over SDIO, halting "
+                             "operation %d\n", __func__,
+                             brcmf_sdcard_regfail(card)));
+                bus->drvr->busstate = BRCMF_BUS_DOWN;
+                bus->intstatus = 0;
+        } else if (bus->clkstate == CLK_PENDING) {
+                BRCMF_INFO(("%s: rescheduled due to CLK_PENDING awaiting "
+                            "I_CHIPACTIVE interrupt\n", __func__));
+                resched = true;
+        } else if (bus->intstatus || bus->ipend ||
+                (!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
+                 && DATAOK(bus)) || PKT_AVAILABLE()) {
+                resched = true;
+        }
+
+        bus->dpc_sched = resched;
+
+        /* If we're done for now, turn off clock request. */
+        if ((bus->clkstate != CLK_PENDING)
+            && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
+                bus->activity = false;
+                brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
+        }
+
+        brcmf_sdbrcm_sdunlock(bus);
+
+        return resched;
+}
+
+void brcmf_sdbrcm_isr(void *arg)
+{
+        struct brcmf_bus *bus = (struct brcmf_bus *) arg;
+        struct brcmf_sdio_card *card;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (!bus) {
+                BRCMF_ERROR(("%s : bus is null pointer , exit\n", __func__));
+                return;
+        }
+        card = bus->card;
+
+        if (bus->drvr->busstate == BRCMF_BUS_DOWN) {
+                BRCMF_ERROR(("%s : bus is down. we have nothing to do\n",
+                           __func__));
+                return;
+        }
+        /* Count the interrupt call */
+        bus->intrcount++;
+        bus->ipend = true;
+
+        /* Shouldn't get this interrupt if we're sleeping? */
+        if (bus->sleeping) {
+                BRCMF_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
+                return;
+        }
+
+        /* Disable additional interrupts (is this needed now)? */
+        if (bus->intr)
+                BRCMF_INTR(("%s: disable SDIO interrupts\n", __func__));
+        else
+                BRCMF_ERROR(("brcmf_sdbrcm_isr() w/o interrupt configured!\n"));
+
+        brcmf_sdcard_intr_disable(card);
+        bus->intdis = true;
+
+#if defined(SDIO_ISR_THREAD)
+        BRCMF_TRACE(("Calling brcmf_sdbrcm_dpc() from %s\n", __func__));
+        while (brcmf_sdbrcm_dpc(bus))
+                ;
+#else
+        bus->dpc_sched = true;
+        brcmf_sdbrcm_sched_dpc(bus);
+#endif
+
+}
+
+#ifdef SDTEST
+static void brcmf_sdbrcm_pktgen_init(struct brcmf_bus *bus)
+{
+        /* Default to specified length, or full range */
+        if (brcmf_pktgen_len) {
+                bus->pktgen_maxlen = min(brcmf_pktgen_len,
+                                         BRCMF_MAX_PKTGEN_LEN);
+                bus->pktgen_minlen = bus->pktgen_maxlen;
+        } else {
+                bus->pktgen_maxlen = BRCMF_MAX_PKTGEN_LEN;
+                bus->pktgen_minlen = 0;
+        }
+        bus->pktgen_len = (u16) bus->pktgen_minlen;
+
+        /* Default to per-watchdog burst with 10s print time */
+        bus->pktgen_freq = 1;
+        bus->pktgen_print = 10000 / brcmf_watchdog_ms;
+        bus->pktgen_count = (brcmf_pktgen * brcmf_watchdog_ms + 999) / 1000;
+
+        /* Default to echo mode */
+        bus->pktgen_mode = BRCMF_PKTGEN_ECHO;
+        bus->pktgen_stop = 1;
+}
+
+static void brcmf_sdbrcm_pktgen(struct brcmf_bus *bus)
+{
+        struct sk_buff *pkt;
+        u8 *data;
+        uint pktcount;
+        uint fillbyte;
+        u16 len;
+
+        /* Display current count if appropriate */
+        if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
+                bus->pktgen_ptick = 0;
+                printk(KERN_DEBUG "%s: send attempts %d rcvd %d\n",
+                       __func__, bus->pktgen_sent, bus->pktgen_rcvd);
+        }
+
+        /* For recv mode, just make sure dongle has started sending */
+        if (bus->pktgen_mode == BRCMF_PKTGEN_RECV) {
+                if (!bus->pktgen_rcvd)
+                        brcmf_sdbrcm_sdtest_set(bus, true);
+                return;
+        }
+
+        /* Otherwise, generate or request the specified number of packets */
+        for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
+                /* Stop if total has been reached */
+                if (bus->pktgen_total
+                    && (bus->pktgen_sent >= bus->pktgen_total)) {
+                        bus->pktgen_count = 0;
+                        break;
+                }
+
+                /* Allocate an appropriate-sized packet */
+                len = bus->pktgen_len;
+                pkt = brcmu_pkt_buf_get_skb(
+                        len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + BRCMF_SDALIGN,
+                        true);
+                if (!pkt) {
+                        BRCMF_ERROR(("%s: brcmu_pkt_buf_get_skb failed!\n",
+                                     __func__));
+                        break;
+                }
+                PKTALIGN(pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN),
+                         BRCMF_SDALIGN);
+                data = (u8 *) (pkt->data) + SDPCM_HDRLEN;
+
+                /* Write test header cmd and extra based on mode */
+                switch (bus->pktgen_mode) {
+                case BRCMF_PKTGEN_ECHO:
+                        *data++ = SDPCM_TEST_ECHOREQ;
+                        *data++ = (u8) bus->pktgen_sent;
+                        break;
+
+                case BRCMF_PKTGEN_SEND:
+                        *data++ = SDPCM_TEST_DISCARD;
+                        *data++ = (u8) bus->pktgen_sent;
+                        break;
+
+                case BRCMF_PKTGEN_RXBURST:
+                        *data++ = SDPCM_TEST_BURST;
+                        *data++ = (u8) bus->pktgen_count;
+                        break;
+
+                default:
+                        BRCMF_ERROR(("Unrecognized pktgen mode %d\n",
+                                     bus->pktgen_mode));
+                        brcmu_pkt_buf_free_skb(pkt, true);
+                        bus->pktgen_count = 0;
+                        return;
+                }
+
+                /* Write test header length field */
+                *data++ = (len >> 0);
+                *data++ = (len >> 8);
+
+                /* Then fill in the remainder -- N/A for burst,
+                         but who cares... */
+                for (fillbyte = 0; fillbyte < len; fillbyte++)
+                        *data++ =
+                            SDPCM_TEST_FILL(fillbyte, (u8) bus->pktgen_sent);
+
+#ifdef BCMDBG
+                if (BRCMF_BYTES_ON() && BRCMF_DATA_ON()) {
+                        data = (u8 *) (pkt->data) + SDPCM_HDRLEN;
+                        printk(KERN_DEBUG "brcmf_sdbrcm_pktgen: Tx Data:\n");
+                        print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, data,
+                                             pkt->len - SDPCM_HDRLEN);
+                }
+#endif
+
+                /* Send it */
+                if (brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, true)) {
+                        bus->pktgen_fail++;
+                        if (bus->pktgen_stop
+                            && bus->pktgen_stop == bus->pktgen_fail)
+                                bus->pktgen_count = 0;
+                }
+                bus->pktgen_sent++;
+
+                /* Bump length if not fixed, wrap at max */
+                if (++bus->pktgen_len > bus->pktgen_maxlen)
+                        bus->pktgen_len = (u16) bus->pktgen_minlen;
+
+                /* Special case for burst mode: just send one request! */
+                if (bus->pktgen_mode == BRCMF_PKTGEN_RXBURST)
+                        break;
+        }
+}
+
+static void brcmf_sdbrcm_sdtest_set(struct brcmf_bus *bus, bool start)
+{
+        struct sk_buff *pkt;
+        u8 *data;
+
+        /* Allocate the packet */
+        pkt = brcmu_pkt_buf_get_skb(SDPCM_HDRLEN + SDPCM_TEST_HDRLEN +
+                BRCMF_SDALIGN, true);
+        if (!pkt) {
+                BRCMF_ERROR(("%s: brcmu_pkt_buf_get_skb failed!\n", __func__));
+                return;
+        }
+        PKTALIGN(pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), BRCMF_SDALIGN);
+        data = (u8 *) (pkt->data) + SDPCM_HDRLEN;
+
+        /* Fill in the test header */
+        *data++ = SDPCM_TEST_SEND;
+        *data++ = start;
+        *data++ = (bus->pktgen_maxlen >> 0);
+        *data++ = (bus->pktgen_maxlen >> 8);
+
+        /* Send it */
+        if (brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, true))
+                bus->pktgen_fail++;
+}
+
+static void
+brcmf_sdbrcm_checkdied(struct brcmf_bus *bus, struct sk_buff *pkt, uint seq)
+{
+        u8 *data;
+        uint pktlen;
+
+        u8 cmd;
+        u8 extra;
+        u16 len;
+        u16 offset;
+
+        /* Check for min length */
+        pktlen = pkt->len;
+        if (pktlen < SDPCM_TEST_HDRLEN) {
+                BRCMF_ERROR(("brcmf_sdbrcm_checkdied: toss runt frame, pktlen "
+                             "%d\n", pktlen));
+                brcmu_pkt_buf_free_skb(pkt, false);
+                return;
+        }
+
+        /* Extract header fields */
+        data = pkt->data;
+        cmd = *data++;
+        extra = *data++;
+        len = *data++;
+        len += *data++ << 8;
+
+        /* Check length for relevant commands */
+        if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ
+            || cmd == SDPCM_TEST_ECHORSP) {
+                if (pktlen != len + SDPCM_TEST_HDRLEN) {
+                        BRCMF_ERROR(("brcmf_sdbrcm_checkdied: frame length "
+                                     "mismatch, pktlen %d seq %d"
+                                     " cmd %d extra %d len %d\n",
+                                     pktlen, seq, cmd, extra, len));
+                        brcmu_pkt_buf_free_skb(pkt, false);
+                        return;
+                }
+        }
+
+        /* Process as per command */
+        switch (cmd) {
+        case SDPCM_TEST_ECHOREQ:
+                /* Rx->Tx turnaround ok (even on NDIS w/current
+                         implementation) */
+                *(u8 *) (pkt->data) = SDPCM_TEST_ECHORSP;
+                if (brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, true) == 0)
+                        bus->pktgen_sent++;
+                else {
+                        bus->pktgen_fail++;
+                        brcmu_pkt_buf_free_skb(pkt, false);
+                }
+                bus->pktgen_rcvd++;
+                break;
+
+        case SDPCM_TEST_ECHORSP:
+                if (bus->ext_loop) {
+                        brcmu_pkt_buf_free_skb(pkt, false);
+                        bus->pktgen_rcvd++;
+                        break;
+                }
+
+                for (offset = 0; offset < len; offset++, data++) {
+                        if (*data != SDPCM_TEST_FILL(offset, extra)) {
+                                BRCMF_ERROR(("brcmf_sdbrcm_checkdied: echo"
+                                             " data mismatch: "
+                                             "offset %d (len %d) "
+                                             "expect 0x%02x rcvd 0x%02x\n",
+                                             offset, len,
+                                             SDPCM_TEST_FILL(offset, extra),
+                                             *data));
+                                break;
+                        }
+                }
+                brcmu_pkt_buf_free_skb(pkt, false);
+                bus->pktgen_rcvd++;
+                break;
+
+        case SDPCM_TEST_DISCARD:
+                brcmu_pkt_buf_free_skb(pkt, false);
+                bus->pktgen_rcvd++;
+                break;
+
+        case SDPCM_TEST_BURST:
+        case SDPCM_TEST_SEND:
+        default:
+                BRCMF_INFO(("brcmf_sdbrcm_checkdied: unsupported or unknown "
+                            "command, pktlen %d seq %d" " cmd %d extra %d"
+                            " len %d\n", pktlen, seq, cmd, extra, len));
+                brcmu_pkt_buf_free_skb(pkt, false);
+                break;
+        }
+
+        /* For recv mode, stop at limie (and tell dongle to stop sending) */
+        if (bus->pktgen_mode == BRCMF_PKTGEN_RECV) {
+                if (bus->pktgen_total
+                    && (bus->pktgen_rcvd >= bus->pktgen_total)) {
+                        bus->pktgen_count = 0;
+                        brcmf_sdbrcm_sdtest_set(bus, false);
+                }
+        }
+}
+#endif                          /* SDTEST */
+
+extern bool brcmf_sdbrcm_bus_watchdog(struct brcmf_pub *drvr)
+{
+        struct brcmf_bus *bus;
+
+        BRCMF_TIMER(("%s: Enter\n", __func__));
+
+        bus = drvr->bus;
+
+        if (bus->drvr->dongle_reset)
+                return false;
+
+        /* Ignore the timer if simulating bus down */
+        if (bus->sleeping)
+                return false;
+
+        brcmf_sdbrcm_sdlock(bus);
+
+        /* Poll period: check device if appropriate. */
+        if (bus->poll && (++bus->polltick >= bus->pollrate)) {
+                u32 intstatus = 0;
+
+                /* Reset poll tick */
+                bus->polltick = 0;
+
+                /* Check device if no interrupts */
+                if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
+
+                        if (!bus->dpc_sched) {
+                                u8 devpend;
+                                devpend = brcmf_sdcard_cfg_read(bus->card,
+                                                SDIO_FUNC_0, SDIO_CCCR_INTx,
+                                                NULL);
+                                intstatus =
+                                    devpend & (INTR_STATUS_FUNC1 |
+                                               INTR_STATUS_FUNC2);
+                        }
+
+                        /* If there is something, make like the ISR and
+                                 schedule the DPC */
+                        if (intstatus) {
+                                bus->pollcnt++;
+                                bus->ipend = true;
+                                if (bus->intr)
+                                        brcmf_sdcard_intr_disable(bus->card);
+
+                                bus->dpc_sched = true;
+                                brcmf_sdbrcm_sched_dpc(bus);
+
+                        }
+                }
+
+                /* Update interrupt tracking */
+                bus->lastintrs = bus->intrcount;
+        }
+#ifdef BCMDBG
+        /* Poll for console output periodically */
+        if (drvr->busstate == BRCMF_BUS_DATA && brcmf_console_ms != 0) {
+                bus->console.count += brcmf_watchdog_ms;
+                if (bus->console.count >= brcmf_console_ms) {
+                        bus->console.count -= brcmf_console_ms;
+                        /* Make sure backplane clock is on */
+                        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+                        if (brcmf_sdbrcm_readconsole(bus) < 0)
+                                brcmf_console_ms = 0;   /* On error,
+                                                         stop trying */
+                }
+        }
+#endif                          /* BCMDBG */
+
+#ifdef SDTEST
+        /* Generate packets if configured */
+        if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
+                /* Make sure backplane clock is on */
+                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+                bus->pktgen_tick = 0;
+                brcmf_sdbrcm_pktgen(bus);
+        }
+#endif
+
+        /* On idle timeout clear activity flag and/or turn off clock */
+        if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
+                if (++bus->idlecount >= bus->idletime) {
+                        bus->idlecount = 0;
+                        if (bus->activity) {
+                                bus->activity = false;
+                                brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
+                        } else {
+                                brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
+                        }
+                }
+        }
+
+        brcmf_sdbrcm_sdunlock(bus);
+
+        return bus->ipend;
+}
+
+#ifdef BCMDBG
+static int brcmf_sdbrcm_bus_console_in(struct brcmf_pub *drvr,
+                                       unsigned char *msg, uint msglen)
+{
+        struct brcmf_bus *bus = drvr->bus;
+        u32 addr, val;
+        int rv;
+        struct sk_buff *pkt;
+
+        /* Address could be zero if CONSOLE := 0 in dongle Makefile */
+        if (bus->console_addr == 0)
+                return -ENOTSUPP;
+
+        /* Exclusive bus access */
+        brcmf_sdbrcm_sdlock(bus);
+
+        /* Don't allow input if dongle is in reset */
+        if (bus->drvr->dongle_reset) {
+                brcmf_sdbrcm_sdunlock(bus);
+                return -EPERM;
+        }
+
+        /* Request clock to allow SDIO accesses */
+        BUS_WAKE(bus);
+        /* No pend allowed since txpkt is called later, ht clk has to be on */
+        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+
+        /* Zero cbuf_index */
+        addr = bus->console_addr + offsetof(struct rte_console, cbuf_idx);
+        val = cpu_to_le32(0);
+        rv = brcmf_sdbrcm_membytes(bus, true, addr, (u8 *)&val, sizeof(val));
+        if (rv < 0)
+                goto done;
+
+        /* Write message into cbuf */
+        addr = bus->console_addr + offsetof(struct rte_console, cbuf);
+        rv = brcmf_sdbrcm_membytes(bus, true, addr, (u8 *)msg, msglen);
+        if (rv < 0)
+                goto done;
+
+        /* Write length into vcons_in */
+        addr = bus->console_addr + offsetof(struct rte_console, vcons_in);
+        val = cpu_to_le32(msglen);
+        rv = brcmf_sdbrcm_membytes(bus, true, addr, (u8 *)&val, sizeof(val));
+        if (rv < 0)
+                goto done;
+
+        /* Bump dongle by sending an empty event pkt.
+         * sdpcm_sendup (RX) checks for virtual console input.
+         */
+        pkt = brcmu_pkt_buf_get_skb(4 + SDPCM_RESERVE);
+        if ((pkt != NULL) && bus->clkstate == CLK_AVAIL)
+                brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_EVENT_CHANNEL, true);
+
+done:
+        if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                bus->activity = false;
+                brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
+        }
+
+        brcmf_sdbrcm_sdunlock(bus);
+
+        return rv;
+}
+#endif                          /* BCMDBG */
+
+static bool brcmf_sdbrcm_chipmatch(u16 chipid)
+{
+        if (chipid == BCM4325_CHIP_ID)
+                return true;
+        if (chipid == BCM4329_CHIP_ID)
+                return true;
+        if (chipid == BCM4319_CHIP_ID)
+                return true;
+        return false;
+}
+
+static void *brcmf_sdbrcm_probe(u16 venid, u16 devid, u16 bus_no,
+                           u16 slot, u16 func, uint bustype, u32 regsva,
+                           void *card)
+{
+        int ret;
+        struct brcmf_bus *bus;
+
+        /* Init global variables at run-time, not as part of the declaration.
+         * This is required to support init/de-init of the driver.
+         * Initialization
+         * of globals as part of the declaration results in non-deterministic
+         * behavior since the value of the globals may be different on the
+         * first time that the driver is initialized vs subsequent
+         * initializations.
+         */
+        brcmf_txbound = BRCMF_TXBOUND;
+        brcmf_rxbound = BRCMF_RXBOUND;
+        brcmf_alignctl = true;
+        sd1idle = true;
+        brcmf_readahead = true;
+        retrydata = false;
+        brcmf_dongle_memsize = 0;
+        brcmf_txminmax = BRCMF_TXMINMAX;
+
+        forcealign = true;
+
+        brcmf_c_init();
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+        BRCMF_INFO(("%s: venid 0x%04x devid 0x%04x\n", __func__, venid, devid));
+
+        /* We make an assumption about address window mappings:
+         * regsva == SI_ENUM_BASE*/
+
+        /* SDIO car passes venid and devid based on CIS parsing -- but
+         * low-power start
+         * means early parse could fail, so here we should get either an ID
+         * we recognize OR (-1) indicating we must request power first.
+         */
+        /* Check the Vendor ID */
+        switch (venid) {
+        case 0x0000:
+        case PCI_VENDOR_ID_BROADCOM:
+                break;
+        default:
+                BRCMF_ERROR(("%s: unknown vendor: 0x%04x\n", __func__, venid));
+                return NULL;
+        }
+
+        /* Check the Device ID and make sure it's one that we support */
+        switch (devid) {
+        case BCM4325_D11DUAL_ID:        /* 4325 802.11a/g id */
+        case BCM4325_D11G_ID:   /* 4325 802.11g 2.4Ghz band id */
+        case BCM4325_D11A_ID:   /* 4325 802.11a 5Ghz band id */
+                BRCMF_INFO(("%s: found 4325 Dongle\n", __func__));
+                break;
+        case BCM4329_D11NDUAL_ID:       /* 4329 802.11n dualband device */
+        case BCM4329_D11N2G_ID: /* 4329 802.11n 2.4G device */
+        case BCM4329_D11N5G_ID: /* 4329 802.11n 5G device */
+        case 0x4329:
+                BRCMF_INFO(("%s: found 4329 Dongle\n", __func__));
+                break;
+        case BCM4319_D11N_ID:   /* 4319 802.11n id */
+        case BCM4319_D11N2G_ID: /* 4319 802.11n2g id */
+        case BCM4319_D11N5G_ID: /* 4319 802.11n5g id */
+                BRCMF_INFO(("%s: found 4319 Dongle\n", __func__));
+                break;
+        case 0:
+                BRCMF_INFO(("%s: allow device id 0, will check chip"
+                            " internals\n", __func__));
+                break;
+
+        default:
+                BRCMF_ERROR(("%s: skipping 0x%04x/0x%04x, not a dongle\n",
+                             __func__, venid, devid));
+                return NULL;
+        }
+
+        /* Allocate private bus interface state */
+        bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
+        if (!bus) {
+                BRCMF_ERROR(("%s: kmalloc of struct dhd_bus failed\n",
+                             __func__));
+                goto fail;
+        }
+        bus->card = card;
+        bus->cl_devid = (u16) devid;
+        bus->bus = BRCMF_BUS;
+        bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
+        bus->usebufpool = false;        /* Use bufpool if allocated,
+                                         else use locally malloced rxbuf */
+
+        /* attempt to attach to the dongle */
+        if (!(brcmf_sdbrcm_probe_attach(bus, card, regsva, devid))) {
+                BRCMF_ERROR(("%s: brcmf_sdbrcm_probe_attach failed\n",
+                             __func__));
+                goto fail;
+        }
+
+        spin_lock_init(&bus->txqlock);
+        init_waitqueue_head(&bus->ctrl_wait);
+
+        /* Set up the watchdog timer */
+        init_timer(&bus->timer);
+        bus->timer.data = (unsigned long)bus;
+        bus->timer.function = brcmf_sdbrcm_watchdog;
+
+        /* Initialize thread based operation and lock */
+        if ((brcmf_watchdog_prio >= 0) && (brcmf_dpc_prio >= 0)) {
+                bus->threads_only = true;
+                sema_init(&bus->sdsem, 1);
+        } else {
+                bus->threads_only = false;
+                spin_lock_init(&bus->sdlock);
+        }
+
+        if (brcmf_dpc_prio >= 0) {
+                /* Initialize watchdog thread */
+                init_completion(&bus->watchdog_wait);
+                bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
+                                                bus, "brcmf_watchdog");
+                if (IS_ERR(bus->watchdog_tsk)) {
+                        printk(KERN_WARNING
+                               "brcmf_watchdog thread failed to start\n");
+                        bus->watchdog_tsk = NULL;
+                }
+        } else
+                bus->watchdog_tsk = NULL;
+
+        /* Set up the bottom half handler */
+        if (brcmf_dpc_prio >= 0) {
+                /* Initialize DPC thread */
+                init_completion(&bus->dpc_wait);
+                bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
+                                           bus, "brcmf_dpc");
+                if (IS_ERR(bus->dpc_tsk)) {
+                        printk(KERN_WARNING
+                               "brcmf_dpc thread failed to start\n");
+                        bus->dpc_tsk = NULL;
+                }
+        } else {
+                tasklet_init(&bus->tasklet, brcmf_sdbrcm_dpc_tasklet,
+                             (unsigned long)bus);
+                bus->dpc_tsk = NULL;
+        }
+
+        /* Attach to the brcmf/OS/network interface */
+        bus->drvr = brcmf_attach(bus, SDPCM_RESERVE);
+        if (!bus->drvr) {
+                BRCMF_ERROR(("%s: brcmf_attach failed\n", __func__));
+                goto fail;
+        }
+
+        /* Allocate buffers */
+        if (!(brcmf_sdbrcm_probe_malloc(bus, card))) {
+                BRCMF_ERROR(("%s: brcmf_sdbrcm_probe_malloc failed\n",
+                             __func__));
+                goto fail;
+        }
+
+        if (!(brcmf_sdbrcm_probe_init(bus, card))) {
+                BRCMF_ERROR(("%s: brcmf_sdbrcm_probe_init failed\n", __func__));
+                goto fail;
+        }
+
+        /* Register interrupt callback, but mask it (not operational yet). */
+        BRCMF_INTR(("%s: disable SDIO interrupts (not interested yet)\n",
+                    __func__));
+        brcmf_sdcard_intr_disable(card);
+        ret = brcmf_sdcard_intr_reg(card, brcmf_sdbrcm_isr, bus);
+        if (ret != 0) {
+                BRCMF_ERROR(("%s: FAILED: sdcard_intr_reg returned %d\n",
+                             __func__, ret));
+                goto fail;
+        }
+        BRCMF_INTR(("%s: registered SDIO interrupt function ok\n", __func__));
+
+        BRCMF_INFO(("%s: completed!!\n", __func__));
+
+        /* if firmware path present try to download and bring up bus */
+        ret = brcmf_bus_start(bus->drvr);
+        if (ret != 0) {
+                if (ret == -ENOLINK) {
+                        BRCMF_ERROR(("%s: dongle is not responding\n",
+                                     __func__));
+                        goto fail;
+                }
+        }
+        /* Ok, have the per-port tell the stack we're open for business */
+        if (brcmf_net_attach(bus->drvr, 0) != 0) {
+                BRCMF_ERROR(("%s: Net attach failed!!\n", __func__));
+                goto fail;
+        }
+
+        return bus;
+
+fail:
+        brcmf_sdbrcm_release(bus);
+        return NULL;
+}
+
+static bool
+brcmf_sdbrcm_probe_attach(struct brcmf_bus *bus, void *card, u32 regsva,
+                          u16 devid)
+{
+        u8 clkctl = 0;
+        int err = 0;
+
+        bus->alp_only = true;
+
+        /* Return the window to backplane enumeration space for core access */
+        if (brcmf_sdbrcm_set_siaddr_window(bus, SI_ENUM_BASE))
+                BRCMF_ERROR(("%s: FAILED to return to SI_ENUM_BASE\n",
+                             __func__));
+
+#ifdef BCMDBG
+        printk(KERN_DEBUG "F1 signature read @0x18000000=0x%4x\n",
+               brcmf_sdcard_reg_read(bus->card, SI_ENUM_BASE, 4));
+
+#endif                          /* BCMDBG */
+
+        /*
+         * Force PLL off until brcmf_sdbrcm_chip_attach()
+         * programs PLL control regs
+         */
+
+        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                         BRCMF_INIT_CLKCTL1, &err);
+        if (!err)
+                clkctl =
+                    brcmf_sdcard_cfg_read(card, SDIO_FUNC_1,
+                                          SBSDIO_FUNC1_CHIPCLKCSR, &err);
+
+        if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
+                BRCMF_ERROR(("brcmf_sdbrcm_probe: ChipClkCSR access: err %d"
+                             " wrote 0x%02x read 0x%02x\n",
+                             err, BRCMF_INIT_CLKCTL1, clkctl));
+                goto fail;
+        }
+
+        if (brcmf_sdbrcm_chip_attach(bus, regsva)) {
+                BRCMF_ERROR(("%s: brcmf_sdbrcm_chip_attach failed!\n",
+                             __func__));
+                goto fail;
+        }
+
+        if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
+                BRCMF_ERROR(("%s: unsupported chip: 0x%04x\n",
+                             __func__, bus->ci->chip));
+                goto fail;
+        }
+
+        brcmf_sdbrcm_sdiod_drive_strength_init(bus, brcmf_sdiod_drive_strength);
+
+        /* Get info on the ARM and SOCRAM cores... */
+        if (!BRCMF_NOPMU(bus)) {
+                brcmf_sdcard_reg_read(bus->card,
+                          CORE_SB(bus->ci->armcorebase, sbidhigh), 4);
+                bus->orig_ramsize = bus->ci->ramsize;
+                if (!(bus->orig_ramsize)) {
+                        BRCMF_ERROR(("%s: failed to find SOCRAM memory!\n",
+                                     __func__));
+                        goto fail;
+                }
+                bus->ramsize = bus->orig_ramsize;
+                if (brcmf_dongle_memsize)
+                        brcmf_sdbrcm_setmemsize(bus, brcmf_dongle_memsize);
+
+                BRCMF_ERROR(("DHD: dongle ram size is set to %d(orig %d)\n",
+                             bus->ramsize, bus->orig_ramsize));
+        }
+
+        /* Set core control so an SDIO reset does a backplane reset */
+        OR_REG(bus->ci->buscorebase + offsetof(struct sdpcmd_regs,
+                                                       corecontrol),
+               CC_BPRESEN, u32);
+
+        brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
+
+        /* Locate an appropriately-aligned portion of hdrbuf */
+        bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
+                                    BRCMF_SDALIGN);
+
+        /* Set the poll and/or interrupt flags */
+        bus->intr = (bool) brcmf_intr;
+        bus->poll = (bool) brcmf_poll;
+        if (bus->poll)
+                bus->pollrate = 1;
+
+        return true;
+
+fail:
+        return false;
+}
+
+static bool brcmf_sdbrcm_probe_malloc(struct brcmf_bus *bus, void *card)
+{
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (bus->drvr->maxctl) {
+                bus->rxblen =
+                    roundup((bus->drvr->maxctl + SDPCM_HDRLEN),
+                            ALIGNMENT) + BRCMF_SDALIGN;
+                bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
+                if (!(bus->rxbuf)) {
+                        BRCMF_ERROR(("%s: kmalloc of %d-byte rxbuf failed\n",
+                                     __func__, bus->rxblen));
+                        goto fail;
+                }
+        }
+
+        /* Allocate buffer to receive glomed packet */
+        bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
+        if (!(bus->databuf)) {
+                BRCMF_ERROR(("%s: kmalloc of %d-byte databuf failed\n",
+                             __func__, MAX_DATA_BUF));
+                /* release rxbuf which was already located as above */
+                if (!bus->rxblen)
+                        kfree(bus->rxbuf);
+                goto fail;
+        }
+
+        /* Align the buffer */
+        if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
+                bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
+                               ((unsigned long)bus->databuf % BRCMF_SDALIGN));
+        else
+                bus->dataptr = bus->databuf;
+
+        return true;
+
+fail:
+        return false;
+}
+
+static bool brcmf_sdbrcm_probe_init(struct brcmf_bus *bus, void *card)
+{
+        s32 fnum;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+#ifdef SDTEST
+        brcmf_sdbrcm_pktgen_init(bus);
+#endif                          /* SDTEST */
+
+        /* Disable F2 to clear any intermediate frame state on the dongle */
+        brcmf_sdcard_cfg_write(card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
+                               SDIO_FUNC_ENABLE_1, NULL);
+
+        bus->drvr->busstate = BRCMF_BUS_DOWN;
+        bus->sleeping = false;
+        bus->rxflow = false;
+
+        /* Done with backplane-dependent accesses, can drop clock... */
+        brcmf_sdcard_cfg_write(card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0,
+                               NULL);
+
+        /* ...and initialize clock/power states */
+        bus->clkstate = CLK_SDONLY;
+        bus->idletime = (s32) brcmf_idletime;
+        bus->idleclock = BRCMF_IDLE_ACTIVE;
+
+        /* Query the F2 block size, set roundup accordingly */
+        fnum = 2;
+        if (brcmf_sdcard_iovar_op(card, "sd_blocksize", &fnum, sizeof(s32),
+                            &bus->blocksize, sizeof(s32), false) != 0) {
+                bus->blocksize = 0;
+                BRCMF_ERROR(("%s: fail on %s get\n", __func__, "sd_blocksize"));
+        } else {
+                BRCMF_INFO(("%s: Initial value for %s is %d\n",
+                            __func__, "sd_blocksize", bus->blocksize));
+        }
+        bus->roundup = min(max_roundup, bus->blocksize);
+
+        /* Query if bus module supports packet chaining,
+                 default to use if supported */
+        if (brcmf_sdcard_iovar_op(card, "sd_rxchain", NULL, 0,
+                            &bus->sd_rxchain, sizeof(s32),
+                            false) != 0) {
+                bus->sd_rxchain = false;
+        } else {
+                BRCMF_INFO(("%s: bus module (through sdiocard API) %s"
+                            " chaining\n", __func__, bus->sd_rxchain
+                            ? "supports" : "does not support"));
+        }
+        bus->use_rxchain = (bool) bus->sd_rxchain;
+
+        return true;
+}
+
+static bool
+brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus, void *card)
+{
+        bool ret;
+
+        /* Download the firmware */
+        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+
+        ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
+
+        brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
+
+        return ret;
+}
+
+/* Detach and free everything */
+static void brcmf_sdbrcm_release(struct brcmf_bus *bus)
+{
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (bus) {
+                /* De-register interrupt handler */
+                brcmf_sdcard_intr_disable(bus->card);
+                brcmf_sdcard_intr_dereg(bus->card);
+
+                if (bus->drvr) {
+                        brcmf_detach(bus->drvr);
+                        brcmf_sdbrcm_release_dongle(bus);
+                        bus->drvr = NULL;
+                }
+
+                brcmf_sdbrcm_release_malloc(bus);
+
+                kfree(bus);
+        }
+
+        BRCMF_TRACE(("%s: Disconnected\n", __func__));
+}
+
+static void brcmf_sdbrcm_release_malloc(struct brcmf_bus *bus)
+{
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (bus->drvr && bus->drvr->dongle_reset)
+                return;
+
+        kfree(bus->rxbuf);
+        bus->rxctl = bus->rxbuf = NULL;
+        bus->rxlen = 0;
+
+        kfree(bus->databuf);
+        bus->databuf = NULL;
+}
+
+static void brcmf_sdbrcm_release_dongle(struct brcmf_bus *bus)
+{
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (bus->drvr && bus->drvr->dongle_reset)
+                return;
+
+        if (bus->ci) {
+                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+                brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
+                brcmf_sdbrcm_chip_detach(bus);
+                if (bus->vars && bus->varsz)
+                        kfree(bus->vars);
+                bus->vars = NULL;
+        }
+
+        BRCMF_TRACE(("%s: Disconnected\n", __func__));
+}
+
+static void brcmf_sdbrcm_disconnect(void *ptr)
+{
+        struct brcmf_bus *bus = (struct brcmf_bus *)ptr;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        if (bus) {
+                brcmf_sdbrcm_release(bus);
+        }
+
+        BRCMF_TRACE(("%s: Disconnected\n", __func__));
+}
+
+/* Register/Unregister functions are called by the main DHD entry
+ * point (e.g. module insertion) to link with the bus driver, in
+ * order to look for or await the device.
+ */
+
+static struct brcmf_sdioh_driver brcmf_sdio = {
+        brcmf_sdbrcm_probe,
+        brcmf_sdbrcm_disconnect
+};
+
+int brcmf_bus_register(void)
+{
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* Sanity check on the module parameters */
+        do {
+                /* Both watchdog and DPC as tasklets are ok */
+                if ((brcmf_watchdog_prio < 0) && (brcmf_dpc_prio < 0))
+                        break;
+
+                /* If both watchdog and DPC are threads, TX must be deferred */
+                if ((brcmf_watchdog_prio >= 0) && (brcmf_dpc_prio >= 0)
+                    && brcmf_deferred_tx)
+                        break;
+
+                BRCMF_ERROR(("Invalid module parameters.\n"));
+                return -EINVAL;
+        } while (0);
+
+        return brcmf_sdio_register(&brcmf_sdio);
+}
+
+void brcmf_bus_unregister(void)
+{
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        brcmf_sdio_unregister();
+}
+
+static int brcmf_sdbrcm_download_code_file(struct brcmf_bus *bus)
+{
+        int offset = 0;
+        uint len;
+        u8 *memblock = NULL, *memptr;
+        int ret;
+
+        BRCMF_INFO(("%s: Enter\n", __func__));
+
+        bus->fw_name = BCM4329_FW_NAME;
+        ret = request_firmware(&bus->firmware, bus->fw_name,
+                               &gInstance->func[2]->dev);
+        if (ret) {
+                BRCMF_ERROR(("%s: Fail to request firmware %d\n",
+                             __func__, ret));
+                return ret;
+        }
+        bus->fw_ptr = 0;
+
+        memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
+        if (memblock == NULL) {
+                BRCMF_ERROR(("%s: Failed to allocate memory %d bytes\n",
+                             __func__, MEMBLOCK));
+                ret = -ENOMEM;
+                goto err;
+        }
+        if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
+                memptr += (BRCMF_SDALIGN -
+                           ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
+
+        /* Download image */
+        while ((len =
+                brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
+                ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
+                if (ret) {
+                        BRCMF_ERROR(("%s: error %d on writing %d membytes at "
+                                     "0x%08x\n", __func__, ret, MEMBLOCK,
+                                     offset));
+                        goto err;
+                }
+
+                offset += MEMBLOCK;
+        }
+
+err:
+        kfree(memblock);
+
+        release_firmware(bus->firmware);
+        bus->fw_ptr = 0;
+
+        return ret;
+}
+
+/*
+ * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
+ * and ending in a NUL.
+ * Removes carriage returns, empty lines, comment lines, and converts
+ * newlines to NULs.
+ * Shortens buffer as needed and pads with NULs.  End of buffer is marked
+ * by two NULs.
+*/
+
+static uint brcmf_process_nvram_vars(char *varbuf, uint len)
+{
+        char *dp;
+        bool findNewline;
+        int column;
+        uint buf_len, n;
+
+        dp = varbuf;
+
+        findNewline = false;
+        column = 0;
+
+        for (n = 0; n < len; n++) {
+                if (varbuf[n] == 0)
+                        break;
+                if (varbuf[n] == '\r')
+                        continue;
+                if (findNewline && varbuf[n] != '\n')
+                        continue;
+                findNewline = false;
+                if (varbuf[n] == '#') {
+                        findNewline = true;
+                        continue;
+                }
+                if (varbuf[n] == '\n') {
+                        if (column == 0)
+                                continue;
+                        *dp++ = 0;
+                        column = 0;
+                        continue;
+                }
+                *dp++ = varbuf[n];
+                column++;
+        }
+        buf_len = dp - varbuf;
+
+        while (dp < varbuf + n)
+                *dp++ = 0;
+
+        return buf_len;
+}
+
+static int brcmf_sdbrcm_download_nvram(struct brcmf_bus *bus)
+{
+        uint len;
+        char *memblock = NULL;
+        char *bufp;
+        int ret;
+
+        bus->nv_name = BCM4329_NV_NAME;
+        ret = request_firmware(&bus->firmware, bus->nv_name,
+                               &gInstance->func[2]->dev);
+        if (ret) {
+                BRCMF_ERROR(("%s: Fail to request nvram %d\n", __func__, ret));
+                return ret;
+        }
+        bus->fw_ptr = 0;
+
+        memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
+        if (memblock == NULL) {
+                BRCMF_ERROR(("%s: Failed to allocate memory %d bytes\n",
+                             __func__, MEMBLOCK));
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
+
+        if (len > 0 && len < MEMBLOCK) {
+                bufp = (char *)memblock;
+                bufp[len] = 0;
+                len = brcmf_process_nvram_vars(bufp, len);
+                bufp += len;
+                *bufp++ = 0;
+                if (len)
+                        ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
+                if (ret)
+                        BRCMF_ERROR(("%s: error downloading vars: %d\n",
+                                     __func__, ret));
+        } else {
+                BRCMF_ERROR(("%s: error reading nvram file: %d\n",
+                             __func__, len));
+                ret = -EIO;
+        }
+
+err:
+        kfree(memblock);
+
+        release_firmware(bus->firmware);
+        bus->fw_ptr = 0;
+
+        return ret;
+}
+
+static int _brcmf_sdbrcm_download_firmware(struct brcmf_bus *bus)
+{
+        int bcmerror = -1;
+
+        /* Keep arm in reset */
+        if (brcmf_sdbrcm_download_state(bus, true)) {
+                BRCMF_ERROR(("%s: error placing ARM core in reset\n",
+                             __func__));
+                goto err;
+        }
+
+        /* External image takes precedence if specified */
+        if (brcmf_sdbrcm_download_code_file(bus)) {
+                BRCMF_ERROR(("%s: dongle image file download failed\n",
+                             __func__));
+                goto err;
+        }
+
+        /* External nvram takes precedence if specified */
+        if (brcmf_sdbrcm_download_nvram(bus)) {
+                BRCMF_ERROR(("%s: dongle nvram file download failed\n",
+                             __func__));
+        }
+
+        /* Take arm out of reset */
+        if (brcmf_sdbrcm_download_state(bus, false)) {
+                BRCMF_ERROR(("%s: error getting out of ARM core reset\n",
+                             __func__));
+                goto err;
+        }
+
+        bcmerror = 0;
+
+err:
+        return bcmerror;
+}
+
+
+static int
+brcmf_sdbrcm_send_buf(struct brcmf_bus *bus, u32 addr, uint fn, uint flags,
+                    u8 *buf, uint nbytes, struct sk_buff *pkt,
+                    void (*complete)(void *handle, int status,
+                                     bool sync_waiting),
+                    void *handle)
+{
+        return brcmf_sdcard_send_buf
+                (bus->card, addr, fn, flags, buf, nbytes, pkt, complete,
+                 handle);
+}
+
+int brcmf_bus_devreset(struct brcmf_pub *drvr, u8 flag)
+{
+        int bcmerror = 0;
+        struct brcmf_bus *bus;
+
+        bus = drvr->bus;
+
+        if (flag == true) {
+                brcmf_sdbrcm_wd_timer(bus, 0);
+                if (!bus->drvr->dongle_reset) {
+                        /* Expect app to have torn down any
+                         connection before calling */
+                        /* Stop the bus, disable F2 */
+                        brcmf_sdbrcm_bus_stop(bus, false);
+
+                        /* Clean tx/rx buffer pointers,
+                         detach from the dongle */
+                        brcmf_sdbrcm_release_dongle(bus);
+
+                        bus->drvr->dongle_reset = true;
+                        bus->drvr->up = false;
+
+                        BRCMF_TRACE(("%s:  WLAN OFF DONE\n", __func__));
+                        /* App can now remove power from device */
+                } else
+                        bcmerror = -EIO;
+        } else {
+                /* App must have restored power to device before calling */
+
+                BRCMF_TRACE(("\n\n%s: == WLAN ON ==\n", __func__));
+
+                if (bus->drvr->dongle_reset) {
+                        /* Turn on WLAN */
+
+                        /* Attempt to re-attach & download */
+                        if (brcmf_sdbrcm_probe_attach(bus, bus->card,
+                                                      SI_ENUM_BASE,
+                                                      bus->cl_devid)) {
+                                /* Attempt to download binary to the dongle */
+                                if (brcmf_sdbrcm_probe_init(bus, bus->card)) {
+                                        /* Re-init bus, enable F2 transfer */
+                                        brcmf_sdbrcm_bus_init(bus->drvr, false);
+
+                                        bus->drvr->dongle_reset = false;
+                                        bus->drvr->up = true;
+
+                                        BRCMF_TRACE(("%s: WLAN ON DONE\n",
+                                                     __func__));
+                                } else
+                                        bcmerror = -EIO;
+                        } else
+                                bcmerror = -EIO;
+                } else {
+                        bcmerror = -EISCONN;
+                        BRCMF_ERROR(("%s: Set DEVRESET=false invoked when"
+                                     " device is on\n", __func__));
+                        bcmerror = -EIO;
+                }
+                brcmf_sdbrcm_wd_timer(bus, brcmf_watchdog_ms);
+        }
+        return bcmerror;
+}
+
+static int
+brcmf_sdbrcm_chip_recognition(struct brcmf_sdio_card *card,
+                              struct chip_info *ci, u32 regs)
+{
+        u32 regdata;
+
+        /*
+         * Get CC core rev
+         * Chipid is assume to be at offset 0 from regs arg
+         * For different chiptypes or old sdio hosts w/o chipcommon,
+         * other ways of recognition should be added here.
+         */
+        ci->cccorebase = regs;
+        regdata = brcmf_sdcard_reg_read(card,
+                                CORE_CC_REG(ci->cccorebase, chipid), 4);
+        ci->chip = regdata & CID_ID_MASK;
+        ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
+
+        BRCMF_INFO(("%s: chipid=0x%x chiprev=%d\n",
+                    __func__, ci->chip, ci->chiprev));
+
+        /* Address of cores for new chips should be added here */
+        switch (ci->chip) {
+        case BCM4329_CHIP_ID:
+                ci->buscorebase = BCM4329_CORE_BUS_BASE;
+                ci->ramcorebase = BCM4329_CORE_SOCRAM_BASE;
+                ci->armcorebase = BCM4329_CORE_ARM_BASE;
+                ci->ramsize = BCM4329_RAMSIZE;
+                break;
+        default:
+                BRCMF_ERROR(("%s: chipid 0x%x is not supported\n",
+                             __func__, ci->chip));
+                return -ENODEV;
+        }
+
+        regdata = brcmf_sdcard_reg_read(card,
+                CORE_SB(ci->cccorebase, sbidhigh), 4);
+        ci->ccrev = SBCOREREV(regdata);
+
+        regdata = brcmf_sdcard_reg_read(card,
+                CORE_CC_REG(ci->cccorebase, pmucapabilities), 4);
+        ci->pmurev = regdata & PCAP_REV_MASK;
+
+        regdata = brcmf_sdcard_reg_read(card,
+                                        CORE_SB(ci->buscorebase, sbidhigh), 4);
+        ci->buscorerev = SBCOREREV(regdata);
+        ci->buscoretype = (regdata & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT;
+
+        BRCMF_INFO(("%s: ccrev=%d, pmurev=%d, buscore rev/type=%d/0x%x\n",
+                    __func__, ci->ccrev, ci->pmurev,
+                    ci->buscorerev, ci->buscoretype));
+
+        /* get chipcommon capabilites */
+        ci->cccaps = brcmf_sdcard_reg_read(card,
+                CORE_CC_REG(ci->cccorebase, capabilities), 4);
+
+        return 0;
+}
+
+static void
+brcmf_sdbrcm_chip_disablecore(struct brcmf_sdio_card *card, u32 corebase)
+{
+        u32 regdata;
+
+        regdata = brcmf_sdcard_reg_read(card,
+                CORE_SB(corebase, sbtmstatelow), 4);
+        if (regdata & SBTML_RESET)
+                return;
+
+        regdata = brcmf_sdcard_reg_read(card,
+                CORE_SB(corebase, sbtmstatelow), 4);
+        if ((regdata & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) != 0) {
+                /*
+                 * set target reject and spin until busy is clear
+                 * (preserve core-specific bits)
+                 */
+                regdata = brcmf_sdcard_reg_read(card,
+                        CORE_SB(corebase, sbtmstatelow), 4);
+                brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
+                        regdata | SBTML_REJ);
+
+                regdata = brcmf_sdcard_reg_read(card,
+                        CORE_SB(corebase, sbtmstatelow), 4);
+                udelay(1);
+                SPINWAIT((brcmf_sdcard_reg_read(card,
+                        CORE_SB(corebase, sbtmstatehigh), 4) &
+                        SBTMH_BUSY), 100000);
+
+                regdata = brcmf_sdcard_reg_read(card,
+                        CORE_SB(corebase, sbtmstatehigh), 4);
+                if (regdata & SBTMH_BUSY)
+                        BRCMF_ERROR(("%s: ARM core still busy\n", __func__));
+
+                regdata = brcmf_sdcard_reg_read(card,
+                        CORE_SB(corebase, sbidlow), 4);
+                if (regdata & SBIDL_INIT) {
+                        regdata = brcmf_sdcard_reg_read(card,
+                                CORE_SB(corebase, sbimstate), 4) |
+                                SBIM_RJ;
+                        brcmf_sdcard_reg_write(card,
+                                CORE_SB(corebase, sbimstate), 4,
+                                regdata);
+                        regdata = brcmf_sdcard_reg_read(card,
+                                CORE_SB(corebase, sbimstate), 4);
+                        udelay(1);
+                        SPINWAIT((brcmf_sdcard_reg_read(card,
+                                CORE_SB(corebase, sbimstate), 4) &
+                                SBIM_BY), 100000);
+                }
+
+                /* set reset and reject while enabling the clocks */
+                brcmf_sdcard_reg_write(card,
+                        CORE_SB(corebase, sbtmstatelow), 4,
+                        (((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+                        SBTML_REJ | SBTML_RESET));
+                regdata = brcmf_sdcard_reg_read(card,
+                        CORE_SB(corebase, sbtmstatelow), 4);
+                udelay(10);
+
+                /* clear the initiator reject bit */
+                regdata = brcmf_sdcard_reg_read(card,
+                        CORE_SB(corebase, sbidlow), 4);
+                if (regdata & SBIDL_INIT) {
+                        regdata = brcmf_sdcard_reg_read(card,
+                                CORE_SB(corebase, sbimstate), 4) &
+                                ~SBIM_RJ;
+                        brcmf_sdcard_reg_write(card,
+                                CORE_SB(corebase, sbimstate), 4,
+                                regdata);
+                }
+        }
+
+        /* leave reset and reject asserted */
+        brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
+                (SBTML_REJ | SBTML_RESET));
+        udelay(1);
+}
+
+static int
+brcmf_sdbrcm_chip_attach(struct brcmf_bus *bus, u32 regs)
+{
+        struct chip_info *ci;
+        int err;
+        u8 clkval, clkset;
+
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        /* alloc chip_info_t */
+        ci = kmalloc(sizeof(struct chip_info), GFP_ATOMIC);
+        if (NULL == ci) {
+                BRCMF_ERROR(("%s: malloc failed!\n", __func__));
+                return -ENOMEM;
+        }
+
+        memset((unsigned char *)ci, 0, sizeof(struct chip_info));
+
+        /* bus/core/clk setup for register access */
+        /* Try forcing SDIO core to do ALPAvail request only */
+        clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
+        brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                        clkset, &err);
+        if (err) {
+                BRCMF_ERROR(("%s: error writing for HT off\n", __func__));
+                goto fail;
+        }
+
+        /* If register supported, wait for ALPAvail and then force ALP */
+        /* This may take up to 15 milliseconds */
+        clkval = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
+                        SBSDIO_FUNC1_CHIPCLKCSR, NULL);
+        if ((clkval & ~SBSDIO_AVBITS) == clkset) {
+                SPINWAIT(((clkval =
+                                brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
+                                                SBSDIO_FUNC1_CHIPCLKCSR,
+                                                NULL)),
+                                !SBSDIO_ALPAV(clkval)),
+                                PMU_MAX_TRANSITION_DLY);
+                if (!SBSDIO_ALPAV(clkval)) {
+                        BRCMF_ERROR(("%s: timeout on ALPAV wait,"
+                                     " clkval 0x%02x\n", __func__, clkval));
+                        err = -EBUSY;
+                        goto fail;
+                }
+                clkset = SBSDIO_FORCE_HW_CLKREQ_OFF |
+                                SBSDIO_FORCE_ALP;
+                brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1,
+                                SBSDIO_FUNC1_CHIPCLKCSR,
+                                clkset, &err);
+                udelay(65);
+        } else {
+                BRCMF_ERROR(("%s: ChipClkCSR access: wrote 0x%02x"
+                             " read 0x%02x\n", __func__, clkset, clkval));
+                err = -EACCES;
+                goto fail;
+        }
+
+        /* Also, disable the extra SDIO pull-ups */
+        brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_SDIOPULLUP,
+                               0, NULL);
+
+        err = brcmf_sdbrcm_chip_recognition(bus->card, ci, regs);
+        if (err)
+                goto fail;
+
+        /*
+         * Make sure any on-chip ARM is off (in case strapping is wrong),
+         * or downloaded code was already running.
+         */
+        brcmf_sdbrcm_chip_disablecore(bus->card, ci->armcorebase);
+
+        brcmf_sdcard_reg_write(bus->card,
+                CORE_CC_REG(ci->cccorebase, gpiopullup), 4, 0);
+        brcmf_sdcard_reg_write(bus->card,
+                CORE_CC_REG(ci->cccorebase, gpiopulldown), 4, 0);
+
+        /* Disable F2 to clear any intermediate frame state on the dongle */
+        brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_0, SDIO_CCCR_IOEx,
+                SDIO_FUNC_ENABLE_1, NULL);
+
+        /* WAR: cmd52 backplane read so core HW will drop ALPReq */
+        clkval = brcmf_sdcard_cfg_read(bus->card, SDIO_FUNC_1,
+                        0, NULL);
+
+        /* Done with backplane-dependent accesses, can drop clock... */
+        brcmf_sdcard_cfg_write(bus->card, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                               0, NULL);
+
+        bus->ci = ci;
+        return 0;
+fail:
+        bus->ci = NULL;
+        kfree(ci);
+        return err;
+}
+
+static void
+brcmf_sdbrcm_chip_resetcore(struct brcmf_sdio_card *card, u32 corebase)
+{
+        u32 regdata;
+
+        /*
+         * Must do the disable sequence first to work for
+         * arbitrary current core state.
+         */
+        brcmf_sdbrcm_chip_disablecore(card, corebase);
+
+        /*
+         * Now do the initialization sequence.
+         * set reset while enabling the clock and
+         * forcing them on throughout the core
+         */
+        brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
+                ((SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+                SBTML_RESET);
+        udelay(1);
+
+        regdata = brcmf_sdcard_reg_read(card, CORE_SB(corebase, sbtmstatehigh),
+                                        4);
+        if (regdata & SBTMH_SERR)
+                brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatehigh),
+                                       4, 0);
+
+        regdata = brcmf_sdcard_reg_read(card, CORE_SB(corebase, sbimstate), 4);
+        if (regdata & (SBIM_IBE | SBIM_TO))
+                brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbimstate), 4,
+                        regdata & ~(SBIM_IBE | SBIM_TO));
+
+        /* clear reset and allow it to propagate throughout the core */
+        brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
+                (SICF_FGC << SBTML_SICF_SHIFT) |
+                (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
+        udelay(1);
+
+        /* leave clock enabled */
+        brcmf_sdcard_reg_write(card, CORE_SB(corebase, sbtmstatelow), 4,
+                (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
+        udelay(1);
+}
+
+/* SDIO Pad drive strength to select value mappings */
+struct sdiod_drive_str {
+        u8 strength;    /* Pad Drive Strength in mA */
+        u8 sel;         /* Chip-specific select value */
+};
+
+/* SDIO Drive Strength to sel value table for PMU Rev 1 */
+static const struct sdiod_drive_str sdiod_drive_strength_tab1[] = {
+        {
+        4, 0x2}, {
+        2, 0x3}, {
+        1, 0x0}, {
+        0, 0x0}
+        };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 2, 3 */
+static const struct sdiod_drive_str sdiod_drive_strength_tab2[] = {
+        {
+        12, 0x7}, {
+        10, 0x6}, {
+        8, 0x5}, {
+        6, 0x4}, {
+        4, 0x2}, {
+        2, 0x1}, {
+        0, 0x0}
+        };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 8 (1.8V) */
+static const struct sdiod_drive_str sdiod_drive_strength_tab3[] = {
+        {
+        32, 0x7}, {
+        26, 0x6}, {
+        22, 0x5}, {
+        16, 0x4}, {
+        12, 0x3}, {
+        8, 0x2}, {
+        4, 0x1}, {
+        0, 0x0}
+        };
+
+#define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
+
+static void
+brcmf_sdbrcm_sdiod_drive_strength_init(struct brcmf_bus *bus, u32 drivestrength) {
+        struct sdiod_drive_str *str_tab = NULL;
+        u32 str_mask = 0;
+        u32 str_shift = 0;
+        char chn[8];
+
+        if (!(bus->ci->cccaps & CC_CAP_PMU))
+                return;
+
+        switch (SDIOD_DRVSTR_KEY(bus->ci->chip, bus->ci->pmurev)) {
+        case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 1):
+                str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab1;
+                str_mask = 0x30000000;
+                str_shift = 28;
+                break;
+        case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 2):
+        case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 3):
+                str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab2;
+                str_mask = 0x00003800;
+                str_shift = 11;
+                break;
+        case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 8):
+                str_tab = (struct sdiod_drive_str *)&sdiod_drive_strength_tab3;
+                str_mask = 0x00003800;
+                str_shift = 11;
+                break;
+        default:
+                BRCMF_ERROR(("No SDIO Drive strength init"
+                             "done for chip %s rev %d pmurev %d\n",
+                             brcmu_chipname(bus->ci->chip, chn, 8),
+                             bus->ci->chiprev, bus->ci->pmurev));
+                break;
+        }
+
+        if (str_tab != NULL) {
+                u32 drivestrength_sel = 0;
+                u32 cc_data_temp;
+                int i;
+
+                for (i = 0; str_tab[i].strength != 0; i++) {
+                        if (drivestrength >= str_tab[i].strength) {
+                                drivestrength_sel = str_tab[i].sel;
+                                break;
+                        }
+                }
+
+                brcmf_sdcard_reg_write(bus->card,
+                        CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
+                        4, 1);
+                cc_data_temp = brcmf_sdcard_reg_read(bus->card,
+                        CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr), 4);
+                cc_data_temp &= ~str_mask;
+                drivestrength_sel <<= str_shift;
+                cc_data_temp |= drivestrength_sel;
+                brcmf_sdcard_reg_write(bus->card,
+                        CORE_CC_REG(bus->ci->cccorebase, chipcontrol_addr),
+                        4, cc_data_temp);
+
+                BRCMF_INFO(("SDIO: %dmA drive strength selected, "
+                            "set to 0x%08x\n", drivestrength, cc_data_temp));
+        }
+}
+
+static void
+brcmf_sdbrcm_chip_detach(struct brcmf_bus *bus)
+{
+        BRCMF_TRACE(("%s: Enter\n", __func__));
+
+        kfree(bus->ci);
+        bus->ci = NULL;
+}
+
+static void
+brcmf_sdbrcm_wait_for_event(struct brcmf_bus *bus, bool *lockvar)
+{
+        brcmf_sdbrcm_sdunlock(bus);
+        wait_event_interruptible_timeout(bus->ctrl_wait,
+                                         (*lockvar == false), HZ * 2);
+        brcmf_sdbrcm_sdlock(bus);
+        return;
+}
+
+static void
+brcmf_sdbrcm_wait_event_wakeup(struct brcmf_bus *bus)
+{
+        if (waitqueue_active(&bus->ctrl_wait))
+                wake_up_interruptible(&bus->ctrl_wait);
+        return;
+}
+
+static int
+brcmf_sdbrcm_watchdog_thread(void *data)
+{
+        struct brcmf_bus *bus = (struct brcmf_bus *)data;
+
+        /* This thread doesn't need any user-level access,
+        * so get rid of all our resources
+        */
+        if (brcmf_watchdog_prio > 0) {
+                struct sched_param param;
+                param.sched_priority = (brcmf_watchdog_prio < MAX_RT_PRIO) ?
+                                       brcmf_watchdog_prio : (MAX_RT_PRIO - 1);
+                sched_setscheduler(current, SCHED_FIFO, &param);
+        }
+
+        allow_signal(SIGTERM);
+        /* Run until signal received */
+        while (1) {
+                if (kthread_should_stop())
+                        break;
+                if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
+                        if (bus->drvr->dongle_reset == false)
+                                brcmf_sdbrcm_bus_watchdog(bus->drvr);
+                        /* Count the tick for reference */
+                        bus->drvr->tickcnt++;
+                } else
+                        break;
+        }
+        return 0;
+}
+
+static void
+brcmf_sdbrcm_watchdog(unsigned long data)
+{
+        struct brcmf_bus *bus = (struct brcmf_bus *)data;
+
+        if (brcmf_watchdog_prio >= 0) {
+                if (bus->watchdog_tsk)
+                        complete(&bus->watchdog_wait);
+                else
+                        return;
+        } else {
+                brcmf_sdbrcm_bus_watchdog(bus->drvr);
+
+                /* Count the tick for reference */
+                bus->drvr->tickcnt++;
+        }
+
+        /* Reschedule the watchdog */
+        if (bus->wd_timer_valid)
+                mod_timer(&bus->timer, jiffies + brcmf_watchdog_ms * HZ / 1000);
+}
+
+void
+brcmf_sdbrcm_wd_timer(struct brcmf_bus *bus, uint wdtick)
+{
+        static uint save_ms;
+
+        /* don't start the wd until fw is loaded */
+        if (bus->drvr->busstate == BRCMF_BUS_DOWN)
+                return;
+
+        /* Totally stop the timer */
+        if (!wdtick && bus->wd_timer_valid == true) {
+                del_timer_sync(&bus->timer);
+                bus->wd_timer_valid = false;
+                save_ms = wdtick;
+                return;
+        }
+
+        if (wdtick) {
+                brcmf_watchdog_ms = (uint) wdtick;
+
+                if (save_ms != brcmf_watchdog_ms) {
+                        if (bus->wd_timer_valid == true)
+                                /* Stop timer and restart at new value */
+                                del_timer_sync(&bus->timer);
+
+                        /* Create timer again when watchdog period is
+                           dynamically changed or in the first instance
+                         */
+                        bus->timer.expires =
+                                jiffies + brcmf_watchdog_ms * HZ / 1000;
+                        add_timer(&bus->timer);
+
+                } else {
+                        /* Re arm the timer, at last watchdog period */
+                        mod_timer(&bus->timer,
+                                jiffies + brcmf_watchdog_ms * HZ / 1000);
+                }
+
+                bus->wd_timer_valid = true;
+                save_ms = wdtick;
+        }
+}
+
+static int brcmf_sdbrcm_dpc_thread(void *data)
+{
+        struct brcmf_bus *bus = (struct brcmf_bus *) data;
+
+        /* This thread doesn't need any user-level access,
+         * so get rid of all our resources
+         */
+        if (brcmf_dpc_prio > 0) {
+                struct sched_param param;
+                param.sched_priority = (brcmf_dpc_prio < MAX_RT_PRIO) ?
+                                       brcmf_dpc_prio : (MAX_RT_PRIO - 1);
+                sched_setscheduler(current, SCHED_FIFO, &param);
+        }
+
+        allow_signal(SIGTERM);
+        /* Run until signal received */
+        while (1) {
+                if (kthread_should_stop())
+                        break;
+                if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
+                        /* Call bus dpc unless it indicated down
+                        (then clean stop) */
+                        if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
+                                if (brcmf_sdbrcm_dpc(bus))
+                                        complete(&bus->dpc_wait);
+                        } else {
+                                brcmf_sdbrcm_bus_stop(bus, true);
+                        }
+                } else
+                        break;
+        }
+        return 0;
+}
+
+static void brcmf_sdbrcm_dpc_tasklet(unsigned long data)
+{
+        struct brcmf_bus *bus = (struct brcmf_bus *) data;
+
+        /* Call bus dpc unless it indicated down (then clean stop) */
+        if (bus->drvr->busstate != BRCMF_BUS_DOWN) {
+                if (brcmf_sdbrcm_dpc(bus))
+                        tasklet_schedule(&bus->tasklet);
+        } else
+                brcmf_sdbrcm_bus_stop(bus, true);
+}
+
+static void brcmf_sdbrcm_sched_dpc(struct brcmf_bus *bus)
+{
+        if (bus->dpc_tsk) {
+                complete(&bus->dpc_wait);
+                return;
+        }
+
+        tasklet_schedule(&bus->tasklet);
+}
+
+static void brcmf_sdbrcm_sdlock(struct brcmf_bus *bus)
+{
+        if (bus->threads_only)
+                down(&bus->sdsem);
+        else
+                spin_lock_bh(&bus->sdlock);
+}
+
+static void brcmf_sdbrcm_sdunlock(struct brcmf_bus *bus)
+{
+        if (bus->threads_only)
+                up(&bus->sdsem);
+        else
+                spin_unlock_bh(&bus->sdlock);
+}
+
+static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_bus *bus)
+{
+        if (bus->firmware->size < bus->fw_ptr + len)
+                len = bus->firmware->size - bus->fw_ptr;
+
+        memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
+        bus->fw_ptr += len;
+        return len;
+}
+
+MODULE_FIRMWARE(BCM4329_FW_NAME);
+MODULE_FIRMWARE(BCM4329_NV_NAME);
diff --git a/drivers/staging/brcm80211/brcmfmac/sdio_host.h b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
new file mode 100644
index 00000000000..d3454721506
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/sdio_host.h
@@ -0,0 +1,347 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _BRCM_SDH_H_
+#define _BRCM_SDH_H_
+
+#include <linux/skbuff.h>
+extern const uint brcmf_sdio_msglevel;
+
+#define SDIO_FUNC_0             0
+#define SDIO_FUNC_1             1
+#define SDIO_FUNC_2             2
+
+#define SDIOD_FBR_SIZE          0x100
+
+/* io_en */
+#define SDIO_FUNC_ENABLE_1      0x02
+#define SDIO_FUNC_ENABLE_2      0x04
+
+/* io_rdys */
+#define SDIO_FUNC_READY_1       0x02
+#define SDIO_FUNC_READY_2       0x04
+
+/* intr_status */
+#define INTR_STATUS_FUNC1       0x2
+#define INTR_STATUS_FUNC2       0x4
+
+/* Maximum number of I/O funcs */
+#define SDIOD_MAX_IOFUNCS       7
+
+#define SBSDIO_NUM_FUNCTION             3       /* as of sdiod rev 0, supports 3 functions */
+
+/* function 1 miscellaneous registers */
+#define SBSDIO_SPROM_CS                 0x10000 /* sprom command and status */
+#define SBSDIO_SPROM_INFO               0x10001 /* sprom info register */
+#define SBSDIO_SPROM_DATA_LOW           0x10002 /* sprom indirect access data byte 0 */
+#define SBSDIO_SPROM_DATA_HIGH          0x10003 /* sprom indirect access data byte 1 */
+#define SBSDIO_SPROM_ADDR_LOW           0x10004 /* sprom indirect access addr byte 0 */
+#define SBSDIO_SPROM_ADDR_HIGH          0x10005 /* sprom indirect access addr byte 0 */
+#define SBSDIO_CHIP_CTRL_DATA           0x10006 /* xtal_pu (gpio) output */
+#define SBSDIO_CHIP_CTRL_EN             0x10007 /* xtal_pu (gpio) enable */
+#define SBSDIO_WATERMARK                0x10008 /* rev < 7, watermark for sdio device */
+#define SBSDIO_DEVICE_CTL               0x10009 /* control busy signal generation */
+
+/* registers introduced in rev 8, some content (mask/bits) defs in sbsdpcmdev.h */
+#define SBSDIO_FUNC1_SBADDRLOW          0x1000A /* SB Address Window Low (b15) */
+#define SBSDIO_FUNC1_SBADDRMID          0x1000B /* SB Address Window Mid (b23:b16) */
+#define SBSDIO_FUNC1_SBADDRHIGH         0x1000C /* SB Address Window High (b31:b24)    */
+#define SBSDIO_FUNC1_FRAMECTRL          0x1000D /* Frame Control (frame term/abort) */
+#define SBSDIO_FUNC1_CHIPCLKCSR         0x1000E /* ChipClockCSR (ALP/HT ctl/status) */
+#define SBSDIO_FUNC1_SDIOPULLUP         0x1000F /* SdioPullUp (on cmd, d0-d2) */
+#define SBSDIO_FUNC1_WFRAMEBCLO         0x10019 /* Write Frame Byte Count Low */
+#define SBSDIO_FUNC1_WFRAMEBCHI         0x1001A /* Write Frame Byte Count High */
+#define SBSDIO_FUNC1_RFRAMEBCLO         0x1001B /* Read Frame Byte Count Low */
+#define SBSDIO_FUNC1_RFRAMEBCHI         0x1001C /* Read Frame Byte Count High */
+
+#define SBSDIO_FUNC1_MISC_REG_START     0x10000 /* f1 misc register start */
+#define SBSDIO_FUNC1_MISC_REG_LIMIT     0x1001C /* f1 misc register end */
+
+/* function 1 OCP space */
+#define SBSDIO_SB_OFT_ADDR_MASK         0x07FFF /* sb offset addr is <= 15 bits, 32k */
+#define SBSDIO_SB_OFT_ADDR_LIMIT        0x08000
+#define SBSDIO_SB_ACCESS_2_4B_FLAG      0x08000 /* with b15, maps to 32-bit SB access */
+
+/* some duplication with sbsdpcmdev.h here */
+/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
+#define SBSDIO_SBADDRLOW_MASK           0x80    /* Valid bits in SBADDRLOW */
+#define SBSDIO_SBADDRMID_MASK           0xff    /* Valid bits in SBADDRMID */
+#define SBSDIO_SBADDRHIGH_MASK          0xffU   /* Valid bits in SBADDRHIGH */
+#define SBSDIO_SBWINDOW_MASK            0xffff8000      /* Address bits from SBADDR regs */
+
+#define SDIOH_READ              0       /* Read request */
+#define SDIOH_WRITE             1       /* Write request */
+
+#define SDIOH_DATA_FIX          0       /* Fixed addressing */
+#define SDIOH_DATA_INC          1       /* Incremental addressing */
+
+/* internal return code */
+#define SUCCESS 0
+#define ERROR   1
+
+/* forward declarations */
+struct brcmf_sdio_card;
+
+struct brcmf_sdreg {
+        int func;
+        int offset;
+        int value;
+};
+
+struct sdioh_info {
+        struct osl_info *osh;           /* osh handler */
+        bool client_intr_enabled;       /* interrupt connnected flag */
+        bool intr_handler_valid;        /* client driver interrupt handler valid */
+        void (*intr_handler)(void *);   /* registered interrupt handler */
+        void *intr_handler_arg; /* argument to call interrupt handler */
+        u16 intmask;            /* Current active interrupts */
+        void *sdos_info;        /* Pointer to per-OS private data */
+
+        uint irq;               /* Client irq */
+        int intrcount;          /* Client interrupts */
+        bool sd_blockmode;      /* sd_blockmode == false => 64 Byte Cmd 53s. */
+        /*  Must be on for sd_multiblock to be effective */
+        bool use_client_ints;   /* If this is false, make sure to restore */
+        int client_block_size[SDIOD_MAX_IOFUNCS];       /* Blocksize */
+        u8 num_funcs;   /* Supported funcs on client */
+        u32 com_cis_ptr;
+        u32 func_cis_ptr[SDIOD_MAX_IOFUNCS];
+        uint max_dma_len;
+        uint max_dma_descriptors;       /* DMA Descriptors supported by this controller. */
+        /*      SDDMA_DESCRIPTOR        SGList[32]; *//* Scatter/Gather DMA List */
+};
+
+struct brcmf_sdmmc_instance {
+        struct sdioh_info *sd;
+        struct sdio_func *func[SDIOD_MAX_IOFUNCS];
+        u32 host_claimed;
+};
+
+/* Attach and build an interface to the underlying SD host driver.
+ *  - Allocates resources (structs, arrays, mem, OS handles, etc) needed by
+ *    brcmf_sdcard.
+ *  - Returns the sdio card handle and virtual address base for register access.
+ *    The returned handle should be used in all subsequent calls, but the bcmsh
+ *    implementation may maintain a single "default" handle (e.g. the first or
+ *    most recent one) to enable single-instance implementations to pass NULL.
+ */
+extern struct brcmf_sdio_card*
+brcmf_sdcard_attach(void *cfghdl, u32 *regsva, uint irq);
+
+/* Detach - freeup resources allocated in attach */
+extern int brcmf_sdcard_detach(struct brcmf_sdio_card *card);
+
+/* Enable/disable SD interrupt */
+extern int brcmf_sdcard_intr_enable(struct brcmf_sdio_card *card);
+extern int brcmf_sdcard_intr_disable(struct brcmf_sdio_card *card);
+
+/* Register/deregister device interrupt handler. */
+extern int
+brcmf_sdcard_intr_reg(struct brcmf_sdio_card *card,
+                      void (*fn)(void *), void *argh);
+
+extern int brcmf_sdcard_intr_dereg(struct brcmf_sdio_card *card);
+
+/* Access SDIO address space (e.g. CCCR) using CMD52 (single-byte interface).
+ *   fn:   function number
+ *   addr: unmodified SDIO-space address
+ *   data: data byte to write
+ *   err:  pointer to error code (or NULL)
+ */
+extern u8 brcmf_sdcard_cfg_read(struct brcmf_sdio_card *card, uint func,
+                                u32 addr, int *err);
+extern void brcmf_sdcard_cfg_write(struct brcmf_sdio_card *card, uint func,
+                                   u32 addr, u8 data, int *err);
+
+/* Read/Write 4bytes from/to cfg space */
+extern u32
+brcmf_sdcard_cfg_read_word(struct brcmf_sdio_card *card, uint fnc_num,
+                           u32 addr, int *err);
+
+extern void brcmf_sdcard_cfg_write_word(struct brcmf_sdio_card *card,
+                                        uint fnc_num, u32 addr,
+                                        u32 data, int *err);
+
+/* Read CIS content for specified function.
+ *   fn:     function whose CIS is being requested (0 is common CIS)
+ *   cis:    pointer to memory location to place results
+ *   length: number of bytes to read
+ * Internally, this routine uses the values from the cis base regs (0x9-0xB)
+ * to form an SDIO-space address to read the data from.
+ */
+extern int brcmf_sdcard_cis_read(struct brcmf_sdio_card *card, uint func,
+                                 u8 *cis, uint length);
+
+/* Synchronous access to device (client) core registers via CMD53 to F1.
+ *   addr: backplane address (i.e. >= regsva from attach)
+ *   size: register width in bytes (2 or 4)
+ *   data: data for register write
+ */
+extern u32
+brcmf_sdcard_reg_read(struct brcmf_sdio_card *card, u32 addr, uint size);
+
+extern u32
+brcmf_sdcard_reg_write(struct brcmf_sdio_card *card, u32 addr, uint size,
+                       u32 data);
+
+/* Indicate if last reg read/write failed */
+extern bool brcmf_sdcard_regfail(struct brcmf_sdio_card *card);
+
+/* Buffer transfer to/from device (client) core via cmd53.
+ *   fn:       function number
+ *   addr:     backplane address (i.e. >= regsva from attach)
+ *   flags:    backplane width, address increment, sync/async
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ *   pkt:      pointer to packet associated with buf (if any)
+ *   complete: callback function for command completion (async only)
+ *   handle:   handle for completion callback (first arg in callback)
+ * Returns 0 or error code.
+ * NOTE: Async operation is not currently supported.
+ */
+extern int
+brcmf_sdcard_send_buf(struct brcmf_sdio_card *card, u32 addr, uint fn,
+                      uint flags, u8 *buf, uint nbytes, void *pkt,
+                      void (*complete)(void *handle, int status,
+                                       bool sync_waiting),
+                      void *handle);
+extern int
+brcmf_sdcard_recv_buf(struct brcmf_sdio_card *card, u32 addr, uint fn,
+                      uint flags, u8 *buf, uint nbytes, struct sk_buff *pkt,
+                      void (*complete)(void *handle, int status,
+                                       bool sync_waiting),
+                      void *handle);
+
+/* Flags bits */
+#define SDIO_REQ_4BYTE  0x1     /* Four-byte target (backplane) width (vs. two-byte) */
+#define SDIO_REQ_FIXED  0x2     /* Fixed address (FIFO) (vs. incrementing address) */
+#define SDIO_REQ_ASYNC  0x4     /* Async request (vs. sync request) */
+
+/* Pending (non-error) return code */
+#define BCME_PENDING    1
+
+/* Read/write to memory block (F1, no FIFO) via CMD53 (sync only).
+ *   rw:       read or write (0/1)
+ *   addr:     direct SDIO address
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ * Returns 0 or error code.
+ */
+extern int brcmf_sdcard_rwdata(struct brcmf_sdio_card *card, uint rw, u32 addr,
+                               u8 *buf, uint nbytes);
+
+/* Issue an abort to the specified function */
+extern int brcmf_sdcard_abort(struct brcmf_sdio_card *card, uint fn);
+
+/* Returns the "Device ID" of target device on the SDIO bus. */
+extern int brcmf_sdcard_query_device(struct brcmf_sdio_card *card);
+
+/* Miscellaneous knob tweaker. */
+extern int brcmf_sdcard_iovar_op(struct brcmf_sdio_card *card, const char *name,
+                                 void *params, int plen, void *arg, int len,
+                                 bool set);
+
+/* helper functions */
+
+/* callback functions */
+struct brcmf_sdioh_driver {
+        /* attach to device */
+        void *(*attach) (u16 vend_id, u16 dev_id, u16 bus, u16 slot,
+                         u16 func, uint bustype, u32 regsva, void *param);
+        /* detach from device */
+        void (*detach) (void *ch);
+};
+
+struct sdioh_info;
+
+/* platform specific/high level functions */
+extern int brcmf_sdio_function_init(void);
+extern int brcmf_sdio_register(struct brcmf_sdioh_driver *driver);
+extern void brcmf_sdio_unregister(void);
+extern void brcmf_sdio_function_cleanup(void);
+extern int brcmf_sdio_probe(struct device *dev);
+extern int brcmf_sdio_remove(struct device *dev);
+
+/* Function to return current window addr */
+extern u32 brcmf_sdcard_cur_sbwad(struct brcmf_sdio_card *card);
+
+/* Allocate/init/free per-OS private data */
+extern int  brcmf_sdioh_osinit(struct sdioh_info *sd);
+extern void brcmf_sdioh_osfree(struct sdioh_info *sd);
+
+/* Core interrupt enable/disable of device interrupts */
+extern void brcmf_sdioh_dev_intr_on(struct sdioh_info *sd);
+extern void brcmf_sdioh_dev_intr_off(struct sdioh_info *sd);
+
+/* attach, return handler on success, NULL if failed.
+ *  The handler shall be provided by all subsequent calls. No local cache
+ *  cfghdl points to the starting address of pci device mapped memory
+ */
+extern struct sdioh_info *brcmf_sdioh_attach(void *cfghdl, uint irq);
+extern int brcmf_sdioh_detach(struct sdioh_info *si);
+
+extern int
+brcmf_sdioh_interrupt_register(struct sdioh_info *si,
+                               void (*sdioh_cb_fn)(void *), void *argh);
+
+extern int brcmf_sdioh_interrupt_deregister(struct sdioh_info *si);
+
+/* enable or disable SD interrupt */
+extern int
+brcmf_sdioh_interrupt_set(struct sdioh_info *si, bool enable_disable);
+
+/* read or write one byte using cmd52 */
+extern int
+brcmf_sdioh_request_byte(struct sdioh_info *si, uint rw, uint fnc, uint addr,
+                         u8 *byte);
+
+/* read or write 2/4 bytes using cmd53 */
+extern int
+brcmf_sdioh_request_word(struct sdioh_info *si, uint cmd_type,
+                         uint rw, uint fnc, uint addr,
+                         u32 *word, uint nbyte);
+
+/* read or write any buffer using cmd53 */
+extern int
+brcmf_sdioh_request_buffer(struct sdioh_info *si, uint pio_dma,
+                           uint fix_inc, uint rw, uint fnc_num,
+                           u32 addr, uint regwidth,
+                           u32 buflen, u8 *buffer, struct sk_buff *pkt);
+
+/* get cis data */
+extern int
+brcmf_sdioh_cis_read(struct sdioh_info *si, uint fuc, u8 *cis, u32 length);
+
+extern int
+brcmf_sdioh_cfg_read(struct sdioh_info *si, uint fuc, u32 addr, u8 *data);
+extern int
+brcmf_sdioh_cfg_write(struct sdioh_info *si, uint fuc, u32 addr, u8 *data);
+
+/* handle iovars */
+extern int brcmf_sdioh_iovar_op(struct sdioh_info *si, const char *name,
+                          void *params, int plen, void *arg, int len, bool set);
+
+/* Issue abort to the specified function and clear controller as needed */
+extern int brcmf_sdioh_abort(struct sdioh_info *si, uint fnc);
+
+/* Watchdog timer interface for pm ops */
+extern void brcmf_sdio_wdtmr_enable(bool enable);
+
+extern uint sd_msglevel;        /* Debug message level */
+
+extern struct brcmf_sdmmc_instance *gInstance;
+
+#endif                          /* _BRCM_SDH_H_ */
diff --git a/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
new file mode 100644
index 00000000000..821206d3e53
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
@@ -0,0 +1,4152 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/if_arp.h>
+#include <linux/sched.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/uaccess.h>
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+
+#include <brcmu_utils.h>
+#include <defs.h>
+#include <brcmu_wifi.h>
+#include "dhd.h"
+#include "wl_cfg80211.h"
+
+static struct sdio_func *cfg80211_sdio_func;
+static struct brcmf_cfg80211_dev *cfg80211_dev;
+static const u8 ether_bcast[ETH_ALEN] = {255, 255, 255, 255, 255, 255};
+
+u32 brcmf_dbg_level = WL_DBG_ERR;
+
+/*
+** cfg80211_ops api/callback list
+*/
+static s32 brcmf_cfg80211_change_iface(struct wiphy *wiphy,
+                                       struct net_device *ndev,
+                                       enum nl80211_iftype type, u32 *flags,
+                                       struct vif_params *params);
+static s32 __brcmf_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+                                 struct cfg80211_scan_request *request,
+                                 struct cfg80211_ssid *this_ssid);
+static s32 brcmf_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+                               struct cfg80211_scan_request *request);
+static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed);
+static s32 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+                                    struct cfg80211_ibss_params *params);
+static s32 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy,
+                                     struct net_device *dev);
+static s32 brcmf_cfg80211_get_station(struct wiphy *wiphy,
+                                      struct net_device *dev, u8 *mac,
+                                      struct station_info *sinfo);
+static s32 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy,
+                                         struct net_device *dev, bool enabled,
+                                         s32 timeout);
+static s32 brcmf_cfg80211_set_bitrate_mask(struct wiphy *wiphy,
+                                           struct net_device *dev,
+                                           const u8 *addr,
+                                           const struct cfg80211_bitrate_mask
+                                           *mask);
+static int brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+                                  struct cfg80211_connect_params *sme);
+static s32 brcmf_cfg80211_disconnect(struct wiphy *wiphy,
+                                     struct net_device *dev,
+                                     u16 reason_code);
+static s32 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy,
+                                      enum nl80211_tx_power_setting type,
+                                      s32 dbm);
+static s32 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm);
+static s32 brcmf_cfg80211_config_default_key(struct wiphy *wiphy,
+                                          struct net_device *dev, u8 key_idx,
+                                          bool unicast, bool multicast);
+static s32 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+                                 u8 key_idx, bool pairwise, const u8 *mac_addr,
+                                 struct key_params *params);
+static s32 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+                                 u8 key_idx, bool pairwise, const u8 *mac_addr);
+static s32 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+                                 u8 key_idx, bool pairwise, const u8 *mac_addr,
+                                 void *cookie, void (*callback) (void *cookie,
+                                                                 struct
+                                                                 key_params *
+                                                                 params));
+static s32 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+                                                 struct net_device *dev,
+                                                 u8 key_idx);
+static s32 brcmf_cfg80211_resume(struct wiphy *wiphy);
+static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
+                                 struct cfg80211_wowlan *wow);
+static s32 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+                                   struct cfg80211_pmksa *pmksa);
+static s32 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+                                   struct cfg80211_pmksa *pmksa);
+static s32 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy,
+                                     struct net_device *dev);
+/*
+** event & event Q handlers for cfg80211 interfaces
+*/
+static s32 brcmf_create_event_handler(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_destroy_event_handler(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_event_handler(void *data);
+static void brcmf_init_eq(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_flush_eq(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_lock_eq(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_unlock_eq(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_init_eq_lock(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_init_eloop_handler(struct brcmf_cfg80211_event_loop *el);
+static struct brcmf_cfg80211_event_q *
+brcmf_deq_event(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_enq_event(struct brcmf_cfg80211_priv *cfg_priv, u32 type,
+                          const struct brcmf_event_msg *msg, void *data);
+static void brcmf_put_event(struct brcmf_cfg80211_event_q *e);
+static void brcmf_wakeup_event(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_notify_connect_status(struct brcmf_cfg80211_priv *cfg_priv,
+                                       struct net_device *ndev,
+                                       const struct brcmf_event_msg *e,
+                                       void *data);
+static s32 brcmf_notify_roaming_status(struct brcmf_cfg80211_priv *cfg_priv,
+                                       struct net_device *ndev,
+                                       const struct brcmf_event_msg *e,
+                                       void *data);
+static s32 brcmf_notify_scan_status(struct brcmf_cfg80211_priv *cfg_priv,
+                                    struct net_device *ndev,
+                                    const struct brcmf_event_msg *e,
+                                    void *data);
+static s32 brcmf_bss_connect_done(struct brcmf_cfg80211_priv *cfg_priv,
+                                  struct net_device *ndev,
+                                  const struct brcmf_event_msg *e, void *data,
+                                  bool completed);
+static s32 brcmf_bss_roaming_done(struct brcmf_cfg80211_priv *cfg_priv,
+                                  struct net_device *ndev,
+                                  const struct brcmf_event_msg *e, void *data);
+static s32 brcmf_notify_mic_status(struct brcmf_cfg80211_priv *cfg_priv,
+                                   struct net_device *ndev,
+                                   const struct brcmf_event_msg *e, void *data);
+
+/*
+** register/deregister sdio function
+*/
+static void brcmf_clear_sdio_func(void);
+
+/*
+** ioctl utilites
+*/
+static s32 brcmf_dev_bufvar_get(struct net_device *dev, s8 *name, s8 *buf,
+                               s32 buf_len);
+static __used s32 brcmf_dev_bufvar_set(struct net_device *dev, s8 *name,
+                                      s8 *buf, s32 len);
+static s32 brcmf_dev_intvar_set(struct net_device *dev, s8 *name, s32 val);
+static s32 brcmf_dev_intvar_get(struct net_device *dev, s8 *name,
+                               s32 *retval);
+static s32 brcmf_dev_ioctl(struct net_device *dev, u32 cmd, void *arg,
+                          u32 len);
+
+/*
+** cfg80211 set_wiphy_params utilities
+*/
+static s32 brcmf_set_frag(struct net_device *dev, u32 frag_threshold);
+static s32 brcmf_set_rts(struct net_device *dev, u32 frag_threshold);
+static s32 brcmf_set_retry(struct net_device *dev, u32 retry, bool l);
+
+/*
+** wl profile utilities
+*/
+static s32 brcmf_update_prof(struct brcmf_cfg80211_priv *cfg_priv,
+                             const struct brcmf_event_msg *e,
+                             void *data, s32 item);
+static void *brcmf_read_prof(struct brcmf_cfg80211_priv *cfg_priv, s32 item);
+static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof);
+
+/*
+** cfg80211 connect utilites
+*/
+static s32 brcmf_set_wpa_version(struct net_device *dev,
+                        struct cfg80211_connect_params *sme);
+static s32 brcmf_set_auth_type(struct net_device *dev,
+                        struct cfg80211_connect_params *sme);
+static s32 brcmf_set_set_cipher(struct net_device *dev,
+                        struct cfg80211_connect_params *sme);
+static s32 brcmf_set_key_mgmt(struct net_device *dev,
+                        struct cfg80211_connect_params *sme);
+static s32 brcmf_set_set_sharedkey(struct net_device *dev,
+                        struct cfg80211_connect_params *sme);
+static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_ch_to_chanspec(int ch,
+        struct brcmf_join_params *join_params, size_t *join_params_size);
+
+/*
+** information element utilities
+*/
+static __used s32 brcmf_add_ie(struct brcmf_cfg80211_priv *cfg_priv,
+                               u8 t, u8 l, u8 *v);
+static s32 brcmf_mode_to_nl80211_iftype(s32 mode);
+static struct wireless_dev *brcmf_alloc_wdev(s32 sizeof_iface,
+                        struct device *dev);
+static void brcmf_free_wdev(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_inform_bss(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_priv *cfg_priv,
+                                   struct brcmf_bss_info *bi);
+static s32 brcmf_update_bss_info(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+                        u8 key_idx, const u8 *mac_addr,
+                        struct key_params *params);
+
+/*
+** key indianess swap utilities
+*/
+static void swap_key_from_BE(struct brcmf_wsec_key *key);
+static void swap_key_to_BE(struct brcmf_wsec_key *key);
+
+/*
+** brcmf_cfg80211_priv memory init/deinit utilities
+*/
+static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_priv *cfg_priv);
+
+static void brcmf_delay(u32 ms);
+
+/*
+** store/restore cfg80211 instance data
+*/
+static void brcmf_set_drvdata(struct brcmf_cfg80211_dev *dev, void *data);
+static void *brcmf_get_drvdata(struct brcmf_cfg80211_dev *dev);
+
+/*
+** ibss mode utilities
+*/
+static bool brcmf_is_ibssmode(struct brcmf_cfg80211_priv *cfg_priv);
+
+/*
+** dongle up/down , default configuration utilities
+*/
+static bool brcmf_is_linkdown(struct brcmf_cfg80211_priv *cfg_priv,
+                              const struct brcmf_event_msg *e);
+static bool brcmf_is_linkup(struct brcmf_cfg80211_priv *cfg_priv,
+                            const struct brcmf_event_msg *e);
+static bool brcmf_is_nonetwork(struct brcmf_cfg80211_priv *cfg_priv,
+                               const struct brcmf_event_msg *e);
+static void brcmf_link_down(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_dongle_mode(struct net_device *ndev, s32 iftype);
+static s32 __brcmf_cfg80211_up(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 __brcmf_cfg80211_down(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_dongle_probecap(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf);
+
+/*
+** dongle configuration utilities
+*/
+static s32 brcmf_dongle_eventmsg(struct net_device *ndev);
+static s32 brcmf_dongle_scantime(struct net_device *ndev, s32 scan_assoc_time,
+                                 s32 scan_unassoc_time, s32 scan_passive_time);
+static s32 brcmf_config_dongle(struct brcmf_cfg80211_priv *cfg_priv,
+                               bool need_lock);
+static s32 brcmf_dongle_roam(struct net_device *ndev, u32 roamvar,
+                            u32 bcn_timeout);
+
+/*
+** iscan handler
+*/
+static void brcmf_iscan_timer(unsigned long data);
+static void brcmf_term_iscan(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_init_iscan(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_iscan_thread(void *data);
+static s32 brcmf_dev_iovar_setbuf(struct net_device *dev, s8 *iovar,
+                                 void *param, s32 paramlen, void *bufptr,
+                                 s32 buflen);
+static s32 brcmf_dev_iovar_getbuf(struct net_device *dev, s8 *iovar,
+                                 void *param, s32 paramlen, void *bufptr,
+                                 s32 buflen);
+static s32 brcmf_run_iscan(struct brcmf_cfg80211_iscan_ctrl *iscan,
+                           struct brcmf_ssid *ssid, u16 action);
+static s32 brcmf_do_iscan(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_wakeup_iscan(struct brcmf_cfg80211_iscan_ctrl *iscan);
+static s32 brcmf_invoke_iscan(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_get_iscan_results(struct brcmf_cfg80211_iscan_ctrl *iscan,
+                                   u32 *status,
+                                   struct brcmf_scan_results **bss_list);
+static void brcmf_notify_iscan_complete(struct brcmf_cfg80211_iscan_ctrl *iscan,
+                                        bool aborted);
+static void brcmf_init_iscan_eloop(struct brcmf_cfg80211_iscan_eloop *el);
+static s32 brcmf_iscan_done(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_iscan_pending(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_iscan_inprogress(struct brcmf_cfg80211_priv *cfg_priv);
+static s32 brcmf_iscan_aborted(struct brcmf_cfg80211_priv *cfg_priv);
+
+/*
+* find most significant bit set
+*/
+static __used u32 brcmf_find_msb(u16 bit16);
+
+/*
+* update pmklist to dongle
+*/
+static __used s32 brcmf_update_pmklist(struct net_device *dev,
+                                       struct brcmf_cfg80211_pmk_list *pmk_list,
+                                       s32 err);
+
+static void brcmf_set_mpc(struct net_device *ndev, int mpc);
+
+/*
+* debufs support
+*/
+static int
+brcmf_debugfs_add_netdev_params(struct brcmf_cfg80211_priv *cfg_priv);
+static void brcmf_debugfs_remove_netdev(struct brcmf_cfg80211_priv *cfg_priv);
+
+#define WL_PRIV_GET()                                                   \
+        ({                                                              \
+        struct brcmf_cfg80211_iface *ci = brcmf_get_drvdata(cfg80211_dev); \
+        if (unlikely(!ci)) {                                            \
+                WL_ERR("wl_cfg80211_dev is unavailable\n");             \
+                BUG();                                                  \
+        }                                                               \
+        ci->cfg_priv;                                                   \
+})
+
+#define CHECK_SYS_UP()                                                  \
+do {                                                                    \
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);     \
+        if (unlikely(!test_bit(WL_STATUS_READY, &cfg_priv->status))) {  \
+                WL_INFO("device is not ready : status (%d)\n",          \
+                        (int)cfg_priv->status);                         \
+                return -EIO;                                            \
+        }                                                               \
+} while (0)
+
+#define CHAN2G(_channel, _freq, _flags) {                       \
+        .band                   = IEEE80211_BAND_2GHZ,          \
+        .center_freq            = (_freq),                      \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
+
+#define CHAN5G(_channel, _flags) {                              \
+        .band                   = IEEE80211_BAND_5GHZ,          \
+        .center_freq            = 5000 + (5 * (_channel)),      \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
+
+#define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
+#define RATETAB_ENT(_rateid, _flags) \
+        {                                                               \
+                .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
+                .hw_value       = (_rateid),                            \
+                .flags          = (_flags),                             \
+        }
+
+static struct ieee80211_rate __wl_rates[] = {
+        RATETAB_ENT(BRCM_RATE_1M, 0),
+        RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(BRCM_RATE_6M, 0),
+        RATETAB_ENT(BRCM_RATE_9M, 0),
+        RATETAB_ENT(BRCM_RATE_12M, 0),
+        RATETAB_ENT(BRCM_RATE_18M, 0),
+        RATETAB_ENT(BRCM_RATE_24M, 0),
+        RATETAB_ENT(BRCM_RATE_36M, 0),
+        RATETAB_ENT(BRCM_RATE_48M, 0),
+        RATETAB_ENT(BRCM_RATE_54M, 0),
+};
+
+#define wl_a_rates              (__wl_rates + 4)
+#define wl_a_rates_size 8
+#define wl_g_rates              (__wl_rates + 0)
+#define wl_g_rates_size 12
+
+static struct ieee80211_channel __wl_2ghz_channels[] = {
+        CHAN2G(1, 2412, 0),
+        CHAN2G(2, 2417, 0),
+        CHAN2G(3, 2422, 0),
+        CHAN2G(4, 2427, 0),
+        CHAN2G(5, 2432, 0),
+        CHAN2G(6, 2437, 0),
+        CHAN2G(7, 2442, 0),
+        CHAN2G(8, 2447, 0),
+        CHAN2G(9, 2452, 0),
+        CHAN2G(10, 2457, 0),
+        CHAN2G(11, 2462, 0),
+        CHAN2G(12, 2467, 0),
+        CHAN2G(13, 2472, 0),
+        CHAN2G(14, 2484, 0),
+};
+
+static struct ieee80211_channel __wl_5ghz_a_channels[] = {
+        CHAN5G(34, 0), CHAN5G(36, 0),
+        CHAN5G(38, 0), CHAN5G(40, 0),
+        CHAN5G(42, 0), CHAN5G(44, 0),
+        CHAN5G(46, 0), CHAN5G(48, 0),
+        CHAN5G(52, 0), CHAN5G(56, 0),
+        CHAN5G(60, 0), CHAN5G(64, 0),
+        CHAN5G(100, 0), CHAN5G(104, 0),
+        CHAN5G(108, 0), CHAN5G(112, 0),
+        CHAN5G(116, 0), CHAN5G(120, 0),
+        CHAN5G(124, 0), CHAN5G(128, 0),
+        CHAN5G(132, 0), CHAN5G(136, 0),
+        CHAN5G(140, 0), CHAN5G(149, 0),
+        CHAN5G(153, 0), CHAN5G(157, 0),
+        CHAN5G(161, 0), CHAN5G(165, 0),
+        CHAN5G(184, 0), CHAN5G(188, 0),
+        CHAN5G(192, 0), CHAN5G(196, 0),
+        CHAN5G(200, 0), CHAN5G(204, 0),
+        CHAN5G(208, 0), CHAN5G(212, 0),
+        CHAN5G(216, 0),
+};
+
+static struct ieee80211_channel __wl_5ghz_n_channels[] = {
+        CHAN5G(32, 0), CHAN5G(34, 0),
+        CHAN5G(36, 0), CHAN5G(38, 0),
+        CHAN5G(40, 0), CHAN5G(42, 0),
+        CHAN5G(44, 0), CHAN5G(46, 0),
+        CHAN5G(48, 0), CHAN5G(50, 0),
+        CHAN5G(52, 0), CHAN5G(54, 0),
+        CHAN5G(56, 0), CHAN5G(58, 0),
+        CHAN5G(60, 0), CHAN5G(62, 0),
+        CHAN5G(64, 0), CHAN5G(66, 0),
+        CHAN5G(68, 0), CHAN5G(70, 0),
+        CHAN5G(72, 0), CHAN5G(74, 0),
+        CHAN5G(76, 0), CHAN5G(78, 0),
+        CHAN5G(80, 0), CHAN5G(82, 0),
+        CHAN5G(84, 0), CHAN5G(86, 0),
+        CHAN5G(88, 0), CHAN5G(90, 0),
+        CHAN5G(92, 0), CHAN5G(94, 0),
+        CHAN5G(96, 0), CHAN5G(98, 0),
+        CHAN5G(100, 0), CHAN5G(102, 0),
+        CHAN5G(104, 0), CHAN5G(106, 0),
+        CHAN5G(108, 0), CHAN5G(110, 0),
+        CHAN5G(112, 0), CHAN5G(114, 0),
+        CHAN5G(116, 0), CHAN5G(118, 0),
+        CHAN5G(120, 0), CHAN5G(122, 0),
+        CHAN5G(124, 0), CHAN5G(126, 0),
+        CHAN5G(128, 0), CHAN5G(130, 0),
+        CHAN5G(132, 0), CHAN5G(134, 0),
+        CHAN5G(136, 0), CHAN5G(138, 0),
+        CHAN5G(140, 0), CHAN5G(142, 0),
+        CHAN5G(144, 0), CHAN5G(145, 0),
+        CHAN5G(146, 0), CHAN5G(147, 0),
+        CHAN5G(148, 0), CHAN5G(149, 0),
+        CHAN5G(150, 0), CHAN5G(151, 0),
+        CHAN5G(152, 0), CHAN5G(153, 0),
+        CHAN5G(154, 0), CHAN5G(155, 0),
+        CHAN5G(156, 0), CHAN5G(157, 0),
+        CHAN5G(158, 0), CHAN5G(159, 0),
+        CHAN5G(160, 0), CHAN5G(161, 0),
+        CHAN5G(162, 0), CHAN5G(163, 0),
+        CHAN5G(164, 0), CHAN5G(165, 0),
+        CHAN5G(166, 0), CHAN5G(168, 0),
+        CHAN5G(170, 0), CHAN5G(172, 0),
+        CHAN5G(174, 0), CHAN5G(176, 0),
+        CHAN5G(178, 0), CHAN5G(180, 0),
+        CHAN5G(182, 0), CHAN5G(184, 0),
+        CHAN5G(186, 0), CHAN5G(188, 0),
+        CHAN5G(190, 0), CHAN5G(192, 0),
+        CHAN5G(194, 0), CHAN5G(196, 0),
+        CHAN5G(198, 0), CHAN5G(200, 0),
+        CHAN5G(202, 0), CHAN5G(204, 0),
+        CHAN5G(206, 0), CHAN5G(208, 0),
+        CHAN5G(210, 0), CHAN5G(212, 0),
+        CHAN5G(214, 0), CHAN5G(216, 0),
+        CHAN5G(218, 0), CHAN5G(220, 0),
+        CHAN5G(222, 0), CHAN5G(224, 0),
+        CHAN5G(226, 0), CHAN5G(228, 0),
+};
+
+static struct ieee80211_supported_band __wl_band_2ghz = {
+        .band = IEEE80211_BAND_2GHZ,
+        .channels = __wl_2ghz_channels,
+        .n_channels = ARRAY_SIZE(__wl_2ghz_channels),
+        .bitrates = wl_g_rates,
+        .n_bitrates = wl_g_rates_size,
+};
+
+static struct ieee80211_supported_band __wl_band_5ghz_a = {
+        .band = IEEE80211_BAND_5GHZ,
+        .channels = __wl_5ghz_a_channels,
+        .n_channels = ARRAY_SIZE(__wl_5ghz_a_channels),
+        .bitrates = wl_a_rates,
+        .n_bitrates = wl_a_rates_size,
+};
+
+static struct ieee80211_supported_band __wl_band_5ghz_n = {
+        .band = IEEE80211_BAND_5GHZ,
+        .channels = __wl_5ghz_n_channels,
+        .n_channels = ARRAY_SIZE(__wl_5ghz_n_channels),
+        .bitrates = wl_a_rates,
+        .n_bitrates = wl_a_rates_size,
+};
+
+static const u32 __wl_cipher_suites[] = {
+        WLAN_CIPHER_SUITE_WEP40,
+        WLAN_CIPHER_SUITE_WEP104,
+        WLAN_CIPHER_SUITE_TKIP,
+        WLAN_CIPHER_SUITE_CCMP,
+        WLAN_CIPHER_SUITE_AES_CMAC,
+};
+
+static void swap_key_from_BE(struct brcmf_wsec_key *key)
+{
+        key->index = cpu_to_le32(key->index);
+        key->len = cpu_to_le32(key->len);
+        key->algo = cpu_to_le32(key->algo);
+        key->flags = cpu_to_le32(key->flags);
+        key->rxiv.hi = cpu_to_le32(key->rxiv.hi);
+        key->rxiv.lo = cpu_to_le16(key->rxiv.lo);
+        key->iv_initialized = cpu_to_le32(key->iv_initialized);
+}
+
+static void swap_key_to_BE(struct brcmf_wsec_key *key)
+{
+        key->index = le32_to_cpu(key->index);
+        key->len = le32_to_cpu(key->len);
+        key->algo = le32_to_cpu(key->algo);
+        key->flags = le32_to_cpu(key->flags);
+        key->rxiv.hi = le32_to_cpu(key->rxiv.hi);
+        key->rxiv.lo = le16_to_cpu(key->rxiv.lo);
+        key->iv_initialized = le32_to_cpu(key->iv_initialized);
+}
+
+static s32
+brcmf_dev_ioctl(struct net_device *dev, u32 cmd, void *arg, u32 len)
+{
+        struct ifreq ifr;
+        struct brcmf_ioctl ioc;
+        mm_segment_t fs;
+        s32 err = 0;
+
+        memset(&ioc, 0, sizeof(ioc));
+        ioc.cmd = cmd;
+        ioc.buf = arg;
+        ioc.len = len;
+        strcpy(ifr.ifr_name, dev->name);
+        ifr.ifr_data = (caddr_t)&ioc;
+
+        fs = get_fs();
+        set_fs(get_ds());
+        err = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
+        set_fs(fs);
+
+        return err;
+}
+
+static s32
+brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
+                         enum nl80211_iftype type, u32 *flags,
+                         struct vif_params *params)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct wireless_dev *wdev;
+        s32 infra = 0;
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        switch (type) {
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_WDS:
+                WL_ERR("type (%d) : currently we do not support this type\n",
+                       type);
+                return -EOPNOTSUPP;
+        case NL80211_IFTYPE_ADHOC:
+                cfg_priv->conf->mode = WL_MODE_IBSS;
+                infra = 0;
+                break;
+        case NL80211_IFTYPE_STATION:
+                cfg_priv->conf->mode = WL_MODE_BSS;
+                infra = 1;
+                break;
+        default:
+                err = -EINVAL;
+                goto done;
+        }
+
+        infra = cpu_to_le32(infra);
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_INFRA, &infra, sizeof(infra));
+        if (unlikely(err)) {
+                WL_ERR("WLC_SET_INFRA error (%d)\n", err);
+                err = -EAGAIN;
+        } else {
+                wdev = ndev->ieee80211_ptr;
+                wdev->iftype = type;
+        }
+
+        WL_INFO("IF Type = %s\n",
+                (cfg_priv->conf->mode == WL_MODE_IBSS) ? "Adhoc" : "Infra");
+
+done:
+        WL_TRACE("Exit\n");
+
+        return err;
+}
+
+static void wl_iscan_prep(struct brcmf_scan_params *params,
+                          struct brcmf_ssid *ssid)
+{
+        memcpy(params->bssid, ether_bcast, ETH_ALEN);
+        params->bss_type = DOT11_BSSTYPE_ANY;
+        params->scan_type = 0;
+        params->nprobes = -1;
+        params->active_time = -1;
+        params->passive_time = -1;
+        params->home_time = -1;
+        params->channel_num = 0;
+
+        params->nprobes = cpu_to_le32(params->nprobes);
+        params->active_time = cpu_to_le32(params->active_time);
+        params->passive_time = cpu_to_le32(params->passive_time);
+        params->home_time = cpu_to_le32(params->home_time);
+        if (ssid && ssid->SSID_len)
+                memcpy(&params->ssid, ssid, sizeof(struct brcmf_ssid));
+
+}
+
+static s32
+brcmf_dev_iovar_setbuf(struct net_device *dev, s8 * iovar, void *param,
+                    s32 paramlen, void *bufptr, s32 buflen)
+{
+        s32 iolen;
+
+        iolen = brcmu_mkiovar(iovar, param, paramlen, bufptr, buflen);
+        BUG_ON(!iolen);
+
+        return brcmf_dev_ioctl(dev, BRCMF_C_SET_VAR, bufptr, iolen);
+}
+
+static s32
+brcmf_dev_iovar_getbuf(struct net_device *dev, s8 * iovar, void *param,
+                    s32 paramlen, void *bufptr, s32 buflen)
+{
+        s32 iolen;
+
+        iolen = brcmu_mkiovar(iovar, param, paramlen, bufptr, buflen);
+        BUG_ON(!iolen);
+
+        return brcmf_dev_ioctl(dev, BRCMF_C_GET_VAR, bufptr, buflen);
+}
+
+static s32
+brcmf_run_iscan(struct brcmf_cfg80211_iscan_ctrl *iscan,
+                struct brcmf_ssid *ssid, u16 action)
+{
+        s32 params_size = (BRCMF_SCAN_PARAMS_FIXED_SIZE +
+                                offsetof(struct brcmf_iscan_params, params));
+        struct brcmf_iscan_params *params;
+        s32 err = 0;
+
+        if (ssid && ssid->SSID_len)
+                params_size += sizeof(struct brcmf_ssid);
+        params = kzalloc(params_size, GFP_KERNEL);
+        if (unlikely(!params))
+                return -ENOMEM;
+        BUG_ON(params_size >= BRCMF_C_IOCTL_SMLEN);
+
+        wl_iscan_prep(&params->params, ssid);
+
+        params->version = cpu_to_le32(BRCMF_ISCAN_REQ_VERSION);
+        params->action = cpu_to_le16(action);
+        params->scan_duration = cpu_to_le16(0);
+
+        /* params_size += offsetof(struct brcmf_iscan_params, params); */
+        err = brcmf_dev_iovar_setbuf(iscan->dev, "iscan", params, params_size,
+                                iscan->ioctl_buf, BRCMF_C_IOCTL_SMLEN);
+        if (unlikely(err)) {
+                if (err == -EBUSY) {
+                        WL_INFO("system busy : iscan canceled\n");
+                } else {
+                        WL_ERR("error (%d)\n", err);
+                }
+        }
+        kfree(params);
+        return err;
+}
+
+static s32 brcmf_do_iscan(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_to_iscan(cfg_priv);
+        struct net_device *ndev = cfg_to_ndev(cfg_priv);
+        struct brcmf_ssid ssid;
+        s32 passive_scan;
+        s32 err = 0;
+
+        /* Broadcast scan by default */
+        memset(&ssid, 0, sizeof(ssid));
+
+        iscan->state = WL_ISCAN_STATE_SCANING;
+
+        passive_scan = cfg_priv->active_scan ? 0 : 1;
+        err = brcmf_dev_ioctl(cfg_to_ndev(cfg_priv), BRCMF_C_SET_PASSIVE_SCAN,
+                        &passive_scan, sizeof(passive_scan));
+        if (unlikely(err)) {
+                WL_ERR("error (%d)\n", err);
+                return err;
+        }
+        brcmf_set_mpc(ndev, 0);
+        cfg_priv->iscan_kickstart = true;
+        brcmf_run_iscan(iscan, &ssid, BRCMF_SCAN_ACTION_START);
+        mod_timer(&iscan->timer, jiffies + iscan->timer_ms * HZ / 1000);
+        iscan->timer_on = 1;
+
+        return err;
+}
+
+static s32
+__brcmf_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+                   struct cfg80211_scan_request *request,
+                   struct cfg80211_ssid *this_ssid)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
+        struct cfg80211_ssid *ssids;
+        struct brcmf_cfg80211_scan_req *sr = cfg_priv->scan_req_int;
+        s32 passive_scan;
+        bool iscan_req;
+        bool spec_scan;
+        s32 err = 0;
+
+        if (unlikely(test_bit(WL_STATUS_SCANNING, &cfg_priv->status))) {
+                WL_ERR("Scanning already : status (%lu)\n", cfg_priv->status);
+                return -EAGAIN;
+        }
+        if (unlikely(test_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status))) {
+                WL_ERR("Scanning being aborted : status (%lu)\n",
+                       cfg_priv->status);
+                return -EAGAIN;
+        }
+        if (test_bit(WL_STATUS_CONNECTING, &cfg_priv->status)) {
+                WL_ERR("Connecting : status (%lu)\n",
+                       cfg_priv->status);
+                return -EAGAIN;
+        }
+
+        iscan_req = false;
+        spec_scan = false;
+        if (request) {
+                /* scan bss */
+                ssids = request->ssids;
+                if (cfg_priv->iscan_on && (!ssids || !ssids->ssid_len))
+                        iscan_req = true;
+        } else {
+                /* scan in ibss */
+                /* we don't do iscan in ibss */
+                ssids = this_ssid;
+        }
+
+        cfg_priv->scan_request = request;
+        set_bit(WL_STATUS_SCANNING, &cfg_priv->status);
+        if (iscan_req) {
+                err = brcmf_do_iscan(cfg_priv);
+                if (likely(!err))
+                        return err;
+                else
+                        goto scan_out;
+        } else {
+                WL_SCAN("ssid \"%s\", ssid_len (%d)\n",
+                       ssids->ssid, ssids->ssid_len);
+                memset(&sr->ssid, 0, sizeof(sr->ssid));
+                sr->ssid.SSID_len =
+                            min_t(u8, sizeof(sr->ssid.SSID), ssids->ssid_len);
+                if (sr->ssid.SSID_len) {
+                        memcpy(sr->ssid.SSID, ssids->ssid, sr->ssid.SSID_len);
+                        sr->ssid.SSID_len = cpu_to_le32(sr->ssid.SSID_len);
+                        spec_scan = true;
+                } else {
+                        WL_SCAN("Broadcast scan\n");
+                }
+
+                passive_scan = cfg_priv->active_scan ? 0 : 1;
+                err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_PASSIVE_SCAN,
+                                &passive_scan, sizeof(passive_scan));
+                if (unlikely(err)) {
+                        WL_ERR("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
+                        goto scan_out;
+                }
+                brcmf_set_mpc(ndev, 0);
+                err = brcmf_dev_ioctl(ndev, BRCMF_C_SCAN, &sr->ssid,
+                                sizeof(sr->ssid));
+                if (err) {
+                        if (err == -EBUSY) {
+                                WL_INFO("system busy : scan for \"%s\" canceled\n",
+                                        sr->ssid.SSID);
+                        } else {
+                                WL_ERR("WLC_SCAN error (%d)\n", err);
+                        }
+                        brcmf_set_mpc(ndev, 1);
+                        goto scan_out;
+                }
+        }
+
+        return 0;
+
+scan_out:
+        clear_bit(WL_STATUS_SCANNING, &cfg_priv->status);
+        cfg_priv->scan_request = NULL;
+        return err;
+}
+
+static s32
+brcmf_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+                 struct cfg80211_scan_request *request)
+{
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+
+        CHECK_SYS_UP();
+
+        err = __brcmf_cfg80211_scan(wiphy, ndev, request, NULL);
+        if (unlikely(err))
+                WL_ERR("scan error (%d)\n", err);
+
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32 brcmf_dev_intvar_set(struct net_device *dev, s8 *name, s32 val)
+{
+        s8 buf[BRCMF_C_IOCTL_SMLEN];
+        u32 len;
+        s32 err = 0;
+
+        val = cpu_to_le32(val);
+        len = brcmu_mkiovar(name, (char *)(&val), sizeof(val), buf,
+                            sizeof(buf));
+        BUG_ON(!len);
+
+        err = brcmf_dev_ioctl(dev, BRCMF_C_SET_VAR, buf, len);
+        if (unlikely(err))
+                WL_ERR("error (%d)\n", err);
+
+        return err;
+}
+
+static s32
+brcmf_dev_intvar_get(struct net_device *dev, s8 *name, s32 *retval)
+{
+        union {
+                s8 buf[BRCMF_C_IOCTL_SMLEN];
+                s32 val;
+        } var;
+        u32 len;
+        u32 data_null;
+        s32 err = 0;
+
+        len =
+            brcmu_mkiovar(name, (char *)(&data_null), 0, (char *)(&var),
+                        sizeof(var.buf));
+        BUG_ON(!len);
+        err = brcmf_dev_ioctl(dev, BRCMF_C_GET_VAR, &var, len);
+        if (unlikely(err))
+                WL_ERR("error (%d)\n", err);
+
+        *retval = le32_to_cpu(var.val);
+
+        return err;
+}
+
+static s32 brcmf_set_rts(struct net_device *dev, u32 rts_threshold)
+{
+        s32 err = 0;
+
+        err = brcmf_dev_intvar_set(dev, "rtsthresh", rts_threshold);
+        if (unlikely(err))
+                WL_ERR("Error (%d)\n", err);
+
+        return err;
+}
+
+static s32 brcmf_set_frag(struct net_device *dev, u32 frag_threshold)
+{
+        s32 err = 0;
+
+        err = brcmf_dev_intvar_set(dev, "fragthresh", frag_threshold);
+        if (unlikely(err))
+                WL_ERR("Error (%d)\n", err);
+
+        return err;
+}
+
+static s32 brcmf_set_retry(struct net_device *dev, u32 retry, bool l)
+{
+        s32 err = 0;
+        u32 cmd = (l ? BRCM_SET_LRL : BRCM_SET_SRL);
+
+        retry = cpu_to_le32(retry);
+        err = brcmf_dev_ioctl(dev, cmd, &retry, sizeof(retry));
+        if (unlikely(err)) {
+                WL_ERR("cmd (%d) , error (%d)\n", cmd, err);
+                return err;
+        }
+        return err;
+}
+
+static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct net_device *ndev = cfg_to_ndev(cfg_priv);
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
+            (cfg_priv->conf->rts_threshold != wiphy->rts_threshold)) {
+                cfg_priv->conf->rts_threshold = wiphy->rts_threshold;
+                err = brcmf_set_rts(ndev, cfg_priv->conf->rts_threshold);
+                if (!err)
+                        goto done;
+        }
+        if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
+            (cfg_priv->conf->frag_threshold != wiphy->frag_threshold)) {
+                cfg_priv->conf->frag_threshold = wiphy->frag_threshold;
+                err = brcmf_set_frag(ndev, cfg_priv->conf->frag_threshold);
+                if (!err)
+                        goto done;
+        }
+        if (changed & WIPHY_PARAM_RETRY_LONG
+            && (cfg_priv->conf->retry_long != wiphy->retry_long)) {
+                cfg_priv->conf->retry_long = wiphy->retry_long;
+                err = brcmf_set_retry(ndev, cfg_priv->conf->retry_long, true);
+                if (!err)
+                        goto done;
+        }
+        if (changed & WIPHY_PARAM_RETRY_SHORT
+            && (cfg_priv->conf->retry_short != wiphy->retry_short)) {
+                cfg_priv->conf->retry_short = wiphy->retry_short;
+                err = brcmf_set_retry(ndev, cfg_priv->conf->retry_short, false);
+                if (!err)
+                        goto done;
+        }
+
+done:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+                      struct cfg80211_ibss_params *params)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct brcmf_join_params join_params;
+        size_t join_params_size = 0;
+        s32 err = 0;
+        s32 wsec = 0;
+        s32 bcnprd;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        if (params->ssid)
+                WL_CONN("SSID: %s\n", params->ssid);
+        else {
+                WL_CONN("SSID: NULL, Not supported\n");
+                return -EOPNOTSUPP;
+        }
+
+        set_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
+
+        if (params->bssid)
+                WL_CONN("BSSID: %02X %02X %02X %02X %02X %02X\n",
+                params->bssid[0], params->bssid[1], params->bssid[2],
+                params->bssid[3], params->bssid[4], params->bssid[5]);
+        else
+                WL_CONN("No BSSID specified\n");
+
+        if (params->channel)
+                WL_CONN("channel: %d\n", params->channel->center_freq);
+        else
+                WL_CONN("no channel specified\n");
+
+        if (params->channel_fixed)
+                WL_CONN("fixed channel required\n");
+        else
+                WL_CONN("no fixed channel required\n");
+
+        if (params->ie && params->ie_len)
+                WL_CONN("ie len: %d\n", params->ie_len);
+        else
+                WL_CONN("no ie specified\n");
+
+        if (params->beacon_interval)
+                WL_CONN("beacon interval: %d\n", params->beacon_interval);
+        else
+                WL_CONN("no beacon interval specified\n");
+
+        if (params->basic_rates)
+                WL_CONN("basic rates: %08X\n", params->basic_rates);
+        else
+                WL_CONN("no basic rates specified\n");
+
+        if (params->privacy)
+                WL_CONN("privacy required\n");
+        else
+                WL_CONN("no privacy required\n");
+
+        /* Configure Privacy for starter */
+        if (params->privacy)
+                wsec |= WEP_ENABLED;
+
+        err = brcmf_dev_intvar_set(dev, "wsec", wsec);
+        if (unlikely(err)) {
+                WL_ERR("wsec failed (%d)\n", err);
+                goto done;
+        }
+
+        /* Configure Beacon Interval for starter */
+        if (params->beacon_interval)
+                bcnprd = cpu_to_le32(params->beacon_interval);
+        else
+                bcnprd = cpu_to_le32(100);
+
+        err = brcmf_dev_ioctl(dev, BRCM_SET_BCNPRD, &bcnprd, sizeof(bcnprd));
+        if (unlikely(err)) {
+                WL_ERR("WLC_SET_BCNPRD failed (%d)\n", err);
+                goto done;
+        }
+
+        /* Configure required join parameter */
+        memset(&join_params, 0, sizeof(struct brcmf_join_params));
+
+        /* SSID */
+        join_params.ssid.SSID_len =
+                        (params->ssid_len > 32) ? 32 : params->ssid_len;
+        memcpy(join_params.ssid.SSID, params->ssid, join_params.ssid.SSID_len);
+        join_params.ssid.SSID_len = cpu_to_le32(join_params.ssid.SSID_len);
+        join_params_size = sizeof(join_params.ssid);
+        brcmf_update_prof(cfg_priv, NULL, &join_params.ssid, WL_PROF_SSID);
+
+        /* BSSID */
+        if (params->bssid) {
+                memcpy(join_params.params.bssid, params->bssid, ETH_ALEN);
+                join_params_size = sizeof(join_params.ssid) +
+                                        BRCMF_ASSOC_PARAMS_FIXED_SIZE;
+        } else {
+                memcpy(join_params.params.bssid, ether_bcast, ETH_ALEN);
+        }
+        brcmf_update_prof(cfg_priv, NULL,
+                          &join_params.params.bssid, WL_PROF_BSSID);
+
+        /* Channel */
+        if (params->channel) {
+                u32 target_channel;
+
+                cfg_priv->channel =
+                        ieee80211_frequency_to_channel(
+                                params->channel->center_freq);
+                if (params->channel_fixed) {
+                        /* adding chanspec */
+                        brcmf_ch_to_chanspec(cfg_priv->channel,
+                                &join_params, &join_params_size);
+                }
+
+                /* set channel for starter */
+                target_channel = cpu_to_le32(cfg_priv->channel);
+                err = brcmf_dev_ioctl(dev, BRCM_SET_CHANNEL,
+                        &target_channel, sizeof(target_channel));
+                if (unlikely(err)) {
+                        WL_ERR("WLC_SET_CHANNEL failed (%d)\n", err);
+                        goto done;
+                }
+        } else
+                cfg_priv->channel = 0;
+
+        cfg_priv->ibss_starter = false;
+
+
+        err = brcmf_dev_ioctl(dev, BRCMF_C_SET_SSID,
+                           &join_params, join_params_size);
+        if (unlikely(err)) {
+                WL_ERR("WLC_SET_SSID failed (%d)\n", err);
+                goto done;
+        }
+
+done:
+        if (err)
+                clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        brcmf_link_down(cfg_priv);
+
+        WL_TRACE("Exit\n");
+
+        return err;
+}
+
+static s32
+brcmf_set_wpa_version(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(dev);
+        struct brcmf_cfg80211_security *sec;
+        s32 val = 0;
+        s32 err = 0;
+
+        if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
+                val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
+        else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
+                val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
+        else
+                val = WPA_AUTH_DISABLED;
+        WL_CONN("setting wpa_auth to 0x%0x\n", val);
+        err = brcmf_dev_intvar_set(dev, "wpa_auth", val);
+        if (unlikely(err)) {
+                WL_ERR("set wpa_auth failed (%d)\n", err);
+                return err;
+        }
+        sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
+        sec->wpa_versions = sme->crypto.wpa_versions;
+        return err;
+}
+
+static s32
+brcmf_set_auth_type(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(dev);
+        struct brcmf_cfg80211_security *sec;
+        s32 val = 0;
+        s32 err = 0;
+
+        switch (sme->auth_type) {
+        case NL80211_AUTHTYPE_OPEN_SYSTEM:
+                val = 0;
+                WL_CONN("open system\n");
+                break;
+        case NL80211_AUTHTYPE_SHARED_KEY:
+                val = 1;
+                WL_CONN("shared key\n");
+                break;
+        case NL80211_AUTHTYPE_AUTOMATIC:
+                val = 2;
+                WL_CONN("automatic\n");
+                break;
+        case NL80211_AUTHTYPE_NETWORK_EAP:
+                WL_CONN("network eap\n");
+        default:
+                val = 2;
+                WL_ERR("invalid auth type (%d)\n", sme->auth_type);
+                break;
+        }
+
+        err = brcmf_dev_intvar_set(dev, "auth", val);
+        if (unlikely(err)) {
+                WL_ERR("set auth failed (%d)\n", err);
+                return err;
+        }
+        sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
+        sec->auth_type = sme->auth_type;
+        return err;
+}
+
+static s32
+brcmf_set_set_cipher(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(dev);
+        struct brcmf_cfg80211_security *sec;
+        s32 pval = 0;
+        s32 gval = 0;
+        s32 err = 0;
+
+        if (sme->crypto.n_ciphers_pairwise) {
+                switch (sme->crypto.ciphers_pairwise[0]) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                        pval = WEP_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_TKIP:
+                        pval = TKIP_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_CCMP:
+                        pval = AES_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        pval = AES_ENABLED;
+                        break;
+                default:
+                        WL_ERR("invalid cipher pairwise (%d)\n",
+                               sme->crypto.ciphers_pairwise[0]);
+                        return -EINVAL;
+                }
+        }
+        if (sme->crypto.cipher_group) {
+                switch (sme->crypto.cipher_group) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                        gval = WEP_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_TKIP:
+                        gval = TKIP_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_CCMP:
+                        gval = AES_ENABLED;
+                        break;
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        gval = AES_ENABLED;
+                        break;
+                default:
+                        WL_ERR("invalid cipher group (%d)\n",
+                               sme->crypto.cipher_group);
+                        return -EINVAL;
+                }
+        }
+
+        WL_CONN("pval (%d) gval (%d)\n", pval, gval);
+        err = brcmf_dev_intvar_set(dev, "wsec", pval | gval);
+        if (unlikely(err)) {
+                WL_ERR("error (%d)\n", err);
+                return err;
+        }
+
+        sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
+        sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
+        sec->cipher_group = sme->crypto.cipher_group;
+
+        return err;
+}
+
+static s32
+brcmf_set_key_mgmt(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(dev);
+        struct brcmf_cfg80211_security *sec;
+        s32 val = 0;
+        s32 err = 0;
+
+        if (sme->crypto.n_akm_suites) {
+                err = brcmf_dev_intvar_get(dev, "wpa_auth", &val);
+                if (unlikely(err)) {
+                        WL_ERR("could not get wpa_auth (%d)\n", err);
+                        return err;
+                }
+                if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
+                        switch (sme->crypto.akm_suites[0]) {
+                        case WLAN_AKM_SUITE_8021X:
+                                val = WPA_AUTH_UNSPECIFIED;
+                                break;
+                        case WLAN_AKM_SUITE_PSK:
+                                val = WPA_AUTH_PSK;
+                                break;
+                        default:
+                                WL_ERR("invalid cipher group (%d)\n",
+                                       sme->crypto.cipher_group);
+                                return -EINVAL;
+                        }
+                } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
+                        switch (sme->crypto.akm_suites[0]) {
+                        case WLAN_AKM_SUITE_8021X:
+                                val = WPA2_AUTH_UNSPECIFIED;
+                                break;
+                        case WLAN_AKM_SUITE_PSK:
+                                val = WPA2_AUTH_PSK;
+                                break;
+                        default:
+                                WL_ERR("invalid cipher group (%d)\n",
+                                       sme->crypto.cipher_group);
+                                return -EINVAL;
+                        }
+                }
+
+                WL_CONN("setting wpa_auth to %d\n", val);
+                err = brcmf_dev_intvar_set(dev, "wpa_auth", val);
+                if (unlikely(err)) {
+                        WL_ERR("could not set wpa_auth (%d)\n", err);
+                        return err;
+                }
+        }
+        sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
+        sec->wpa_auth = sme->crypto.akm_suites[0];
+
+        return err;
+}
+
+static s32
+brcmf_set_set_sharedkey(struct net_device *dev,
+                     struct cfg80211_connect_params *sme)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(dev);
+        struct brcmf_cfg80211_security *sec;
+        struct brcmf_wsec_key key;
+        s32 val;
+        s32 err = 0;
+
+        WL_CONN("key len (%d)\n", sme->key_len);
+        if (sme->key_len) {
+                sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
+                WL_CONN("wpa_versions 0x%x cipher_pairwise 0x%x\n",
+                       sec->wpa_versions, sec->cipher_pairwise);
+                if (!
+                    (sec->wpa_versions & (NL80211_WPA_VERSION_1 |
+                                          NL80211_WPA_VERSION_2))
+&& (sec->cipher_pairwise & (WLAN_CIPHER_SUITE_WEP40 |
+                            WLAN_CIPHER_SUITE_WEP104))) {
+                        memset(&key, 0, sizeof(key));
+                        key.len = (u32) sme->key_len;
+                        key.index = (u32) sme->key_idx;
+                        if (unlikely(key.len > sizeof(key.data))) {
+                                WL_ERR("Too long key length (%u)\n", key.len);
+                                return -EINVAL;
+                        }
+                        memcpy(key.data, sme->key, key.len);
+                        key.flags = BRCMF_PRIMARY_KEY;
+                        switch (sec->cipher_pairwise) {
+                        case WLAN_CIPHER_SUITE_WEP40:
+                                key.algo = CRYPTO_ALGO_WEP1;
+                                break;
+                        case WLAN_CIPHER_SUITE_WEP104:
+                                key.algo = CRYPTO_ALGO_WEP128;
+                                break;
+                        default:
+                                WL_ERR("Invalid algorithm (%d)\n",
+                                       sme->crypto.ciphers_pairwise[0]);
+                                return -EINVAL;
+                        }
+                        /* Set the new key/index */
+                        WL_CONN("key length (%d) key index (%d) algo (%d)\n",
+                               key.len, key.index, key.algo);
+                        WL_CONN("key \"%s\"\n", key.data);
+                        swap_key_from_BE(&key);
+                        err = brcmf_dev_ioctl(dev, BRCMF_C_SET_KEY, &key,
+                                        sizeof(key));
+                        if (unlikely(err)) {
+                                WL_ERR("WLC_SET_KEY error (%d)\n", err);
+                                return err;
+                        }
+                        if (sec->auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM) {
+                                WL_CONN("set auth_type to shared key\n");
+                                val = 1;        /* shared key */
+                                err = brcmf_dev_intvar_set(dev, "auth", val);
+                                if (unlikely(err)) {
+                                        WL_ERR("set auth failed (%d)\n", err);
+                                        return err;
+                                }
+                        }
+                }
+        }
+        return err;
+}
+
+static s32
+brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+                    struct cfg80211_connect_params *sme)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct ieee80211_channel *chan = sme->channel;
+        struct brcmf_join_params join_params;
+        size_t join_params_size;
+
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        if (unlikely(!sme->ssid)) {
+                WL_ERR("Invalid ssid\n");
+                return -EOPNOTSUPP;
+        }
+
+        set_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
+
+        if (chan) {
+                cfg_priv->channel =
+                        ieee80211_frequency_to_channel(chan->center_freq);
+                WL_CONN("channel (%d), center_req (%d)\n",
+                                cfg_priv->channel, chan->center_freq);
+        } else
+                cfg_priv->channel = 0;
+
+        WL_INFO("ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
+
+        err = brcmf_set_wpa_version(dev, sme);
+        if (err) {
+                WL_ERR("wl_set_wpa_version failed (%d)\n", err);
+                goto done;
+        }
+
+        err = brcmf_set_auth_type(dev, sme);
+        if (err) {
+                WL_ERR("wl_set_auth_type failed (%d)\n", err);
+                goto done;
+        }
+
+        err = brcmf_set_set_cipher(dev, sme);
+        if (err) {
+                WL_ERR("wl_set_set_cipher failed (%d)\n", err);
+                goto done;
+        }
+
+        err = brcmf_set_key_mgmt(dev, sme);
+        if (err) {
+                WL_ERR("wl_set_key_mgmt failed (%d)\n", err);
+                goto done;
+        }
+
+        err = brcmf_set_set_sharedkey(dev, sme);
+        if (err) {
+                WL_ERR("wl_set_set_sharedkey failed (%d)\n", err);
+                goto done;
+        }
+
+        brcmf_update_prof(cfg_priv, NULL, sme->bssid, WL_PROF_BSSID);
+        /*
+         **  Join with specific BSSID and cached SSID
+         **  If SSID is zero join based on BSSID only
+         */
+        memset(&join_params, 0, sizeof(join_params));
+        join_params_size = sizeof(join_params.ssid);
+
+        join_params.ssid.SSID_len = min(sizeof(join_params.ssid.SSID), sme->ssid_len);
+        memcpy(&join_params.ssid.SSID, sme->ssid, join_params.ssid.SSID_len);
+        join_params.ssid.SSID_len = cpu_to_le32(join_params.ssid.SSID_len);
+        brcmf_update_prof(cfg_priv, NULL, &join_params.ssid, WL_PROF_SSID);
+
+        if (sme->bssid)
+                memcpy(join_params.params.bssid, sme->bssid, ETH_ALEN);
+        else
+                memcpy(join_params.params.bssid, ether_bcast, ETH_ALEN);
+
+        if (join_params.ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+                WL_CONN("ssid \"%s\", len (%d)\n",
+                       join_params.ssid.SSID, join_params.ssid.SSID_len);
+        }
+
+        brcmf_ch_to_chanspec(cfg_priv->channel,
+                             &join_params, &join_params_size);
+        err = brcmf_dev_ioctl(dev, BRCMF_C_SET_SSID,
+                           &join_params, join_params_size);
+        if (err)
+                WL_ERR("WLC_SET_SSID failed (%d)\n", err);
+
+done:
+        if (err)
+                clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+                       u16 reason_code)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct brcmf_scb_val scbval;
+        s32 err = 0;
+
+        WL_TRACE("Enter. Reason code = %d\n", reason_code);
+        CHECK_SYS_UP();
+
+        clear_bit(WL_STATUS_CONNECTED, &cfg_priv->status);
+
+        scbval.val = reason_code;
+        memcpy(&scbval.ea, brcmf_read_prof(cfg_priv, WL_PROF_BSSID), ETH_ALEN);
+        scbval.val = cpu_to_le32(scbval.val);
+        err = brcmf_dev_ioctl(dev, BRCMF_C_DISASSOC, &scbval,
+                        sizeof(struct brcmf_scb_val));
+        if (unlikely(err))
+                WL_ERR("error (%d)\n", err);
+
+        cfg_priv->link_up = false;
+
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_cfg80211_set_tx_power(struct wiphy *wiphy,
+                         enum nl80211_tx_power_setting type, s32 dbm)
+{
+
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct net_device *ndev = cfg_to_ndev(cfg_priv);
+        u16 txpwrmw;
+        s32 err = 0;
+        s32 disable = 0;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        switch (type) {
+        case NL80211_TX_POWER_AUTOMATIC:
+                break;
+        case NL80211_TX_POWER_LIMITED:
+                if (dbm < 0) {
+                        WL_ERR("TX_POWER_LIMITED - dbm is negative\n");
+                        err = -EINVAL;
+                        goto done;
+                }
+                break;
+        case NL80211_TX_POWER_FIXED:
+                if (dbm < 0) {
+                        WL_ERR("TX_POWER_FIXED - dbm is negative\n");
+                        err = -EINVAL;
+                        goto done;
+                }
+                break;
+        }
+        /* Make sure radio is off or on as far as software is concerned */
+        disable = WL_RADIO_SW_DISABLE << 16;
+        disable = cpu_to_le32(disable);
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_RADIO, &disable, sizeof(disable));
+        if (unlikely(err))
+                WL_ERR("WLC_SET_RADIO error (%d)\n", err);
+
+        if (dbm > 0xffff)
+                txpwrmw = 0xffff;
+        else
+                txpwrmw = (u16) dbm;
+        err = brcmf_dev_intvar_set(ndev, "qtxpower",
+                        (s32) (brcmu_mw_to_qdbm(txpwrmw)));
+        if (unlikely(err))
+                WL_ERR("qtxpower error (%d)\n", err);
+        cfg_priv->conf->tx_power = dbm;
+
+done:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct net_device *ndev = cfg_to_ndev(cfg_priv);
+        s32 txpwrdbm;
+        u8 result;
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        err = brcmf_dev_intvar_get(ndev, "qtxpower", &txpwrdbm);
+        if (unlikely(err)) {
+                WL_ERR("error (%d)\n", err);
+                goto done;
+        }
+
+        result = (u8) (txpwrdbm & ~WL_TXPWR_OVERRIDE);
+        *dbm = (s32) brcmu_qdbm_to_mw(result);
+
+done:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *dev,
+                               u8 key_idx, bool unicast, bool multicast)
+{
+        u32 index;
+        s32 wsec;
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        WL_CONN("key index (%d)\n", key_idx);
+        CHECK_SYS_UP();
+
+        err = brcmf_dev_ioctl(dev, BRCMF_C_GET_WSEC, &wsec, sizeof(wsec));
+        if (unlikely(err)) {
+                WL_ERR("WLC_GET_WSEC error (%d)\n", err);
+                goto done;
+        }
+
+        wsec = le32_to_cpu(wsec);
+        if (wsec & WEP_ENABLED) {
+                /* Just select a new current key */
+                index = (u32) key_idx;
+                index = cpu_to_le32(index);
+                err = brcmf_dev_ioctl(dev, BRCMF_C_SET_KEY_PRIMARY, &index,
+                                sizeof(index));
+                if (unlikely(err))
+                        WL_ERR("error (%d)\n", err);
+        }
+done:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+              u8 key_idx, const u8 *mac_addr, struct key_params *params)
+{
+        struct brcmf_wsec_key key;
+        s32 err = 0;
+
+        memset(&key, 0, sizeof(key));
+        key.index = (u32) key_idx;
+        /* Instead of bcast for ea address for default wep keys,
+                 driver needs it to be Null */
+        if (!is_multicast_ether_addr(mac_addr))
+                memcpy((char *)&key.ea, (void *)mac_addr, ETH_ALEN);
+        key.len = (u32) params->key_len;
+        /* check for key index change */
+        if (key.len == 0) {
+                /* key delete */
+                swap_key_from_BE(&key);
+                err = brcmf_dev_ioctl(dev, BRCMF_C_SET_KEY, &key, sizeof(key));
+                if (unlikely(err)) {
+                        WL_ERR("key delete error (%d)\n", err);
+                        return err;
+                }
+        } else {
+                if (key.len > sizeof(key.data)) {
+                        WL_ERR("Invalid key length (%d)\n", key.len);
+                        return -EINVAL;
+                }
+
+                WL_CONN("Setting the key index %d\n", key.index);
+                memcpy(key.data, params->key, key.len);
+
+                if (params->cipher == WLAN_CIPHER_SUITE_TKIP) {
+                        u8 keybuf[8];
+                        memcpy(keybuf, &key.data[24], sizeof(keybuf));
+                        memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
+                        memcpy(&key.data[16], keybuf, sizeof(keybuf));
+                }
+
+                /* if IW_ENCODE_EXT_RX_SEQ_VALID set */
+                if (params->seq && params->seq_len == 6) {
+                        /* rx iv */
+                        u8 *ivptr;
+                        ivptr = (u8 *) params->seq;
+                        key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
+                            (ivptr[3] << 8) | ivptr[2];
+                        key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
+                        key.iv_initialized = true;
+                }
+
+                switch (params->cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                        key.algo = CRYPTO_ALGO_WEP1;
+                        WL_CONN("WLAN_CIPHER_SUITE_WEP40\n");
+                        break;
+                case WLAN_CIPHER_SUITE_WEP104:
+                        key.algo = CRYPTO_ALGO_WEP128;
+                        WL_CONN("WLAN_CIPHER_SUITE_WEP104\n");
+                        break;
+                case WLAN_CIPHER_SUITE_TKIP:
+                        key.algo = CRYPTO_ALGO_TKIP;
+                        WL_CONN("WLAN_CIPHER_SUITE_TKIP\n");
+                        break;
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        key.algo = CRYPTO_ALGO_AES_CCM;
+                        WL_CONN("WLAN_CIPHER_SUITE_AES_CMAC\n");
+                        break;
+                case WLAN_CIPHER_SUITE_CCMP:
+                        key.algo = CRYPTO_ALGO_AES_CCM;
+                        WL_CONN("WLAN_CIPHER_SUITE_CCMP\n");
+                        break;
+                default:
+                        WL_ERR("Invalid cipher (0x%x)\n", params->cipher);
+                        return -EINVAL;
+                }
+                swap_key_from_BE(&key);
+
+                brcmf_netdev_wait_pend8021x(dev);
+                err = brcmf_dev_ioctl(dev, BRCMF_C_SET_KEY, &key, sizeof(key));
+                if (unlikely(err)) {
+                        WL_ERR("WLC_SET_KEY error (%d)\n", err);
+                        return err;
+                }
+        }
+        return err;
+}
+
+static s32
+brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+                    u8 key_idx, bool pairwise, const u8 *mac_addr,
+                    struct key_params *params)
+{
+        struct brcmf_wsec_key key;
+        s32 val;
+        s32 wsec;
+        s32 err = 0;
+        u8 keybuf[8];
+
+        WL_TRACE("Enter\n");
+        WL_CONN("key index (%d)\n", key_idx);
+        CHECK_SYS_UP();
+
+        if (mac_addr) {
+                WL_TRACE("Exit");
+                return brcmf_add_keyext(wiphy, dev, key_idx, mac_addr, params);
+        }
+        memset(&key, 0, sizeof(key));
+
+        key.len = (u32) params->key_len;
+        key.index = (u32) key_idx;
+
+        if (unlikely(key.len > sizeof(key.data))) {
+                WL_ERR("Too long key length (%u)\n", key.len);
+                err = -EINVAL;
+                goto done;
+        }
+        memcpy(key.data, params->key, key.len);
+
+        key.flags = BRCMF_PRIMARY_KEY;
+        switch (params->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                key.algo = CRYPTO_ALGO_WEP1;
+                WL_CONN("WLAN_CIPHER_SUITE_WEP40\n");
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                key.algo = CRYPTO_ALGO_WEP128;
+                WL_CONN("WLAN_CIPHER_SUITE_WEP104\n");
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                memcpy(keybuf, &key.data[24], sizeof(keybuf));
+                memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
+                memcpy(&key.data[16], keybuf, sizeof(keybuf));
+                key.algo = CRYPTO_ALGO_TKIP;
+                WL_CONN("WLAN_CIPHER_SUITE_TKIP\n");
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                key.algo = CRYPTO_ALGO_AES_CCM;
+                WL_CONN("WLAN_CIPHER_SUITE_AES_CMAC\n");
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                key.algo = CRYPTO_ALGO_AES_CCM;
+                WL_CONN("WLAN_CIPHER_SUITE_CCMP\n");
+                break;
+        default:
+                WL_ERR("Invalid cipher (0x%x)\n", params->cipher);
+                err = -EINVAL;
+                goto done;
+        }
+
+        /* Set the new key/index */
+        swap_key_from_BE(&key);
+        err = brcmf_dev_ioctl(dev, BRCMF_C_SET_KEY, &key, sizeof(key));
+        if (unlikely(err)) {
+                WL_ERR("WLC_SET_KEY error (%d)\n", err);
+                goto done;
+        }
+
+        val = WEP_ENABLED;
+        err = brcmf_dev_intvar_get(dev, "wsec", &wsec);
+        if (unlikely(err)) {
+                WL_ERR("get wsec error (%d)\n", err);
+                goto done;
+        }
+        wsec &= ~(WEP_ENABLED);
+        wsec |= val;
+        err = brcmf_dev_intvar_set(dev, "wsec", wsec);
+        if (unlikely(err)) {
+                WL_ERR("set wsec error (%d)\n", err);
+                goto done;
+        }
+
+        val = 1;                /* assume shared key. otherwise 0 */
+        val = cpu_to_le32(val);
+        err = brcmf_dev_ioctl(dev, BRCMF_C_SET_AUTH, &val, sizeof(val));
+        if (unlikely(err))
+                WL_ERR("WLC_SET_AUTH error (%d)\n", err);
+done:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+                    u8 key_idx, bool pairwise, const u8 *mac_addr)
+{
+        struct brcmf_wsec_key key;
+        s32 err = 0;
+        s32 val;
+        s32 wsec;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+        memset(&key, 0, sizeof(key));
+
+        key.index = (u32) key_idx;
+        key.flags = BRCMF_PRIMARY_KEY;
+        key.algo = CRYPTO_ALGO_OFF;
+
+        WL_CONN("key index (%d)\n", key_idx);
+        /* Set the new key/index */
+        swap_key_from_BE(&key);
+        err = brcmf_dev_ioctl(dev, BRCMF_C_SET_KEY, &key, sizeof(key));
+        if (unlikely(err)) {
+                if (err == -EINVAL) {
+                        if (key.index >= DOT11_MAX_DEFAULT_KEYS)
+                                /* we ignore this key index in this case */
+                                WL_ERR("invalid key index (%d)\n", key_idx);
+                } else
+                        WL_ERR("WLC_SET_KEY error (%d)\n", err);
+
+                /* Ignore this error, may happen during DISASSOC */
+                err = -EAGAIN;
+                goto done;
+        }
+
+        val = 0;
+        err = brcmf_dev_intvar_get(dev, "wsec", &wsec);
+        if (unlikely(err)) {
+                WL_ERR("get wsec error (%d)\n", err);
+                /* Ignore this error, may happen during DISASSOC */
+                err = -EAGAIN;
+                goto done;
+        }
+        wsec &= ~(WEP_ENABLED);
+        wsec |= val;
+        err = brcmf_dev_intvar_set(dev, "wsec", wsec);
+        if (unlikely(err)) {
+                WL_ERR("set wsec error (%d)\n", err);
+                /* Ignore this error, may happen during DISASSOC */
+                err = -EAGAIN;
+                goto done;
+        }
+
+        val = 0;                /* assume open key. otherwise 1 */
+        val = cpu_to_le32(val);
+        err = brcmf_dev_ioctl(dev, BRCMF_C_SET_AUTH, &val, sizeof(val));
+        if (unlikely(err)) {
+                WL_ERR("WLC_SET_AUTH error (%d)\n", err);
+                /* Ignore this error, may happen during DISASSOC */
+                err = -EAGAIN;
+        }
+done:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+                    u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
+                    void (*callback) (void *cookie, struct key_params * params))
+{
+        struct key_params params;
+        struct brcmf_wsec_key key;
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct brcmf_cfg80211_security *sec;
+        s32 wsec;
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        WL_CONN("key index (%d)\n", key_idx);
+        CHECK_SYS_UP();
+
+        memset(&key, 0, sizeof(key));
+        key.index = key_idx;
+        swap_key_to_BE(&key);
+        memset(&params, 0, sizeof(params));
+        params.key_len = (u8) min_t(u8, WLAN_MAX_KEY_LEN, key.len);
+        memcpy(params.key, key.data, params.key_len);
+
+        err = brcmf_dev_ioctl(dev, BRCMF_C_GET_WSEC, &wsec, sizeof(wsec));
+        if (unlikely(err)) {
+                WL_ERR("WLC_GET_WSEC error (%d)\n", err);
+                /* Ignore this error, may happen during DISASSOC */
+                err = -EAGAIN;
+                goto done;
+        }
+        wsec = le32_to_cpu(wsec);
+        switch (wsec) {
+        case WEP_ENABLED:
+                sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
+                if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
+                        params.cipher = WLAN_CIPHER_SUITE_WEP40;
+                        WL_CONN("WLAN_CIPHER_SUITE_WEP40\n");
+                } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
+                        params.cipher = WLAN_CIPHER_SUITE_WEP104;
+                        WL_CONN("WLAN_CIPHER_SUITE_WEP104\n");
+                }
+                break;
+        case TKIP_ENABLED:
+                params.cipher = WLAN_CIPHER_SUITE_TKIP;
+                WL_CONN("WLAN_CIPHER_SUITE_TKIP\n");
+                break;
+        case AES_ENABLED:
+                params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+                WL_CONN("WLAN_CIPHER_SUITE_AES_CMAC\n");
+                break;
+        default:
+                WL_ERR("Invalid algo (0x%x)\n", wsec);
+                err = -EINVAL;
+                goto done;
+        }
+        callback(cookie, &params);
+
+done:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+                                    struct net_device *dev, u8 key_idx)
+{
+        WL_INFO("Not supported\n");
+
+        CHECK_SYS_UP();
+        return -EOPNOTSUPP;
+}
+
+static s32
+brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
+                        u8 *mac, struct station_info *sinfo)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct brcmf_scb_val scb_val;
+        int rssi;
+        s32 rate;
+        s32 err = 0;
+        u8 *bssid = brcmf_read_prof(cfg_priv, WL_PROF_BSSID);
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        if (unlikely
+            (memcmp(mac, bssid, ETH_ALEN))) {
+                WL_ERR("Wrong Mac address cfg_mac-%X:%X:%X:%X:%X:%X"
+                        "wl_bssid-%X:%X:%X:%X:%X:%X\n",
+                        mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
+                        bssid[0], bssid[1], bssid[2], bssid[3],
+                        bssid[4], bssid[5]);
+                err = -ENOENT;
+                goto done;
+        }
+
+        /* Report the current tx rate */
+        err = brcmf_dev_ioctl(dev, BRCMF_C_GET_RATE, &rate, sizeof(rate));
+        if (err) {
+                WL_ERR("Could not get rate (%d)\n", err);
+        } else {
+                rate = le32_to_cpu(rate);
+                sinfo->filled |= STATION_INFO_TX_BITRATE;
+                sinfo->txrate.legacy = rate * 5;
+                WL_CONN("Rate %d Mbps\n", rate / 2);
+        }
+
+        if (test_bit(WL_STATUS_CONNECTED, &cfg_priv->status)) {
+                scb_val.val = 0;
+                err = brcmf_dev_ioctl(dev, BRCMF_C_GET_RSSI, &scb_val,
+                                sizeof(struct brcmf_scb_val));
+                if (unlikely(err)) {
+                        WL_ERR("Could not get rssi (%d)\n", err);
+                }
+                rssi = le32_to_cpu(scb_val.val);
+                sinfo->filled |= STATION_INFO_SIGNAL;
+                sinfo->signal = rssi;
+                WL_CONN("RSSI %d dBm\n", rssi);
+        }
+
+done:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
+                           bool enabled, s32 timeout)
+{
+        s32 pm;
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        pm = enabled ? PM_FAST : PM_OFF;
+        pm = cpu_to_le32(pm);
+        WL_INFO("power save %s\n", (pm ? "enabled" : "disabled"));
+
+        err = brcmf_dev_ioctl(dev, BRCMF_C_SET_PM, &pm, sizeof(pm));
+        if (unlikely(err)) {
+                if (err == -ENODEV)
+                        WL_ERR("net_device is not ready yet\n");
+                else
+                        WL_ERR("error (%d)\n", err);
+        }
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static __used u32 brcmf_find_msb(u16 bit16)
+{
+        u32 ret = 0;
+
+        if (bit16 & 0xff00) {
+                ret += 8;
+                bit16 >>= 8;
+        }
+
+        if (bit16 & 0xf0) {
+                ret += 4;
+                bit16 >>= 4;
+        }
+
+        if (bit16 & 0xc) {
+                ret += 2;
+                bit16 >>= 2;
+        }
+
+        if (bit16 & 2)
+                ret += bit16 & 2;
+        else if (bit16)
+                ret += bit16;
+
+        return ret;
+}
+
+static s32
+brcmf_cfg80211_set_bitrate_mask(struct wiphy *wiphy, struct net_device *dev,
+                             const u8 *addr,
+                             const struct cfg80211_bitrate_mask *mask)
+{
+        struct wl_rateset rateset;
+        s32 rate;
+        s32 val;
+        s32 err_bg;
+        s32 err_a;
+        u32 legacy;
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        /* addr param is always NULL. ignore it */
+        /* Get current rateset */
+        err = brcmf_dev_ioctl(dev, BRCM_GET_CURR_RATESET, &rateset,
+                        sizeof(rateset));
+        if (unlikely(err)) {
+                WL_ERR("could not get current rateset (%d)\n", err);
+                goto done;
+        }
+
+        rateset.count = le32_to_cpu(rateset.count);
+
+        legacy = brcmf_find_msb(mask->control[IEEE80211_BAND_2GHZ].legacy);
+        if (!legacy)
+                legacy = brcmf_find_msb(mask->control[IEEE80211_BAND_5GHZ].legacy);
+
+        val = wl_g_rates[legacy - 1].bitrate * 100000;
+
+        if (val < rateset.count)
+                /* Select rate by rateset index */
+                rate = rateset.rates[val] & 0x7f;
+        else
+                /* Specified rate in bps */
+                rate = val / 500000;
+
+        WL_CONN("rate %d mbps\n", rate / 2);
+
+        /*
+         *
+         *      Set rate override,
+         *      Since the is a/b/g-blind, both a/bg_rate are enforced.
+         */
+        err_bg = brcmf_dev_intvar_set(dev, "bg_rate", rate);
+        err_a = brcmf_dev_intvar_set(dev, "a_rate", rate);
+        if (unlikely(err_bg && err_a)) {
+                WL_ERR("could not set fixed rate (%d) (%d)\n", err_bg, err_a);
+                err = err_bg | err_a;
+        }
+
+done:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+
+        /*
+         * Check for WL_STATUS_READY before any function call which
+         * could result is bus access. Don't block the resume for
+         * any driver error conditions
+         */
+        WL_TRACE("Enter\n");
+
+#if defined(CONFIG_PM_SLEEP)
+        atomic_set(&brcmf_mmc_suspend, false);
+#endif  /*  defined(CONFIG_PM_SLEEP) */
+
+        if (test_bit(WL_STATUS_READY, &cfg_priv->status))
+                brcmf_invoke_iscan(wiphy_to_cfg(wiphy));
+
+        WL_TRACE("Exit\n");
+        return 0;
+}
+
+static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
+                                  struct cfg80211_wowlan *wow)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct net_device *ndev = cfg_to_ndev(cfg_priv);
+
+        WL_TRACE("Enter\n");
+
+        /*
+         * Check for WL_STATUS_READY before any function call which
+         * could result is bus access. Don't block the suspend for
+         * any driver error conditions
+         */
+
+        /*
+         * While going to suspend if associated with AP disassociate
+         * from AP to save power while system is in suspended state
+         */
+        if ((test_bit(WL_STATUS_CONNECTED, &cfg_priv->status) ||
+             test_bit(WL_STATUS_CONNECTING, &cfg_priv->status)) &&
+             test_bit(WL_STATUS_READY, &cfg_priv->status)) {
+                WL_INFO("Disassociating from AP"
+                        " while entering suspend state\n");
+                brcmf_link_down(cfg_priv);
+
+                /*
+                 * Make sure WPA_Supplicant receives all the event
+                 * generated due to DISASSOC call to the fw to keep
+                 * the state fw and WPA_Supplicant state consistent
+                 */
+                rtnl_unlock();
+                brcmf_delay(500);
+                rtnl_lock();
+        }
+
+        set_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status);
+        if (test_bit(WL_STATUS_READY, &cfg_priv->status))
+                brcmf_term_iscan(cfg_priv);
+
+        if (cfg_priv->scan_request) {
+                /* Indidate scan abort to cfg80211 layer */
+                WL_INFO("Terminating scan in progress\n");
+                cfg80211_scan_done(cfg_priv->scan_request, true);
+                cfg_priv->scan_request = NULL;
+        }
+        clear_bit(WL_STATUS_SCANNING, &cfg_priv->status);
+        clear_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status);
+
+        /* Turn off watchdog timer */
+        if (test_bit(WL_STATUS_READY, &cfg_priv->status)) {
+                WL_INFO("Enable MPC\n");
+                brcmf_set_mpc(ndev, 1);
+        }
+
+#if defined(CONFIG_PM_SLEEP)
+        atomic_set(&brcmf_mmc_suspend, true);
+#endif  /*  defined(CONFIG_PM_SLEEP) */
+
+        WL_TRACE("Exit\n");
+
+        return 0;
+}
+
+static __used s32
+brcmf_update_pmklist(struct net_device *dev,
+                     struct brcmf_cfg80211_pmk_list *pmk_list, s32 err)
+{
+        int i, j;
+
+        WL_CONN("No of elements %d\n", pmk_list->pmkids.npmkid);
+        for (i = 0; i < pmk_list->pmkids.npmkid; i++) {
+                WL_CONN("PMKID[%d]: %pM =\n", i,
+                        &pmk_list->pmkids.pmkid[i].BSSID);
+                for (j = 0; j < WLAN_PMKID_LEN; j++)
+                        WL_CONN("%02x\n", pmk_list->pmkids.pmkid[i].PMKID[j]);
+        }
+
+        if (likely(!err))
+                brcmf_dev_bufvar_set(dev, "pmkid_info", (char *)pmk_list,
+                                        sizeof(*pmk_list));
+
+        return err;
+}
+
+static s32
+brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+                         struct cfg80211_pmksa *pmksa)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct _pmkid_list *pmkids = &cfg_priv->pmk_list->pmkids;
+        s32 err = 0;
+        int i;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        for (i = 0; i < pmkids->npmkid; i++)
+                if (!memcmp(pmksa->bssid, pmkids->pmkid[i].BSSID, ETH_ALEN))
+                        break;
+        if (i < WL_NUM_PMKIDS_MAX) {
+                memcpy(pmkids->pmkid[i].BSSID, pmksa->bssid, ETH_ALEN);
+                memcpy(pmkids->pmkid[i].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
+                if (i == pmkids->npmkid)
+                        pmkids->npmkid++;
+        } else
+                err = -EINVAL;
+
+        WL_CONN("set_pmksa,IW_PMKSA_ADD - PMKID: %pM =\n",
+                pmkids->pmkid[pmkids->npmkid].BSSID);
+        for (i = 0; i < WLAN_PMKID_LEN; i++)
+                WL_CONN("%02x\n", pmkids->pmkid[pmkids->npmkid].PMKID[i]);
+
+        err = brcmf_update_pmklist(dev, cfg_priv->pmk_list, err);
+
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+                      struct cfg80211_pmksa *pmksa)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        struct _pmkid_list pmkid;
+        s32 err = 0;
+        int i;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+        memcpy(&pmkid.pmkid[0].BSSID, pmksa->bssid, ETH_ALEN);
+        memcpy(&pmkid.pmkid[0].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
+
+        WL_CONN("del_pmksa,IW_PMKSA_REMOVE - PMKID: %pM =\n",
+               &pmkid.pmkid[0].BSSID);
+        for (i = 0; i < WLAN_PMKID_LEN; i++)
+                WL_CONN("%02x\n", pmkid.pmkid[0].PMKID[i]);
+
+        for (i = 0; i < cfg_priv->pmk_list->pmkids.npmkid; i++)
+                if (!memcmp
+                    (pmksa->bssid, &cfg_priv->pmk_list->pmkids.pmkid[i].BSSID,
+                     ETH_ALEN))
+                        break;
+
+        if ((cfg_priv->pmk_list->pmkids.npmkid > 0)
+            && (i < cfg_priv->pmk_list->pmkids.npmkid)) {
+                memset(&cfg_priv->pmk_list->pmkids.pmkid[i], 0,
+                       sizeof(pmkid_t));
+                for (; i < (cfg_priv->pmk_list->pmkids.npmkid - 1); i++) {
+                        memcpy(&cfg_priv->pmk_list->pmkids.pmkid[i].BSSID,
+                               &cfg_priv->pmk_list->pmkids.pmkid[i + 1].BSSID,
+                               ETH_ALEN);
+                        memcpy(&cfg_priv->pmk_list->pmkids.pmkid[i].PMKID,
+                               &cfg_priv->pmk_list->pmkids.pmkid[i + 1].PMKID,
+                               WLAN_PMKID_LEN);
+                }
+                cfg_priv->pmk_list->pmkids.npmkid--;
+        } else
+                err = -EINVAL;
+
+        err = brcmf_update_pmklist(dev, cfg_priv->pmk_list, err);
+
+        WL_TRACE("Exit\n");
+        return err;
+
+}
+
+static s32
+brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *dev)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        CHECK_SYS_UP();
+
+        memset(cfg_priv->pmk_list, 0, sizeof(*cfg_priv->pmk_list));
+        err = brcmf_update_pmklist(dev, cfg_priv->pmk_list, err);
+
+        WL_TRACE("Exit\n");
+        return err;
+
+}
+
+static struct cfg80211_ops wl_cfg80211_ops = {
+        .change_virtual_intf = brcmf_cfg80211_change_iface,
+        .scan = brcmf_cfg80211_scan,
+        .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
+        .join_ibss = brcmf_cfg80211_join_ibss,
+        .leave_ibss = brcmf_cfg80211_leave_ibss,
+        .get_station = brcmf_cfg80211_get_station,
+        .set_tx_power = brcmf_cfg80211_set_tx_power,
+        .get_tx_power = brcmf_cfg80211_get_tx_power,
+        .add_key = brcmf_cfg80211_add_key,
+        .del_key = brcmf_cfg80211_del_key,
+        .get_key = brcmf_cfg80211_get_key,
+        .set_default_key = brcmf_cfg80211_config_default_key,
+        .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
+        .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
+        .set_bitrate_mask = brcmf_cfg80211_set_bitrate_mask,
+        .connect = brcmf_cfg80211_connect,
+        .disconnect = brcmf_cfg80211_disconnect,
+        .suspend = brcmf_cfg80211_suspend,
+        .resume = brcmf_cfg80211_resume,
+        .set_pmksa = brcmf_cfg80211_set_pmksa,
+        .del_pmksa = brcmf_cfg80211_del_pmksa,
+        .flush_pmksa = brcmf_cfg80211_flush_pmksa
+};
+
+static s32 brcmf_mode_to_nl80211_iftype(s32 mode)
+{
+        s32 err = 0;
+
+        switch (mode) {
+        case WL_MODE_BSS:
+                return NL80211_IFTYPE_STATION;
+        case WL_MODE_IBSS:
+                return NL80211_IFTYPE_ADHOC;
+        default:
+                return NL80211_IFTYPE_UNSPECIFIED;
+        }
+
+        return err;
+}
+
+static struct wireless_dev *brcmf_alloc_wdev(s32 sizeof_iface,
+                                          struct device *dev)
+{
+        struct wireless_dev *wdev;
+        s32 err = 0;
+
+        wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+        if (unlikely(!wdev)) {
+                WL_ERR("Could not allocate wireless device\n");
+                return ERR_PTR(-ENOMEM);
+        }
+        wdev->wiphy =
+            wiphy_new(&wl_cfg80211_ops,
+                      sizeof(struct brcmf_cfg80211_priv) + sizeof_iface);
+        if (unlikely(!wdev->wiphy)) {
+                WL_ERR("Couldn not allocate wiphy device\n");
+                err = -ENOMEM;
+                goto wiphy_new_out;
+        }
+        set_wiphy_dev(wdev->wiphy, dev);
+        wdev->wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
+        wdev->wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
+        wdev->wiphy->interface_modes =
+            BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC);
+        wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
+        wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_a;    /* Set
+                                                * it as 11a by default.
+                                                * This will be updated with
+                                                * 11n phy tables in
+                                                * "ifconfig up"
+                                                * if phy has 11n capability
+                                                */
+        wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+        wdev->wiphy->cipher_suites = __wl_cipher_suites;
+        wdev->wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
+#ifndef WL_POWERSAVE_DISABLED
+        wdev->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;      /* enable power
+                                                                 * save mode
+                                                                 * by default
+                                                                 */
+#else
+        wdev->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#endif                          /* !WL_POWERSAVE_DISABLED */
+        err = wiphy_register(wdev->wiphy);
+        if (unlikely(err < 0)) {
+                WL_ERR("Couldn not register wiphy device (%d)\n", err);
+                goto wiphy_register_out;
+        }
+        return wdev;
+
+wiphy_register_out:
+        wiphy_free(wdev->wiphy);
+
+wiphy_new_out:
+        kfree(wdev);
+
+        return ERR_PTR(err);
+}
+
+static void brcmf_free_wdev(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct wireless_dev *wdev = cfg_to_wdev(cfg_priv);
+
+        if (unlikely(!wdev)) {
+                WL_ERR("wdev is invalid\n");
+                return;
+        }
+        wiphy_unregister(wdev->wiphy);
+        wiphy_free(wdev->wiphy);
+        kfree(wdev);
+        cfg_to_wdev(cfg_priv) = NULL;
+}
+
+static s32 brcmf_inform_bss(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_scan_results *bss_list;
+        struct brcmf_bss_info *bi = NULL;       /* must be initialized */
+        s32 err = 0;
+        int i;
+
+        bss_list = cfg_priv->bss_list;
+        if (unlikely(bss_list->version != BRCMF_BSS_INFO_VERSION)) {
+                WL_ERR("Version %d != WL_BSS_INFO_VERSION\n",
+                       bss_list->version);
+                return -EOPNOTSUPP;
+        }
+        WL_SCAN("scanned AP count (%d)\n", bss_list->count);
+        bi = next_bss(bss_list, bi);
+        for_each_bss(bss_list, bi, i) {
+                err = brcmf_inform_single_bss(cfg_priv, bi);
+                if (unlikely(err))
+                        break;
+        }
+        return err;
+}
+
+
+static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_priv *cfg_priv,
+                                   struct brcmf_bss_info *bi)
+{
+        struct wiphy *wiphy = cfg_to_wiphy(cfg_priv);
+        struct ieee80211_channel *notify_channel;
+        struct cfg80211_bss *bss;
+        struct ieee80211_supported_band *band;
+        s32 err = 0;
+        u16 channel;
+        u32 freq;
+        u64 notify_timestamp;
+        u16 notify_capability;
+        u16 notify_interval;
+        u8 *notify_ie;
+        size_t notify_ielen;
+        s32 notify_signal;
+
+        if (unlikely(le32_to_cpu(bi->length) > WL_BSS_INFO_MAX)) {
+                WL_ERR("Bss info is larger than buffer. Discarding\n");
+                return 0;
+        }
+
+        channel = bi->ctl_ch ? bi->ctl_ch :
+                                CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
+
+        if (channel <= CH_MAX_2G_CHANNEL)
+                band = wiphy->bands[IEEE80211_BAND_2GHZ];
+        else
+                band = wiphy->bands[IEEE80211_BAND_5GHZ];
+
+        freq = ieee80211_channel_to_frequency(channel, band->band);
+        notify_channel = ieee80211_get_channel(wiphy, freq);
+
+        notify_timestamp = jiffies_to_msecs(jiffies)*1000; /* uSec */
+        notify_capability = le16_to_cpu(bi->capability);
+        notify_interval = le16_to_cpu(bi->beacon_period);
+        notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
+        notify_ielen = le16_to_cpu(bi->ie_length);
+        notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
+
+        WL_CONN("bssid: %2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",
+                        bi->BSSID[0], bi->BSSID[1], bi->BSSID[2],
+                        bi->BSSID[3], bi->BSSID[4], bi->BSSID[5]);
+        WL_CONN("Channel: %d(%d)\n", channel, freq);
+        WL_CONN("Capability: %X\n", notify_capability);
+        WL_CONN("Beacon interval: %d\n", notify_interval);
+        WL_CONN("Signal: %d\n", notify_signal);
+        WL_CONN("notify_timestamp: %#018llx\n", notify_timestamp);
+
+        bss = cfg80211_inform_bss(wiphy, notify_channel, (const u8 *)bi->BSSID,
+                notify_timestamp, notify_capability, notify_interval, notify_ie,
+                notify_ielen, notify_signal, GFP_KERNEL);
+
+        if (unlikely(!bss)) {
+                WL_ERR("cfg80211_inform_bss_frame error\n");
+                return -EINVAL;
+        }
+
+        return err;
+}
+
+static s32 wl_inform_ibss(struct brcmf_cfg80211_priv *cfg_priv,
+                          struct net_device *dev, const u8 *bssid)
+{
+        struct wiphy *wiphy = cfg_to_wiphy(cfg_priv);
+        struct ieee80211_channel *notify_channel;
+        struct brcmf_bss_info *bi = NULL;
+        struct ieee80211_supported_band *band;
+        u8 *buf = NULL;
+        s32 err = 0;
+        u16 channel;
+        u32 freq;
+        u64 notify_timestamp;
+        u16 notify_capability;
+        u16 notify_interval;
+        u8 *notify_ie;
+        size_t notify_ielen;
+        s32 notify_signal;
+
+        WL_TRACE("Enter\n");
+
+        buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
+        if (buf == NULL) {
+                WL_ERR("kzalloc() failed\n");
+                err = -ENOMEM;
+                goto CleanUp;
+        }
+
+        *(u32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
+
+        err = brcmf_dev_ioctl(dev, BRCMF_C_GET_BSS_INFO, buf, WL_BSS_INFO_MAX);
+        if (unlikely(err)) {
+                WL_ERR("WLC_GET_BSS_INFO failed: %d\n", err);
+                goto CleanUp;
+        }
+
+        bi = (struct brcmf_bss_info *)(buf + 4);
+
+        channel = bi->ctl_ch ? bi->ctl_ch :
+                                CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
+
+        if (channel <= CH_MAX_2G_CHANNEL)
+                band = wiphy->bands[IEEE80211_BAND_2GHZ];
+        else
+                band = wiphy->bands[IEEE80211_BAND_5GHZ];
+
+        freq = ieee80211_channel_to_frequency(channel, band->band);
+        notify_channel = ieee80211_get_channel(wiphy, freq);
+
+        notify_timestamp = jiffies_to_msecs(jiffies)*1000; /* uSec */
+        notify_capability = le16_to_cpu(bi->capability);
+        notify_interval = le16_to_cpu(bi->beacon_period);
+        notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
+        notify_ielen = le16_to_cpu(bi->ie_length);
+        notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
+
+        WL_CONN("channel: %d(%d)\n", channel, freq);
+        WL_CONN("capability: %X\n", notify_capability);
+        WL_CONN("beacon interval: %d\n", notify_interval);
+        WL_CONN("signal: %d\n", notify_signal);
+        WL_CONN("notify_timestamp: %#018llx\n", notify_timestamp);
+
+        cfg80211_inform_bss(wiphy, notify_channel, bssid,
+                notify_timestamp, notify_capability, notify_interval,
+                notify_ie, notify_ielen, notify_signal, GFP_KERNEL);
+
+CleanUp:
+
+        kfree(buf);
+
+        WL_TRACE("Exit\n");
+
+        return err;
+}
+
+static bool brcmf_is_linkup(struct brcmf_cfg80211_priv *cfg_priv,
+                            const struct brcmf_event_msg *e)
+{
+        u32 event = be32_to_cpu(e->event_type);
+        u32 status = be32_to_cpu(e->status);
+
+        if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
+                WL_CONN("Processing set ssid\n");
+                cfg_priv->link_up = true;
+                return true;
+        }
+
+        return false;
+}
+
+static bool brcmf_is_linkdown(struct brcmf_cfg80211_priv *cfg_priv,
+                              const struct brcmf_event_msg *e)
+{
+        u32 event = be32_to_cpu(e->event_type);
+        u16 flags = be16_to_cpu(e->flags);
+
+        if (event == BRCMF_E_LINK && (!(flags & BRCMF_EVENT_MSG_LINK))) {
+                WL_CONN("Processing link down\n");
+                return true;
+        }
+        return false;
+}
+
+static bool brcmf_is_nonetwork(struct brcmf_cfg80211_priv *cfg_priv,
+                               const struct brcmf_event_msg *e)
+{
+        u32 event = be32_to_cpu(e->event_type);
+        u32 status = be32_to_cpu(e->status);
+
+        if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
+                WL_CONN("Processing Link %s & no network found\n",
+                                be16_to_cpu(e->flags) & BRCMF_EVENT_MSG_LINK ?
+                                "up" : "down");
+                return true;
+        }
+
+        if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
+                WL_CONN("Processing connecting & no network found\n");
+                return true;
+        }
+
+        return false;
+}
+
+static s32
+brcmf_notify_connect_status(struct brcmf_cfg80211_priv *cfg_priv,
+                            struct net_device *ndev,
+                            const struct brcmf_event_msg *e, void *data)
+{
+        s32 err = 0;
+
+        if (brcmf_is_linkup(cfg_priv, e)) {
+                WL_CONN("Linkup\n");
+                if (brcmf_is_ibssmode(cfg_priv)) {
+                        brcmf_update_prof(cfg_priv, NULL, (void *)e->addr,
+                                WL_PROF_BSSID);
+                        wl_inform_ibss(cfg_priv, ndev, e->addr);
+                        cfg80211_ibss_joined(ndev, e->addr, GFP_KERNEL);
+                        clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
+                        set_bit(WL_STATUS_CONNECTED, &cfg_priv->status);
+                } else
+                        brcmf_bss_connect_done(cfg_priv, ndev, e, data, true);
+        } else if (brcmf_is_linkdown(cfg_priv, e)) {
+                WL_CONN("Linkdown\n");
+                if (brcmf_is_ibssmode(cfg_priv)) {
+                        clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
+                        if (test_and_clear_bit(WL_STATUS_CONNECTED,
+                                &cfg_priv->status))
+                                brcmf_link_down(cfg_priv);
+                } else {
+                        brcmf_bss_connect_done(cfg_priv, ndev, e, data, false);
+                        if (test_and_clear_bit(WL_STATUS_CONNECTED,
+                                &cfg_priv->status)) {
+                                cfg80211_disconnected(ndev, 0, NULL, 0,
+                                        GFP_KERNEL);
+                                brcmf_link_down(cfg_priv);
+                        }
+                }
+                brcmf_init_prof(cfg_priv->profile);
+        } else if (brcmf_is_nonetwork(cfg_priv, e)) {
+                if (brcmf_is_ibssmode(cfg_priv))
+                        clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
+                else
+                        brcmf_bss_connect_done(cfg_priv, ndev, e, data, false);
+        }
+
+        return err;
+}
+
+static s32
+brcmf_notify_roaming_status(struct brcmf_cfg80211_priv *cfg_priv,
+                            struct net_device *ndev,
+                            const struct brcmf_event_msg *e, void *data)
+{
+        s32 err = 0;
+        u32 event = be32_to_cpu(e->event_type);
+        u32 status = be32_to_cpu(e->status);
+
+        if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
+                if (test_bit(WL_STATUS_CONNECTED, &cfg_priv->status))
+                        brcmf_bss_roaming_done(cfg_priv, ndev, e, data);
+                else
+                        brcmf_bss_connect_done(cfg_priv, ndev, e, data, true);
+        }
+
+        return err;
+}
+
+static __used s32
+brcmf_dev_bufvar_set(struct net_device *dev, s8 *name, s8 *buf, s32 len)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(dev);
+        u32 buflen;
+
+        buflen = brcmu_mkiovar(name, buf, len, cfg_priv->ioctl_buf,
+                               WL_IOCTL_LEN_MAX);
+        BUG_ON(!buflen);
+
+        return brcmf_dev_ioctl(dev, BRCMF_C_SET_VAR, cfg_priv->ioctl_buf,
+                               buflen);
+}
+
+static s32
+brcmf_dev_bufvar_get(struct net_device *dev, s8 *name, s8 *buf,
+                  s32 buf_len)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(dev);
+        u32 len;
+        s32 err = 0;
+
+        len = brcmu_mkiovar(name, NULL, 0, cfg_priv->ioctl_buf,
+                            WL_IOCTL_LEN_MAX);
+        BUG_ON(!len);
+        err = brcmf_dev_ioctl(dev, BRCMF_C_GET_VAR, (void *)cfg_priv->ioctl_buf,
+                        WL_IOCTL_LEN_MAX);
+        if (unlikely(err)) {
+                WL_ERR("error (%d)\n", err);
+                return err;
+        }
+        memcpy(buf, cfg_priv->ioctl_buf, buf_len);
+
+        return err;
+}
+
+static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct net_device *ndev = cfg_to_ndev(cfg_priv);
+        struct brcmf_cfg80211_assoc_ielen *assoc_info;
+        struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg_priv);
+        u32 req_len;
+        u32 resp_len;
+        s32 err = 0;
+
+        brcmf_clear_assoc_ies(cfg_priv);
+
+        err = brcmf_dev_bufvar_get(ndev, "assoc_info", cfg_priv->extra_buf,
+                                WL_ASSOC_INFO_MAX);
+        if (unlikely(err)) {
+                WL_ERR("could not get assoc info (%d)\n", err);
+                return err;
+        }
+        assoc_info = (struct brcmf_cfg80211_assoc_ielen *)cfg_priv->extra_buf;
+        req_len = assoc_info->req_len;
+        resp_len = assoc_info->resp_len;
+        if (req_len) {
+                err = brcmf_dev_bufvar_get(ndev, "assoc_req_ies",
+                                           cfg_priv->extra_buf,
+                                           WL_ASSOC_INFO_MAX);
+                if (unlikely(err)) {
+                        WL_ERR("could not get assoc req (%d)\n", err);
+                        return err;
+                }
+                conn_info->req_ie_len = req_len;
+                conn_info->req_ie =
+                    kmemdup(cfg_priv->extra_buf, conn_info->req_ie_len,
+                            GFP_KERNEL);
+        } else {
+                conn_info->req_ie_len = 0;
+                conn_info->req_ie = NULL;
+        }
+        if (resp_len) {
+                err = brcmf_dev_bufvar_get(ndev, "assoc_resp_ies",
+                                           cfg_priv->extra_buf,
+                                           WL_ASSOC_INFO_MAX);
+                if (unlikely(err)) {
+                        WL_ERR("could not get assoc resp (%d)\n", err);
+                        return err;
+                }
+                conn_info->resp_ie_len = resp_len;
+                conn_info->resp_ie =
+                    kmemdup(cfg_priv->extra_buf, conn_info->resp_ie_len,
+                            GFP_KERNEL);
+        } else {
+                conn_info->resp_ie_len = 0;
+                conn_info->resp_ie = NULL;
+        }
+        WL_CONN("req len (%d) resp len (%d)\n",
+               conn_info->req_ie_len, conn_info->resp_ie_len);
+
+        return err;
+}
+
+static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg_priv);
+
+        kfree(conn_info->req_ie);
+        conn_info->req_ie = NULL;
+        conn_info->req_ie_len = 0;
+        kfree(conn_info->resp_ie);
+        conn_info->resp_ie = NULL;
+        conn_info->resp_ie_len = 0;
+}
+
+
+static void brcmf_ch_to_chanspec(int ch, struct brcmf_join_params *join_params,
+        size_t *join_params_size)
+{
+        chanspec_t chanspec = 0;
+
+        if (ch != 0) {
+                join_params->params.chanspec_num = 1;
+                join_params->params.chanspec_list[0] = ch;
+
+                if (join_params->params.chanspec_list[0] <= CH_MAX_2G_CHANNEL)
+                        chanspec |= WL_CHANSPEC_BAND_2G;
+                else
+                        chanspec |= WL_CHANSPEC_BAND_5G;
+
+                chanspec |= WL_CHANSPEC_BW_20;
+                chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+                *join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE +
+                        join_params->params.chanspec_num * sizeof(chanspec_t);
+
+                join_params->params.chanspec_list[0] &= WL_CHANSPEC_CHAN_MASK;
+                join_params->params.chanspec_list[0] |= chanspec;
+                join_params->params.chanspec_list[0] =
+                cpu_to_le16(join_params->params.chanspec_list[0]);
+
+                join_params->params.chanspec_num =
+                        cpu_to_le32(join_params->params.chanspec_num);
+
+                WL_CONN("join_params->params.chanspec_list[0]= %#X,"
+                        "channel %d, chanspec %#X\n",
+                       join_params->params.chanspec_list[0], ch, chanspec);
+        }
+}
+
+static s32 brcmf_update_bss_info(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_bss_info *bi;
+        struct brcmf_ssid *ssid;
+        struct brcmu_tlv *tim;
+        u16 beacon_interval;
+        u8 dtim_period;
+        size_t ie_len;
+        u8 *ie;
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+        if (brcmf_is_ibssmode(cfg_priv))
+                return err;
+
+        ssid = (struct brcmf_ssid *)brcmf_read_prof(cfg_priv, WL_PROF_SSID);
+
+        *(u32 *)cfg_priv->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
+        err = brcmf_dev_ioctl(cfg_to_ndev(cfg_priv), BRCMF_C_GET_BSS_INFO,
+                        cfg_priv->extra_buf, WL_EXTRA_BUF_MAX);
+        if (unlikely(err)) {
+                WL_ERR("Could not get bss info %d\n", err);
+                goto update_bss_info_out;
+        }
+
+        bi = (struct brcmf_bss_info *)(cfg_priv->extra_buf + 4);
+        err = brcmf_inform_single_bss(cfg_priv, bi);
+        if (unlikely(err))
+                goto update_bss_info_out;
+
+        ie = ((u8 *)bi) + bi->ie_offset;
+        ie_len = bi->ie_length;
+        beacon_interval = cpu_to_le16(bi->beacon_period);
+
+        tim = brcmu_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
+        if (tim)
+                dtim_period = tim->data[1];
+        else {
+                /*
+                * active scan was done so we could not get dtim
+                * information out of probe response.
+                * so we speficially query dtim information to dongle.
+                */
+                u32 var;
+                err = brcmf_dev_intvar_get(cfg_to_ndev(cfg_priv),
+                                           "dtim_assoc", &var);
+                if (unlikely(err)) {
+                        WL_ERR("wl dtim_assoc failed (%d)\n", err);
+                        goto update_bss_info_out;
+                }
+                dtim_period = (u8)var;
+        }
+
+        brcmf_update_prof(cfg_priv, NULL, &beacon_interval, WL_PROF_BEACONINT);
+        brcmf_update_prof(cfg_priv, NULL, &dtim_period, WL_PROF_DTIMPERIOD);
+
+update_bss_info_out:
+        WL_TRACE("Exit");
+        return err;
+}
+
+static s32
+brcmf_bss_roaming_done(struct brcmf_cfg80211_priv *cfg_priv,
+                       struct net_device *ndev,
+                       const struct brcmf_event_msg *e, void *data)
+{
+        struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg_priv);
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+
+        brcmf_get_assoc_ies(cfg_priv);
+        brcmf_update_prof(cfg_priv, NULL, &e->addr, WL_PROF_BSSID);
+        brcmf_update_bss_info(cfg_priv);
+
+        cfg80211_roamed(ndev, NULL,
+                        (u8 *)brcmf_read_prof(cfg_priv, WL_PROF_BSSID),
+                        conn_info->req_ie, conn_info->req_ie_len,
+                        conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
+        WL_CONN("Report roaming result\n");
+
+        set_bit(WL_STATUS_CONNECTED, &cfg_priv->status);
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_bss_connect_done(struct brcmf_cfg80211_priv *cfg_priv,
+                       struct net_device *ndev, const struct brcmf_event_msg *e,
+                       void *data, bool completed)
+{
+        struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg_priv);
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+
+        if (test_and_clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status)) {
+                if (completed) {
+                        brcmf_get_assoc_ies(cfg_priv);
+                        brcmf_update_prof(cfg_priv, NULL, &e->addr,
+                                          WL_PROF_BSSID);
+                        brcmf_update_bss_info(cfg_priv);
+                }
+                cfg80211_connect_result(ndev,
+                                        (u8 *)brcmf_read_prof(cfg_priv,
+                                                              WL_PROF_BSSID),
+                                        conn_info->req_ie,
+                                        conn_info->req_ie_len,
+                                        conn_info->resp_ie,
+                                        conn_info->resp_ie_len,
+                                        completed ? WLAN_STATUS_SUCCESS :
+                                                    WLAN_STATUS_AUTH_TIMEOUT,
+                                        GFP_KERNEL);
+                if (completed)
+                        set_bit(WL_STATUS_CONNECTED, &cfg_priv->status);
+                WL_CONN("Report connect result - connection %s\n",
+                                completed ? "succeeded" : "failed");
+        }
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_notify_mic_status(struct brcmf_cfg80211_priv *cfg_priv,
+                        struct net_device *ndev,
+                        const struct brcmf_event_msg *e, void *data)
+{
+        u16 flags = be16_to_cpu(e->flags);
+        enum nl80211_key_type key_type;
+
+        rtnl_lock();
+        if (flags & BRCMF_EVENT_MSG_GROUP)
+                key_type = NL80211_KEYTYPE_GROUP;
+        else
+                key_type = NL80211_KEYTYPE_PAIRWISE;
+
+        cfg80211_michael_mic_failure(ndev, (u8 *)&e->addr, key_type, -1,
+                                     NULL, GFP_KERNEL);
+        rtnl_unlock();
+
+        return 0;
+}
+
+static s32
+brcmf_notify_scan_status(struct brcmf_cfg80211_priv *cfg_priv,
+                         struct net_device *ndev,
+                         const struct brcmf_event_msg *e, void *data)
+{
+        struct brcmf_channel_info channel_inform;
+        struct brcmf_scan_results *bss_list;
+        u32 len = WL_SCAN_BUF_MAX;
+        s32 err = 0;
+        bool scan_abort = false;
+
+        WL_TRACE("Enter\n");
+
+        if (cfg_priv->iscan_on && cfg_priv->iscan_kickstart) {
+                WL_TRACE("Exit\n");
+                return brcmf_wakeup_iscan(cfg_to_iscan(cfg_priv));
+        }
+
+        if (unlikely(!test_and_clear_bit(WL_STATUS_SCANNING,
+                                         &cfg_priv->status))) {
+                WL_ERR("Scan complete while device not scanning\n");
+                scan_abort = true;
+                err = -EINVAL;
+                goto scan_done_out;
+        }
+
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_GET_CHANNEL, &channel_inform,
+                        sizeof(channel_inform));
+        if (unlikely(err)) {
+                WL_ERR("scan busy (%d)\n", err);
+                scan_abort = true;
+                goto scan_done_out;
+        }
+        channel_inform.scan_channel = le32_to_cpu(channel_inform.scan_channel);
+        if (unlikely(channel_inform.scan_channel)) {
+
+                WL_CONN("channel_inform.scan_channel (%d)\n",
+                       channel_inform.scan_channel);
+        }
+        cfg_priv->bss_list = cfg_priv->scan_results;
+        bss_list = cfg_priv->bss_list;
+        memset(bss_list, 0, len);
+        bss_list->buflen = cpu_to_le32(len);
+
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SCAN_RESULTS, bss_list, len);
+        if (unlikely(err)) {
+                WL_ERR("%s Scan_results error (%d)\n", ndev->name, err);
+                err = -EINVAL;
+                scan_abort = true;
+                goto scan_done_out;
+        }
+        bss_list->buflen = le32_to_cpu(bss_list->buflen);
+        bss_list->version = le32_to_cpu(bss_list->version);
+        bss_list->count = le32_to_cpu(bss_list->count);
+
+        err = brcmf_inform_bss(cfg_priv);
+        if (err) {
+                scan_abort = true;
+                goto scan_done_out;
+        }
+
+scan_done_out:
+        if (cfg_priv->scan_request) {
+                WL_SCAN("calling cfg80211_scan_done\n");
+                cfg80211_scan_done(cfg_priv->scan_request, scan_abort);
+                brcmf_set_mpc(ndev, 1);
+                cfg_priv->scan_request = NULL;
+        }
+
+        WL_TRACE("Exit\n");
+
+        return err;
+}
+
+static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
+{
+        conf->mode = (u32)-1;
+        conf->frag_threshold = (u32)-1;
+        conf->rts_threshold = (u32)-1;
+        conf->retry_short = (u32)-1;
+        conf->retry_long = (u32)-1;
+        conf->tx_power = -1;
+}
+
+static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
+{
+        memset(prof, 0, sizeof(*prof));
+}
+
+static void brcmf_init_eloop_handler(struct brcmf_cfg80211_event_loop *el)
+{
+        memset(el, 0, sizeof(*el));
+        el->handler[BRCMF_E_SCAN_COMPLETE] = brcmf_notify_scan_status;
+        el->handler[BRCMF_E_LINK] = brcmf_notify_connect_status;
+        el->handler[BRCMF_E_ROAM] = brcmf_notify_roaming_status;
+        el->handler[BRCMF_E_MIC_ERROR] = brcmf_notify_mic_status;
+        el->handler[BRCMF_E_SET_SSID] = brcmf_notify_connect_status;
+}
+
+static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        cfg_priv->scan_results = kzalloc(WL_SCAN_BUF_MAX, GFP_KERNEL);
+        if (unlikely(!cfg_priv->scan_results)) {
+                WL_ERR("Scan results alloc failed\n");
+                goto init_priv_mem_out;
+        }
+        cfg_priv->conf = kzalloc(sizeof(*cfg_priv->conf), GFP_KERNEL);
+        if (unlikely(!cfg_priv->conf)) {
+                WL_ERR("wl_conf alloc failed\n");
+                goto init_priv_mem_out;
+        }
+        cfg_priv->profile = kzalloc(sizeof(*cfg_priv->profile), GFP_KERNEL);
+        if (unlikely(!cfg_priv->profile)) {
+                WL_ERR("wl_profile alloc failed\n");
+                goto init_priv_mem_out;
+        }
+        cfg_priv->bss_info = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
+        if (unlikely(!cfg_priv->bss_info)) {
+                WL_ERR("Bss information alloc failed\n");
+                goto init_priv_mem_out;
+        }
+        cfg_priv->scan_req_int = kzalloc(sizeof(*cfg_priv->scan_req_int),
+                                         GFP_KERNEL);
+        if (unlikely(!cfg_priv->scan_req_int)) {
+                WL_ERR("Scan req alloc failed\n");
+                goto init_priv_mem_out;
+        }
+        cfg_priv->ioctl_buf = kzalloc(WL_IOCTL_LEN_MAX, GFP_KERNEL);
+        if (unlikely(!cfg_priv->ioctl_buf)) {
+                WL_ERR("Ioctl buf alloc failed\n");
+                goto init_priv_mem_out;
+        }
+        cfg_priv->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
+        if (unlikely(!cfg_priv->extra_buf)) {
+                WL_ERR("Extra buf alloc failed\n");
+                goto init_priv_mem_out;
+        }
+        cfg_priv->iscan = kzalloc(sizeof(*cfg_priv->iscan), GFP_KERNEL);
+        if (unlikely(!cfg_priv->iscan)) {
+                WL_ERR("Iscan buf alloc failed\n");
+                goto init_priv_mem_out;
+        }
+        cfg_priv->pmk_list = kzalloc(sizeof(*cfg_priv->pmk_list), GFP_KERNEL);
+        if (unlikely(!cfg_priv->pmk_list)) {
+                WL_ERR("pmk list alloc failed\n");
+                goto init_priv_mem_out;
+        }
+
+        return 0;
+
+init_priv_mem_out:
+        brcmf_deinit_priv_mem(cfg_priv);
+
+        return -ENOMEM;
+}
+
+static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        kfree(cfg_priv->scan_results);
+        cfg_priv->scan_results = NULL;
+        kfree(cfg_priv->bss_info);
+        cfg_priv->bss_info = NULL;
+        kfree(cfg_priv->conf);
+        cfg_priv->conf = NULL;
+        kfree(cfg_priv->profile);
+        cfg_priv->profile = NULL;
+        kfree(cfg_priv->scan_req_int);
+        cfg_priv->scan_req_int = NULL;
+        kfree(cfg_priv->ioctl_buf);
+        cfg_priv->ioctl_buf = NULL;
+        kfree(cfg_priv->extra_buf);
+        cfg_priv->extra_buf = NULL;
+        kfree(cfg_priv->iscan);
+        cfg_priv->iscan = NULL;
+        kfree(cfg_priv->pmk_list);
+        cfg_priv->pmk_list = NULL;
+}
+
+static s32 brcmf_create_event_handler(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        sema_init(&cfg_priv->event_sync, 0);
+        cfg_priv->event_tsk = kthread_run(brcmf_event_handler, cfg_priv,
+                                          "wl_event_handler");
+        if (IS_ERR(cfg_priv->event_tsk)) {
+                cfg_priv->event_tsk = NULL;
+                WL_ERR("failed to create event thread\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+static void brcmf_destroy_event_handler(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        if (cfg_priv->event_tsk) {
+                send_sig(SIGTERM, cfg_priv->event_tsk, 1);
+                kthread_stop(cfg_priv->event_tsk);
+                cfg_priv->event_tsk = NULL;
+        }
+}
+
+static void brcmf_term_iscan(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_to_iscan(cfg_priv);
+
+        if (cfg_priv->iscan_on && iscan->tsk) {
+                iscan->state = WL_ISCAN_STATE_IDLE;
+                send_sig(SIGTERM, iscan->tsk, 1);
+                kthread_stop(iscan->tsk);
+                iscan->tsk = NULL;
+        }
+}
+
+static void brcmf_notify_iscan_complete(struct brcmf_cfg80211_iscan_ctrl *iscan,
+                                        bool aborted)
+{
+        struct brcmf_cfg80211_priv *cfg_priv = iscan_to_cfg(iscan);
+        struct net_device *ndev = cfg_to_ndev(cfg_priv);
+
+        if (unlikely(!test_and_clear_bit(WL_STATUS_SCANNING,
+                                         &cfg_priv->status))) {
+                WL_ERR("Scan complete while device not scanning\n");
+                return;
+        }
+        if (likely(cfg_priv->scan_request)) {
+                WL_SCAN("ISCAN Completed scan: %s\n",
+                                aborted ? "Aborted" : "Done");
+                cfg80211_scan_done(cfg_priv->scan_request, aborted);
+                brcmf_set_mpc(ndev, 1);
+                cfg_priv->scan_request = NULL;
+        }
+        cfg_priv->iscan_kickstart = false;
+}
+
+static s32 brcmf_wakeup_iscan(struct brcmf_cfg80211_iscan_ctrl *iscan)
+{
+        if (likely(iscan->state != WL_ISCAN_STATE_IDLE)) {
+                WL_SCAN("wake up iscan\n");
+                up(&iscan->sync);
+                return 0;
+        }
+
+        return -EIO;
+}
+
+static s32
+brcmf_get_iscan_results(struct brcmf_cfg80211_iscan_ctrl *iscan, u32 *status,
+                     struct brcmf_scan_results **bss_list)
+{
+        struct brcmf_iscan_results list;
+        struct brcmf_scan_results *results;
+        struct brcmf_iscan_results *list_buf;
+        s32 err = 0;
+
+        memset(iscan->scan_buf, 0, WL_ISCAN_BUF_MAX);
+        list_buf = (struct brcmf_iscan_results *)iscan->scan_buf;
+        results = &list_buf->results;
+        results->buflen = BRCMF_ISCAN_RESULTS_FIXED_SIZE;
+        results->version = 0;
+        results->count = 0;
+
+        memset(&list, 0, sizeof(list));
+        list.results.buflen = cpu_to_le32(WL_ISCAN_BUF_MAX);
+        err = brcmf_dev_iovar_getbuf(iscan->dev, "iscanresults", &list,
+                                BRCMF_ISCAN_RESULTS_FIXED_SIZE, iscan->scan_buf,
+                                WL_ISCAN_BUF_MAX);
+        if (unlikely(err)) {
+                WL_ERR("error (%d)\n", err);
+                return err;
+        }
+        results->buflen = le32_to_cpu(results->buflen);
+        results->version = le32_to_cpu(results->version);
+        results->count = le32_to_cpu(results->count);
+        WL_SCAN("results->count = %d\n", results->count);
+        WL_SCAN("results->buflen = %d\n", results->buflen);
+        *status = le32_to_cpu(list_buf->status);
+        *bss_list = results;
+
+        return err;
+}
+
+static s32 brcmf_iscan_done(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_priv->iscan;
+        s32 err = 0;
+
+        iscan->state = WL_ISCAN_STATE_IDLE;
+        rtnl_lock();
+        brcmf_inform_bss(cfg_priv);
+        brcmf_notify_iscan_complete(iscan, false);
+        rtnl_unlock();
+
+        return err;
+}
+
+static s32 brcmf_iscan_pending(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_priv->iscan;
+        s32 err = 0;
+
+        /* Reschedule the timer */
+        mod_timer(&iscan->timer, jiffies + iscan->timer_ms * HZ / 1000);
+        iscan->timer_on = 1;
+
+        return err;
+}
+
+static s32 brcmf_iscan_inprogress(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_priv->iscan;
+        s32 err = 0;
+
+        rtnl_lock();
+        brcmf_inform_bss(cfg_priv);
+        brcmf_run_iscan(iscan, NULL, BRCMF_SCAN_ACTION_CONTINUE);
+        rtnl_unlock();
+        /* Reschedule the timer */
+        mod_timer(&iscan->timer, jiffies + iscan->timer_ms * HZ / 1000);
+        iscan->timer_on = 1;
+
+        return err;
+}
+
+static s32 brcmf_iscan_aborted(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_priv->iscan;
+        s32 err = 0;
+
+        iscan->state = WL_ISCAN_STATE_IDLE;
+        rtnl_lock();
+        brcmf_notify_iscan_complete(iscan, true);
+        rtnl_unlock();
+
+        return err;
+}
+
+static s32 brcmf_iscan_thread(void *data)
+{
+        struct sched_param param = {.sched_priority = MAX_RT_PRIO - 1 };
+        struct brcmf_cfg80211_iscan_ctrl *iscan =
+                        (struct brcmf_cfg80211_iscan_ctrl *)data;
+        struct brcmf_cfg80211_priv *cfg_priv = iscan_to_cfg(iscan);
+        struct brcmf_cfg80211_iscan_eloop *el = &iscan->el;
+        u32 status;
+        int err = 0;
+
+        sched_setscheduler(current, SCHED_FIFO, &param);
+        allow_signal(SIGTERM);
+        status = BRCMF_SCAN_RESULTS_PARTIAL;
+        while (likely(!down_interruptible(&iscan->sync))) {
+                if (kthread_should_stop())
+                        break;
+                if (iscan->timer_on) {
+                        del_timer_sync(&iscan->timer);
+                        iscan->timer_on = 0;
+                }
+                rtnl_lock();
+                err = brcmf_get_iscan_results(iscan, &status,
+                                              &cfg_priv->bss_list);
+                if (unlikely(err)) {
+                        status = BRCMF_SCAN_RESULTS_ABORTED;
+                        WL_ERR("Abort iscan\n");
+                }
+                rtnl_unlock();
+                el->handler[status](cfg_priv);
+        }
+        if (iscan->timer_on) {
+                del_timer_sync(&iscan->timer);
+                iscan->timer_on = 0;
+        }
+        WL_SCAN("ISCAN thread terminated\n");
+
+        return 0;
+}
+
+static void brcmf_iscan_timer(unsigned long data)
+{
+        struct brcmf_cfg80211_iscan_ctrl *iscan =
+                        (struct brcmf_cfg80211_iscan_ctrl *)data;
+
+        if (iscan) {
+                iscan->timer_on = 0;
+                WL_SCAN("timer expired\n");
+                brcmf_wakeup_iscan(iscan);
+        }
+}
+
+static s32 brcmf_invoke_iscan(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_to_iscan(cfg_priv);
+        int err = 0;
+
+        if (cfg_priv->iscan_on && !iscan->tsk) {
+                iscan->state = WL_ISCAN_STATE_IDLE;
+                sema_init(&iscan->sync, 0);
+                iscan->tsk = kthread_run(brcmf_iscan_thread, iscan, "wl_iscan");
+                if (IS_ERR(iscan->tsk)) {
+                        WL_ERR("Could not create iscan thread\n");
+                        iscan->tsk = NULL;
+                        return -ENOMEM;
+                }
+        }
+
+        return err;
+}
+
+static void brcmf_init_iscan_eloop(struct brcmf_cfg80211_iscan_eloop *el)
+{
+        memset(el, 0, sizeof(*el));
+        el->handler[BRCMF_SCAN_RESULTS_SUCCESS] = brcmf_iscan_done;
+        el->handler[BRCMF_SCAN_RESULTS_PARTIAL] = brcmf_iscan_inprogress;
+        el->handler[BRCMF_SCAN_RESULTS_PENDING] = brcmf_iscan_pending;
+        el->handler[BRCMF_SCAN_RESULTS_ABORTED] = brcmf_iscan_aborted;
+        el->handler[BRCMF_SCAN_RESULTS_NO_MEM] = brcmf_iscan_aborted;
+}
+
+static s32 brcmf_init_iscan(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_to_iscan(cfg_priv);
+        int err = 0;
+
+        if (cfg_priv->iscan_on) {
+                iscan->dev = cfg_to_ndev(cfg_priv);
+                iscan->state = WL_ISCAN_STATE_IDLE;
+                brcmf_init_iscan_eloop(&iscan->el);
+                iscan->timer_ms = WL_ISCAN_TIMER_INTERVAL_MS;
+                init_timer(&iscan->timer);
+                iscan->timer.data = (unsigned long) iscan;
+                iscan->timer.function = brcmf_iscan_timer;
+                sema_init(&iscan->sync, 0);
+                iscan->tsk = kthread_run(brcmf_iscan_thread, iscan, "wl_iscan");
+                if (IS_ERR(iscan->tsk)) {
+                        WL_ERR("Could not create iscan thread\n");
+                        iscan->tsk = NULL;
+                        return -ENOMEM;
+                }
+                iscan->data = cfg_priv;
+        }
+
+        return err;
+}
+
+static s32 wl_init_priv(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct wiphy *wiphy = cfg_to_wiphy(cfg_priv);
+        s32 err = 0;
+
+        cfg_priv->scan_request = NULL;
+        cfg_priv->pwr_save = !!(wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT);
+        cfg_priv->iscan_on = true;      /* iscan on & off switch.
+                                 we enable iscan per default */
+        cfg_priv->roam_on = false;      /* roam on & off switch.
+                                 we enable roam per default */
+
+        cfg_priv->iscan_kickstart = false;
+        cfg_priv->active_scan = true;   /* we do active scan for
+                                 specific scan per default */
+        cfg_priv->dongle_up = false;    /* dongle is not up yet */
+        brcmf_init_eq(cfg_priv);
+        err = brcmf_init_priv_mem(cfg_priv);
+        if (unlikely(err))
+                return err;
+        if (unlikely(brcmf_create_event_handler(cfg_priv)))
+                return -ENOMEM;
+        brcmf_init_eloop_handler(&cfg_priv->el);
+        mutex_init(&cfg_priv->usr_sync);
+        err = brcmf_init_iscan(cfg_priv);
+        if (unlikely(err))
+                return err;
+        brcmf_init_conf(cfg_priv->conf);
+        brcmf_init_prof(cfg_priv->profile);
+        brcmf_link_down(cfg_priv);
+
+        return err;
+}
+
+static void wl_deinit_priv(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        brcmf_destroy_event_handler(cfg_priv);
+        cfg_priv->dongle_up = false;    /* dongle down */
+        brcmf_flush_eq(cfg_priv);
+        brcmf_link_down(cfg_priv);
+        brcmf_term_iscan(cfg_priv);
+        brcmf_deinit_priv_mem(cfg_priv);
+}
+
+s32 brcmf_cfg80211_attach(struct net_device *ndev, void *data)
+{
+        struct wireless_dev *wdev;
+        struct brcmf_cfg80211_priv *cfg_priv;
+        struct brcmf_cfg80211_iface *ci;
+        s32 err = 0;
+
+        if (unlikely(!ndev)) {
+                WL_ERR("ndev is invalid\n");
+                return -ENODEV;
+        }
+        cfg80211_dev = kzalloc(sizeof(struct brcmf_cfg80211_dev), GFP_KERNEL);
+        if (unlikely(!cfg80211_dev)) {
+                WL_ERR("wl_cfg80211_dev is invalid\n");
+                return -ENOMEM;
+        }
+        WL_INFO("func %p\n", brcmf_cfg80211_get_sdio_func());
+        wdev = brcmf_alloc_wdev(sizeof(struct brcmf_cfg80211_iface),
+                                &brcmf_cfg80211_get_sdio_func()->dev);
+        if (IS_ERR(wdev))
+                return -ENOMEM;
+
+        wdev->iftype = brcmf_mode_to_nl80211_iftype(WL_MODE_BSS);
+        cfg_priv = wdev_to_cfg(wdev);
+        cfg_priv->wdev = wdev;
+        cfg_priv->pub = data;
+        ci = (struct brcmf_cfg80211_iface *)&cfg_priv->ci;
+        ci->cfg_priv = cfg_priv;
+        ndev->ieee80211_ptr = wdev;
+        SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
+        wdev->netdev = ndev;
+        err = wl_init_priv(cfg_priv);
+        if (unlikely(err)) {
+                WL_ERR("Failed to init iwm_priv (%d)\n", err);
+                goto cfg80211_attach_out;
+        }
+        brcmf_set_drvdata(cfg80211_dev, ci);
+
+        return err;
+
+cfg80211_attach_out:
+        brcmf_free_wdev(cfg_priv);
+        return err;
+}
+
+void brcmf_cfg80211_detach(void)
+{
+        struct brcmf_cfg80211_priv *cfg_priv;
+
+        cfg_priv = WL_PRIV_GET();
+
+        wl_deinit_priv(cfg_priv);
+        brcmf_free_wdev(cfg_priv);
+        brcmf_set_drvdata(cfg80211_dev, NULL);
+        kfree(cfg80211_dev);
+        cfg80211_dev = NULL;
+        brcmf_clear_sdio_func();
+}
+
+static void brcmf_wakeup_event(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        up(&cfg_priv->event_sync);
+}
+
+static s32 brcmf_event_handler(void *data)
+{
+        struct brcmf_cfg80211_priv *cfg_priv =
+                        (struct brcmf_cfg80211_priv *)data;
+        struct sched_param param = {.sched_priority = MAX_RT_PRIO - 1 };
+        struct brcmf_cfg80211_event_q *e;
+
+        sched_setscheduler(current, SCHED_FIFO, &param);
+        allow_signal(SIGTERM);
+        while (likely(!down_interruptible(&cfg_priv->event_sync))) {
+                if (kthread_should_stop())
+                        break;
+                e = brcmf_deq_event(cfg_priv);
+                if (unlikely(!e)) {
+                        WL_ERR("event queue empty...\n");
+                        BUG();
+                }
+                WL_INFO("event type (%d)\n", e->etype);
+                if (cfg_priv->el.handler[e->etype]) {
+                        cfg_priv->el.handler[e->etype](cfg_priv,
+                                                       cfg_to_ndev(cfg_priv),
+                                                       &e->emsg, e->edata);
+                } else {
+                        WL_INFO("Unknown Event (%d): ignoring\n", e->etype);
+                }
+                brcmf_put_event(e);
+        }
+        WL_INFO("was terminated\n");
+        return 0;
+}
+
+void
+brcmf_cfg80211_event(struct net_device *ndev,
+                  const struct brcmf_event_msg *e, void *data)
+{
+        u32 event_type = be32_to_cpu(e->event_type);
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
+
+        if (likely(!brcmf_enq_event(cfg_priv, event_type, e, data)))
+                brcmf_wakeup_event(cfg_priv);
+}
+
+static void brcmf_init_eq(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        brcmf_init_eq_lock(cfg_priv);
+        INIT_LIST_HEAD(&cfg_priv->eq_list);
+}
+
+static void brcmf_flush_eq(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_event_q *e;
+
+        brcmf_lock_eq(cfg_priv);
+        while (!list_empty(&cfg_priv->eq_list)) {
+                e = list_first_entry(&cfg_priv->eq_list,
+                                     struct brcmf_cfg80211_event_q, eq_list);
+                list_del(&e->eq_list);
+                kfree(e);
+        }
+        brcmf_unlock_eq(cfg_priv);
+}
+
+/*
+* retrieve first queued event from head
+*/
+
+static struct brcmf_cfg80211_event_q *brcmf_deq_event(
+        struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct brcmf_cfg80211_event_q *e = NULL;
+
+        brcmf_lock_eq(cfg_priv);
+        if (likely(!list_empty(&cfg_priv->eq_list))) {
+                e = list_first_entry(&cfg_priv->eq_list,
+                                     struct brcmf_cfg80211_event_q, eq_list);
+                list_del(&e->eq_list);
+        }
+        brcmf_unlock_eq(cfg_priv);
+
+        return e;
+}
+
+/*
+** push event to tail of the queue
+*/
+
+static s32
+brcmf_enq_event(struct brcmf_cfg80211_priv *cfg_priv, u32 event,
+                const struct brcmf_event_msg *msg, void *data)
+{
+        struct brcmf_cfg80211_event_q *e;
+        s32 err = 0;
+
+        e = kzalloc(sizeof(struct brcmf_cfg80211_event_q), GFP_KERNEL);
+        if (unlikely(!e)) {
+                WL_ERR("event alloc failed\n");
+                return -ENOMEM;
+        }
+
+        e->etype = event;
+        memcpy(&e->emsg, msg, sizeof(struct brcmf_event_msg));
+
+        brcmf_lock_eq(cfg_priv);
+        list_add_tail(&e->eq_list, &cfg_priv->eq_list);
+        brcmf_unlock_eq(cfg_priv);
+
+        return err;
+}
+
+static void brcmf_put_event(struct brcmf_cfg80211_event_q *e)
+{
+        kfree(e);
+}
+
+void brcmf_cfg80211_sdio_func(void *func)
+{
+        cfg80211_sdio_func = (struct sdio_func *)func;
+}
+
+static void brcmf_clear_sdio_func(void)
+{
+        cfg80211_sdio_func = NULL;
+}
+
+struct sdio_func *brcmf_cfg80211_get_sdio_func(void)
+{
+        return cfg80211_sdio_func;
+}
+
+static s32 brcmf_dongle_mode(struct net_device *ndev, s32 iftype)
+{
+        s32 infra = 0;
+        s32 err = 0;
+
+        switch (iftype) {
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_WDS:
+                WL_ERR("type (%d) : currently we do not support this mode\n",
+                       iftype);
+                err = -EINVAL;
+                return err;
+        case NL80211_IFTYPE_ADHOC:
+                infra = 0;
+                break;
+        case NL80211_IFTYPE_STATION:
+                infra = 1;
+                break;
+        default:
+                err = -EINVAL;
+                WL_ERR("invalid type (%d)\n", iftype);
+                return err;
+        }
+        infra = cpu_to_le32(infra);
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_INFRA, &infra, sizeof(infra));
+        if (unlikely(err)) {
+                WL_ERR("WLC_SET_INFRA error (%d)\n", err);
+                return err;
+        }
+
+        return 0;
+}
+
+static s32 brcmf_dongle_eventmsg(struct net_device *ndev)
+{
+        /* Room for "event_msgs" + '\0' + bitvec */
+        s8 iovbuf[BRCMF_EVENTING_MASK_LEN + 12];
+        s8 eventmask[BRCMF_EVENTING_MASK_LEN];
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+
+        /* Setup event_msgs */
+        brcmu_mkiovar("event_msgs", eventmask, BRCMF_EVENTING_MASK_LEN, iovbuf,
+                    sizeof(iovbuf));
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_GET_VAR, iovbuf, sizeof(iovbuf));
+        if (unlikely(err)) {
+                WL_ERR("Get event_msgs error (%d)\n", err);
+                goto dongle_eventmsg_out;
+        }
+        memcpy(eventmask, iovbuf, BRCMF_EVENTING_MASK_LEN);
+
+        setbit(eventmask, BRCMF_E_SET_SSID);
+        setbit(eventmask, BRCMF_E_ROAM);
+        setbit(eventmask, BRCMF_E_PRUNE);
+        setbit(eventmask, BRCMF_E_AUTH);
+        setbit(eventmask, BRCMF_E_REASSOC);
+        setbit(eventmask, BRCMF_E_REASSOC_IND);
+        setbit(eventmask, BRCMF_E_DEAUTH_IND);
+        setbit(eventmask, BRCMF_E_DISASSOC_IND);
+        setbit(eventmask, BRCMF_E_DISASSOC);
+        setbit(eventmask, BRCMF_E_JOIN);
+        setbit(eventmask, BRCMF_E_ASSOC_IND);
+        setbit(eventmask, BRCMF_E_PSK_SUP);
+        setbit(eventmask, BRCMF_E_LINK);
+        setbit(eventmask, BRCMF_E_NDIS_LINK);
+        setbit(eventmask, BRCMF_E_MIC_ERROR);
+        setbit(eventmask, BRCMF_E_PMKID_CACHE);
+        setbit(eventmask, BRCMF_E_TXFAIL);
+        setbit(eventmask, BRCMF_E_JOIN_START);
+        setbit(eventmask, BRCMF_E_SCAN_COMPLETE);
+
+        brcmu_mkiovar("event_msgs", eventmask, BRCMF_EVENTING_MASK_LEN, iovbuf,
+                    sizeof(iovbuf));
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_VAR, iovbuf, sizeof(iovbuf));
+        if (unlikely(err)) {
+                WL_ERR("Set event_msgs error (%d)\n", err);
+                goto dongle_eventmsg_out;
+        }
+
+dongle_eventmsg_out:
+        WL_TRACE("Exit\n");
+        return err;
+}
+
+static s32
+brcmf_dongle_roam(struct net_device *ndev, u32 roamvar, u32 bcn_timeout)
+{
+        s8 iovbuf[32];
+        s32 roamtrigger[2];
+        s32 roam_delta[2];
+        s32 err = 0;
+
+        /*
+         * Setup timeout if Beacons are lost and roam is
+         * off to report link down
+         */
+        if (roamvar) {
+                brcmu_mkiovar("bcn_timeout", (char *)&bcn_timeout,
+                        sizeof(bcn_timeout), iovbuf, sizeof(iovbuf));
+                err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_VAR,
+                                   iovbuf, sizeof(iovbuf));
+                if (unlikely(err)) {
+                        WL_ERR("bcn_timeout error (%d)\n", err);
+                        goto dongle_rom_out;
+                }
+        }
+
+        /*
+         * Enable/Disable built-in roaming to allow supplicant
+         * to take care of roaming
+         */
+        WL_INFO("Internal Roaming = %s\n", roamvar ? "Off" : "On");
+        brcmu_mkiovar("roam_off", (char *)&roamvar,
+                                sizeof(roamvar), iovbuf, sizeof(iovbuf));
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_VAR, iovbuf, sizeof(iovbuf));
+        if (unlikely(err)) {
+                WL_ERR("roam_off error (%d)\n", err);
+                goto dongle_rom_out;
+        }
+
+        roamtrigger[0] = WL_ROAM_TRIGGER_LEVEL;
+        roamtrigger[1] = BRCM_BAND_ALL;
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_ROAM_TRIGGER,
+                        (void *)roamtrigger, sizeof(roamtrigger));
+        if (unlikely(err)) {
+                WL_ERR("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
+                goto dongle_rom_out;
+        }
+
+        roam_delta[0] = WL_ROAM_DELTA;
+        roam_delta[1] = BRCM_BAND_ALL;
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_ROAM_DELTA,
+                                (void *)roam_delta, sizeof(roam_delta));
+        if (unlikely(err)) {
+                WL_ERR("WLC_SET_ROAM_DELTA error (%d)\n", err);
+                goto dongle_rom_out;
+        }
+
+dongle_rom_out:
+        return err;
+}
+
+static s32
+brcmf_dongle_scantime(struct net_device *ndev, s32 scan_assoc_time,
+                s32 scan_unassoc_time, s32 scan_passive_time)
+{
+        s32 err = 0;
+
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+                           &scan_assoc_time, sizeof(scan_assoc_time));
+        if (err) {
+                if (err == -EOPNOTSUPP)
+                        WL_INFO("Scan assoc time is not supported\n");
+                else
+                        WL_ERR("Scan assoc time error (%d)\n", err);
+                goto dongle_scantime_out;
+        }
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_SCAN_UNASSOC_TIME,
+                           &scan_unassoc_time, sizeof(scan_unassoc_time));
+        if (err) {
+                if (err == -EOPNOTSUPP)
+                        WL_INFO("Scan unassoc time is not supported\n");
+                else
+                        WL_ERR("Scan unassoc time error (%d)\n", err);
+                goto dongle_scantime_out;
+        }
+
+        err = brcmf_dev_ioctl(ndev, BRCMF_C_SET_SCAN_PASSIVE_TIME,
+                           &scan_passive_time, sizeof(scan_passive_time));
+        if (err) {
+                if (err == -EOPNOTSUPP)
+                        WL_INFO("Scan passive time is not supported\n");
+                else
+                        WL_ERR("Scan passive time error (%d)\n", err);
+                goto dongle_scantime_out;
+        }
+
+dongle_scantime_out:
+        return err;
+}
+
+s32 brcmf_config_dongle(struct brcmf_cfg80211_priv *cfg_priv, bool need_lock)
+{
+        struct net_device *ndev;
+        struct wireless_dev *wdev;
+        s32 err = 0;
+
+        if (cfg_priv->dongle_up)
+                return err;
+
+        ndev = cfg_to_ndev(cfg_priv);
+        wdev = ndev->ieee80211_ptr;
+        if (need_lock)
+                rtnl_lock();
+
+        brcmf_dongle_scantime(ndev, WL_SCAN_CHANNEL_TIME,
+                        WL_SCAN_UNASSOC_TIME, WL_SCAN_PASSIVE_TIME);
+
+        err = brcmf_dongle_eventmsg(ndev);
+        if (unlikely(err))
+                goto default_conf_out;
+        err = brcmf_dongle_roam(ndev, (cfg_priv->roam_on ? 0 : 1),
+                                WL_BEACON_TIMEOUT);
+        if (unlikely(err))
+                goto default_conf_out;
+        err = brcmf_dongle_mode(ndev, wdev->iftype);
+        if (unlikely(err && err != -EINPROGRESS))
+                goto default_conf_out;
+        err = brcmf_dongle_probecap(cfg_priv);
+        if (unlikely(err))
+                goto default_conf_out;
+
+        /* -EINPROGRESS: Call commit handler */
+
+default_conf_out:
+        if (need_lock)
+                rtnl_unlock();
+
+        cfg_priv->dongle_up = true;
+
+        return err;
+
+}
+
+static s32 wl_update_wiphybands(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct wiphy *wiphy;
+        s32 phy_list;
+        s8 phy;
+        s32 err = 0;
+
+        err = brcmf_dev_ioctl(cfg_to_ndev(cfg_priv), BRCM_GET_PHYLIST,
+                              &phy_list, sizeof(phy_list));
+        if (unlikely(err)) {
+                WL_ERR("error (%d)\n", err);
+                return err;
+        }
+
+        phy = ((char *)&phy_list)[1];
+        WL_INFO("%c phy\n", phy);
+        if (phy == 'n' || phy == 'a') {
+                wiphy = cfg_to_wiphy(cfg_priv);
+                wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_n;
+        }
+
+        return err;
+}
+
+static s32 __brcmf_cfg80211_up(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        s32 err = 0;
+
+        set_bit(WL_STATUS_READY, &cfg_priv->status);
+
+        brcmf_debugfs_add_netdev_params(cfg_priv);
+
+        err = brcmf_config_dongle(cfg_priv, false);
+        if (unlikely(err))
+                return err;
+
+        brcmf_invoke_iscan(cfg_priv);
+
+        return err;
+}
+
+static s32 __brcmf_cfg80211_down(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        /*
+         * While going down, if associated with AP disassociate
+         * from AP to save power
+         */
+        if ((test_bit(WL_STATUS_CONNECTED, &cfg_priv->status) ||
+             test_bit(WL_STATUS_CONNECTING, &cfg_priv->status)) &&
+             test_bit(WL_STATUS_READY, &cfg_priv->status)) {
+                WL_INFO("Disassociating from AP");
+                brcmf_link_down(cfg_priv);
+
+                /* Make sure WPA_Supplicant receives all the event
+                   generated due to DISASSOC call to the fw to keep
+                   the state fw and WPA_Supplicant state consistent
+                 */
+                rtnl_unlock();
+                brcmf_delay(500);
+                rtnl_lock();
+        }
+
+        set_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status);
+        brcmf_term_iscan(cfg_priv);
+        if (cfg_priv->scan_request) {
+                cfg80211_scan_done(cfg_priv->scan_request, true);
+                /* May need to perform this to cover rmmod */
+                /* wl_set_mpc(cfg_to_ndev(wl), 1); */
+                cfg_priv->scan_request = NULL;
+        }
+        clear_bit(WL_STATUS_READY, &cfg_priv->status);
+        clear_bit(WL_STATUS_SCANNING, &cfg_priv->status);
+        clear_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status);
+
+        brcmf_debugfs_remove_netdev(cfg_priv);
+
+        return 0;
+}
+
+s32 brcmf_cfg80211_up(void)
+{
+        struct brcmf_cfg80211_priv *cfg_priv;
+        s32 err = 0;
+
+        cfg_priv = WL_PRIV_GET();
+        mutex_lock(&cfg_priv->usr_sync);
+        err = __brcmf_cfg80211_up(cfg_priv);
+        mutex_unlock(&cfg_priv->usr_sync);
+
+        return err;
+}
+
+s32 brcmf_cfg80211_down(void)
+{
+        struct brcmf_cfg80211_priv *cfg_priv;
+        s32 err = 0;
+
+        cfg_priv = WL_PRIV_GET();
+        mutex_lock(&cfg_priv->usr_sync);
+        err = __brcmf_cfg80211_down(cfg_priv);
+        mutex_unlock(&cfg_priv->usr_sync);
+
+        return err;
+}
+
+static s32 brcmf_dongle_probecap(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        return wl_update_wiphybands(cfg_priv);
+}
+
+static void *brcmf_read_prof(struct brcmf_cfg80211_priv *cfg_priv, s32 item)
+{
+        switch (item) {
+        case WL_PROF_SEC:
+                return &cfg_priv->profile->sec;
+        case WL_PROF_BSSID:
+                return &cfg_priv->profile->bssid;
+        case WL_PROF_SSID:
+                return &cfg_priv->profile->ssid;
+        }
+        WL_ERR("invalid item (%d)\n", item);
+        return NULL;
+}
+
+static s32
+brcmf_update_prof(struct brcmf_cfg80211_priv *cfg_priv,
+                  const struct brcmf_event_msg *e, void *data, s32 item)
+{
+        s32 err = 0;
+        struct brcmf_ssid *ssid;
+
+        switch (item) {
+        case WL_PROF_SSID:
+                ssid = (struct brcmf_ssid *) data;
+                memset(cfg_priv->profile->ssid.SSID, 0,
+                       sizeof(cfg_priv->profile->ssid.SSID));
+                memcpy(cfg_priv->profile->ssid.SSID,
+                       ssid->SSID, ssid->SSID_len);
+                cfg_priv->profile->ssid.SSID_len = ssid->SSID_len;
+                break;
+        case WL_PROF_BSSID:
+                if (data)
+                        memcpy(cfg_priv->profile->bssid, data, ETH_ALEN);
+                else
+                        memset(cfg_priv->profile->bssid, 0, ETH_ALEN);
+                break;
+        case WL_PROF_SEC:
+                memcpy(&cfg_priv->profile->sec, data,
+                       sizeof(cfg_priv->profile->sec));
+                break;
+        case WL_PROF_BEACONINT:
+                cfg_priv->profile->beacon_interval = *(u16 *)data;
+                break;
+        case WL_PROF_DTIMPERIOD:
+                cfg_priv->profile->dtim_period = *(u8 *)data;
+                break;
+        default:
+                WL_ERR("unsupported item (%d)\n", item);
+                err = -EOPNOTSUPP;
+                break;
+        }
+
+        return err;
+}
+
+static bool brcmf_is_ibssmode(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        return cfg_priv->conf->mode == WL_MODE_IBSS;
+}
+
+static __used s32 brcmf_add_ie(struct brcmf_cfg80211_priv *cfg_priv,
+                               u8 t, u8 l, u8 *v)
+{
+        struct brcmf_cfg80211_ie *ie = &cfg_priv->ie;
+        s32 err = 0;
+
+        if (unlikely(ie->offset + l + 2 > WL_TLV_INFO_MAX)) {
+                WL_ERR("ei crosses buffer boundary\n");
+                return -ENOSPC;
+        }
+        ie->buf[ie->offset] = t;
+        ie->buf[ie->offset + 1] = l;
+        memcpy(&ie->buf[ie->offset + 2], v, l);
+        ie->offset += l + 2;
+
+        return err;
+}
+
+static void brcmf_link_down(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        struct net_device *dev = NULL;
+        s32 err = 0;
+
+        WL_TRACE("Enter\n");
+
+        if (cfg_priv->link_up) {
+                dev = cfg_to_ndev(cfg_priv);
+                WL_INFO("Call WLC_DISASSOC to stop excess roaming\n ");
+                err = brcmf_dev_ioctl(dev, BRCMF_C_DISASSOC, NULL, 0);
+                if (unlikely(err))
+                        WL_ERR("WLC_DISASSOC failed (%d)\n", err);
+                cfg_priv->link_up = false;
+        }
+        WL_TRACE("Exit\n");
+}
+
+static void brcmf_lock_eq(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        spin_lock_irq(&cfg_priv->eq_lock);
+}
+
+static void brcmf_unlock_eq(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        spin_unlock_irq(&cfg_priv->eq_lock);
+}
+
+static void brcmf_init_eq_lock(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        spin_lock_init(&cfg_priv->eq_lock);
+}
+
+static void brcmf_delay(u32 ms)
+{
+        if (ms < 1000 / HZ) {
+                cond_resched();
+                mdelay(ms);
+        } else {
+                msleep(ms);
+        }
+}
+
+static void brcmf_set_drvdata(struct brcmf_cfg80211_dev *dev, void *data)
+{
+        dev->driver_data = data;
+}
+
+static void *brcmf_get_drvdata(struct brcmf_cfg80211_dev *dev)
+{
+        void *data = NULL;
+
+        if (dev)
+                data = dev->driver_data;
+        return data;
+}
+
+static void brcmf_set_mpc(struct net_device *ndev, int mpc)
+{
+        s32 err = 0;
+        struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
+
+        if (test_bit(WL_STATUS_READY, &cfg_priv->status)) {
+                err = brcmf_dev_intvar_set(ndev, "mpc", mpc);
+                if (unlikely(err)) {
+                        WL_ERR("fail to set mpc\n");
+                        return;
+                }
+                WL_INFO("MPC : %d\n", mpc);
+        }
+}
+
+static int brcmf_debugfs_add_netdev_params(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        char buf[10+IFNAMSIZ];
+        struct dentry *fd;
+        s32 err = 0;
+
+        sprintf(buf, "netdev:%s", cfg_to_ndev(cfg_priv)->name);
+        cfg_priv->debugfsdir = debugfs_create_dir(buf,
+                                        cfg_to_wiphy(cfg_priv)->debugfsdir);
+
+        fd = debugfs_create_u16("beacon_int", S_IRUGO, cfg_priv->debugfsdir,
+                (u16 *)&cfg_priv->profile->beacon_interval);
+        if (!fd) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+        fd = debugfs_create_u8("dtim_period", S_IRUGO, cfg_priv->debugfsdir,
+                (u8 *)&cfg_priv->profile->dtim_period);
+        if (!fd) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+err_out:
+        return err;
+}
+
+static void brcmf_debugfs_remove_netdev(struct brcmf_cfg80211_priv *cfg_priv)
+{
+        debugfs_remove_recursive(cfg_priv->debugfsdir);
+        cfg_priv->debugfsdir = NULL;
+}
diff --git a/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.h
new file mode 100644
index 00000000000..f26d08793ca
--- /dev/null
+++ b/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.h
@@ -0,0 +1,356 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _wl_cfg80211_h_
+#define _wl_cfg80211_h_
+
+struct brcmf_cfg80211_conf;
+struct brcmf_cfg80211_iface;
+struct brcmf_cfg80211_priv;
+struct brcmf_cfg80211_security;
+struct brcmf_cfg80211_ibss;
+
+#define WL_DBG_NONE             0
+#define WL_DBG_CONN             (1 << 5)
+#define WL_DBG_SCAN             (1 << 4)
+#define WL_DBG_TRACE            (1 << 3)
+#define WL_DBG_INFO             (1 << 1)
+#define WL_DBG_ERR              (1 << 0)
+#define WL_DBG_MASK             ((WL_DBG_INFO | WL_DBG_ERR | WL_DBG_TRACE) | \
+                                (WL_DBG_SCAN) | (WL_DBG_CONN))
+
+#define WL_ERR(fmt, args...)                                    \
+do {                                                            \
+        if (brcmf_dbg_level & WL_DBG_ERR) {                     \
+                if (net_ratelimit()) {                          \
+                        printk(KERN_ERR "ERROR @%s : " fmt,     \
+                                __func__, ##args);              \
+                }                                               \
+        }                                                       \
+} while (0)
+
+#if (defined BCMDBG)
+#define WL_INFO(fmt, args...)                                   \
+do {                                                            \
+        if (brcmf_dbg_level & WL_DBG_INFO) {                    \
+                if (net_ratelimit()) {                          \
+                        printk(KERN_ERR "INFO @%s : " fmt,      \
+                                __func__, ##args);              \
+                }                                               \
+        }                                                       \
+} while (0)
+
+#define WL_TRACE(fmt, args...)                                  \
+do {                                                            \
+        if (brcmf_dbg_level & WL_DBG_TRACE) {                   \
+                if (net_ratelimit()) {                          \
+                        printk(KERN_ERR "TRACE @%s : " fmt,     \
+                                __func__, ##args);              \
+                }                                               \
+        }                                                       \
+} while (0)
+
+#define WL_SCAN(fmt, args...)                                   \
+do {                                                            \
+        if (brcmf_dbg_level & WL_DBG_SCAN) {                    \
+                if (net_ratelimit()) {                          \
+                        printk(KERN_ERR "SCAN @%s : " fmt,      \
+                                __func__, ##args);              \
+                }                                               \
+        }                                                       \
+} while (0)
+
+#define WL_CONN(fmt, args...)                                   \
+do {                                                            \
+        if (brcmf_dbg_level & WL_DBG_CONN) {                    \
+                if (net_ratelimit()) {                          \
+                        printk(KERN_ERR "CONN @%s : " fmt,      \
+                                __func__, ##args);              \
+                }                                               \
+        }                                                       \
+} while (0)
+
+#else /* (defined BCMDBG) */
+#define WL_INFO(fmt, args...)
+#define WL_TRACE(fmt, args...)
+#define WL_SCAN(fmt, args...)
+#define WL_CONN(fmt, args...)
+#endif /* (defined BCMDBG) */
+
+#define WL_NUM_SCAN_MAX         1
+#define WL_NUM_PMKIDS_MAX       MAXPMKID        /* will be used
+                                                 * for 2.6.33 kernel
+                                                 * or later
+                                                 */
+#define WL_SCAN_BUF_MAX                 (1024 * 8)
+#define WL_TLV_INFO_MAX                 1024
+#define WL_BSS_INFO_MAX                 2048
+#define WL_ASSOC_INFO_MAX       512     /*
+                                 * needs to grab assoc info from dongle to
+                                 * report it to cfg80211 through "connect"
+                                 * event
+                                 */
+#define WL_IOCTL_LEN_MAX        1024
+#define WL_EXTRA_BUF_MAX        2048
+#define WL_ISCAN_BUF_MAX        2048    /*
+                                 * the buf length can be BRCMF_C_IOCTL_MAXLEN
+                                 * to reduce iteration
+                                 */
+#define WL_ISCAN_TIMER_INTERVAL_MS      3000
+#define WL_SCAN_ERSULTS_LAST    (BRCMF_SCAN_RESULTS_NO_MEM+1)
+#define WL_AP_MAX       256     /* virtually unlimitted as long
+                                 * as kernel memory allows
+                                 */
+
+#define WL_ROAM_TRIGGER_LEVEL           -75
+#define WL_ROAM_DELTA                   20
+#define WL_BEACON_TIMEOUT               3
+
+#define WL_SCAN_CHANNEL_TIME            40
+#define WL_SCAN_UNASSOC_TIME            40
+#define WL_SCAN_PASSIVE_TIME            120
+
+/* dongle status */
+enum wl_status {
+        WL_STATUS_READY,
+        WL_STATUS_SCANNING,
+        WL_STATUS_SCAN_ABORTING,
+        WL_STATUS_CONNECTING,
+        WL_STATUS_CONNECTED
+};
+
+/* wi-fi mode */
+enum wl_mode {
+        WL_MODE_BSS,
+        WL_MODE_IBSS,
+        WL_MODE_AP
+};
+
+/* dongle profile list */
+enum wl_prof_list {
+        WL_PROF_MODE,
+        WL_PROF_SSID,
+        WL_PROF_SEC,
+        WL_PROF_IBSS,
+        WL_PROF_BAND,
+        WL_PROF_BSSID,
+        WL_PROF_ACT,
+        WL_PROF_BEACONINT,
+        WL_PROF_DTIMPERIOD
+};
+
+/* dongle iscan state */
+enum wl_iscan_state {
+        WL_ISCAN_STATE_IDLE,
+        WL_ISCAN_STATE_SCANING
+};
+
+/* dongle configuration */
+struct brcmf_cfg80211_conf {
+        u32 mode;               /* adhoc , infrastructure or ap */
+        u32 frag_threshold;
+        u32 rts_threshold;
+        u32 retry_short;
+        u32 retry_long;
+        s32 tx_power;
+        struct ieee80211_channel channel;
+};
+
+/* cfg80211 main event loop */
+struct brcmf_cfg80211_event_loop {
+        s32(*handler[BRCMF_E_LAST]) (struct brcmf_cfg80211_priv *cfg_priv,
+                                     struct net_device *ndev,
+                                     const struct brcmf_event_msg *e,
+                                     void *data);
+};
+
+/* representing interface of cfg80211 plane */
+struct brcmf_cfg80211_iface {
+        struct brcmf_cfg80211_priv *cfg_priv;
+};
+
+struct brcmf_cfg80211_dev {
+        void *driver_data;      /* to store cfg80211 object information */
+};
+
+/* basic structure of scan request */
+struct brcmf_cfg80211_scan_req {
+        struct brcmf_ssid ssid;
+};
+
+/* basic structure of information element */
+struct brcmf_cfg80211_ie {
+        u16 offset;
+        u8 buf[WL_TLV_INFO_MAX];
+};
+
+/* event queue for cfg80211 main event */
+struct brcmf_cfg80211_event_q {
+        struct list_head eq_list;
+        u32 etype;
+        struct brcmf_event_msg emsg;
+        s8 edata[1];
+};
+
+/* security information with currently associated ap */
+struct brcmf_cfg80211_security {
+        u32 wpa_versions;
+        u32 auth_type;
+        u32 cipher_pairwise;
+        u32 cipher_group;
+        u32 wpa_auth;
+};
+
+/* ibss information for currently joined ibss network */
+struct brcmf_cfg80211_ibss {
+        u8 beacon_interval;     /* in millisecond */
+        u8 atim;                /* in millisecond */
+        s8 join_only;
+        u8 band;
+        u8 channel;
+};
+
+/* dongle profile */
+struct brcmf_cfg80211_profile {
+        u32 mode;
+        struct brcmf_ssid ssid;
+        u8 bssid[ETH_ALEN];
+        u16 beacon_interval;
+        u8 dtim_period;
+        struct brcmf_cfg80211_security sec;
+        struct brcmf_cfg80211_ibss ibss;
+        s32 band;
+};
+
+/* dongle iscan event loop */
+struct brcmf_cfg80211_iscan_eloop {
+        s32 (*handler[WL_SCAN_ERSULTS_LAST])
+                (struct brcmf_cfg80211_priv *cfg_priv);
+};
+
+/* dongle iscan controller */
+struct brcmf_cfg80211_iscan_ctrl {
+        struct net_device *dev;
+        struct timer_list timer;
+        u32 timer_ms;
+        u32 timer_on;
+        s32 state;
+        struct task_struct *tsk;
+        struct semaphore sync;
+        struct brcmf_cfg80211_iscan_eloop el;
+        void *data;
+        s8 ioctl_buf[BRCMF_C_IOCTL_SMLEN];
+        s8 scan_buf[WL_ISCAN_BUF_MAX];
+};
+
+/* association inform */
+struct brcmf_cfg80211_connect_info {
+        u8 *req_ie;
+        s32 req_ie_len;
+        u8 *resp_ie;
+        s32 resp_ie_len;
+};
+
+/* assoc ie length */
+struct brcmf_cfg80211_assoc_ielen {
+        u32 req_len;
+        u32 resp_len;
+};
+
+/* wpa2 pmk list */
+struct brcmf_cfg80211_pmk_list {
+        pmkid_list_t pmkids;
+        pmkid_t foo[MAXPMKID - 1];
+};
+
+/* dongle private data of cfg80211 interface */
+struct brcmf_cfg80211_priv {
+        struct wireless_dev *wdev;      /* representing wl cfg80211 device */
+        struct brcmf_cfg80211_conf *conf;       /* dongle configuration */
+        struct cfg80211_scan_request *scan_request;     /* scan request
+                                                         object */
+        struct brcmf_cfg80211_event_loop el;    /* main event loop */
+        struct list_head eq_list;       /* used for event queue */
+        spinlock_t eq_lock;     /* for event queue synchronization */
+        struct mutex usr_sync;  /* maily for dongle up/down synchronization */
+        struct brcmf_scan_results *bss_list;    /* bss_list holding scanned
+                                                 ap information */
+        struct brcmf_scan_results *scan_results;
+        struct brcmf_cfg80211_scan_req *scan_req_int;   /* scan request object
+                                                 for internal purpose */
+        struct wl_cfg80211_bss_info *bss_info;  /* bss information for
+                                                 cfg80211 layer */
+        struct brcmf_cfg80211_ie ie;    /* information element object for
+                                         internal purpose */
+        struct semaphore event_sync;    /* for synchronization of main event
+                                         thread */
+        struct brcmf_cfg80211_profile *profile; /* holding dongle profile */
+        struct brcmf_cfg80211_iscan_ctrl *iscan;        /* iscan controller */
+        struct brcmf_cfg80211_connect_info conn_info; /* association info */
+        struct brcmf_cfg80211_pmk_list *pmk_list;       /* wpa2 pmk list */
+        struct task_struct *event_tsk;  /* task of main event handler thread */
+        unsigned long status;           /* current dongle status */
+        void *pub;
+        u32 channel;            /* current channel */
+        bool iscan_on;          /* iscan on/off switch */
+        bool iscan_kickstart;   /* indicate iscan already started */
+        bool active_scan;       /* current scan mode */
+        bool ibss_starter;      /* indicates this sta is ibss starter */
+        bool link_up;           /* link/connection up flag */
+        bool pwr_save;          /* indicate whether dongle to support
+                                         power save mode */
+        bool dongle_up;         /* indicate whether dongle up or not */
+        bool roam_on;           /* on/off switch for dongle self-roaming */
+        bool scan_tried;        /* indicates if first scan attempted */
+        u8 *ioctl_buf;  /* ioctl buffer */
+        u8 *extra_buf;  /* maily to grab assoc information */
+        struct dentry *debugfsdir;
+        u8 ci[0] __attribute__ ((__aligned__(NETDEV_ALIGN)));
+};
+
+#define cfg_to_wiphy(w) (w->wdev->wiphy)
+#define wiphy_to_cfg(w) ((struct brcmf_cfg80211_priv *)(wiphy_priv(w)))
+#define cfg_to_wdev(w) (w->wdev)
+#define wdev_to_cfg(w) ((struct brcmf_cfg80211_priv *)(wdev_priv(w)))
+#define cfg_to_ndev(w) (w->wdev->netdev)
+#define ndev_to_cfg(n) (wdev_to_cfg(n->ieee80211_ptr))
+#define iscan_to_cfg(i) ((struct brcmf_cfg80211_priv *)(i->data))
+#define cfg_to_iscan(w) (w->iscan)
+#define cfg_to_conn(w) (&w->conn_info)
+
+static inline struct brcmf_bss_info *next_bss(struct brcmf_scan_results *list,
+                                           struct brcmf_bss_info *bss)
+{
+        return bss = bss ?
+                (struct brcmf_bss_info *)((unsigned long)bss +
+                                       le32_to_cpu(bss->length)) :
+                list->bss_info;
+}
+
+#define for_each_bss(list, bss, __i)    \
+        for (__i = 0; __i < list->count && __i < WL_AP_MAX; __i++, bss = next_bss(list, bss))
+
+extern s32 brcmf_cfg80211_attach(struct net_device *ndev, void *data);
+extern void brcmf_cfg80211_detach(void);
+/* event handler from dongle */
+extern void brcmf_cfg80211_event(struct net_device *ndev,
+                                 const struct brcmf_event_msg *e, void *data);
+extern void brcmf_cfg80211_sdio_func(void *func); /* set sdio function info */
+extern struct sdio_func *brcmf_cfg80211_get_sdio_func(void);
+extern s32 brcmf_cfg80211_up(void);     /* dongle up */
+extern s32 brcmf_cfg80211_down(void);   /* dongle down */
+
+#endif                          /* _wl_cfg80211_h_ */